c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60

Resubmissions

22/05/2026, 22:43

260522-2nbttah18t8

22/05/2026, 22:42

260522-2ml86ah17s3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CheraxLoader.exe
Size 6.5MB
Sample260522-2nbttah18t
SHA256 c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60
MD5 ac1a7c7d5846970fa3ba1eccad346737
SHA1 1154fcf391eebb268ca0558afa6508627ed80055
SHA512 c37293a7184bc97cca10492cb9fbef9d2ea907cb18b6091da2434c5489e289a7b4d001a2aba4a18ba82721b44c15dd1c5dcbf4d69dda966ceba7ef01703ba2b9
SSDEEP 196608:BdS5kN51OPnAxHVNYgK0SSsF5mVgp00rrxLighFe/I81ykvm:BdLNePnAxHVNYgK0SSsF5mVgp00rrxLs
TLSH
T10D66DF5676ED81B9C666F2388647C527E7B17E090321C6EB32D09B673F23AE41A3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	5040	msedge.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_755551869\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_755551869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1081832856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1081832856\typosquatting_list.pb	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239634377459277"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{34443149-5CF7-49F3-966D-AB619DC2A1C1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6116	CheraxLoader.exe
6116	CheraxLoader.exe
6056	msedge.exe
6056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 1976	6116	CheraxLoader.exe	81
PID 1976 wrote to memory of 5084	1976	msedge.exe	82
PID 1976 wrote to memory of 5040	1976	msedge.exe	83
PID 1976 wrote to memory of 3084	1976	msedge.exe	84
PID 1976 wrote to memory of 3084	1976	msedge.exe	84
PID 1976 wrote to memory of 3084	1976	msedge.exe	84
PID 1976 wrote to memory of 5824	1976	msedge.exe	85
PID 1976 wrote to memory of 5824	1976	msedge.exe	85
PID 1976 wrote to memory of 864	1976	msedge.exe	86
PID 1976 wrote to memory of 864	1976	msedge.exe	86
PID 1976 wrote to memory of 864	1976	msedge.exe	86
PID 1976 wrote to memory of 1848	1976	msedge.exe	87
PID 1976 wrote to memory of 1848	1976	msedge.exe	87
PID 1976 wrote to memory of 1848	1976	msedge.exe	87
PID 1976 wrote to memory of 2992	1976	msedge.exe	90
PID 1976 wrote to memory of 4720	1976	msedge.exe	91
PID 1976 wrote to memory of 2992	1976	msedge.exe	90
PID 1976 wrote to memory of 4720	1976	msedge.exe	91
PID 1976 wrote to memory of 5116	1976	msedge.exe	92
PID 1976 wrote to memory of 436	1976	msedge.exe	93
PID 1976 wrote to memory of 5116	1976	msedge.exe	92
PID 1976 wrote to memory of 436	1976	msedge.exe	93
PID 1976 wrote to memory of 436	1976	msedge.exe	93
PID 1976 wrote to memory of 5812	1976	msedge.exe	94
PID 5812 wrote to memory of 2208	5812	msedge.exe	95
PID 1976 wrote to memory of 1492	1976	msedge.exe	97
PID 1976 wrote to memory of 1072	1976	msedge.exe	98
PID 1976 wrote to memory of 2988	1976	msedge.exe	101
PID 1976 wrote to memory of 3196	1976	msedge.exe	102
PID 1976 wrote to memory of 1080	1976	msedge.exe	103
PID 1976 wrote to memory of 4580	1976	msedge.exe	104
PID 1976 wrote to memory of 4580	1976	msedge.exe	104
PID 1976 wrote to memory of 5404	1976	msedge.exe	107
PID 1976 wrote to memory of 5404	1976	msedge.exe	107
PID 1976 wrote to memory of 5804	1976	msedge.exe	108
PID 1976 wrote to memory of 5804	1976	msedge.exe	108
PID 1976 wrote to memory of 6056	1976	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\CheraxLoader.exe
"C:\Users\Admin\AppData\Local\Temp\CheraxLoader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x64.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffce436c188,0x7ffce436c194,0x7ffce436c1a0
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,11560697710278667494,949607194677774464,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,17175089335624450867,5094822142925569881,262144 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,12081323775227850010,13388686645766627712,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16484182282768116550,5679002189579515856,2097152 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1292138895805642814,7352903978668799736,2097152 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4391717891490459684,15680586413132806454,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,2057015575295633079,8387828243979342967,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,14208594189257796490,13035776390175918156,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5500,i,9968592208435040946,2062863927230932601,2097152 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,535472766395661353,16954635248803994241,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1232784416024863140,2190661226616818227,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1232784416024863140,2190661226616818227,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9167971013381904769,14773019876657223653,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12599800228854959892,5295291966949075832,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15828814778089082674,4075754887377764414,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,8819988979091157889,12977230493094591806,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8098647661772787312,10954271515017570867,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7947441657510345586,3263261374543275860,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,15639561422891542055,2227226554117291237,524288 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5280,i,3186665494449638786,10835390040569295833,262144 --field-trial-handle=1964,i,1623679968977122499,9837373179186343986,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bd8c276b966427eafa3460b20b6123cd1c08e5a9953dc2b2388d17fc6a677fdc
MD5 cf5a819602f91ece009ce41d0e464792
SHA1 eedbc97deb84066c8bdeca1f5d5fc5e785ffbaf6
SHA512 4e25f85290d156d83f84a9f4518ee81d6ed5b0b8a22ffbc5f1b90985651822301e9d0361bb7fa6e26e909884a2b96c66dc511005d17d21d40fac43f5f9b0a2f9
TLSH
T195F0F9BAC930AC2718FD0B1971A60B4AEB9513672780845F3B3D560C4FB563B469581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b644ac9e175bfb65808fd45bad9fccdb8b5ba822d671bf41c21baa5915cd48a1
MD5 60139ac411a49cc1d55fef2736f84be7
SHA1 1a53f8d8ee72e5c25e17da7257c7bb82b32f264e
SHA512 0966ea51e4bcbcc6ba338ffb07cf2e1553650d094a8e62799dda194087db654c816a619acbb345be7a8f62a75100fdbb1781d1a15ab3e8d5c043fd2130d8407f
TLSH
T16F417CF7C3E8856D891196F0AA186E2BCE1D0914432C3D9A85E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 651cc91cbfa0f4e116232dd697b29b995dd80755d3fef71c3be1b0dd83dd7d12
MD5 8d5b5108c69a967598b8f134f343960c
SHA1 7b166fbde182e20aa0c9ae8bdc4d3009b746beb6
SHA512 c666777263461322c7a522cc5b05940fa1d978bc639a225929ae9e7ce5347351cbe26cf109cb285b9c3e97ab867f4da420abf309db956e327f34039615d1d963
SSDEEP 192:sxZ5R4vyMqZjK1Ml8Ml7/frs843PxE0CXUyynDazodpW/W6+WNGY0deWIe4Igj5J:sxZ5Dt7/frs843P60Ly8hW/bG5JIDjj
TLSH
T1A762F706AA38597B8CDBD219FA457F53D7F9156392400E44AAFCCB1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 83c596fb30d4e74f31fcc5925c4ea4d1479bc152843f7e811ead1db773be8f0b
MD5 6e7f24b00b5d55c3ca1b87e73b8da333
SHA1 9e0b56d35cd3674eb6b90e2e00734ff9bede5ee4
SHA512 6c38b53ea983ba11a7e6307e5af8df3676234447f5e27d09c220258f41c59085d0bcc73fef5f8b8dfd0a7ed9afd9b55f501ab48746328001adbf55f797f8129e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3O3pQLlF:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKO3pS
TLSH
T11F031B3B680CCB7E4F805E9CED266F9A6EE8018B6698895447FA844C03C76EF55170DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 74fb6dcbcac41fa7d63cf9647ea105a1e5f0520cab319042712078a71061efef
MD5 98832349821ec6622f12ecf04d7abc17
SHA1 78e04c93c5acc34eddc6e505023e57a82f013bef
SHA512 9b23fad31e9d10d2b8b6348891b447bdf97ed084d8e9bd3033740f658a982e3000ffa2de8743f8258414f5fbcd97cf8e736e4267786765cc6bb97ef43b7e9bd3
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv76j0:AFBHhTofhno2mB21q3Llbfe3sLDdeEpn
TLSH
T1C0B28F56717B12023C3D291CA6929B370E8272A3345CA57F77B900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0007f826fc58fcf254ce279f220afc072f6f75e84df6baa96eebaa817a55764b
MD5 4e12bdc1d64db9b5f58c500241f72281
SHA1 954d02b4d396e047b003d56a22d50ef3bd1130ef
SHA512 6dbc3f7b95020578def32674f967d1b6b6177fcf33e04260bd99f1498b27bbc085f8e625abb7731b7170e22786959b7cca19f9447894b230ae14e4ec1d6a2da3
SSDEEP 384:nyiF1tNnNnb9B8Ni8TUNTUlIRByg7WjGfbwoFMtT/hY6B2LnOYPpcSmU4Hy/7IgL:5F1jZbb5wgHmoFMZJY68yo5mUiQ
TLSH
T1C1E2B3F198E789B7D99E4B97A33D6E026AFCC193B4841984B7C81D1DCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ebc1379f5087d81aec23a95a170c4da7ce66c969a0f98eae21fdbef77466eeb3
MD5 d23f5ee1b874aa3a83ccb976b4c0bced
SHA1 7301e072007f45af1dc60c4b85d2f2cde37773b5
SHA512 090d399830f7a4c4f799b03e06e9bc1c2fdabd0235ae1d256ec8a0a668d89c6ac2a55e8cf9eb3293c9673026983399c1c2928612a837df6459d00c751b2c61fe
SSDEEP 384:n5ciF9CcmyWCs38NH8TUNTUlIxBydvQoBajGfbwoFMtTvGhkP+lFYS/npHy/7Igo:lFccps3kwgBYioFMZvGhkoFYS/r
TLSH
T17EB24A36ECA8CAB7EDE64F99E74E6A47DEE00163818899D4CAD91E5C00C72DD1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7a828b98196c368ce58bad7bc1ee0c59bff107cc64712a31a99566e892756252
MD5 b11512e6627515388d0ea161f2ea4fd0
SHA1 7c4f0c3f663d752a4d1a667e403e4525839d216d
SHA512 ee07b27c3e65df47a306b2bb26cf090e59b133fa684cf702dfcd12d5134ef89e47defab2d3ee5095d8fe9756e8830655b56e29ef00c026c7c9e77968a3033612
SSDEEP 384:n5hiF1tNnNnb9038Ni8TUNTUlIRBy/rWjGfbwoFMtT/kY6B2LnOYPpcSmU4Hy/7p:qF1jZba35wgAmoFMZ8Y68yo5mUiQ
TLSH
T116D25B32EC64DEB7EDE75E9AE74A7607AFE012A384881AD4D9C91D1D00C72DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 79131bde59ba11d13daadf71fa2fe0160a234c38fc79767f4af051d7e7c5cf82
MD5 0c167d7248f9a81881ffa4436aeb7aac
SHA1 fe4ccc4812de0319baabbdc87204b0237cc4cd2a
SHA512 89ed3471be621bad2528b5ce5a24a17623283764ae44ac0f900c6c6c0a20e2ce515eb33e473ea0cc029f2e63b10cd5ddf1699f8846e36733339c78d165005b7f
SSDEEP 384:nSiF1tNnNnb9o8Ni8TUNTUlIRBygrWjGfbwoFMtT/kY6B2LnOYPpcSmU4Hy/7IgL:ZF1jZbW5wgXmoFMZ8Y68yo5mUiQ
TLSH
T19DD25B32EC64DEB7EDE75E9AE34A7607AFE012A384985AD4D9C91D1D00C72DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 04ceb0b39077cf592bf1d33d39c2a75a0ec9fa725abede03a034754352e7c875
MD5 808a3419c6f6d9f1ec391caebd45907c
SHA1 6ce0e831bda709116738155acaca3a44ec1ba062
SHA512 1de8b45fe6ddc33fe67ebb51d97f619d33e53721c09f70d4e2c45b6c5588142284bf6cd06bfab2db8368ccd552544a92f708e720988c55cd9f00a93728613421
TLSH
T1134141E15C3D2AC1D1BD1E6F648B38FC81EC8725F4A0357D6814EE98097921D648587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 54560dff4ab0de013f43671afad6abe39ef5a7278b701beb2645c8fd4e844453
MD5 966d3dab7d53f5083ae297a424faf0f6
SHA1 1748e764805418fee1c675c4ddf0bce88b81ca73
SHA512 64eacad81b887c83b06c05c43b4421e441644ce7f4b9221e20beb35c19f092df11b766a03ea845564ec3f711fcdf684d9aee3a004d44c0f18ef9b4fbcb356f40
TLSH
T1E34141E15C392AC1D1BD1A6E64CB38FC81ECC725F4A4347A7814DA98067A21D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe.crdownload

Path C:\Users\Admin\Downloads\VC_redist.x64.exe.crdownload
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier
Size 211B
SHA256 0f78d8e49972c57affd3760a34a16453147458db4957d5d69bd9d10372c0759f
MD5 a99745a5a2d244ce5acd77fe46c4a83f
SHA1 7fde299be30317b50a29574d857b959e0a7c8a83
SHA512 32837e4fd17435a8702e7ddd4d13865248938f41b06f5629823cc2f02e01cec76f6a4908b351ac0fde80b28a01db187010459f5aba63fe906fb7ff4353ed5151
TLSH
T1B1D022AFC14044201EA4A18A0B8DA200FFDF2A020A86D8CCCC5BC0E8D27529A5C88093
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1081832856\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_755551869\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_755551869\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-176-0x000001B100000000-0x000001B101000000-memory.dmp

Download