hxxp://advisor[.]ca

Analysis

user interaction
yes
max time kernel
108s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://advisor.ca
Sample260522-yvhddset7k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_445423177\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_551096160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_551096160\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_445423177\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3416	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239540547303139"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{67A4E11E-3866-4A70-AD7B-59B8A7911EA7}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5444	2484	msedge.exe	80
PID 2484 wrote to memory of 3416	2484	msedge.exe	81
PID 2484 wrote to memory of 3252	2484	msedge.exe	82
PID 2484 wrote to memory of 3288	2484	msedge.exe	83
PID 2484 wrote to memory of 3252	2484	msedge.exe	82
PID 2484 wrote to memory of 3252	2484	msedge.exe	82
PID 2484 wrote to memory of 3288	2484	msedge.exe	83
PID 2484 wrote to memory of 5888	2484	msedge.exe	85
PID 2484 wrote to memory of 5888	2484	msedge.exe	85
PID 2484 wrote to memory of 5888	2484	msedge.exe	85
PID 2484 wrote to memory of 4552	2484	msedge.exe	86
PID 2484 wrote to memory of 4552	2484	msedge.exe	86
PID 2484 wrote to memory of 4552	2484	msedge.exe	86
PID 2484 wrote to memory of 4768	2484	msedge.exe	88
PID 2484 wrote to memory of 4768	2484	msedge.exe	88
PID 2484 wrote to memory of 4768	2484	msedge.exe	88
PID 2484 wrote to memory of 1184	2484	msedge.exe	90
PID 2484 wrote to memory of 808	2484	msedge.exe	91
PID 2484 wrote to memory of 5804	2484	msedge.exe	89
PID 2484 wrote to memory of 1184	2484	msedge.exe	90
PID 2484 wrote to memory of 1184	2484	msedge.exe	90
PID 2484 wrote to memory of 808	2484	msedge.exe	91
PID 2484 wrote to memory of 808	2484	msedge.exe	91
PID 2484 wrote to memory of 5804	2484	msedge.exe	89
PID 2484 wrote to memory of 5804	2484	msedge.exe	89
PID 2484 wrote to memory of 2024	2484	msedge.exe	92
PID 2484 wrote to memory of 2024	2484	msedge.exe	92
PID 2484 wrote to memory of 2024	2484	msedge.exe	92
PID 2484 wrote to memory of 3188	2484	msedge.exe	93
PID 2484 wrote to memory of 3188	2484	msedge.exe	93
PID 2484 wrote to memory of 3188	2484	msedge.exe	93
PID 2484 wrote to memory of 3128	2484	msedge.exe	94
PID 2484 wrote to memory of 3128	2484	msedge.exe	94
PID 2484 wrote to memory of 3128	2484	msedge.exe	94
PID 2484 wrote to memory of 5000	2484	msedge.exe	95
PID 2484 wrote to memory of 4996	2484	msedge.exe	96
PID 2484 wrote to memory of 4592	2484	msedge.exe	97
PID 2484 wrote to memory of 4560	2484	msedge.exe	98
PID 2484 wrote to memory of 4560	2484	msedge.exe	98
PID 2484 wrote to memory of 4560	2484	msedge.exe	98
PID 2484 wrote to memory of 3404	2484	msedge.exe	99
PID 2484 wrote to memory of 3404	2484	msedge.exe	99
PID 2484 wrote to memory of 4980	2484	msedge.exe	100
PID 2484 wrote to memory of 4980	2484	msedge.exe	100
PID 2484 wrote to memory of 5428	2484	msedge.exe	101
PID 2484 wrote to memory of 6076	2484	msedge.exe	103
PID 5428 wrote to memory of 2784	5428	msedge.exe	104
PID 2484 wrote to memory of 3796	2484	msedge.exe	107
PID 2484 wrote to memory of 3796	2484	msedge.exe	107
PID 2484 wrote to memory of 5180	2484	msedge.exe	110
PID 2484 wrote to memory of 5360	2484	msedge.exe	111
PID 2484 wrote to memory of 2800	2484	msedge.exe	112
PID 2484 wrote to memory of 5180	2484	msedge.exe	110
PID 2484 wrote to memory of 5180	2484	msedge.exe	110
PID 2484 wrote to memory of 5360	2484	msedge.exe	111
PID 2484 wrote to memory of 5360	2484	msedge.exe	111
PID 2484 wrote to memory of 2800	2484	msedge.exe	112
PID 2484 wrote to memory of 2800	2484	msedge.exe	112
PID 2484 wrote to memory of 4552	2484	msedge.exe	113
PID 2484 wrote to memory of 4552	2484	msedge.exe	113
PID 2484 wrote to memory of 4552	2484	msedge.exe	113
PID 2484 wrote to memory of 5268	2484	msedge.exe	114
PID 2484 wrote to memory of 5268	2484	msedge.exe	114
PID 2484 wrote to memory of 5268	2484	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://advisor.ca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbc177c188,0x7ffbc177c194,0x7ffbc177c1a0
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,12389830638230420873,10201577266438445892,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,8051968589162607857,14608015917984217303,262144 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,18245374645529810178,8788161112167909002,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,18419546829138790702,6596358121461881051,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12188947537065452677,8214557910159968027,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,603525133797596728,3120905617983634409,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5288,i,13011827808539205881,6858034270110934013,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5284,i,17662838568010243749,6862306434306381733,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,2397846430611985873,7634556754424150527,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5720,i,4222349555132386801,8097234810227341933,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5928,i,15986589903117312832,3681042850642069000,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6268,i,3918372248400986665,16778306659913049547,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,2174587385412724876,16942356145193774007,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,4142814796087975280,1581431624820190677,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,4054297277324631562,680533261601736515,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6932,i,8317275489547956251,6381047723117229092,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,14713357935984714397,605433436162162089,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,9100351637200046912,12961202703857425688,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,15270817780496247334,8900734198197111439,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,16326478191052295744,856867677946480080,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:14
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,16326478191052295744,856867677946480080,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8048,i,4497590062192172678,5821219026311201117,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5816,i,11578929574841922603,12858199707176003746,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5892,i,2871001617573177822,6658747688446188985,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5880,i,5777238347386887176,15174497343083309878,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5932,i,12175380975269048558,5351662966339437005,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5596,i,16696248008897590682,17871809122178686252,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5984,i,260787604886698373,7814011489789327830,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15962691206541741409,2870115408392109646,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3768,i,7496555772683252247,6210844178925633048,2097152 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18131018785357710688,13882817632183821936,524288 --field-trial-handle=2540,i,10657874494919259789,14631522200813069437,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 11ffb754c6833c76b27f84f26da6ff6f9a31b8489d56cc254975b456897a448b
MD5 23a5c199d1bf64c88ba07278f32e0698
SHA1 5f7ae8af3b678b4f757d3596a97a5cf492b5d675
SHA512 459e9d8c2bb004db557db24f64e1cf9893c2cec2bda97b1d00692f0456a7b467b8c96dd052a9827066b07565bd44915cec74ee1d310a8ad2ccb7c0a7f4631804
TLSH
T1E9F0F9AAC920AC3714FD0B1970B95B4AE75413672781845F3B3D520C4FF563B478581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 34KB
SHA256 2313b94635e36ed6e65e19bf385af3e2389a9fb190bb1ab96d8f6d374094aba3
MD5 51287cac32432c4e0a5e287dbde7323c
SHA1 05cf5f979ababc965cd4f0de9e815c9e34735379
SHA512 af597c48be42cd9e437a3fb595818a2876340ed4c36ed7d9917d2a3f20614a061596f5d15885374add3f7d86e0e0d7603fc09548ce4fbe6f142da8ddb2b9d558
SSDEEP 768:rpsZkh129YhKKXMukD9ND3hys6aF9xWEwwGoaRPx5DayK:tRYYAHu2ju8RqRayK
TLSH
T1A7F2F10F79A045CF0F2C1EBFF6B456925008152CBAD1EE968673D6A795A3B0339302C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 23KB
SHA256 8c300073bf263cc24f386c4eaf20a2b2e767a7bcace6e13ffb387a8cd9950324
MD5 8885e4455d7737b15874f0f1fc8f7a71
SHA1 b7893de329c001c1f34c1438118d77bfcf97f62e
SHA512 5efe986a4806a1a6c7f8b363a311acd4357e8af86ee3bf3e6652c5511d027af372a3f4ad68da18ca1adba5be527556d340c4b342b2fcfa3b7f505ad660f2d6cb
SSDEEP 384:5b8TfdQbgqby6XzzhvN7P9xq5tAi4c3ZBTqnS62vIWTCoJPXCI8qiXj:p5bgCfhlj9Yt33fOS62v7TCyt9ej
TLSH
T1F5B2E18AA780550B11DEE399B7CB592ED05F91839327994FCFC79BE2E9402F0B0167B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 26KB
SHA256 914f5b0ab786d5e05d4bff3d0f5208b8ba4379f92130803dcba25ecd39e0d80b
MD5 35abcd1c87bba892b207eb1446e44fb4
SHA1 d2ec67f60712c70b3643fdebe527230ea350011f
SHA512 6db490996c30c7ef952e9ea7393d6352c4b96e43244f0b8709ed6209c8bc46f554582b3c6df0738aa980a28450599d3ceb9a167664a23ebd94c6ac4cd11994b7
SSDEEP 768:kQHLrUPpIdHVLC161otafP+ZU+0jCgXFaju6M:f8pmC610RZv0dWM
TLSH
T1BBC2E158F837A3667254D02FEBDBC3A2261A2C9CC4E36C1AB9E3E247C3D05536583851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 73KB
SHA256 fb69de564c55a631541f30a26e52223a2b422597eefa5a9e4edf9bceb8231067
MD5 8822fe579701e42c5e040b1744724840
SHA1 0c416166b448914abe086a784c24a83078a1b499
SHA512 016813d4e5539b4e3d6cb4ec59c91afe114a9e530115727c49a21f98b9624bae968083443a1c554716fd6a19da056d9c1d57206484c1f8db58e28ecea3804927
SSDEEP 1536:yfMXjpph2FzFBd9el1ehoPgjakxvP8Cmm4gTkQ7yo3DR24fxvyyEX2v9iFJ:+MXjpphqzF7ElfgBvPlmKTNyoPfxvykc
TLSH
T10C73025D799F1FDB1D648642F0ECB084892E687229317AB8D5C89000BF3F625EB1F579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 21KB
SHA256 3ac8effc424d7e91310b126cc364453e20504593dc5456107e378937ac6bceac
MD5 51c3d7bb1117e650e40f7656db7bf628
SHA1 b8a90a73b319d9b829f1bde16126cadf29863c88
SHA512 2779f93e0f5cf558664efef68ea9c36e96fce90acc949a12b1378785dd58e0ec0a1d62a9e41fd8fb49c5baf8a533ed31c9015b148c202d014ac5c54747b547ad
SSDEEP 384:2kOQ039g5gtakyBcv9CqILmc4k2Y7t5fkCkSdxWSDUguLOC3CehCGOS6xPh1zA:2kOQ039gSakLgquEY7TkCk1SDpQOGCzA
TLSH
T133A2F1C6EDA40496A785837D9F837F3F0A62EA4339F21565A869A4C9212CBC03937E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f5e6b2f3219dc2b21a58eae67fc77bbe53e1b88819baababf32c6de5b090e2e9
MD5 347b9c679ab7b185f5e82a9f80a2e1ac
SHA1 34ce1facb25be9d9dbfbfdda2e73ca430aea68dc
SHA512 334a6489d05215529e6eaadc3c8ba03f8da8dae13255e8b6e94ae1ee176218b965b626820c265693cc6482581653497a32b50cff7b7d9770b0e4de24c22d5dda
SSDEEP 96:yVHuyXmARbEKPHPL3KHX8UZ0qIFCZzO2BDEk1:yVHL5PHD63PZVtRZ1
TLSH
T1C3A1A41895A70AC7DF221EF3C1D80C1DB370848A59C31E9A3FFB3979689F391C029501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 84a87dfe6789bcd73ac902afc8de3ff7786d842360f0ad15bdaff85b42563bb0
MD5 b73b7b5ccfb8a6555c2312cd50264109
SHA1 34ed4cd2f44021c7d2bb6cb636cb67661aade595
SHA512 6a23cb8cb64b5417302deb2f708e721b9882bf58d02e469aa6d908662c59f4dd571c1c26a8343b29b0a9698f86ac51b39c3d06d7db5a027205edcaebd3aa448c
SSDEEP 96:mVHuyXmARb/KPHPL3KHX8UZ0qIFCZzO2BDEki:mVHLYPHD63PZVtRZi
TLSH
T134A1B51995A70AD7DF220EF3C1C80C1DB370848A58C31E9A3FFB7979689F791C02A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59041d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59041d.TMP
Size 3KB
SHA256 f9093e306a58b15c2f1edea8713a33904a81f8ca7647ced8db8057c0aa4b852b
MD5 0882b473b67fde1167e48e1f294a874b
SHA1 35b3b668fb40310e03feb88f847de3f824c58973
SHA512 7aaa1e20303fed2892fb77bd7e8203af3c246fe2a4c5fad6522167ed409538c9996b064fbf9bec0b2685adcdb985ef025200f79e7ea356b60a2cf9865734147c
TLSH
T17B71702A09B31BE7EF100DF3D6D0051E3374889999436FA50CF7B9F9A91D722C523004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 9ba9932b8ab0cdd1469d78c6c05670d925af71f445bea1b220a96bf895f679d6
MD5 3729fa0d1ca0c0bc6b0c7d2c3249929a
SHA1 2b6977fbd2241880b73e6ed57ece488b7fff1938
SHA512 41c949beb8763d064d2fbbea64f07571c319be117b3b21938e8d756d4c697cc39c1420137ee31ab55226980a82b9a65325fd23005dd8577b8e6d6a34e2172428
SSDEEP 384:DW1NnOK+tZie4yPIn8heEZDJUeWJeBlOaiGU1E+/iVcSrixoAGIR5Aytwgb5hNQ3:zqONlas3LVlUi
TLSH
T128825CF7C3E5952DD91369F06A15EE1BCE190918436C7C3A89D8AF0B93F18B1E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 559fc6473160b7f4ab0af2a3d6e7840a286a9073ede7fcb8c44958578dabccde
MD5 54a19896c45c1e6acf94fba0ccb15527
SHA1 98118c9977b5e6487cc190bd97511ad55bdceadb
SHA512 bee4c6c0d334a8f308bcecbf51496cc7093c778d336ea510f47f58afa5c1e2ed32779e9b8f19a2c8afe3a9fa4af26a7f5d5dc5f7c7fc687a5fdbfa1c1d90c02a
SSDEEP 384:sxZD3dG/f4sej0Ly8vp/btxhvB042sTbVSPDMb:srtG/fqj0D/bLd645bko
TLSH
T1409284A3B574097B4ECA9536F088B73AD7A50476D6944E81AAFCCF1C00D7AEC6902C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 383d80d85e6b54b158bf96f3c500583a7a21976428332cb727d65ee49759988c
MD5 afe434c675c37343e784617dab6bf385
SHA1 82bc7bf61b136b50272d8ea6d109f7fa7a7743c7
SHA512 c79a16862b580b8556e0d7a68ffb826605f8361260c4264ea40c8c38dbfb5db5764fa14321660fbe0b5f1060ecc17e428a332fba344bac34c823466fc96073c8
SSDEEP 384:sxZ/ldG/f4s8M660Ly89p/bi4/D8VDkDjZ:s33G/fRV0Z/biqApC
TLSH
T1BE72D616AA34597B8DCAD219F945BB63D3F90573D2904E449AFCCB0C04E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 bbdd43029f7b8330d9a504f898621fa404f2cc99cae3cd82275efc34e5a40548
MD5 c7825e296050ba1144cec5216c8d418f
SHA1 c9aeef613c0498b1752b84596859e6f118e74f52
SHA512 1a738a81d572c62b39e507b175774eaad10f133a4c47dc9031875096583a3f86cb26968bf07cfb21328394de8a766754826edba93888cac9e0095ebe113bc136
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV333pQLll:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK33pK
TLSH
T1BB031B3B680CCB7E4F804E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B0DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 783fe03452d21b1dc993725692c8c8a8ab916236c6aabfa6222b0a46c90602e7
MD5 d82d08ce48062566d05021f8f3c19cf1
SHA1 30634c3552cd5adb3bddcc5326185fe15bad0c72
SHA512 d8500050e85892ec8e98f289a363d2101363eb1990200480f09b7884b75ce069d5191a3b2114a8c7a9bc787ff1383de12869109819f50a1df304fe0e6a9d8cbc
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ed7:AFBHhTofhno2mB21q3Llbfe3sLDdeEpC
TLSH
T12EB28C56717B12023C3E290CA6959B770E8272A3355CA57F7BB800BA4E67E215DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4978a1ddaf4daee8e84c6ce13b9e03e89b0dc1e296ead002ca4ade048cac2ee6
MD5 a4527e3e70958960fec277972c238b89
SHA1 c1c65a957c9efda90b39084c43739fe7749afeb9
SHA512 bc4c974bfbb1d8f5eda21720159ec3b4c9b220b2f13f038d00265818b86755c710776fbdf2e69382d520464281f538c56657a15575176bfbebe5a53a1d095faa
SSDEEP 384:nliFKtNnNnb9338NS8TUNTUlIRJyLC+jkpfb7oBUG1lWeI1Ra/6B2LnOYPpcsVjc:sFKjZbR3twgfnJoCG1l4s68yoHa1
TLSH
T164D24B32EC65CAB7EEE75E9AB74A7A02EFD001A7858C5AD4D9C81D4D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5696da01625bcbc8462625b383935ff79ff95ae95aad4ed05e115afbbe60de0a
MD5 726290b05018018bddd38629d55624ba
SHA1 f25b70fbf2f904c25cac0ca17b7262d989b65977
SHA512 2732e3035b189b4983ab2f0e63a1cba13d2d5be3b74357c17b49c44a3ba76174d05432f67ac8e7aacbcbcd8121e48f8c87c3c30083e024748d5137fbf967c1fc
SSDEEP 384:n55iF9CcmyWCf38NS8TUNTUlIRhyZF+jkpfb7oBUG1lWeI1Fa/rHy/7Ig/:SFccpf3twgOnJoCG1lasM
TLSH
T14BB22B32EC68C9B7EDE69E9AF74A7A03EEE00167C58C4AD4D9D81E1D008B1DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1544281df4bcb93c689f5c8f697323f0b439e6d4b585586adf12406a59fb234f
MD5 f08e5cf17bd18f2d072c2375721ff568
SHA1 374802b4d7381ea435006a506ed5f8b7e6bac35c
SHA512 b0d81214e8423cad62d4f851411afb7735bea11aa01ecbd6e7973d3a00ed7c82485b23572ded0b29a122011e4c02430519c1a69a597731a01df15eda76e71338
SSDEEP 384:n55iF0CcmyWCf38NS8TUNTUlIRhyoF+jkpfb7oBUG1lWeI1Ua/rHy/7Ig/:SF/cpf3twgrnJoCG1lPsM
TLSH
T185B22B32EC69C9B7EDE69E99F74A7A03EEE00167C58C4AD4D9D81D1C008B1DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 86eacf802ecebac6f05016f713a2c5d7a9616f79f03a7c842de62d4a4978832c
MD5 4af6060b759fee8a4ed5faaa018e8a4c
SHA1 890bd659cbc1d1b1e0143ba3dec6794391f70d2d
SHA512 91b8ea417cd114b60a1822e49590522a085d6cf32d6ca682e99f47cabd6f6d1320a7cbfbe8c7a3eb2711e8ef5bb2388b3841c3aed4cedfa9764eff0558b9c411
SSDEEP 384:n4iFKtNnNnb9F38NS8TUNTUlIRJyoF+jkpfb7oBUG1lWeI1Ua/6B2LnOYPpcsVjc:DFKjZbj3twgbnJoCG1lPs68yoHa1
TLSH
T1F1D24B32EC65DAB7EEE75E9AB74A7A02EFD001A7858C5AD4D9C81D1D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dc42949523155a3a025feb9c9bfc770f154b786ae94b8915fdd9e76426ffa906
MD5 4242ee80b8c72f93e22cea74f32d99b6
SHA1 1cb99a4768d2178662715e6248da5df9bb4ce6f5
SHA512 83cc266a5aa5596c5ded09f0d3cec1baebcb0a586c60970923cc535e1dd1b992a38e729b39012d727206f00a87fab219b706fd4a88e9ecda6dee8d80febf3a9c
SSDEEP 384:n5FiF9CcmyWCs38NI8TUNTUlIxBydv1o7ajkpfb7oBUG1lWeAjhkP+lFYS/F+Hyj:OFccps3bwgIk7JoCG1lajhkoFYS/j
TLSH
T109C24B32EC98C9B7EDEA4F99F74A7A02EEE00163C5885AD4DAC81D5D00DB1DD5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 33c6ec34a2ca40cb9b87a5db8470832187d52e7ea1e701c5406a9fb2141d6fbf
MD5 7d2f6e9cd44ee92438936ef93d9b1732
SHA1 2aba92a9a230936fb1c42b473bfcfbfd90364353
SHA512 deee9563df856eb220bcc526adc7fda314f4d42b7e0028d2d7719f78b402687f801d7b07bef0517699f2c24910fe136aa5b5787081bcfdf25d3fa9ed899bd487
SSDEEP 384:n4iF0CcmyWCf38NS8TUNTUlIRhyoF+jkpfb7oBUG1lWeI1Ua/rHy/7Ig/:DF/cpf3twgrnJoCG1lPsM
TLSH
T1E8B22B32EC69C9B7EDE69E9AF74A7A03EEE00167C58C4AD4D9D81D1C008B1DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f869fb7902963d551af605ffcc232aad3509e26f4a31d2ce2239b064fdb85f91
MD5 d938b45ef1ebb692fd552c5b5e525772
SHA1 65be111d98b48df0b0cfa4fbb3d83100ad8af44b
SHA512 8e417182c2df312648bc1e78af19771e665f07df6ba04693dabc94f02bf0c3ddb7ac8ab5dd876a62c2db8154a914d6df09f47ea9ce5079390188f07bbe7c41b1
TLSH
T13B5160E15C7D2AC1D0BE1E6FA48B38FC82ECC725F4A0757D6818EA98097921D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_445423177\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_445423177\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_551096160\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6076-460-0x000002A0E62E0000-0x000002A0E72E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads