4c59c335fd62ef430c2f546c1fac622f313801db245eff4c3aa18fccc45719a2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
307_exercices/ex01-html5-base/index.html
Size 1KB
Sample260523-pcbcpab15x
SHA256 4c59c335fd62ef430c2f546c1fac622f313801db245eff4c3aa18fccc45719a2
MD5 4933f3c0d2e08b267e9479cb000162a0
SHA1 b625c19c33c2a33d52617ccfacd19e3e7c6b49ff
SHA512 b4af1f333c12cb20aef5b2016818ad045586c9a39e93aaaa84c072b196e2ea172a4ac8741ace811a725a65f0d214d602bbe5ed8c6507ae6d9b26943cb4f5fc6d
TLSH
T18721315D8ED2001380C112237D92E4418A60CE5267CDE9A0FECDA0D19FC271ED88F59D
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_1896453899\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_174024735\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_174024735\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_1896453899\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-mul-ethi.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240118587981530"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1D398100-5D03-404D-B81E-9C50B20DA992}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 3056	5852	msedge.exe	87
PID 5852 wrote to memory of 3212	5852	msedge.exe	88
PID 5852 wrote to memory of 336	5852	msedge.exe	89
PID 5852 wrote to memory of 336	5852	msedge.exe	89
PID 5852 wrote to memory of 336	5852	msedge.exe	89
PID 5852 wrote to memory of 5140	5852	msedge.exe	90
PID 5852 wrote to memory of 5140	5852	msedge.exe	90
PID 5852 wrote to memory of 1792	5852	msedge.exe	92
PID 5852 wrote to memory of 2728	5852	msedge.exe	93
PID 5852 wrote to memory of 1792	5852	msedge.exe	92
PID 5852 wrote to memory of 1792	5852	msedge.exe	92
PID 5852 wrote to memory of 2728	5852	msedge.exe	93
PID 5852 wrote to memory of 2728	5852	msedge.exe	93
PID 5852 wrote to memory of 1176	5852	msedge.exe	96
PID 5852 wrote to memory of 1176	5852	msedge.exe	96
PID 5852 wrote to memory of 6040	5852	msedge.exe	97
PID 5852 wrote to memory of 6040	5852	msedge.exe	97
PID 5852 wrote to memory of 3020	5852	msedge.exe	100
PID 5852 wrote to memory of 2404	5852	msedge.exe	116
PID 5852 wrote to memory of 2364	5852	msedge.exe	117
PID 5852 wrote to memory of 1840	5852	msedge.exe	118
PID 5852 wrote to memory of 3360	5852	msedge.exe	121
PID 5852 wrote to memory of 3360	5852	msedge.exe	121
PID 5852 wrote to memory of 660	5852	msedge.exe	124
PID 5852 wrote to memory of 660	5852	msedge.exe	124
PID 5852 wrote to memory of 2600	5852	msedge.exe	129
PID 5852 wrote to memory of 2600	5852	msedge.exe	129
PID 5852 wrote to memory of 3968	5852	msedge.exe	130
PID 5852 wrote to memory of 208	5852	msedge.exe	131
PID 5852 wrote to memory of 208	5852	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\307_exercices\ex01-html5-base\index.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc25fbc188,0x7ffc25fbc194,0x7ffc25fbc1a0
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7523784698174763608,8218794454775965032,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10215561951584152359,12304094695938579673,262144 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,12822003302195197558,5929446671632745038,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,9781991252792680747,3140950524068956451,2097152 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,17892731561149482037,13126687567123544576,2097152 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8183053873806734334,16642202452086134983,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,7123720741676735062,14257841452205828667,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9469572467688750133,11384263153391840285,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9469572467688750133,11384263153391840285,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,12857183683301999028,10878634379133010768,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6979041642724903817,11737609518113261852,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,9709805693942758632,5366676139625185907,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,15136207565211615456,7020474695858824150,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,6571574779488452089,17724503812152623739,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,4397239545558574515,7258282895589584090,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,9239548897369935647,120537094995770952,262144 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10032799177673752977,11879186542565992810,524288 --field-trial-handle=2272,i,5781836681286708155,1914167496266778127,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
  2⤵
  PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_174024735\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_1896453899\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_1896453899\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5852_9724401\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b9ee3fa9fb9f8481f6455851db79ab956f62fc162b514e8120872e9032f01d48
MD5 de36d0cba3d67ffc48b308d2ca4cac14
SHA1 674ab5fefa47ec4b5b2af6fed498e31c19d532a5
SHA512 b96ad08ce4b09b8fcfa118ce5ba2eb5b8d1585a38d604326238fc562842f825d44af8f48ae4a3392d4a60cd170c7c4a779ab7ad5d2e1b2d00d14cb641faf4ac7
TLSH
T197F0F4B6D925EC2718FD0B6870598B46E75423672780989F3B3D820D8FB463B899591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1734cc15749a027a72c9826850f239968f7c419d259be3fade88b431d4751484
MD5 5ce31d46fe9cfafe53906ee5e0d1b07e
SHA1 7ad6a97f7f83e2ba894a0dde8a9be79c8c7b3e5b
SHA512 edb8bccd82011582e5dae812799cc9b5f1114d9a61b856d043b080bbc4cdf51fee6a3d135ea3410a3a0b73947847a79bfec32988a9b57f8463599ef141c93bcf
TLSH
T10F41AEF3C7E8856DCA1155F0BA286E1FDE1D0914432C3D9A85E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 30827cbc99cef9b2db8c9f081cf6bde297f5c71f977cc985c7fd9c51b8cf7637
MD5 f278f5bd806a583681023dcf3038c25f
SHA1 19e5622a1fcce87a5faa3ea4409e07b6cfb6f6a8
SHA512 28453fe82e60e612502e02248f0abf8f876d78033c9505c14005d1fbeddbd508b37ed48a916486f6e70ac52bb05b7ea7f3866d5d81a9f507aa29f9dc8be6ece2
SSDEEP 192:sxZnRtyMqZjK1Ml8UQ4kC/fEsQ4UZZdIaRuvOzodpHKHW6+WNGYvQ+taIg5osJ:sxZniqbC/fEsRUZzIKYVqHbGy8qQ
TLSH
T1E862E7066A3859778DDBD209FA45BB53D7F8156392944E44A9FCCB0C05E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 58d22f2e56109893d5175de9c2d7394d4aafac0cc0893610a8975d21e8611d46
MD5 f5bd486677f8e30cc85d6c104258b82f
SHA1 19ee5b5f932bd32955e372006451b38aadb742ae
SHA512 4e823ea134d4c598a858a236d723bfac9a8237b1d6ca8caa91cf5fef7d436a4e8725fac05bca3c2ac54d1f038b11ad9f873af7d775f067db2a093de123f1ec01
SSDEEP 192:sxZnRtyMqZjK1Ml8MkC/fEss541aZdIaRuvOzodpHKHW6+WNGYvIC+taIgjnJ:sxZniMC/fEssG1azIKYVqHbGr8jJ
TLSH
T15962D7066A2859778DDBD219FA45BF53D7F81163A2944E449AFCCB0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 be5dc1d7ac3e429791cc03cdf153c703d7f307d9fac95e1b608d20b08cc795de
MD5 9b0c43b81a9c01aa8447433c5058bebf
SHA1 2ba7a255051adddf179e9f0dbb51d47689ed07ea
SHA512 515de00de30e8b5aa78b677e389a5a521a60ae8163fc018ca940a93c46a7b262da1455acc3029501c3f4e540db1bf3b8801771549208b3e29f34c70e9b09f7b6
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhysy10Lln:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuPQ
TLSH
T196F2EB3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b9c6344db406980050e620d6584a4dd9e2660cc3cbaa3cd36e2d60a16f0c5ac8
MD5 94cbcd202ffa88b154e537634d2398c1
SHA1 28ecd1fc3945cd8fa4f8a1850beb68d3f1a67e7c
SHA512 fcaf1becd9972716638b4140f24b1f7f41e1a0dcff2e678b486a873edf4b994877f25ba299eda928d999e67ff92e1bc1bad1fb815875c3cf4d5332bd4f11c9fd
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdS:0LppY93PBZJPtN53ATy3jJlZEdQ3bvVm
TLSH
T112B26A5A703E0211393E2988B39696364F4235A37058E4EF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 75cbdd9d12bdbb26fa3f24c85c09b3c9a0bbe8a533692d7473fcb1fddb18ceed
MD5 e57d9571e6f7a5ccd95792795e4a251e
SHA1 9e6c23114b0844f0508cdac0c470023d2174e046
SHA512 1ecfbb7bbe876e6f923b8a0862c706aa8885a5fd0dd512ed8cbba511797d0d9d8f8053a4693b2de6d409cf54559c7b4ac98ebd38dbaa1b8c26dc376818911a4c
SSDEEP 768:poF1jZbF3twgIk+yoGpENdwjnPLVIiWZxfa:eh3EKHOiVVWFa
TLSH
T191D25B36D864DEABEDEB4FD5A31A3647AFE40267888C5ED8D9D84D4D00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e02e2858d3b75dd627ed3956528f8764b2f99b375209b68b24fa9895d7d8ea20
MD5 97fc24683b2616d594fe8221259e4ffb
SHA1 1dad03c7e00798a727c5b5b3cdae17d69c84b38a
SHA512 30730b55631fb05426eb6332669b49aa4b089be8cc2e25154af671a52e6b36bc7ac9827107f839b5fab5dc283208911b2847d7c2d3ba534ef8ee0e1fdaccf3e7
SSDEEP 768:7F1jZbF3twgIk+yoGpENdwjnPLVIiWZxfa:th3EKHOiVVWFa
TLSH
T14BD25B36D864DEABEDEB4FD5A31A3647AFE40167888C5EC8D9D84D4D00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d4a3de4b1eadcbe4aef31b0207de99d2a9b5d252f835bdb72a5f22e83aed8af2
MD5 865482dc87b7fe172f27becc4049290f
SHA1 d25ebc03fe396573965bc87ac0e4fe9d46f19d87
SHA512 a39633ba0c83a5e7c8290e34d159d7504f395b5d9d8c250ab82455559ab27fb60ca55f0c6e5d06b74b483bdf6924a46275ccc856cb9ff1b0500a4a83d6d94e77
SSDEEP 768:poFccps3bwgbkURkoGpENdwj2LEI8p0KS:Ws3VcHOlEI8p05
TLSH
T1C9B25B36EC68DEABEDE74F89B74A7A07DEE0122785DC59D8DAD85D0D009319C430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1b237fd5b4d2f6fb9139aae6b3bd69fc4a02a8c573e55e5424182271769c986e
MD5 ef17e2e5cf485d5b0f1adcbf9cf7e1b3
SHA1 a72e010a78b661e3ff0df4de4b85fcf599af08c8
SHA512 1391286cffcbc77b6cd92e9e0ba818d2178aeca24ee939f9c24f79a948a3128baaf745282b1862b29ab61873c331e498ed4fcc48179d4e401e5e3e6075830af5
SSDEEP 768:poFccpM3twgwkKyoGpENdwjnPLVIiWZxF:6M3c8HOiVVWf
TLSH
T151D24B36D8A4DEABEDEB4FC9A75A3507DEE41163859C8DD8D9D84D4D00871DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7c8cb90c13c2ece25a611d5c1ff02b01db6cd3c8ab95681cc673bcd18b8b8f3f
MD5 5cf492e039801ad30359a37f5b20a3bb
SHA1 f098a5344789362c40d463808925afe4ac80ab2e
SHA512 185f05cccc8778aa2845f13709d2a226cbc7363741861df1c161352cff46ceb0befcd8bf7f80d3f2950a3b45e3ef4fbb6028a9cbb0feb9d668d62613ccadf091
SSDEEP 768:TF1jZbO3twgIk+yoGpENdwjnWLVIiWZxfa:lC3EKHONVVWFa
TLSH
T15ED25B36D864DE6BEDEB4FD5A31A3647AFE40267888C5ED8D9D84E4D00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 156e3eeeace11f18343358651d09bc26a7c7d3e49bba7657b60539300360f477
MD5 a18471f407ffbddaa3f5596c654807d8
SHA1 166ca27c8271d88ba9742378f6dfe9e9d3a6e76b
SHA512 23844fb3b9af3cdc7ed66a561bd2752dbc58295c82cfff64e0ef7666874117c6aef7e5dc53446ac6b801f9436d490cdfd9bb2d1c320bae220118b26ddc153948
TLSH
T1EC4133E25C381AD1D4BD0E7EB4DB78FC85D8C326F6A4307E6858DA84063DA1E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cba256ac955a61be29c00b61ef0f06004bfb3369c41b2d05f2b6e2dc8a24978f
MD5 696903617bb76e376374e19a4f0b5036
SHA1 2b4f8d967a23f1566d71026d7ffa47c2ad83e99c
SHA512 31be87eabd5446ec01d18ef4695bd6961c0c40d7f70e08c76400668cb89befe1cadcdf6abb31cdff3b1b5254bb9c0e6efed9d6f7f57f958af2e3c94119a7fb83
TLSH
T1684153E15C3816D1C4BD0A7EB0DB78FC85E8C729F5A4307E6C58DA840A3DA1D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9b668ce98c7245de49adaae8db73615da95f8112df00fa69e85ac142e5c89028
MD5 4514432f9f309651aa26430feb66ff69
SHA1 743fd57fd340e782b185f8ecce51eca8c529bb22
SHA512 c67156f54ca1c376066300fb3f2d88ff55e8a9a2105d6da4180a295550a2bd9aac37c4b0d06fd1684b86688c5fd798c61f9a7379478e8d97b2d9196cf042e24e
TLSH
T1074133D15C381AD1C4BD0EBEB49B34FC85D8D72AF1A470BE6858EA940A3D54E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a4e0a2cfc4b5ed923a43b6f77e068bcc1c4290b008bd5ec9a63a4af1747f69fe
MD5 4d72acd4f226a13331f7bc0d8718c639
SHA1 d11a15b0ebbf5904a0a8fc18bbd2d2ac49c265e8
SHA512 0423201a8ddb4171b35515927e70471fb879fa633ee650856319e61f13b4e13a7c202f1d89f6447539ef2de4febe123d1d6587732c576eba5e45dc1e8d792a9d
TLSH
T1C4413D5866E9110CB3B77E5BABF7A86D847EB9772F0BD45D10010D4F0626A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3020-173-0x0000022A306E0000-0x0000022A316E0000-memory.dmp

Download