788d0aa5714debf87160caecfbbc6cf0f6a78a73bc24471423784e0faf16f057

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 1KB
Sample260527-phpr9sdt5k
SHA256 788d0aa5714debf87160caecfbbc6cf0f6a78a73bc24471423784e0faf16f057
MD5 d4d77bff234513d649bf45ae6b1380e5
SHA1 61e792cddb4935b02fa1749f26e0fbdd5e375c13
SHA512 34de4a50486689ebe013676a057e62819c16df8d4687b2a437c3c39f43fcb27f5f92f74724843b6e619cf11e5be9c89e37339852c6aa29de272ec6c322ea9350
TLSH
T13021EA372A070927D6455E9F7706FBC09D82A8C9A2FD266C705751CFC4CA2B98B9C3C8
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1769928119\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_649858299\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1769928119\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_649858299\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-ta.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243582160941981"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6601B8D4-A188-4572-8077-35C38D931E54}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3640	4568	msedge.exe	85
PID 4568 wrote to memory of 1724	4568	msedge.exe	86
PID 4568 wrote to memory of 956	4568	msedge.exe	87
PID 4568 wrote to memory of 956	4568	msedge.exe	87
PID 4568 wrote to memory of 956	4568	msedge.exe	87
PID 4568 wrote to memory of 5896	4568	msedge.exe	88
PID 4568 wrote to memory of 5896	4568	msedge.exe	88
PID 4568 wrote to memory of 6120	4568	msedge.exe	89
PID 4568 wrote to memory of 3272	4568	msedge.exe	90
PID 4568 wrote to memory of 6120	4568	msedge.exe	89
PID 4568 wrote to memory of 6120	4568	msedge.exe	89
PID 4568 wrote to memory of 3272	4568	msedge.exe	90
PID 4568 wrote to memory of 3272	4568	msedge.exe	90
PID 4568 wrote to memory of 4600	4568	msedge.exe	96
PID 4568 wrote to memory of 1412	4568	msedge.exe	97
PID 4568 wrote to memory of 4600	4568	msedge.exe	96
PID 4568 wrote to memory of 1412	4568	msedge.exe	97
PID 4568 wrote to memory of 2356	4568	msedge.exe	99
PID 4568 wrote to memory of 4900	4568	msedge.exe	115
PID 4568 wrote to memory of 3952	4568	msedge.exe	116
PID 4568 wrote to memory of 4236	4568	msedge.exe	117
PID 4568 wrote to memory of 5972	4568	msedge.exe	124
PID 4568 wrote to memory of 5972	4568	msedge.exe	124
PID 4568 wrote to memory of 5884	4568	msedge.exe	129
PID 4568 wrote to memory of 5884	4568	msedge.exe	129
PID 4568 wrote to memory of 2184	4568	msedge.exe	130
PID 4568 wrote to memory of 2184	4568	msedge.exe	130
PID 4568 wrote to memory of 3048	4568	msedge.exe	133
PID 4568 wrote to memory of 4688	4568	msedge.exe	134
PID 4568 wrote to memory of 4688	4568	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdd6a7c188,0x7ffdd6a7c194,0x7ffdd6a7c1a0
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,16958738293090297763,16227010556409196057,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8823282489537506833,10736234876204508354,262144 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,17714497770293488718,3699825526088444731,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2002529356735314417,6290094600695050270,2097152 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2397626033053172846,9474103666698102776,2097152 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,6718727047326725310,6331989659194388125,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3522001106060573033,3402583594677982097,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,9932823418458956050,7178842059687695235,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,9932823418458956050,7178842059687695235,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,200782378099586628,8096520093400213530,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,611363165005866307,7169123559440033680,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14774814262439945926,10066698438909922536,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5327800120611787760,17231527509673124879,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,7452733254428656262,10624838947965229920,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,1793041442265534725,6742210544658762278,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5792,i,3457685349700214238,12032273253958344951,262144 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9519549652552594536,7602655678905030090,524288 --field-trial-handle=2292,i,15258957109658218439,10968343676917857439,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1268911828\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_1769928119\manifest.json
Size 118B
SHA256 828658147aa137be854d8e5a079884dd0388f2b7c17400952338374ca0b53f4f
MD5 a9e80c400101025da0ff7fa3616810a5
SHA1 bd3f73166085a1d83452e87dba88ae9058842f4e
SHA512 d1e62ad4c3031173bebb6c8059c84d220a1dcbf993bff7db9ea6680cde90639571d9e57b0e1fc1d3b0c9b024a9027d551532ea28d10c14fc06fabe8a721d34f3
TLSH
T128B092B00C0AA47B22849720ECA06A8383F80218F8065B1E088036881F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_649858299\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4568_649858299\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

99345d93-af23-44d2-831d-c21cadf72177.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\99345d93-af23-44d2-831d-c21cadf72177.tmp
Size 28KB
SHA256 b576eb664cc62990d1f37109f043e394d1320926296ee8a96751eba33db64183
MD5 9e694acd58934ca66b79d13ffa74fb0c
SHA1 3e7168e356a1e33a410955f2080e3a12b5f03710
SHA512 935b64b60cd710e856569c79765a0e167ed95629b7f1b7fce04d583cac4b2b7a285b65ef5e6e05988efdcb2fa9717ddcb1a52fa5f256d15b30c45d42ea5335c9
SSDEEP 768:pFF1jZb63bwgqkEKboGP/sxofUSbQAEGtr:Z+3EihUStr
TLSH
T1EDD24B36A864DEABEDE74FD9A75E7A43EFE401A7848C19D4DAD84E0D00C71AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dbe2771e463df09fa23d4b86fbe76803d621ca8f91c33436ebf74c65ad31a072
MD5 2712cee93f88ba862854d08fcf22010a
SHA1 6f0225cdaa7169b8f79dfd88080ed03936d5ff81
SHA512 869d5c21bc28f9f290f76e3c3c78aef6431404313285cb878581fc44dced685d9df5931a8c3d287786215bcd58c7a039ed5bb5cfa5b9f86753f2629fe7fa6417
TLSH
T142F0F4B6D921EC2718FD0B6970999B46E75013272B81985F3B3D830D8FB4A3B8699D1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c6dca765eb28b9c0fecc8989c32bacd0eb7db1ff7772223bec79dc82b4dfc26a
MD5 05eb420b6a7841801f0ddd2aced798a8
SHA1 7c673ebc2c7011700cb910bb695283f03c60d43c
SHA512 d2c4a1330ea49f107ccfcac47be36ac48ae0a3bbefafbd6428879b8ffea5333bf89656a8caf7fdc8e48c23a2f2f7106908ec038a6ec32712536acf0bee953a78
TLSH
T13241BEF7C7E8856E891195F0BA187E2FCE2D0914832C3D9AC9E4AF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 962e3220fb44d1a8a25a312419a88b627bfeb4409be2b8160e8d0df6bb82a9c0
MD5 0fac8a30ec76ca3e2d21a29acea04fee
SHA1 867fab1047c7b5864c1ab872982038bbe27158cc
SHA512 38f6938470212963bcb8ead37e2663464eaaf0fd4395b7b3da2ad4580a4c06bed18af5a52b8205e8399fa0e090be5cb227660379188352c94b9f4803250dc263
SSDEEP 192:sxZgRkyMqZjK1Ml8UQ+k3/f5sM83ZdIaRuvhzodpHTHW6+WNGYvJ+nAIg5SJmPJ:sxZghqV3/f5s53zIKYKzHbGv8/R
TLSH
T19272E9166A3489778CDBD219F645BB53D7F81563A2944E44A9FC8F0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 177334acd3bdc5315485f3538c45e5159771c6a69b5878815ec1876a59709a07
MD5 e70b921edff6777c68a1c9bb091aeabc
SHA1 daf84775f0070b835d034d57a77ba19a6567d863
SHA512 c9e6dde75dc927586420600939c5697ffbe80a24a39768e80277425135214ab34047bb0ea5121c459c5e12d0d0e4eaf1c1949aeb6aa8083aaaf667db5921fbaf
SSDEEP 192:sxZgRkyMqZjK1Ml8Mk3/f5sss8maZdIaRuvhzodpHTHW6+WNGYvIC+nAIgjHJ:sxZghM3/f5ssZmazIKYKzHbGr8jp
TLSH
T1E962EA066A3499778DDBD219FA45BF53D7F81163A2944D44AAFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4a5af2e8cd80c6d6d6b2a166236117d87b9340370175ad8dcb67117432342e86
MD5 944e3e14322f6e7f74f741c6a4c48d62
SHA1 e8e6514fa77aa4fc65846673d7e2bade326392fe
SHA512 655655390b55c622f4b4b7baf82202bb4717280fa99fa4ac4411f78e38021676fdb96c287143f4ac19e369361e54176948a588e1288b6c93657e3d0f726abf9e
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0ysy10Ll3:eY8Od/HEnFhWvFvmXu1jast10Lm2NuFW
TLSH
T1DBF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f7ca38b7360d3320d62b6a9fc06781e38b01bf239422d84c224a395f7159c883
MD5 7816b7f35037748e781325b4ab43000c
SHA1 3805ef8df1cb6496f0b250a1384cb96f44f8335f
SHA512 867e2265cbab9fa36af65c04c212e7d27d1e2929c47602112600914801688832a7783d872c60505420803ddd4f66697e84662073c63a5be9966b9a507f8ad4e1
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM649:0LppY93PBZJPtN53t79
TLSH
T1EEB27C5A703F0212397E2948B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b8ee104916099287a5d1ae96a5073346f515ff942d083f0679893a55700ed891
MD5 0bf9670dd698a4f87a3739b8af42563a
SHA1 01c357c97cffed728349cd33c7ccee87de3f93bd
SHA512 e727771362dc4142155626fef5bbff6e370f61145d00dc8f18b8aff02dd7d1179abf7f9b54908bcb072f438fbfd37bb7d754dcc765aa80cc061e161f72264661
SSDEEP 768:WF1jZb63bwgqk+KboGP/sxofUSbQAEGtr:W+3EUhUStr
TLSH
T137D24B36A864DEABEDE74FD9A75E7A43EFE40197848C19D4DAD84E0D00C71AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4fbaf4bba9b1b259f4e17b702fe8833019b5627ebc82c89e2acc396583d5a1a3
MD5 7a56f3c11a4c62de48c80be9e3c2a273
SHA1 276d7d3c005b80c725b66157d391901212c23909
SHA512 e0fb220ca208966104b524382a5b1f5b6e5736d8dd4df406c555c155b586c1e191821056a9a712fdf8e1f62c50adeec9ad74e0c32081ea0393796fe637913e1d
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9lSKphiftGP/scapse4KV8p0+Hrty/7j:p7Fccps3owgbkUEkoGP/scLI8p0oK
TLSH
T15BB24C36EC68DDBBEDE34F99B74E7A03DEE05167859C59E4CAD81E0D00931AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e9a1dd35ec7c2fff57871ad872a3ee2df48af2028a87e6b7281ca49fdcd16685
MD5 0d3b7d3c5e39822960543619c73fd967
SHA1 c608c380e395479f8b2cc782b4963148d1c81549
SHA512 e1fb9c586a171b572240ec9b1f01d276affd1ba7ce0e74ae571189662f66bb74fb60e6394dfac4120a55b3d6f618fe3cf8ee2587a1c4481cae481a6075fe2b1e
SSDEEP 768:5F1jZb83bwgqk+KboGP/sxVfUSbQAEGtr:ng3EU6UStr
TLSH
T119D23B36A864DEABEDE74FD9A75E7A43EFE40297848C19D4DAD84E0D00C71AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.26.1\typosquatting_list.pb
Size 447KB
SHA256 ad756d39f4fa4a70bee09929f53e29bdacbe552aa1d097309b849ccb92ef7a7c
MD5 c1229bb6439d3426ef7e54fa3911e9f7
SHA1 8623ef46acbf1e0f75a298c098800d1012f347c8
SHA512 d1be2ec8c1137138e38d616ee405172bac5cc61e7beecf6d3da2437adab44d8d702df300d84350020e5e9525220193c6015fc58f41a59fb9a9d4fd094e6730b7
SSDEEP 3072:ZOwNK6ZgDoFVUqY7O3Uw4pQXuDlalIfT1JCuGSrw5mWDecdCs:nNBgDoFuY4ioTCTS05mgdCs
TLSH
T15CA4A3B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c506ab067453376c29488f1cc37830eb20fa19fba9441c4e3f11adf9c5ad23f
MD5 ee0c6a56003aabf9af280164ee178246
SHA1 739724d980a5b43cc88b1043a9365dc999eae0b0
SHA512 cf458e31f3c4fe400082dc0948a7b8cc71994951943b4387d60676d9d677567827a58f1a04344346660a99663f9a9dde3d829c5f77199286074ce656828c4c2a
TLSH
T1214130E15C381AD1D4BD0A7EA49734FC94E8D32AF5A830BE2C58DA840A39A4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 197b15be2148323936a5f75759d89a924b7b334b7923488082810dc4f6bb3dff
MD5 7ea30de53eb4019f7c553fa47a0c582b
SHA1 088c10fce2dea6c671d910314f15aec1cc5e00a5
SHA512 213397f728188256dc8e06979a3d79364ea847c0cebaf30f6814a35a4c3cbf37c682c2586580d6b31bca1fc5be97eca810fb22cafa83f0090c858ba8299cf83d
TLSH
T11D4142E15C3816D1C4BD0A7EB08B74FC85E8D72AF5A4307E2C58DA844A3DA5E648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9b668ce98c7245de49adaae8db73615da95f8112df00fa69e85ac142e5c89028
MD5 4514432f9f309651aa26430feb66ff69
SHA1 743fd57fd340e782b185f8ecce51eca8c529bb22
SHA512 c67156f54ca1c376066300fb3f2d88ff55e8a9a2105d6da4180a295550a2bd9aac37c4b0d06fd1684b86688c5fd798c61f9a7379478e8d97b2d9196cf042e24e
TLSH
T1074133D15C381AD1C4BD0EBEB49B34FC85D8D72AF1A470BE6858EA940A3D54E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c9878388d8e47d8fcebb79bcfe042b307c0281819d300e796256d1aca2db7574
MD5 18cbb59516db44d35cafd98501f85a90
SHA1 7a652335d4210de9a01859bfee2e59c06a123be5
SHA512 8aef8d347c1681fbd163729c53549246e790618ca33635b66760819aaadf033770859e20be7c8bc94813d6a9afe9fa5f0042b48dbe3120a1a786bb9a726ad795
TLSH
T162412A5CAAFA2118F3B76F1A9BF6B46E487A7D672F0AD45D10010D4E0623E44DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download