hxxp://getdeviceinfresolver[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://getdeviceinfresolver.com
Sample260527-pzapnsfy21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_2134948802\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_708834688\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_708834688\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_887357713\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_887357713\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_2134948802\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_2134948802\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2620_2134948802\kp_pinslist.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5584	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243595360243154"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{94208906-C842-4251-BFDA-F386AA4945D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 5484	2620	msedge.exe	86
PID 2620 wrote to memory of 5584	2620	msedge.exe	87
PID 2620 wrote to memory of 5576	2620	msedge.exe	88
PID 2620 wrote to memory of 5576	2620	msedge.exe	88
PID 2620 wrote to memory of 5576	2620	msedge.exe	88
PID 2620 wrote to memory of 5636	2620	msedge.exe	89
PID 2620 wrote to memory of 5636	2620	msedge.exe	89
PID 2620 wrote to memory of 5824	2620	msedge.exe	91
PID 2620 wrote to memory of 5824	2620	msedge.exe	91
PID 2620 wrote to memory of 5744	2620	msedge.exe	92
PID 2620 wrote to memory of 5824	2620	msedge.exe	91
PID 2620 wrote to memory of 5744	2620	msedge.exe	92
PID 2620 wrote to memory of 5744	2620	msedge.exe	92
PID 2620 wrote to memory of 1872	2620	msedge.exe	95
PID 2620 wrote to memory of 1872	2620	msedge.exe	95
PID 2620 wrote to memory of 1872	2620	msedge.exe	95
PID 2620 wrote to memory of 2268	2620	msedge.exe	97
PID 2620 wrote to memory of 2268	2620	msedge.exe	97
PID 2620 wrote to memory of 2268	2620	msedge.exe	97
PID 2620 wrote to memory of 3004	2620	msedge.exe	98
PID 2620 wrote to memory of 1860	2620	msedge.exe	99
PID 2620 wrote to memory of 3004	2620	msedge.exe	98
PID 2620 wrote to memory of 1860	2620	msedge.exe	99
PID 2620 wrote to memory of 1492	2620	msedge.exe	101
PID 2620 wrote to memory of 4284	2620	msedge.exe	104
PID 2620 wrote to memory of 4284	2620	msedge.exe	104
PID 2620 wrote to memory of 4284	2620	msedge.exe	104
PID 2620 wrote to memory of 32	2620	msedge.exe	120
PID 2620 wrote to memory of 312	2620	msedge.exe	121
PID 2620 wrote to memory of 1644	2620	msedge.exe	122
PID 2620 wrote to memory of 5472	2620	msedge.exe	124
PID 2620 wrote to memory of 5472	2620	msedge.exe	124
PID 2620 wrote to memory of 5472	2620	msedge.exe	124
PID 2620 wrote to memory of 4860	2620	msedge.exe	127
PID 2620 wrote to memory of 4860	2620	msedge.exe	127
PID 2620 wrote to memory of 1288	2620	msedge.exe	130
PID 2620 wrote to memory of 1288	2620	msedge.exe	130
PID 2620 wrote to memory of 5300	2620	msedge.exe	133
PID 2620 wrote to memory of 5300	2620	msedge.exe	133
PID 2620 wrote to memory of 5300	2620	msedge.exe	133
PID 2620 wrote to memory of 4592	2620	msedge.exe	134
PID 2620 wrote to memory of 4592	2620	msedge.exe	134
PID 2620 wrote to memory of 2468	2620	msedge.exe	136
PID 2620 wrote to memory of 4336	2620	msedge.exe	137
PID 2620 wrote to memory of 4336	2620	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://getdeviceinfresolver.com
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffb2da0c188,0x7ffb2da0c194,0x7ffb2da0c1a0
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,13439024661134699927,294566288134482463,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,9126012347639441435,6427580727227943469,262144 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,7570914025517493235,11512293157330178605,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,11529200217442813131,3254333574209336343,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,17437298800747375646,11961131172722253484,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,5154784582585343490,10925711516235772863,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3576,i,16942042081424570690,13413579213895829355,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,465868021599976219,12462602702793450136,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8833946897245865783,8785881688439290511,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,5924441441300574323,16960154791712373159,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,5924441441300574323,16960154791712373159,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6080,i,13981620785358475271,11835070460804281342,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7259166516258718365,2994240655412180420,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,14240916809990683482,10517619485986337662,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,17917488334279619126,17600419173732426407,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3796,i,3152655740542040016,9187302225225058658,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,1086544563598435789,14997781666438850738,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,16338576606102976413,11255915148248316846,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5156,i,6417441362797676470,391485449741047988,2097152 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8334775689355694482,5876988309635360399,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3560,i,11015118717749806017,2222073397907130549,262144 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10577411734083044219,4420955303046675086,524288 --field-trial-handle=2344,i,16480326699228855900,14854487930094216536,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2620_2134948802\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2620_708834688\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2620_708834688\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2620_887357713\manifest.json
Size 118B
SHA256 828658147aa137be854d8e5a079884dd0388f2b7c17400952338374ca0b53f4f
MD5 a9e80c400101025da0ff7fa3616810a5
SHA1 bd3f73166085a1d83452e87dba88ae9058842f4e
SHA512 d1e62ad4c3031173bebb6c8059c84d220a1dcbf993bff7db9ea6680cde90639571d9e57b0e1fc1d3b0c9b024a9027d551532ea28d10c14fc06fabe8a721d34f3
TLSH
T128B092B00C0AA47B22849720ECA06A8383F80218F8065B1E088036881F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0028ec41572286b29d78dc62eae5772cdc9dfd469cc273fb7262dc2644c0b299
MD5 5880a14506d5e8ea5c9398c84cbbcd19
SHA1 e3a5e954cf1781bde09609269d0f3b2fe02ea3cf
SHA512 f98be4b9957e545f3ab99238d59a3025fd62114b785b8b15260d342beb46a4f5a66c710a97a82e94b5c05df0f704e52fa21737e713ce1091a4eadd3344cd0a22
TLSH
T1DDF0F4B6D822EC2B18FD0B6970598B46E75013672780899B3B3C820D8FB463B4695D1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e70f5eea53474cc3ad03cc1295d6a6e4105e2b3e98a5311d7fa553ebec1f766d
MD5 99e672e67ba9dca43f53b4433dc42859
SHA1 989a93733b3ceffa13ad35549f3223e58c6b1706
SHA512 fcdadbdff4e2e9bdebc788adb8045e20bb000d84ffb51cbc6a983f7112df498e8520acd15dd6bf16538a9981464940e2853bd382b6824bff87f5f00fd7605941
TLSH
T16541AFF3C3E8856DC91196F0B6187E1FDE2D0914832C3D9A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e3427cc906d101b6ceb7ed05ff38e0892eb65a2780210b9d41498290175bc46f
MD5 c6229a016861c303090650f17d9b9813
SHA1 a867958ce177b887a9911e3f942cd539dff82f12
SHA512 5b3ff103c0c1be7a75728516be77421cac66053a2fa4eef463c0b89ae9c3bdffa35ba99d8d7caadc878b5325702e5a4c77761f6aa6e8231d219a9d000c6c9a29
SSDEEP 192:sxZkROyMqZjK1Ml8UQgkJW/fZsfVRZdIaRuvlzodpEXHwh6+WNGYvz+gpIg5ymnJ:sxZkdqzJW/fZsdRzIKYuqHdGd0JJ
TLSH
T1E572D8066A34597B8CD7D619F645BB53D7F84563A2944E449AFCCB0C04E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c7caaf65d1922a76540b2f56c73c32101cd419bbcca35a6c505a0cce46cfa45d
MD5 7169ec746a9070c548fd7ed1c10f9cb7
SHA1 631b3759def52754f8e9ab9422a055d5a76aaaf5
SHA512 17c2d6301caf87802d0e9d0f4d64ae860744404637c69d2a99b40e36724eac599ca137a78ecfcaffd29e31f47e47ff9e061abcc6341446b6dc679303a12df333
SSDEEP 192:sxZkROyMqZjK1Ml8MkJW/fZssnVkaZdIaRuvlzodpEXHwF6+WNGYvIC+gpIgjCMc:sxZkdMJW/fZssVkazIKYuqHpGr0jFc
TLSH
T1B262D7066A24597B8DDBD619FA45BF53D7F81163A2944E449AFCCB0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a1dabaff805abba155a5a08375faa475cf8cd635123bff55c5fdbd6b96a07507
MD5 927491327a5cfc0eebd8323ddcb815ab
SHA1 3c48b8394567cf8dfac7f1b5ff2d5a3cf409650e
SHA512 637fff8294243fc5cfb3fac26b65a0372fb7e5801d6dcde9364fa551849dcf6d9fe85758be4c0bf07efdea8d89b5067daaa54df0d1873ab141fecad7bacd24ae
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmysy10Llf:eY8Od/HEnFhWvFvmXu1jamt10Lm2Nu9O
TLSH
T1E9F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ce9eb5b3bd32a48c5e8ed8f96015653f9f5dfc47b1e570df034a6bc832950648
MD5 ab9112cd5e606b8f28ce893d28e52096
SHA1 3f78e19aa35d4695163fb9a92e3cbfa10175f9e8
SHA512 a8232a4cb05a0c551e68c0b0ec6a1a1f2ee312a1f0ab2a44a1d8a8228e843320f9f5e290c5c0d5e45684189deed6d8650906c7782dc012c2d9f92bd1dfd343e0
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGa:05ppxnY753RNBvRJJdt7p5J9pRv+
TLSH
T1F7B27C5A703E0212397E294CB39696364F4235A33058E4AF7FB814A54F67E224DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ab4dba474770f9691ff52aae10bbf2a05ebdf3b2401176c326f3504ea3f73af
MD5 68857b483b27fa4a72157e9d1508062f
SHA1 92abc60a11575f2e8bc1b3220f1b829b99088518
SHA512 511338e797f5238692be530ba1c00b5ce3aefe53df2860860457b4398296b63ebe1a27ed0950502a90fe95c2567cff4ecd3a983ecdb8613805a167b905f0e6e9
SSDEEP 384:npRiF9CcmyWCH3sN18TUNTUlI4PQckCrdfKpv4fmGsaiiFWIzUpLUSbQmXEG47mr:p4FccpH3gwgmkwkbGsUWo+USbQAEG4Cr
TLSH
T16DD24B31E8A49EABEDE74F89FB1E3603EFE44297859C59E4DAD84E0D008719D034BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0058be6cd8ab91a7fcf05fcc99a0c6963af2e8880a07d7d1362a96e73e07d976
MD5 b2cf000b123a14c57e89115aa77b8b33
SHA1 103ecf9772eaa0d9fbf3f048e149a254152fdf72
SHA512 fa0f1d15fc8f8442acffdc36f9af66c9d55f2b51b67a91f77341b2d3b008fa204998be3cd458804f57f9bcc649ce90c2748ac9d86bf982f451e1a3f7b50014fc
SSDEEP 768:p4F1jZb+3gwgtk4kbGsUWo+USbQAEG4CZN:6q32mkWJUS4CZN
TLSH
T186D24B36D864DAABEEE74F89E71E3643AFE40297859C1AD0DAD85E0E00C719D134BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4d0bced87e7d064c2ab85def7460a981d3aebcf53a4a15812c94f1c7abb52d92
MD5 cfe0148d6d0fc43a0a19ef8a415a444a
SHA1 df09219e84cc700539c0a4c43a0b62fd85edc992
SHA512 95fcda96845e071b7cd526606c928ae5b40b8b5e7b3f2cca91abb3aa7e990ab4735929e5c9a9bb431fcd2bb24ac0df904463f197765c5f084e293eef5fda1e38
SSDEEP 384:np1iF9CcmyWCs3sNI8TUNTUlIm2QckCr9l5Kpv4fmGsaiiFqFpge4KV8p0ZLAtyx:p8Fccps35wgbkUPkbGsUq4I8p0ZLv
TLSH
T10CB25C36EC59DA7BEDE74F89B74A7A07EEE0126785DC59D4DAD81D0D008719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 161aa05a6a66ddec535d2e2fcd5ae07844d31b78030127205b9c4dfa11221ead
MD5 c2685bdd72ce05ede9f35046eb422d9e
SHA1 b91b9d3ef99bce1f2a456ed88354cecb9a6208f4
SHA512 0a7569e30c0420b6f3f7d71eaea46f0520d8224b4f93e9306a7a09a02ed6ba8699df0dfe9d6611737d8e7c61c5a2a3c93722f36e0fb4443988bae4e779d6f1fc
SSDEEP 768:nF1jZbV3gwgtk4kbGsUWN+USbQAEG4CZN:BZ32mkW8US4CZN
TLSH
T1DCD24B32E864DAABEEE74F89F71E3643AFE40297859C59D0DAD85E0E00C719D134BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d5ab5f94773d83e6a7ff9ae448e748a076f89af2da5bae2d90048f33d91ba0d6
MD5 c7dd8a52b47f6e8da8c9f1a7594b4bd3
SHA1 ca1d4d9b6a3cfed538f9b02f94806452d3e84855
SHA512 d18be285cdcda03764aa5be855629f3f42d2b2e2c4fe4e890e8aff2d02d65bfe8a0ae0b0f00d9353ced9a9d734ca890b16e5f42a63e4e3afad428f61fdacd637
SSDEEP 768:tF1jZb+3gwgtk4kbGsUWo+USbQAEG4CZN:jq32mkWJUS4CZN
TLSH
T1DCD24B36D864DAABEEE74F89E71E3643AFE40297859C19D0DAD85E0E00C719D034BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.26.1\typosquatting_list.pb
Size 447KB
SHA256 ad756d39f4fa4a70bee09929f53e29bdacbe552aa1d097309b849ccb92ef7a7c
MD5 c1229bb6439d3426ef7e54fa3911e9f7
SHA1 8623ef46acbf1e0f75a298c098800d1012f347c8
SHA512 d1be2ec8c1137138e38d616ee405172bac5cc61e7beecf6d3da2437adab44d8d702df300d84350020e5e9525220193c6015fc58f41a59fb9a9d4fd094e6730b7
SSDEEP 3072:ZOwNK6ZgDoFVUqY7O3Uw4pQXuDlalIfT1JCuGSrw5mWDecdCs:nNBgDoFuY4ioTCTS05mgdCs
TLSH
T15CA4A3B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fe05d7507b244f9ae64949667c77d8167c18cda8e2d9e411bfbffd89cd4a3355
MD5 124c2bc76750ac261c21803ade54625d
SHA1 eb2de2efb47e5834e7d7a6f95e4b942bfe62b284
SHA512 b9f64445ad4e9f49e6ef651b9286c687949efdf0f389d945d2cf507a5dd727a153e5739aa2261fd48b39f70471759543a4d7529547840c37942324839bff721c
TLSH
T1D93122E26D781AD1C4BE0EFFA08B35FC44D8C21AF1A871795854ED94073890E244143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 87b09420ee8efdd7757db3dd71be84ce122cccd18002f5fb0eb6e17bfb9676cb
MD5 1fdd78d8b15bcbd3994142150782bb9e
SHA1 89c1d09f0261157d70a5bbe192b20bc35a950432
SHA512 a6fdad787fe49710c29f54c577e0e3aab0fc513eba5d1840e0a26d0c3045732322267f6027c10b6d3b5d992afdfc57212e0da0836420c8569da2a0c62c94e83b
TLSH
T1893142E25C381AC1C4BD0EBFA48734FC94E8C32AF1A830791858E994472C90E248043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9389493bf474fd487bb7e825235a3a31c118bb959ead40831c905fb22dcfd4c0
MD5 561b3fb101d30ccef644c51771bc600b
SHA1 1f18615b6024191f52858935e6ac6ad2fce0df75
SHA512 d01111d5fd24fc118b1d02f04d932ecf30067be4fd466d6af9e2bc96d827bb1fa74696bfdbc797c76d7aab39904834c1acd8fe9276f1fd24340a127d6809b558
TLSH
T1F13120E26D781AD1C4BD0EBFA09775FC94E8C31AF5A870792858D994073894E244143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c28764b3dae6ca72639b8fc159496c73f7cbb3c7e86a7cc5d7a0beea9f863a84
MD5 8dba11f81783b59726186a26c742f2e9
SHA1 5c07dd9ba68c45ef2ed917913aa899afb1c2b65f
SHA512 57bf0a3abb146edd1cf15f5e6abf2c10b135eb587a9b4c48228438dcc33fe928ccb23b93942ac0b27d4006530bff689795191145197a22930f7af7c38952444a
TLSH
T1E641275CB7F91144B3B77F56ABF6A8AE087EB9332E46C49D00010E4F4A66B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-172-0x00000224E9000000-0x00000224EA000000-memory.dmp

Download