hxxps://ms-secure-sign-ywdo95mf[.]vercel[.]app/?filename=Faculty%20Leave%20of%20Absence&org_site=georgetown[.]edu

Resubmissions

28/05/2026, 15:47

260528-s8ab2sey914

28/05/2026, 15:19

260528-sqj4jacy9p10

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ms-secure-sign-ywdo95mf.vercel.app/?filename=Faculty%20Leave%20of%20Absence&org_site=georgetown.edu
Sample260528-s8ab2sey91

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_165158034\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1554853629\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1193412882\_locales\sk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244568509119336"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{51983A41-725E-4341-B727-31C164FD105E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2956	5112	msedge.exe	85
PID 5112 wrote to memory of 5372	5112	msedge.exe	86
PID 5112 wrote to memory of 6116	5112	msedge.exe	89
PID 5112 wrote to memory of 6116	5112	msedge.exe	89
PID 5112 wrote to memory of 5108	5112	msedge.exe	87
PID 5112 wrote to memory of 5108	5112	msedge.exe	87
PID 5112 wrote to memory of 5108	5112	msedge.exe	87
PID 5112 wrote to memory of 1788	5112	msedge.exe	90
PID 5112 wrote to memory of 5280	5112	msedge.exe	91
PID 5112 wrote to memory of 1788	5112	msedge.exe	90
PID 5112 wrote to memory of 1788	5112	msedge.exe	90
PID 5112 wrote to memory of 5280	5112	msedge.exe	91
PID 5112 wrote to memory of 5280	5112	msedge.exe	91
PID 5112 wrote to memory of 3460	5112	msedge.exe	99
PID 5112 wrote to memory of 3460	5112	msedge.exe	99
PID 5112 wrote to memory of 3460	5112	msedge.exe	99
PID 5112 wrote to memory of 260	5112	msedge.exe	102
PID 5112 wrote to memory of 260	5112	msedge.exe	102
PID 5112 wrote to memory of 260	5112	msedge.exe	102
PID 5112 wrote to memory of 3048	5112	msedge.exe	103
PID 5112 wrote to memory of 3048	5112	msedge.exe	103
PID 5112 wrote to memory of 2276	5112	msedge.exe	104
PID 5112 wrote to memory of 2276	5112	msedge.exe	104
PID 5112 wrote to memory of 3828	5112	msedge.exe	107
PID 5112 wrote to memory of 5292	5112	msedge.exe	109
PID 5112 wrote to memory of 5292	5112	msedge.exe	109
PID 5112 wrote to memory of 5292	5112	msedge.exe	109
PID 5112 wrote to memory of 4660	5112	msedge.exe	117
PID 5112 wrote to memory of 4660	5112	msedge.exe	117
PID 5112 wrote to memory of 2172	5112	msedge.exe	119
PID 5112 wrote to memory of 2172	5112	msedge.exe	119
PID 5112 wrote to memory of 2172	5112	msedge.exe	119
PID 5112 wrote to memory of 3340	5112	msedge.exe	120
PID 5112 wrote to memory of 3340	5112	msedge.exe	120
PID 5112 wrote to memory of 3340	5112	msedge.exe	120
PID 5112 wrote to memory of 440	5112	msedge.exe	122
PID 5112 wrote to memory of 440	5112	msedge.exe	122
PID 5112 wrote to memory of 440	5112	msedge.exe	122
PID 5112 wrote to memory of 2928	5112	msedge.exe	124
PID 5112 wrote to memory of 2928	5112	msedge.exe	124
PID 5112 wrote to memory of 2928	5112	msedge.exe	124
PID 5112 wrote to memory of 5012	5112	msedge.exe	130
PID 5112 wrote to memory of 1192	5112	msedge.exe	131
PID 5112 wrote to memory of 3384	5112	msedge.exe	132
PID 5112 wrote to memory of 384	5112	msedge.exe	133
PID 5112 wrote to memory of 384	5112	msedge.exe	133
PID 5112 wrote to memory of 4488	5112	msedge.exe	134
PID 5112 wrote to memory of 4488	5112	msedge.exe	134
PID 5112 wrote to memory of 5480	5112	msedge.exe	137
PID 5112 wrote to memory of 5480	5112	msedge.exe	137
PID 5112 wrote to memory of 2220	5112	msedge.exe	140
PID 5112 wrote to memory of 2220	5112	msedge.exe	140
PID 5112 wrote to memory of 2652	5112	msedge.exe	143
PID 5112 wrote to memory of 2652	5112	msedge.exe	143
PID 5112 wrote to memory of 5720	5112	msedge.exe	144
PID 5112 wrote to memory of 1064	5112	msedge.exe	146
PID 5112 wrote to memory of 1064	5112	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ms-secure-sign-ywdo95mf.vercel.app/?filename=Faculty%20Leave%20of%20Absence&org_site=georgetown.edu
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdd682c188,0x7ffdd682c194,0x7ffdd682c1a0
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6634613622677604860,18388365060192435910,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12719804256351641945,14508864979239270157,262144 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,17149585788117990593,15001744931473802351,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2662329167705826862,10721680468815099007,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17748198162576652,11806592086374452150,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,2349692066694946877,7785635526950743760,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3528,i,717044878623428298,2329521360460161018,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11891404989293934812,11740310953836851084,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13769025762670818878,12500627515902606990,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5127175283385828990,11996512809184582973,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5127175283385828990,11996512809184582973,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4992,i,9339666203398341960,6052839048463294387,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,14197629469391859920,7891964562143438082,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6472,i,4860723344606683149,13154133802584653930,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6516,i,6589949665956818864,11661910287180846004,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6128,i,4699035380740958133,5222448381776668074,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6784,i,2882879127036995670,3275482468536070459,2097152 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,2776945266577427329,1395204529694544374,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10839713981260686747,11190498124386232958,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,7867928031709696779,4392417240721584784,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,7369977540746692829,343755048722870252,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,13043650443202660675,9716947816784752662,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9349559321231123985,4187589796833584125,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,5045883060865150246,16655079703868651703,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9695842484468701051,2423303986033173537,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5944,i,5277737200570233688,17893940920671738700,262144 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,18107590115777784093,14750823842236793507,524288 --field-trial-handle=2232,i,5306207008856578515,14731593538316877830,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1554853629\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_1634806119\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_165158034\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5112_165158034\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

151f7b88-89ad-4698-86c4-0bab81fe7fc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\151f7b88-89ad-4698-86c4-0bab81fe7fc1.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dc3d7e4e1e827d5ef299e75c49362bfad61be0ab5de8fd9efcb670e5abcadb75
MD5 6bb9f25ce748ce38006c91b39664a5fe
SHA1 f03a60596252823af4e414a37ccd97ee2b6531a2
SHA512 870fb1022fbc4ebf44804958d53685030172211d05394c43c1b13564abe5e64923800aac6b7ecd8e9803cfdec0707a03fed58b6ee4a96b3947840951ba8f67e9
TLSH
T168F0A976D821EC3718FD0768705D4746E75113172B41595F3B3C930D4FB463B459591D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b0edcd546a2792acbdda0c24ea13a94fbed6ea64e304f3308043d0687903950b
MD5 822fea5d9dde6ef94325379a8ada89f9
SHA1 d0325d0aebf4c26e67e88fc9a96fb3d524b4f1ec
SHA512 5dc96d3e70bc803152021190add4c90163a013847bb7a52902c5523f1f84613b323c40d6b451c7ea9dd4a55bb5ac91103ab29dd6fc2f2949f462e34982077162
SSDEEP 96:jkr0MyomFXWtVZmVBo6tF/WeEXx3tSrJG5hojbF:jkyomFmforDUx9SUhoV
TLSH
T125B1637218912DA8EB62477646D00D62FDB1CBE9FB338ECB23105437192B7937147B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58eeef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eeef.TMP
Size 3KB
SHA256 14c013e3f1d8840a66174542ae7449ecb49765c924b4c44c3381c41af2ef0cab
MD5 f73e29d2816ef0547d84bddb17873071
SHA1 2231315deab4ade19e6da415a8233252cd146be7
SHA512 c581dc5b0ee0789f0a7aff7d2fc1e9b72de5778e5ca05fb6e9ccfaf8cd273f2e40feb2c734fdb9467776e012047a8681fc836d38fbf9305dec96725e198d51f4
TLSH
T14881A43625524DF9D7A1077A95D01A26F432C6E9FB275FCF2140A0372931723B26B719
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ef2f19c3c38af4a2076e48f610ec6d64ddadbeb915d8d67b396403f3ca65e936
MD5 bacd718817216532b870505b49b5f012
SHA1 3a2a874dbedbd44223ec6ba4704860f01927647e
SHA512 a34b258c6c8529e1ba447c6102f1518c1bd0d9cbee7de6bf88f48f1d915baf912e14555a4647f42c6c55a5d2c170dbf09fe57065ef1d94ed665d071113c1e3c0
SSDEEP 192:D1sg/Rlmaij6VSrPcSOG8PYiM5eKfJULy060yqCDrcT5cH2nUC5/m40A2N:D1sg/RlmaiGVSrPcSOG8PlM5eKfJULyV
TLSH
T1D802BDF783F4866E991196F0AA18AE2FDF1C0625431C3C158AD4EE27E3E3472E14265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4451462123dbf24f869bb16945a3d07a57cb1cac07a243f7ac5560d6121e760f
MD5 e992aa05ed50a08bad52f478f693aa09
SHA1 ad2d2fc38fd868aa9eedeabb88463d8bc088128a
SHA512 f6bcd5d6180a78e0e22c652ceba9011079638a0ea93b1c38a72d7cd2a813086e87ac8dde7b0a2b7c997c3a3bd35be47e0c08228acf1aa0fb0ff191ff23fc1278
SSDEEP 192:sxZGcbDRXc1yMqZjK1Ml8UQnqkn+/fHRsnRVhrZdIaRuval0zodp3GmG/GlHW6+1:sxZLXCoq5+/fxsbpzIKYG3Hbf/hiLt
TLSH
T19982D747A538497B8DDBD229F644BB67D3F90667D6944E80AAFCCB0C00D7AEC2106C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 caffc150ba0ad0132e0c64d19d14fd5e78fbae316dd7a87a8ea4bdee93686b64
MD5 a73c88702fb74ea58a7d0ae98b04484b
SHA1 b1ae640536245ce409c57eef22706056ff1a091e
SHA512 b1da37b72f17443205175c6d8d59bc2c5a69023af01f03f9a7661cd8b306df5fd933d4db2ae1e6dc9295637810f7c596e7ae60eba27191741951f45aeb2e97d3
SSDEEP 192:sxZGcbDRXc1yMqZjK1Ml8Mkn+/fHRssJVCaZdIaRuvaG0zodp3GmG/GlHW6+WN52:sxZLXCoM+/fxssDCazIKYN3Hbf/bijp
TLSH
T1AE72D606AA3859778DD7D219FA45BB53D3F91163D6944E44AAFCCB0C04E6BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4a5af2e8cd80c6d6d6b2a166236117d87b9340370175ad8dcb67117432342e86
MD5 944e3e14322f6e7f74f741c6a4c48d62
SHA1 e8e6514fa77aa4fc65846673d7e2bade326392fe
SHA512 655655390b55c622f4b4b7baf82202bb4717280fa99fa4ac4411f78e38021676fdb96c287143f4ac19e369361e54176948a588e1288b6c93657e3d0f726abf9e
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0ysy10Ll3:eY8Od/HEnFhWvFvmXu1jast10Lm2NuFW
TLSH
T1DBF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ae4587b4edcffb28a61687db9bd1b683b257e1694492eb2754327adbf17ddab0
MD5 e16ad9f086bae7691ce044a03e5c5e01
SHA1 2c6aaaafbe2f9bc6d456e8382789be295e891cdc
SHA512 b04f9139d6747c2fbb2d54599215fafa8068244885ba6f04c84941b133c0baf6c3452644ea41ea65ecc0de925ca7e03c25813e0501510ad37de285e8f0b1d5b7
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM64I:0LppY93PBZJPtN53t7I
TLSH
T19CB27C5A703F0212397E2948B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7050dd2598c0a116ebc9c5cc2f4cc0d8c75732dc15aff685f9eaef367e81b27b
MD5 8013359c379f3f167c1d4f7c2ceb7e59
SHA1 19bb9462dc6e47fd836ba8954ddf10ec2c9ec655
SHA512 4b5571018dac59a11e64c5dc8ab2f24f35e201daf3dac45cc1d94a87ffe1fb6047f94f2913e30add121678870c4cf558949f2d7244b039c9a50a8f0a71a05959
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9lqKphiftGP/scSpse4KV8p0+Hrty/7j:p7Fccps3owgbkUskoGP/scTI8p0oK
TLSH
T168B24B36EC68DDBBEDE34F99B74E3A03DEE05167859C59E4CAD81E0D00971AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5eb9b9e4912e751639548be3f7e85cbfaa45757b37aba12e69598b643fcbf611
MD5 a7f9810ded4f9414d9807c7f55fb3d11
SHA1 2d89b005403e1191d441b68e6fe1885e9d939be3
SHA512 61b809c758434fb63743749e322b64f83e3024fedf46a6af7a9a20bcbf4c7aec5e7efe589f178d4e78db5ac447b543a6e6ff07e056ae3e86ab042f3703ebde85
SSDEEP 768:pnF1jZb73JwgSk+AoGP/sx3gBULwX0m+U:Df36KdSLwXZ+U
TLSH
T1E0D24A32D864DAABFDE34FD9A35A7643EFE01257858C2AD4EAD81E0D00C719D1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c62df308a0d892ba51f6f742bfa400f43fd9fe3da41787baa1d09e929c2fd541
MD5 82b3a565503f979d48e6b1cf52beedb8
SHA1 bac9d11764ceefed872173689fe86292dd016e71
SHA512 81923aa27c46470102b6d2f38aec01147586e8494ed2d0a7580af7b02307e5534355c4730c63dc2a60b5bb120d7123eb5a4e03f0653434cde24d3aa005e13a84
SSDEEP 384:ngiF1tNnNnb9rsNE8TUNTUlI41QckCr43ephiftGP/sxXLrjpWBULP4Tr1YHm/oI:7F1jZbFJwgSkDAoGP/sx3gBULwX0m+U
TLSH
T16AD24A32D864DAABFDE34FD9A35A7643EFE4125785882AD4EAD81E0D00C719D1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6624d1b9eb85f3103906157d53730c6a7f43517313bd35c1d0548cb4f1d755b2
MD5 a47c4d1b6965c4b6e6c8ce2c397e92a1
SHA1 a4a59992d45fd8e5d62aeb6834a8311eee074413
SHA512 661f3641f4f7c27fdb4a23c82668b11179d43705a0066f2d1b1ad0c84b45e595de7ebebe740000127c8db4b16243e9fef26f40be2d6f84bf5200a76438b534cd
SSDEEP 768:DF1jZbCJwgSk8++eIoqAoGP/sxGgBULwX0m+U:Vm6E+SLwXZ+U
TLSH
T1CFE292F294E79976E9AE4B87A33D2D029EFCD157B4881990B7D80E0DCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9b668ce98c7245de49adaae8db73615da95f8112df00fa69e85ac142e5c89028
MD5 4514432f9f309651aa26430feb66ff69
SHA1 743fd57fd340e782b185f8ecce51eca8c529bb22
SHA512 c67156f54ca1c376066300fb3f2d88ff55e8a9a2105d6da4180a295550a2bd9aac37c4b0d06fd1684b86688c5fd798c61f9a7379478e8d97b2d9196cf042e24e
TLSH
T1074133D15C381AD1C4BD0EBEB49B34FC85D8D72AF1A470BE6858EA940A3D54E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 70e4eb77e649e8e90415ac3eeccd25f566f31505596ffe53827b7433d7c26e42
MD5 968ae3c1c76618cef62801f006ff03fc
SHA1 46fa03d914b7074dcb8a9910b7d2e53f61ce3201
SHA512 550713b5763119f15c0d3fc2298072b20f69cfa92a9a52b15a97ec111190f943c34d6f6a5fa682af20f1d1c5f777e30995d9b42720963a6f3225edadc2308617
TLSH
T1DA4142E11C3816D1D4BD0ABEB08B74FC85E8C72AF5A430BE2C58DA944A3DA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1bac674852785d374ac2f88f2db97b895b3de27f1d7f40e4a48e7c8b0136145b
MD5 d2c62ee1b3394fc5b25947b54e11b7dd
SHA1 9101cd5cb55fd4f0de9cfefc710c5c0618246bf6
SHA512 021647d3128741730912f90e51eeb32668c8c04550e8ec557614e874d4b61e8f6548bfdf28844cfd0a0c9ca3b6c1a36025800e471f9c5e44d99f02253c105bc7
TLSH
T19B4121E15C381AD1D4BD0ABEB49B38FC85D8D72AF5A430BE2C58DA94063DA5E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7bd762faaec4d12fb82b6e404f9851a4b8ce84a268dc9708f52ef10c0c39c47
MD5 e1c5340c6cd43d2ceefd983df53143c6
SHA1 9a671084ee6627885ed6e022840b5f53e6942279
SHA512 3c770951cc80a16f943572e08b5621b427d842287da22591499ca253b54118e6c60bc36c83202592229b63025c7cc574722ecd85cbd5b0712b347943cfdcd98f
TLSH
T101415659BAEA1148B3B37F0A9BF3A86D447EBC372E07959D10100E4F0A23B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download