868bdefcf6d67c49909c4447ea59742a2e096ad2085db64ad25cad8d33bccb19

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capital-advisory-meeting-nassau-street-partners.html
Size 5KB
Sample260529-abddbsev5x
SHA256 868bdefcf6d67c49909c4447ea59742a2e096ad2085db64ad25cad8d33bccb19
MD5 c24595c270350647e149f8575b3044f3
SHA1 fa79793093ca0b3c0625d87252cefce17197774c
SHA512 3302ee0121cb0286e6a58f0f25b5a09a97634dcd34762143e032e4831e4f49172440845d887c694b656685e77ecccee09f78887d4714e8b87c127f08ea201150
SSDEEP 96:lqx7+1C9fBwQvC8rhI8PXcmN6JEZP6sX3FTQ3b6:G7rPrhIc6JyCoVU3W
TLSH
T18DB1E693E50015AE0710B960FD2B31DC8652CFA7C964FDC852D811AB34CAFE185B367B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_162653691\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1204_265374095\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_162653691\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1204_426445494\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244865542922810"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{289556E2-CE25-45F4-A15B-28F330BE93C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
796	msedge.exe
796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2252	1204	msedge.exe	86
PID 1204 wrote to memory of 5640	1204	msedge.exe	87
PID 1204 wrote to memory of 3428	1204	msedge.exe	88
PID 1204 wrote to memory of 5640	1204	msedge.exe	87
PID 1204 wrote to memory of 5640	1204	msedge.exe	87
PID 1204 wrote to memory of 2540	1204	msedge.exe	89
PID 1204 wrote to memory of 2540	1204	msedge.exe	89
PID 1204 wrote to memory of 2392	1204	msedge.exe	91
PID 1204 wrote to memory of 1648	1204	msedge.exe	92
PID 1204 wrote to memory of 2392	1204	msedge.exe	91
PID 1204 wrote to memory of 2392	1204	msedge.exe	91
PID 1204 wrote to memory of 1648	1204	msedge.exe	92
PID 1204 wrote to memory of 1648	1204	msedge.exe	92
PID 1204 wrote to memory of 2056	1204	msedge.exe	97
PID 1204 wrote to memory of 2056	1204	msedge.exe	97
PID 1204 wrote to memory of 2056	1204	msedge.exe	97
PID 1204 wrote to memory of 4700	1204	msedge.exe	98
PID 1204 wrote to memory of 4700	1204	msedge.exe	98
PID 1204 wrote to memory of 4700	1204	msedge.exe	98
PID 1204 wrote to memory of 4980	1204	msedge.exe	108
PID 1204 wrote to memory of 4980	1204	msedge.exe	108
PID 1204 wrote to memory of 5888	1204	msedge.exe	109
PID 1204 wrote to memory of 5888	1204	msedge.exe	109
PID 1204 wrote to memory of 2716	1204	msedge.exe	111
PID 1204 wrote to memory of 3456	1204	msedge.exe	113
PID 1204 wrote to memory of 2752	1204	msedge.exe	114
PID 1204 wrote to memory of 4836	1204	msedge.exe	115
PID 1204 wrote to memory of 5724	1204	msedge.exe	118
PID 1204 wrote to memory of 5724	1204	msedge.exe	118
PID 1204 wrote to memory of 1748	1204	msedge.exe	120
PID 1204 wrote to memory of 1748	1204	msedge.exe	120
PID 1204 wrote to memory of 5480	1204	msedge.exe	126
PID 1204 wrote to memory of 5480	1204	msedge.exe	126
PID 1204 wrote to memory of 2188	1204	msedge.exe	129
PID 1204 wrote to memory of 2188	1204	msedge.exe	129
PID 1204 wrote to memory of 900	1204	msedge.exe	131
PID 1204 wrote to memory of 900	1204	msedge.exe	131
PID 1204 wrote to memory of 796	1204	msedge.exe	132
PID 1204 wrote to memory of 6068	1204	msedge.exe	136
PID 1204 wrote to memory of 6068	1204	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\capital-advisory-meeting-nassau-street-partners.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcc6c1c188,0x7ffcc6c1c194,0x7ffcc6c1c1a0
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,13296128943710171650,17544451583623332514,262144 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13286098726657172436,17039212750757713245,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,9909268884690254827,7795832161646645151,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13852694318718215997,15863435168317416480,2097152 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,13943465937698671533,1075832824335651440,2097152 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5144,i,5911778825856247172,5736244908913565880,2097152 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5292,i,15580350666261756793,14558643458570853395,2097152 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,5762608037491006094,13271795321497071161,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,14529743649178959044,16456071532397443332,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,7972459297006406424,16066041707469289530,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,7972459297006406424,16066041707469289530,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12553311211902249661,11883595650462409369,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15610509644941061844,15424465547113847093,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2950062226257448155,4510469323703239468,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15524115313144954468,8266439342393559613,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7626396127932256864,908245220345777634,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,14405041599729674439,5939957503831087090,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11813360372572631119,5765180467325110100,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,5168706421747186022,5658679718476662825,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6916,i,12266049489100431909,9185271400151491550,262144 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11139276926443965485,13573456692439515082,524288 --field-trial-handle=2944,i,7553517554121213223,12474579507970144003,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_1231367873\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_1231367873\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_162653691\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1204_297435651\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ada8333254b2270709a4d15b535e3b2400d4b4e8b071671ac046b333fa113ac3
MD5 50b8c3c69df2fb898786f9d503a39c57
SHA1 7a7095f7281b375bb046c387fc8ea706514974f2
SHA512 7caabfd7dd60be84470253d5da2e2b35263d3da34ad162105aad7d615cd4c4266fdddf2bce775dd832d3ed0cc76a80c5fe09bc9f642cc6a063bd6567771a4fe6
TLSH
T1F4F0F4BAD921EC2718FD0B6870594B8AE750132B2780989F3B3C920C8FB473B858991C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a62f0aad482bd9880f1c2797b8b717df6ee43ea85551677ad764a5051f1ace5d
MD5 91f70a20b65d72abf89e813f5374eacf
SHA1 c4d7f7f40852e6679dd6afc263320bd04ea89c46
SHA512 2696b1e30ff0c89a71966cf96b395c531e0f93f9ec3eb5ee277f276c926ef277ccff0101346559799c9d833f3ae5f24a02b5c9b599be858d0ce0deaf74a7e1db
TLSH
T14B512DF999B91261EBED02FC9BD03B34B37057D8F8D71D854E8867756830B358D21A02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 26eae6bd33878a5bafada593ad64c946ce94931176c909bc2b1600c680072775
MD5 3ce514db3f31f9dc6e7a735daf5cf53c
SHA1 eda33c1ab9efbb1586b90d2fc7e6d90fef65086e
SHA512 0e0b9ac1218ef640c0c4c4af8a77150c1c34c6692cb73fe52d7900a5c606a4552774bac74e160e835f1f68d08613c26227bdbeeef80c67bbcf10f2f3d2519703
TLSH
T1E3513BF954B91261EBED02FC9BD03B34B3B107D8F8D71D858E846B756830B354D21A02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c9f7666ab8a52af2842966e57787ad91f44c7ddac547fe1602e1898e8f66d0c7
MD5 367d62a842cfe1ef640bf3220fa27386
SHA1 a12952720bb10145141e43e58e80d0940fb8fc8d
SHA512 c9da5196a31ce7ed8fc791f25dd155d143cdf9452fb66c8712d61271fa366c2bb48f800f2f2852bb8b1ad2d0fe5be5ea3a5613d079f9131fb492f764d777adc2
TLSH
T18B71C1F7C3E8866DC90156F0AA25BE2BCE2D0515432C3C5A8DF4AF0BA3E2471D14269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b3bac6d60e0f0e0e902a8518bab25ee9b4d160c4ca192330e1630c3819bbb2df
MD5 8a770c0e7ccf62692974e287ba4a83c1
SHA1 4ad9de7ac54a1ee03cd8689361f704b0f809aaea
SHA512 15a3e69f3f02538f09e3c0b5b1e04bfba6b820f33f2ec5a762565446bb5dd68392929c906546fcbe4f8a5782fd169cb391c035d797cf6d2fafd1349cd659956c
SSDEEP 192:sxZjRc7yMqZjK1Ml8UQokk/f+sqIzLZdIaRuvazodpH0HW6+WNG6dmIvybtWYIgI:sxZjaSqLk/f+sXLzIKYhUHbG7z/A
TLSH
T1F172E906AA34497B8DD7D219FA45BB53D7F81162A2944E44A9FCCF0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3f48dc42d68cc4a63363228a7b48be38db5e46b6ccb75204410a6320fb64fe8c
MD5 15d225bf8c285c07c1e3701fba5635a3
SHA1 79c7c939afe0d141444aedc42412399b3d9350ee
SHA512 401be4b19fb6fe23fb7df4476c36e8457420681166570aa00919fea503ca7effce8b56c5fb91ab6a23158cb9853c59952bc0c6b0c67014e8d3bd2041c337d7a1
SSDEEP 192:sxZjRc7yMqZjK1Ml8Mkk/f+sqIzLZdIaRuvazodpH0HW6+WNG6dmIvybtWYIg529:sxZjaSMk/f+sXLzIKYhUHbG7z/A
TLSH
T13A72E906AA34497B8DD7D219FA45BB53D7F91163A2944E449AFCCB0C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 99a2a182315975cb279e422d8595b2c9390da8e83b0cf976f7b8a7a4852db3de
MD5 d23920fa0a40a37b2ed81786cefbfb55
SHA1 9204d71e62cf101e58294f51ff506d882b51bbea
SHA512 b115436b72b6aae05d4fd505117a42b2059f6d1053e4f11969f3332784aa4938b25e323c2e9ccf2ee3fe18a8a73c3eed8d8f07f98f240012ada4b6bfb9556d6c
SSDEEP 192:sxZTRc7yMqZjK1Ml8Mkk/f+ss/z8aZdIaRuvazodpH0HW6+WNG6nvIC+tWYIgj1J:sxZTaaMk/f+ssr8azIKYhUHbG5zjf
TLSH
T17062E8066A34597B8DD7D219FA45BF53D7F91163A2905E44AAFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 37023eb59b1e896dbd686cfba677c5c0fdb52af76e7dbe1e76f28b0845c82305
MD5 7f42e9309fe118f482a94e4df8d3aee9
SHA1 f3e85113423e9ed67b91300a7d7ecae7f79850f7
SHA512 da13ebfac0c9d2381e48faefa490016ee01486ac73789d97041e029a6721537f0afcb75589aa8bf7d1bdb598f346857ddad22fb0a07ee994b77c4ab0c554bc85
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGB:05ppxnY753RNBvRJJdt7p5J9fvXR
TLSH
T106B2685A713E0212397E2948B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d2d61a-d1ab-4329-a8e5-df5e3632e4c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2d2d61a-d1ab-4329-a8e5-df5e3632e4c4.tmp
Size 35KB
SHA256 aea7f395831bae51b3c7357aa921ec8d6818ec891a445026616b6b86a2edaeda
MD5 61b94009793505503736c0c4d035c89a
SHA1 8fc97839356f66425f9d90da46f511b53672163c
SHA512 58629f281e1cd179c00c6b39251675a4b2879a0d52b6723fc4db56d4fd032e04779dc6c93a572dfc870866351ff02d9529cc2c76e6a972b1cb103399c2d534c8
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ysy10LlM:eY8Od/HEnFhWvFvmXu1jait10Lm2Nujv
TLSH
T1BFF2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1f3686d18a50d6ab9e9726594b2c6f68fa546eb612c2d6793eca06ba64fce637
MD5 5f34c5ba0037a478096614645c4d10f6
SHA1 a17dcfab92af3b85ecc7c6e18e7d5f215bdf7147
SHA512 0f0a157c19380e8e3583b8b67c59d4ff99b04a02ffef12b5908745a3a72372aba6307ec38a105e75e1f13dec8faa14c74dbb5c51fe7f00fba53220a55607970a
SSDEEP 384:yBiF1tNnNnb9iF3sNf8TUNTUlI4gQckCrkwzphifGGb/4w9VokEL5tLkpplVo9dj:tF1jZbk3OwgrkA9FGb/X2kgOlsYkPfh
TLSH
T1E1D23A36E868DAB7EEE74F89B70A7A43EFE4025795C819D4DAD81E4D00D719D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d82f7cea2ce5065fc33af493d878dc767272af1294bb72dabdd15eb0ac72635f
MD5 6a87c06f084819d2173f28fef7f583b0
SHA1 217a1bf02e6861a0769a3c1801c1f2830e2b7083
SHA512 14b724d378c74e489dc24867cfeef3bb3da6a116074691f2d054e03615b1ea14971d964db1262a545fa6ed78253aae8bc3dd2bae0348839e85540636915bffac
SSDEEP 384:np3iF9CcmyWCs3sNf8TUNTUlI4lQckCrrNzphifGGb/4w9VokEL5rkpplxsb8htf:pyFccps3OwgykK9FGb/X2kUOlqQ/
TLSH
T158B23A36E858CEB7EDEB4F89FB4A3653DEE4126785CC59D4DAD80E0D009719D034B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0aa74e4294f2d83fb8908fa0900cc9e6150e2b1cace53fa9b83dd879ed9444e6
MD5 aa17bb2be56137f8dd947e9dbda7e234
SHA1 44c355570c73f54babd8bdbf2e8fb68a835c98f9
SHA512 4eb995049e846a661cfa0bd8dd22452171c245683d0631949315d2a7eb95088cdfa7298d1bf5d146a64dc061f3613ecc2d91f9ac427168b988875e08c5aa8444
SSDEEP 384:nxiF1tNnNnb9W3sNf8TUNTUlI4gQckCrkNzphifGGb/4w9VokEL5rkpplVo9dYkR:YF1jZbk3Owgrkd9FGb/X2kUOlsYkPfh
TLSH
T13ED24B36E828DAB7EEE78F89A70A7A43EFF4025795C819D4D9D81E4D00971DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 006cd2a28ae5bae4a49546b6d5b9f70e6495ee393014ed3bce927b530ff434e7
MD5 a0ed632d50c9632f2d3a711fe10385e7
SHA1 90d5749e4567d521d82b0764cca68be749ac682e
SHA512 a9f8323010215e0e7ec752cefd56645bf7b5f740954bbff98201cab98f88f8708fffb0cfebf9116ea60684f96b4cf4ecb01a60f50b17915199d2e9446ffbfd48
SSDEEP 384:yxiF1tNnNnb9W3sNf8TUNTUlI4gQckCrkwzphifGGb/4w9VokEL5rkpplVo9dYkR:VF1jZbk3OwgrkA9FGb/X2kUOlsYkPfh
TLSH
T1A0D24B36E828DAB7EEE78F89A70A7A43EFE4025795C819D4D9D81E4D00971DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5a4a93c4467c14c50afc940f49c7a7f2df2f15530373cf2e077652d748907695
MD5 4506235f9fa5807c278d289030afcbba
SHA1 fcab232eb42f82849fbf3a9224f778e29b91e438
SHA512 28fbd7f04345681bc7754993fca3633e81726d6f9db09d01b4943b542f804fe86c5bf33b1668bfc7787474bafe6b13d9f04c376fdecb322dd98c468d2ae31b2f
SSDEEP 384:np3iF1tNnNnb9W3sNf8TUNTUlI4gQckCrrNzphifGGb/4w9VokEL5rkpplVo9dYC:pyF1jZbk3OwgrkK9FGb/X2kUOlsYkPfh
TLSH
T129D24B36E828DAB7EEE78F89A70A7643EFF4025795C819D4D9D81E4D00971DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f213eb2b1026ff0254bdbc5a464cf86ee66976ef6e3b9a0c238766821c10acff
MD5 b59c8f5411c200afdd7877ebd439bddf
SHA1 9b2fa8afb869938c054682507da6807bc52ba04e
SHA512 acc901aa9c9f9589bb4af7a3cf7d786a6d6e4afd4fe24a1132430aa76e873720cff06e3911fe41656721c68bad921f50a11f421e881e5e84045d2ea4e916b660
TLSH
T1CB4142E15C781AD1D4BD0ABEA08738FC84DCC72AF5A430BE2858DAC50779A5E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1bac674852785d374ac2f88f2db97b895b3de27f1d7f40e4a48e7c8b0136145b
MD5 d2c62ee1b3394fc5b25947b54e11b7dd
SHA1 9101cd5cb55fd4f0de9cfefc710c5c0618246bf6
SHA512 021647d3128741730912f90e51eeb32668c8c04550e8ec557614e874d4b61e8f6548bfdf28844cfd0a0c9ca3b6c1a36025800e471f9c5e44d99f02253c105bc7
TLSH
T19B4121E15C381AD1D4BD0ABEB49B38FC85D8D72AF5A430BE2C58DA94063DA5E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9b668ce98c7245de49adaae8db73615da95f8112df00fa69e85ac142e5c89028
MD5 4514432f9f309651aa26430feb66ff69
SHA1 743fd57fd340e782b185f8ecce51eca8c529bb22
SHA512 c67156f54ca1c376066300fb3f2d88ff55e8a9a2105d6da4180a295550a2bd9aac37c4b0d06fd1684b86688c5fd798c61f9a7379478e8d97b2d9196cf042e24e
TLSH
T1074133D15C381AD1C4BD0EBEB49B34FC85D8D72AF1A470BE6858EA940A3D54E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

e375cb59-68a9-4654-a37f-e32fdc2b392f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e375cb59-68a9-4654-a37f-e32fdc2b392f.tmp
Size 25KB
SHA256 6d78410bb4dad3a788bab97387499b7d971a7e03d82f87e6969931fcd4cda222
MD5 7f688cba3d27d265e081caa4b5491dd5
SHA1 5b8e66468d6f6d1e03f73fca4e73681b5905dfdd
SHA512 39f316cfe4e3064f01015539216e9fb91884c0baabb66d262662783793fdb9a9a1e014735538ae7c85b3582818c868e85fa77f7262a1213c2278538d8b251f3b
SSDEEP 384:npdiF9CcmyWCs3sNC8TUNTUlIm2QckCr9l3KphifGGb/4w9VobTpdEe4KV8p0TH1:pUFccps3PwgbkU9kFGb/X2boI8p0j1
TLSH
T187B26D36EC58CEBBEDE74F89B70A7A07DEE01227859C59D4DAD85E0D009719C170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c451cb9f93a1716b317da247ae17f540390162c25ac3d357c17f6a6d16e2eee2
MD5 1ece3add5013104c4e0aa9b40b713d77
SHA1 1f05cd94cb49440e0b648464d952236192cacca8
SHA512 42d7a57ab4b075702e932009852c03f8b92d56a58a3f17823010c09b8bf5aaaae7283586b3392028e12cd5d42b2ebc091d14836e72125c7e9eaf23620aa7b760
TLSH
T121412C58AAEA1148B3B76E5A9BF3B56D447B79772F06D45E10010E4F0A72A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2716-451-0x000001B068540000-0x000001B069540000-memory.dmp

Download