7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Size 13.8MB
Sample260529-d27lmscs6v
SHA256 7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2
MD5 35fc02cbef9209f6811b9094491c214d
SHA1 781738df39f8f05aa4034b960f75b2bfbc196aad
SHA512 91cc79195c3f46c96666c8d8ef43840054906c51100c3b490f2c949b2fed35e02b97c16c2a9ea2e73083c5db4a734abb4b948d122f1b6dbbcab409ea2ff2fef1
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/QgEZ:Hxj3mE7P3pSpJuQnPte
TLSH
T161E6331177DA8435E1620571D66AD36B69BAFD321B32C4CBB3D90A5D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	2580	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_401898033\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1991405069\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4540_1749312624\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_656793646\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_656793646\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1991405069\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_656793646\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_418732584\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2580	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244990974909987"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{52A8A4A7-B852-404F-AB27-8D284EAC5068}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
Token: SeRestorePrivilege	1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4540	1988	7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe	80
PID 4540 wrote to memory of 3372	4540	msedge.exe	81
PID 4540 wrote to memory of 2580	4540	msedge.exe	82
PID 4540 wrote to memory of 3844	4540	msedge.exe	83
PID 4540 wrote to memory of 3844	4540	msedge.exe	83
PID 4540 wrote to memory of 3844	4540	msedge.exe	83
PID 4540 wrote to memory of 3256	4540	msedge.exe	84
PID 4540 wrote to memory of 3256	4540	msedge.exe	84
PID 4540 wrote to memory of 4260	4540	msedge.exe	86
PID 4540 wrote to memory of 4260	4540	msedge.exe	86
PID 4540 wrote to memory of 4260	4540	msedge.exe	86
PID 4540 wrote to memory of 2920	4540	msedge.exe	87
PID 4540 wrote to memory of 2920	4540	msedge.exe	87
PID 4540 wrote to memory of 2920	4540	msedge.exe	87
PID 4540 wrote to memory of 5876	4540	msedge.exe	89
PID 4540 wrote to memory of 5876	4540	msedge.exe	89
PID 4540 wrote to memory of 4812	4540	msedge.exe	90
PID 4540 wrote to memory of 4812	4540	msedge.exe	90
PID 4540 wrote to memory of 5800	4540	msedge.exe	91
PID 4540 wrote to memory of 3984	4540	msedge.exe	92
PID 4540 wrote to memory of 5800	4540	msedge.exe	91
PID 4540 wrote to memory of 3984	4540	msedge.exe	92
PID 4540 wrote to memory of 3984	4540	msedge.exe	92
PID 4540 wrote to memory of 5868	4540	msedge.exe	93
PID 4540 wrote to memory of 5452	4540	msedge.exe	95
PID 5868 wrote to memory of 1900	5868	msedge.exe	96
PID 4540 wrote to memory of 4856	4540	msedge.exe	99
PID 4540 wrote to memory of 1460	4540	msedge.exe	100
PID 4540 wrote to memory of 5892	4540	msedge.exe	101
PID 4540 wrote to memory of 540	4540	msedge.exe	102
PID 4540 wrote to memory of 540	4540	msedge.exe	102
PID 4540 wrote to memory of 1892	4540	msedge.exe	103
PID 4540 wrote to memory of 1892	4540	msedge.exe	103
PID 4540 wrote to memory of 1900	4540	msedge.exe	104
PID 4540 wrote to memory of 1900	4540	msedge.exe	104
PID 4540 wrote to memory of 4884	4540	msedge.exe	107
PID 4540 wrote to memory of 4884	4540	msedge.exe	107
PID 4540 wrote to memory of 4184	4540	msedge.exe	108
PID 4540 wrote to memory of 4184	4540	msedge.exe	108
PID 4540 wrote to memory of 4676	4540	msedge.exe	109
PID 4540 wrote to memory of 4564	4540	msedge.exe	110
PID 4540 wrote to memory of 4564	4540	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe
"C:\Users\Admin\AppData\Local\Temp\7748d9dd6023b9e7a2ec65c85b775e3e59dce75bc7dcd73ce55e653f6f7827f2.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffe6045c188,0x7ffe6045c194,0x7ffe6045c1a0
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14258583444571314653,13001887699548849997,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,15686289154920091528,14229320365862600680,262144 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,5648275462256359549,13625786729632777589,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,894230433770336050,10176213479007045948,2097152 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,3984596767220905447,7065177765287347610,2097152 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,17943440098284523687,11092290517520030536,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,102586034133399922,16652463955858377096,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,3663080946041044135,15418720287471627204,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5640,i,11125942968389650521,1316241868030806183,2097152 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,7015668467914072111,8268084955130769670,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15913749465268230439,14905556820038366221,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15913749465268230439,14905556820038366221,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,18375191178705284580,4234285536998677871,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,11946165095157288766,3965704557661935467,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17734751645658470718,6502831621600488574,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8996500954284786085,8381772841798275561,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,12214964779401555098,15040796111140790803,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12140323511886419595,17520697133863397234,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,4396697238791664217,9719871287308878189,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,16559635947939094724,4294221782614071191,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,16173840323782242295,8620972244545642867,262144 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,3431457650298425813,10450674619499030954,524288 --field-trial-handle=2076,i,4742481940674196002,13260404853623855010,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 64687b9b30025126fbef6f308cf777d34305e8be2f20cbac1b72a0c2807b4f05
MD5 2853e0948b2a5da71f7cf976909eafc4
SHA1 69d545962cd62d574e3b41d93c2ea640ab6c9554
SHA512 b7565c7d6d5d26de350dd78440751850829656189b3971a3455119757c9182435fcad40baeac3e104bd1ef95af00efe1dbaa2e22a18574ef9fc5647b96df1ab1
TLSH
T1B2F028B6C921AC3B08FD4B2934951B06E751133B2B80985F3B3D920D8FB463F499A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e0b0438b0f31c0873e1bd6f7041bba4159608aa091792f71d553c7cb8c2944a5
MD5 d039630f13535c007feefe9b5a190403
SHA1 ab563c90a7ab2f5e677625cad7301a83e36870f8
SHA512 45fd5d0fd9fd26cea38deea456ab92df6fb39057d1d667dbcc29b4f87c0afabb615978c00dc00f0dc1361fac6615fd0c18b9b3055968a7429b573ec700a5920d
TLSH
T12541B3F7C2E8856E890196F0B7147E1FCE2D0514432C3D5AC5E4AF5B93E3471D18195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e9abac3fdc92135b70d98a5815547f933a54d3cf2438b8bcc3d0e76fd54f9a4c
MD5 64d36cea7a1fa396da60177e55ba53f3
SHA1 f1aa372c208e77ce22b54d4624966758699b9c44
SHA512 894f0b1f2cc740d23b71c56ceb8f311cca5b8601714abea742d5d60caa8ea385891fa256a6f4d8e69799e977e49a2414d1a4edec201d3adb1d5dc67e9442badb
SSDEEP 384:sxZFpLOtp/fosm+MV7orU0QW/bG5HPjJH:s/LKp/fC+Mgr/bG5Hl
TLSH
T1B262E8166A3499378CDBD219FA457F93D7F9556392900E44AAFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 77260e42d1e629f155172c46a1a8559cbaf3cec954d4671d294b5bb5737a1bb8
MD5 fb19e8498877573b5768480d5029e96a
SHA1 1c4f60b7876c1bde30692d3a4991d716b7208a12
SHA512 39f004c9f8e10508f58d67ca29f22d2fbb8acaebb191bac8cd7fe903eec9e997a048d1ed0d5cb9bf784bb850d8d88e744a4e0774998924144edf87f9498221a0
SSDEEP 384:sxZFpLOqkp/fos0+0V7orU0QW/bG5TP8HU:s/Lxkp/fY+0gr/bG5T3
TLSH
T10072F916AA345977CCDBD219FA457F93D7F9156391900E44AAFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 fb0a28a3e446db2176b670c9046b995ad0d69096767d51cce1834a4a0dbc8360
MD5 b260655a6a9a3aa891fe451bd28993ad
SHA1 01a81f22e5fb8d4e57a431c64dd4062e0a5688b8
SHA512 1bb2b8fdfb82283d67271adc6fed0b4297f2ba25f2b29578ea174af923f11af7aeb6aa568bb517da600075cdd67ddefe8d5b7349da8d4dabe12bb144abaee3d1
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fGq9LlO:XwZh38Dv2SkEnZFWRm6GQFmu1jaKfGqu
TLSH
T126030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 8e35c24446af155327e90ded8666d38df411dfe735e5cb3c47bcd4aa9e97690f
MD5 599677a45056e28f917c85ecb6cf0a1a
SHA1 2e9f2d3fcc5c2a2da9100dd1c5d8a72330582ac9
SHA512 8e8fa74c0f3d01ad804578a40666f3e432ff06c8c815703961368fb7e96badb0f6cff5b228b4213e311bc1903790ce36a1f63494614cb371d65d8992f2866f46
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlH3BbhXI:ctGj+BCNC5qFVpKxHxbhI
TLSH
T180C2761632FA02023C3D791D87A597371A42B1A33028E93B7BE914B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 30e8ad7ad6b47898343348f944c943f31a3b5311d72530784ac90d55a8290b6a
MD5 041fd424641cbe594ac99d8bd60aeedf
SHA1 9fc18d1d02e475163a71a7cdc831bd77ee50bd57
SHA512 4ed4b1024898a9bc3d2daf1388cbcbc40f4b5ab8af91eadb97b4ee069334642b7de5c8c04adbfd524396add896af4729921eaec3b272de8f7c876e9a29874275
SSDEEP 384:ybiF1tNnNnb9VV8NA8TUNTUlIRNrk64IG1zCfbLoNuIn/9gXzp+VOHbgltjty/7L:PF1jZbNjwgEwsOotn/9QN+VO7gv9i
TLSH
T167D25C36DC69DABBEDE74F89A70A76439FE40163C98C5AC4EAD85E0D00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b2bd0e974dd102ba6e6064668e673579d3d3c2c0dbad3243ade6886efa0507f6
MD5 979de20a137fcb4d30e3b36213d591e6
SHA1 fa244c0b30b39d79e79c2b41e26eb09d37a32f17
SHA512 b07ab51d98f2683585e590cc3f0ee95c14ec8b36a312a9e7769181ff1c8113160744e097525a92eba80381199f577504e8048bcc1202a55be4cf2079b78037cd
SSDEEP 384:nIiF9CcmyWCs38Nf8TUNTUlIxBrk6oFcF1zCfbLoNuIn/9XSfwT6ty/7IgA:TFccps3Uwg4BczOotn/9XSfUC
TLSH
T159B23A36EC98CABBEDE64F99E74EB603DEE0127385885AD4DAD81D0C009719D130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d6a55d7fd0bec6069c0a616f094b6e26dd167ad8c3c0e3659e959dfc4d52da10
MD5 78e9fc3b412995f1ba52e267c1c87a6b
SHA1 2d9399fcd0d685205d01e56a61eab5bc9df1e669
SHA512 f7997c17728d299069ce2c7f19f650eb2513242b0878597e87eaa3e405051a7983c51f5b13b98544d5965b80460f039859f7f18e3a5f854541e392bb45bab317
SSDEEP 384:ntiF1tNnNnb9G8NA8TUNTUlIRNrk64IG1zCfbLoNuIn/9gXzQOVOHbgltjty/7Is:kF1jZbIjwgEwsOotn/9Q8OVO7gv9i
TLSH
T1FDD25C36DC69DABBEDE74F89A70A7643DFE40163C98C5AC4DAD85E0D009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 31bb7dc531e1f66186d5d220f20cebbd0ce0ad34b1dace09b64e4f02dcb54aba
MD5 7dd61d60385261c4620d9a6e696a8b11
SHA1 2a5e236e29a500333a48b9f453303525095b01f5
SHA512 a24022eb8b15b9937e838248b6541e73c6830607e38759f9de2bc47fe9e4b0cbcbf3956cc44285b89b52174e3a98401b6e6696ea2e674450a9e81d471a1385d6
SSDEEP 384:ntiF9CcmyWCB38NA8TUNTUlIRirk6xIG1zCfbLoNuIn/9gXzQOVTmty/7IgM:kFccpB3jwgTnsOotn/9Q8OVy
TLSH
T15FC23A36EC99CABBEDE74F89E74A7603DEE0116385C85AD4DAD91E0D009719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 892cf866fedc9d3abb996af99d2b6fa298d1862e0e60f80c3916e550c392ea65
MD5 68b74509cb12163ae46c71f796863a82
SHA1 967285021faae59bc445777ca9c3b1347cb66afb
SHA512 28ea484a91033a2a33a16995d982cd7822f2ebd6c007733b69eb6010221d28ef7ad08e926a91c85a8bf1d8e33390dbd09a0007642940f1615f38a3434686a477
SSDEEP 384:yNiF1tNnNnb9G8NA8TUNTUlIRNrk64IG1zCfbLoNuIn/9gXzQOVOHbgltjty/7Is:1F1jZbIjwgEwsOotn/9Q8OVO7gv9i
TLSH
T19CD25C36DC69DABBEDE74F89A70A7643DFE40163C98C5AC4DAD85E0D009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa7a5234ca0e70fe211ca51375cf5138c59bcca69115570c72225818f27be702
MD5 eaaf566686c8deb99eb1beca445c4529
SHA1 86b7cfeb4e5b1e7541ddfcc51a44728a8a6aff41
SHA512 6049ccadebcdd3db81b87a7cd2919d44ffb286d857975d90596cbdd1216f96861ca60d918cb0c0725aee6cfa61f44fc34f199c77d80ec981a7e208848482c7e4
TLSH
T1FB516FE04C7C1AC0D4BE0E6F608B34FC82E8D725F1A4347D2868EA850A7962C748483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 64ea69de82be14ec9315a6d0933d86b856b51477608975b800d31372b7cdc9b5
MD5 729c07f0773fd4dd0bf7139fc3043fb9
SHA1 63d9a22b27da0f08bc3f0d3704af5568dae5caab
SHA512 c8781375da6d5e794fb9c69c62fc212e18404a84690875f6ad36c3fde3ce39e84b9197132bef882133b555f28ad834849a94478bcd2442179b874b9cb858453f
TLSH
T1D15130E04C7D5AC0D4BE0A7E608B34FC81D8D726F5A434BD2858EA950A7962C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 920b52928b070bdcec430483a5721f964bf5eba66bb8be252028c5c82f4b4ab8
MD5 2302b2eb487f5d56ee178e06d3ad0f0b
SHA1 2336df503bb911a53d7ddb1086b6812ce30e52e8
SHA512 37657dd6a895fe06b21ae558e85c70d1f135ee568eee9019f962e82a018d59a80f83aabc119e3b93f102079041ad1b78618e9b0661f57642d7572806ee1d28eb
TLSH
T15D5130E14C791AC0D4BD0A7F609B38FC85E8D725F5A434BD2858EAC90A79A2D68C443F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1991405069\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_401898033\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_401898033\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_656793646\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1988-0-0x0000000003D80000-0x0000000003D81000-memory.dmp

Download

memory/5452-171-0x000002588B790000-0x000002588C790000-memory.dmp

Download