f53277d9920e18eb70d49dd3487b833e061bec8307d3b4944609e29046570d15

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EdgewarePlusPlus-20/edgeware/assets/tutorial/intro.html
Size 2KB
Sample260529-e3wffac121
SHA256 f53277d9920e18eb70d49dd3487b833e061bec8307d3b4944609e29046570d15
MD5 2aaf259f44374dc23197da4de80b2204
SHA1 3c0616e9391d17bfff0807621dcf13fb370d48c1
SHA512 a1afc5fecd4fcb865f2e970866f009813188d4ca50638301e0e180bd650da29f126fbb96cbb6e6171811c62ec9907a530a939a6c6aeeb709556a36d90522c06b
TLSH
T15051E91FF3A1124146926201EB1968C6EB20D0BB6799C8603CED915D5BC3E31F43FAEC
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1391233910\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\mk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_188645409\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1391233910\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4240_1494657144\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1818876383\_locales\is\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245025297888391"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{DC107305-3A2B-45D8-92F4-E8188C85178E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 6064	4240	msedge.exe	81
PID 4240 wrote to memory of 808	4240	msedge.exe	82
PID 4240 wrote to memory of 5336	4240	msedge.exe	83
PID 4240 wrote to memory of 5336	4240	msedge.exe	83
PID 4240 wrote to memory of 5336	4240	msedge.exe	83
PID 4240 wrote to memory of 4408	4240	msedge.exe	84
PID 4240 wrote to memory of 4408	4240	msedge.exe	84
PID 4240 wrote to memory of 3976	4240	msedge.exe	85
PID 4240 wrote to memory of 3976	4240	msedge.exe	85
PID 4240 wrote to memory of 3976	4240	msedge.exe	85
PID 4240 wrote to memory of 2496	4240	msedge.exe	86
PID 4240 wrote to memory of 2496	4240	msedge.exe	86
PID 4240 wrote to memory of 2496	4240	msedge.exe	86
PID 4240 wrote to memory of 2240	4240	msedge.exe	90
PID 4240 wrote to memory of 4544	4240	msedge.exe	89
PID 4240 wrote to memory of 2240	4240	msedge.exe	90
PID 4240 wrote to memory of 4544	4240	msedge.exe	89
PID 4240 wrote to memory of 3232	4240	msedge.exe	92
PID 4240 wrote to memory of 3892	4240	msedge.exe	93
PID 3232 wrote to memory of 1640	3232	msedge.exe	94
PID 4240 wrote to memory of 4752	4240	msedge.exe	97
PID 4240 wrote to memory of 580	4240	msedge.exe	98
PID 4240 wrote to memory of 2344	4240	msedge.exe	99
PID 4240 wrote to memory of 4828	4240	msedge.exe	100
PID 4240 wrote to memory of 4828	4240	msedge.exe	100
PID 4240 wrote to memory of 5068	4240	msedge.exe	101
PID 4240 wrote to memory of 5068	4240	msedge.exe	101
PID 4240 wrote to memory of 6124	4240	msedge.exe	102
PID 4240 wrote to memory of 6124	4240	msedge.exe	102
PID 4240 wrote to memory of 5488	4240	msedge.exe	105
PID 4240 wrote to memory of 5488	4240	msedge.exe	105
PID 4240 wrote to memory of 5628	4240	msedge.exe	106
PID 4240 wrote to memory of 5628	4240	msedge.exe	106
PID 4240 wrote to memory of 5856	4240	msedge.exe	107
PID 4240 wrote to memory of 5052	4240	msedge.exe	108
PID 4240 wrote to memory of 5052	4240	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\assets\tutorial\intro.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x288,0x7ff8c13cc188,0x7ff8c13cc194,0x7ff8c13cc1a0
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13200328049780214826,5450758188782169379,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,16785691431536342846,817062642710683635,262144 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,18113648001860636499,11760810703815746774,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,3950971283130825176,7407850963317553365,2097152 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3336,i,7705719353984260760,2014458907408223325,2097152 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6976173001732420125,16483399880508031379,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,11371397398204227788,5706346316928749632,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1204955671318489425,4885991530409813491,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,18205490425201691789,3543098033316875719,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1204955671318489425,4885991530409813491,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,18439577261407415365,1671047809948437825,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,8199654623754549514,484043633871066736,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6869732006120573569,14612934365759872364,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3114925097028081329,15682471337220297121,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3799432036047978150,2993844942259676690,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,14336814337260180764,1636715095667062470,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6808448402793630371,10837550601404921059,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,8384656265172556919,14553550943253939656,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,6057224924480934329,14546913094126615526,262144 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,16599577746964651895,452690277525720855,524288 --field-trial-handle=2176,i,16296800750555813867,15681487065061301851,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1b3fe61abd8c3767b5b7c6a00ab3e367201b0b0a7f49387573c98ec39ae7db10
MD5 73d90184cdf98dde06e46dfdbd25aff3
SHA1 e54f15ab7a6b15cc983b10316c980639ff37cd70
SHA512 f865ae67c92d7631b1b42e37c160cf6a8f41a8cb3c0257334737af35ff7ba7dcf0204d3072e8dcaab7dbfdb54200cb8ca8c8a5642170dbfcb49150c1957a9e5d
TLSH
T1D7F0F9B6CD21AC3B18FD1B2960645746E75417572B818A5B3B3C920D8FB063F4595C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 674a22c965b387048cb9df6f30e42f2e62195f6f0ebc7839b36687b5945bbba2
MD5 77d0e2c979d164f3d7631f69c86e843e
SHA1 fb5960bd61bb0f88c114a88745e64c6363751f7d
SHA512 b482e45baca79eeb7cb8c9c5600e2687c9ec77c8703e0422afafcc659776b6f954730b8e69e3e18bebd1e8bb31d6dbbdbf55211499ab24d96608831838cf259c
TLSH
T15141B0F3C2E8856DC90196F0A614BE2BCE2D0954432C3D9AC9E4EF1B93E3471D181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4b2f2fee08e1239a5a668ddef82f9e2cd6bf390bd955d6085d5a20717603ff10
MD5 a59979c7be30f571e6181b797181c555
SHA1 cae6de82bc0cbe85c54ff91ba6592c526dbeedbd
SHA512 e55210f916b364559ab00b75dbeccf5c9941569b040da8e379ba48f4092e9f487fc9f79c191aeed7a61a4852afac8500884f86be7bce9fe7d11f4859634f79ff
SSDEEP 192:sxZPRMyMqZjK1Ml8MFw/fzsSqKTG5GN2QwyzodpED/W6+WNGY0ht+lKIgj+BJ:sxZPldw/fzsSqUei2VO/bG5Wgj+L
TLSH
T13762F8066A64597B8CDBD719FA857B53D7F9157292904E48AAFCCB0C04D66EC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4c147cddc9b049a0cf62eba09f5636368b7843b2a9a16229c6566214f9e68c3e
MD5 b2d71bf5891071f5a88ded4f04bc415b
SHA1 1937e079cae4ac1c33164abb7fd78dfb10461090
SHA512 b67ee3e4c44545cefa19f8596dd2c17d585a11d679d0cf836224426495da6249c393726b9f9b44ec34eb3866afff9bb79a7072a5e85d73cce8e79818a8a57783
SSDEEP 192:sxZPRMyMqZjK1Ml8UQeFw/fzsKZKTG5GN2QwyzodpED/W6+WNGY0hH+lKIg57I8m:sxZPlqMw/fzsKZUei2VO/bG5sg+8m
TLSH
T17472F9166A74597BCCDBD619F6857B53D3F9157291904E489AFCCB0C04DAAEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 413c04813e6febcf5cfbfe02f550ebf579d0b28aefab57a09ae0ea2fbde09df7
MD5 3030dca31c456e1670536953e84ea6b5
SHA1 734f74d79eab64f61c7b8d909eb3d404cc2d6cd9
SHA512 27641ab3dc58c7b123f8d64a698286c5aa6ab729b48b20e9446dbc49b3103f7b6ab2196c463530cdef727ee02298d291048e8c88853cb04f4cb667db8394dc7a
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nzx4Ll3:wQAKq8y02yqEnjbWRmj1QWTu1jaKnzxM
TLSH
T1B303FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 e4e3bd1367ab10cbedef292125e3a69ffbe80b4683545d422a7d6a2a4c92a78d
MD5 08723924614fe539e22985562035ae6d
SHA1 f296d4ff6093b61178022f6f89c4b6db7cec7d54
SHA512 77364a7b5b458c24dca729ab7ec9fc03c622ff7577219a0465e2c619c29c4e34191c31b3316c735c86f1cf539be02dce47156973829d3f6f4cc16b710f02a285
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5K:GZLVDJjEDPV0/ZdAr1
TLSH
T138A2581232BA02023C7D390C93969B674A42F1633069AD7F7BB940B54E27E125EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4ddfb16c6d94b0ec1c7c8a447c9bb707eb08ee7ed069ced9e8775fe1bb62b059
MD5 87beb217f3b55a2fc2ec28c4a4c68bb1
SHA1 654c91718f2623ac44cb2581cde2214c9c0a2402
SHA512 6450a80170efbfa4e5d79961ed6223fdbd30e28ef9b4dbf82fbe5cb8acaa4b46963eb73da65e855a687bdef35ff36b989828947345b98dace97aa83e2b59791b
SSDEEP 384:nhiFDtNnNnb9K38NF8TUNTUlIRkPm3ek32nn9SUg4uf+8GD4k+LBG/ykOSBSTK3V:IFDjZbM3iwgCKekmdSGu4D7BST+R2Wnd
TLSH
T1E9D24B32AC64D9BBADE74FD5B70A3713EFE4015385885AD8EAD81D4E00C729D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0b772f3dd84716bfab22ff615127a8c55b49be45c99136eebc396a3d8724d7bd
MD5 58f46a8653daf057f3cea08c3fef9d4f
SHA1 9f1133c2195ee8ab1a688407be7fd1bcd3e88eda
SHA512 964f7945680db3a5df0f165abda54d0c842392608af12c8d8507747d5a2c056ad6cc6a2f92bff5c119df2f5e0f919cd942757ba198f21447a2687492c950c086
SSDEEP 384:nWiF9CcmyWCs38Nn8TUNTUlIxBPm3ek32nn9BhQe9s4uf+8GD4k+LBGX0e4KV8p9:9Fccps3kwgPKekmZZ+Gu4X0I8p0vm
TLSH
T129B25B32EC58CABBECEA4F99F70A7A02DEE0116785984AD8DADC5D1D009719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4f15636c8f693ae75b528c7e250bdd82d855186e88c1c88ba49506fceddcabff
MD5 ac9633d6bbfb33df2f782b2c8ffbc059
SHA1 be9cac4d486ae5c45718c11e0175c50b46f233d9
SHA512 34104933b94171585a24e869bd8e919fbf0831d047d94602a9aa2ab09c6539ec5236c3275a6a7c3e36238ee74228e503d5f0869a4402b43bf0b4acd0b40f4fd1
SSDEEP 384:nhiFDtNnNnb9R38NF8TUNTUlIRkPm3ek32nn9SUg4uf+8GD4k+LBG/yrOSBSTK3V:IFDjZb/3iwgCKekmdSGu4i7BST+R2Wnd
TLSH
T10BD24B32AC65D9BBEDE74FD9B70A7713EFE4015385885AD8EAD81D1E008729D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 04a9333cc1870c43da1572b36ec096bb69d79bfd0c83ca42038473ace8f452fd
MD5 bf6a14f225f6ded8097ae50c5e2b9956
SHA1 9645a08d650ce6ed25f6f643251f4c7e6170cc21
SHA512 cb6aeee12b3eafe381f8dce04221deac1d1cfed283bbd4eec8cfe51f54a6621cf4c483fc98042d649a5b532177eeedb60ec8f8c5e5cb2cbc9971c5154d1d6142
SSDEEP 384:naiFDtNnNnb9R38NF8TUNTUlIRkPm3ek32nn9SUg4uf+8GD4k+LBG/yrOSBSTK3V:RFDjZb/3iwgCKekmdSGu4i7BST+R2Wnd
TLSH
T146D24B32AC65D9ABEDE74FD9B70A7B13EFE4015385885ED8EAD81D0D008729D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 075a2a637090b48358624137e0ac5be299385d01fbbaf6238e6679689175cdeb
MD5 9357be6e5007579d84d9a88567b0bc92
SHA1 90ee0c0c314f7d0b579524ef2fb8a43155265707
SHA512 eddec5527dee26f211ac72e0eed79624afe4c7ebdeedadcbd106febbe2bf526950b735df36b0c0116d5267cd30b577b040d7f4767955825dbd0e5e0e7e06490b
SSDEEP 384:naiF1tNnNnb9c38NF8TUNTUlIR4Pm3ek32nn9LUg4uf+8GD4k+LBG/yrOSBSTK3V:RF1jZb+3iwgCKekmOSGu4i7BST+R2Wnd
TLSH
T14CD24C32A864D9BBEDE74FD9B70A7B13EFE4015785885AD8EAD81D1D008719D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ecd462427eedd624deb999cad5ccaf970339807d92a94851e1d72f4d5bccad3a
MD5 839bcdbc313b193cfa84bc2a1e1aa561
SHA1 aec0345e6055358db00d5933836f0f4355adf657
SHA512 8423187aaf58004a0410b75e1ef0c275075a8b01ce182c2cdcf9b6b93f8fd2279a8d688b5dab1b15347e19a8854815b73f7ba8aacef8b79d8c56f1a0661337eb
TLSH
T1034141E15C3D2AD1D0BE0EAFB49B34FC81D8D326F5A4707D6858E998467D60E644183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a10579ddb5e5783592b5cd07fc32fbad085fbfed4ebb5e5efcc579807df7c8ff
MD5 56d05eb6ba3537ad1d83dfd11867539a
SHA1 4fa53cb1c99efe575c2a4218ac030e325543e4a2
SHA512 54f18ece417130ab8c2a15fccd6e414dbb40adfb4f0b6e7f531558a0cd309336c9e9de28f548e11821019bed68969645ad1446bc2390775d8435a19d46151faf
TLSH
T10F4120E15C781AD1E0BE0A7EB09B38FC85DCC726F5A430BE2C58EA98467965D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b2713b53b35381cf2e8b4a19af3b802028dc2360e983e1aee60f4d5c32358dca
MD5 ac01b90369d255a7750c4e2d2c539847
SHA1 0dc70aeb281c3c264aaa2d63b8348dc6202d368d
SHA512 77114b0f7b45c8b6a51250ea06a9a05c3d9c1ef1816f3217bfeeb3051db589434763e4f06286787ec0b9e0c7ad23ef35a4329529ad78df4e80bbec4bfbaa98b2
TLSH
T1CA4131E15C3D1AD0E0BE0AAFB49B34FC84D8C326F5A4307D2C58E998467960D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1391233910\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1560368565\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_1560368565\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4240_188645409\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download