f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Size 15.6MB
Sample260529-e7zcwscy3m
SHA256 f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6
MD5 da94fa262346da3d8ab5dd884b71a036
SHA1 a013099c743785f14320dd5a32f63af385f582f7
SHA512 92c348cb33abf37e04cc29f139a98e5db31ef335dd1015b40a7577540a282bde8e5f9fe431cf453729280fd2b9c8f88e14da4f1791be8243e6f22b5a233583bc
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/QgEeKlUH:Hxj3mE7P3pSpJuQnPt1H
TLSH
T136F6331177EA8831E1620671D66AD36B65BBFD321B31C4CBB3D5065D4A36A82CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
30	2036	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5460_2081187566\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_614698404\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_614698404\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_901009373\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_901009373\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\or\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_477326864\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2036	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245029555974153"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{68E4CC48-6661-4A3B-AA5A-74D10B09B2EF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
1460	msedge.exe
1460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Token: SeRestorePrivilege	3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5460	3976	f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe	80
PID 5460 wrote to memory of 5620	5460	msedge.exe	81
PID 5460 wrote to memory of 2036	5460	msedge.exe	82
PID 5460 wrote to memory of 2184	5460	msedge.exe	83
PID 5460 wrote to memory of 2184	5460	msedge.exe	83
PID 5460 wrote to memory of 2184	5460	msedge.exe	83
PID 5460 wrote to memory of 4412	5460	msedge.exe	84
PID 5460 wrote to memory of 4412	5460	msedge.exe	84
PID 5460 wrote to memory of 5532	5460	msedge.exe	86
PID 5460 wrote to memory of 5532	5460	msedge.exe	86
PID 5460 wrote to memory of 5532	5460	msedge.exe	86
PID 5460 wrote to memory of 5564	5460	msedge.exe	87
PID 5460 wrote to memory of 5564	5460	msedge.exe	87
PID 5460 wrote to memory of 5564	5460	msedge.exe	87
PID 5460 wrote to memory of 5484	5460	msedge.exe	89
PID 5460 wrote to memory of 5868	5460	msedge.exe	90
PID 5460 wrote to memory of 5484	5460	msedge.exe	89
PID 5460 wrote to memory of 5868	5460	msedge.exe	90
PID 5460 wrote to memory of 3232	5460	msedge.exe	92
PID 5460 wrote to memory of 2564	5460	msedge.exe	91
PID 5460 wrote to memory of 3232	5460	msedge.exe	92
PID 5460 wrote to memory of 2564	5460	msedge.exe	91
PID 5460 wrote to memory of 2564	5460	msedge.exe	91
PID 5460 wrote to memory of 4812	5460	msedge.exe	94
PID 5460 wrote to memory of 2104	5460	msedge.exe	95
PID 2104 wrote to memory of 5268	2104	msedge.exe	96
PID 5460 wrote to memory of 5128	5460	msedge.exe	99
PID 5460 wrote to memory of 2740	5460	msedge.exe	100
PID 5460 wrote to memory of 544	5460	msedge.exe	101
PID 5460 wrote to memory of 5904	5460	msedge.exe	102
PID 5460 wrote to memory of 5904	5460	msedge.exe	102
PID 5460 wrote to memory of 3388	5460	msedge.exe	103
PID 5460 wrote to memory of 3388	5460	msedge.exe	103
PID 5460 wrote to memory of 4156	5460	msedge.exe	104
PID 5460 wrote to memory of 4156	5460	msedge.exe	104
PID 5460 wrote to memory of 2604	5460	msedge.exe	107
PID 5460 wrote to memory of 2604	5460	msedge.exe	107
PID 5460 wrote to memory of 1460	5460	msedge.exe	108
PID 5460 wrote to memory of 224	5460	msedge.exe	109
PID 5460 wrote to memory of 224	5460	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
"C:\Users\Admin\AppData\Local\Temp\f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7fff2196c188,0x7fff2196c194,0x7fff2196c1a0
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,14694234356953339417,1479905132821903775,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,7358246071459670405,16915007024645609120,262144 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,13982911929431073622,12220235279845754350,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14552784547269197214,3229739268334366682,2097152 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,2736352557909097355,3764233093064082746,2097152 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,6770295457174120889,10841746494286404324,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,1251590477916339672,106468955973642720,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5588,i,12770332904585474421,11428652852211302791,2097152 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,7434376916315639523,5875268207230483347,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16957385641698815907,6364552065293521230,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16957385641698815907,6364552065293521230,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10496358539795528980,7720657733995889296,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1100
      4⤵
      PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14438901171687063291,2916893125437345531,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,6492331980536006233,13207302153252753173,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,2208803669107317408,13666492458290940847,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,4102840124398396954,13534870654251175666,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15525733167795448779,6678859530262160041,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,2620348789559041594,13614737647070979909,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,4087835276099012423,966281328249835320,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,5222456916617054300,12367787602731131063,262144 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,3339022220524803182,8940957034323483380,524288 --field-trial-handle=2088,i,15781981139440009194,15645318111991450629,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 df038d364d0d2c7775d2f54c67322fae45c2824f79c6a1828b71436dcb5216c8
MD5 8cec81f53c6e9e636ea4cc3f04de89e4
SHA1 432f7ab9b2c89ef3ceede1855d2e16a686a2e088
SHA512 0b078bba61a1329408755b9ce14b1e359e4f3f6a59c2d368923157ebcecc013006772392ea369abb2ca4b685174d5142a3216937fc00b0515e7c77a391adf2e8
TLSH
T138F0F9A6C821AC3B08FD2B2860645746EB5513572B41495B3B3CD20C8FB063B4685D2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d55f8a9e8ede2213c288564088ad67bdfb5deb3baafdccd7be1bf23dbcad1552
MD5 a4e53055048c870958a5643f821a3f38
SHA1 45f8d9c096dcab77344a0dde45c83e0e29250977
SHA512 829998bdf34d4c086a628e0b974a96824bd26ea86c333119d571ea069a9cef43cab78737e3ea044ae22846715671122e4f9ba3baf6bd1dc3508c48b580056e18
TLSH
T1E541AFF7C2E8856D890196F0A718BE2BCE2D0954532C3D5AC9E4EF1B93E2471D18155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9169ce9637481b02c8ef83a7b632ca0e1e05be3436ccee94060f18926f3d0921
MD5 b15cf31771c3d57cad169ea27db1773e
SHA1 b368384d31652b91058e2f43a5eec84388cd5f30
SHA512 5b703d58bcc22b380117271be2a76486f948d86148f0d25a45162b734b1212c3d0f57a6917879e87a57ef368d40eeef5dc1f374a557ec484ffd6a81fc3037189
SSDEEP 192:sxZ0YROyMqZjK1Ml8MlG/fysY4KTG5GN2IwszodpW/W6+WNGY0hJF2Igj+IJ:sxZ0Y9tG/fysY4Uei2TW/bG50j+s
TLSH
T19C62E8066A74593B8CDBD319FA557B53D6F9157292904E44AAFCCB0C04EAAEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 02787ee1e4116adaa38df982d643188efe1d2ecf7c72f855366a0a10e5025046
MD5 c68bd2e5b260207a75973782546924ad
SHA1 19c358642480e58124879594e3ffd5c94e124184
SHA512 5c5186bea017de48da8431a6c5203ca633edc73c1ac01ed661fe3ab67793923660e341c310685ad1e14086421498c52c90f2bd920a6a567480522a787c6e94e4
SSDEEP 192:sxZ0YROyMqZjK1Ml8UQplG/fys1KKTG5GN2IwszodpW/W6+WNGY0hkF2Ig5R78fJ:sxZ0Y9qfG/fys1KUei2TW/bG5Zz8h
TLSH
T13F72F8066A74597BCCDBD719FA457B93D6F9157292900E449AFCCB0C04EAAEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 11e8488d68d1e68c36bd496b607d0d7f9702b08d144af696de6bb6cd1f19a817
MD5 7e4aad8f6ce87d6b00aa70d53f37aa08
SHA1 399cee247db4be699932899e4058e11be3561e69
SHA512 5a4ed218e176888cf52fadda71c2e0af3dbb20101ad2e3e641aa17afb892a3e0843c14cf968e06b1367cfd743303eb7d98cdddeb9b0ec59da29877d6bc5f1007
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3szx4Ll0:wQAKq8y02yqEnjbWRmj1QWTu1jaKszxj
TLSH
T1DB03FA3B680CCB7E4FC04E9CED277E8A6DE8028BA6988D5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6162a7d3ce2fb82549be0707264362236ea6c3d699a2a3aabf07b644e0c76990
MD5 0bfd235707cf8370ba7d822f187d7e04
SHA1 e3c73abe246dcbb2596942c622c830d97d492155
SHA512 c8a34eb82711c98e7c63eec49ce98e7f3fbf096013d69da8f2a339078015b521486306f28c011a4999b3c4c9823bdd5c75011e18511af3d141aad74c10530781
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5r:GZLVDJjEDPV0/Zdu3i
TLSH
T15DA2781232BA02023C7D390C92969B274A42F5633069ED7F7BB940B54E67E225DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e3b4797fdf4b1ddcd622e857f7d9c2f3b82fa32a2774372acdbf2b8aeda84aeb
MD5 704652cb28e17a3446b11cd733556ae1
SHA1 d98b924b1776e44c22e1f1bdf94c60ad9b29c153
SHA512 e045c8493445f84f464173060f0067a20d631801be4e899c9fca620c583046cd776a93af31178f29f46010972a5a078c3d825ebea55e9d9ba211929722d9837d
SSDEEP 384:y5eiF1tNnNnb9O28Nq8TUNTUlIRdPm3ek32nn9N3H4Jfb8G7vGSMW3rEe6qB872w:21F1jZbk2NwgjKekm3VGqSwqygRD+P/1
TLSH
T1A6D24B32A864DDABADE74F95F34A3742EEE001A3988C6ED8EAD85D0D00D71DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4dfc2954a778323b70ad16d15a976c8a0672ccd4ec552f7ac80b796a8a003b0c
MD5 5d2fdf891ff0f36910331459fc05fe79
SHA1 4b676891ab4de8385d04ed4667bbb01c0848f708
SHA512 ede282e0912af994637e022531a8438c72b2e56c8e69b2e4126bb224b5a66c58986b096d83c6f9007d5ad60ea58d154c2710a250a3e238c6a1c4928a645e5c05
SSDEEP 384:n3iF9CcmyWCs38Nx8TUNTUlIxBPm3ek32nn9BpQIs4Jfb8G7vGSMW3r2Ne4KV8pa:yFccps36wgPKekmxrwGqSaNI8p0t
TLSH
T19FB25B31EC64C9BBECE70FD9F74A6A02DEE01263959C99E8DAD85D0D009B1DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8e810332813d01b604fc5998f2bc9a18132bca1a1f93fb6dcddef327fcff2913
MD5 69418e94ae2312231e3d305faac40ca0
SHA1 6a59f7b280b56e460c7ddcb58b43d87d3b0aa567
SHA512 f13ec376975501a5869ba9e2ae417def7c0e779d61b660440a8696c9141ddc458c57288bb96c425780d639cfe7b796f5e5551fb4e1d106bb18ff40713099b18b
SSDEEP 384:noiF9CcmyWCZ38Nq8TUNTUlIR5xPm3ek32nn9k3H4Jfb8G7vGSMW3rEeCqxsq/ve:zFccpZ3NwgpKekm0VGqSEqqqO
TLSH
T174B23A31E865CDB7ECEB4FD9B74A3643DEE011A3998C5AD8DAD84E0C00971DD170B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 808bc3304344b78819f92ed01049fe3b0050c41a61ef3389bf435819eda358c3
MD5 f6c7aff74f75a06b6e8a1153092e6f15
SHA1 bc3ec1fe89180c5d7ff04d2ff3ff06ccf8861430
SHA512 385eb3016a8ad6089dd264afe6b05db87e0dab356b888879759e0bf52d17770d1b2fb480a70715325461692040fd1a2475d2e73609ec79f01ed86e66c52945bf
SSDEEP 384:noiF1tNnNnb9q8Nq8TUNTUlIRdPm3ek32nn9N3H4Jfb8G7vGSMW3rEeCqB872+ss:zF1jZboNwgjKekm3VGqSoqygRD+P/1
TLSH
T140D24C32A864DDA7ADE74F95F34A3642DEE00193988C6ED8EAD85D0D00D71DD170FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 85103a8799c7d85e7df66c40017cc65eae21faf886c5d52de959269bcf8a2ccf
MD5 213e385288de5a41bd7c2d4ec812879f
SHA1 15996b5ded2bddc2ee788be9f1cd84632fd160ab
SHA512 b42d25007c773d9d7dc3c33409c1134ad4cf2730a1bbb2900a82bf1d107b148171cf83f7c78dc81b4b98afb8b3197c468e80bc686f6470ae843f2203b049f765
SSDEEP 384:yCiF1tNnNnb9q8Nq8TUNTUlIRdPm3ek32nn9N3H4Jfb8G7vGSMW3rEeCqB872+ss:EF1jZboNwgjKekm3VGqSoqygRD+P/1
TLSH
T1E4D24C32A864DDA7ADE74F95F34A3742EEE002A3988C6ED8EAD85D0D00D71DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d261f6bead8554d4a6cdf625967087fb841e491e582283c8de79afb9483e6ebc
MD5 e1eaefadaa4dce6bf41948b0a9cdd647
SHA1 02c7f7c8b595ec5fd8590d2f16fbf333d583a839
SHA512 751cbf6240574ca2a6616a29627f87b770aed2079c4b3d6362e5071f080b500df533b7d991bfc330111818b9f869d334767e770a4fc56d27648ba1d9b8be1f0c
SSDEEP 384:yoiF1tNnNnb9q8Nq8TUNTUlIRdPm3ek32nn9N3H4Jfb8G7vGSMW3rEeCqB872+ss:WF1jZboNwgjKekm3VGqSoqygRD+P/1
TLSH
T120D24B32A864DDA7ADE74F95F34A3742EEE002A3988C6ED8EAD85D0D00D71DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b6d23fe3d25c59e64f788ab6fd8a243a0e5d1b3a8e2b500883fd5a935bf2bbd2
MD5 7ac6c28b7a0a56b74b3166cd70e655d3
SHA1 1faa015b3ff765219101add3e81146626b44ac3f
SHA512 c5786e1721e55fba8ebf1c1ae84f59fd0257ac1c2bddcd4ce899cfb14b80675d11b22b5008f6cfd511dab0d7f5cf1336f1d5593ac56cb0301c7e1f52c6c937a1
TLSH
T1FF512EE15C381AD1D0BD0E7FB08B34FC81E8C726F5A4347E6C58EA984A7960D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 20c2574303a5eb412f42f1363a30b0018fb0b5a18641dcc0eafb592ec1b9a3db
MD5 920c5e5f25168d2604d0f5ff5924b4ef
SHA1 0161bec01996be8293d570e356b566cb40a840aa
SHA512 f7216812f9b83e9c85af98faa13972ca6f32aed1ecc646c1f38db332f90d203e1a3fcd635ad2152ccad7159a21d67f8f53258fb982a6980b270e32fe8ca849fc
TLSH
T1405132E15C781AD1D0BD0A7FB08B34FC85DCC726F5A434BE6C58EA984A7961D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_614698404\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_614698404\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_901009373\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-0-0x0000000004740000-0x0000000004741000-memory.dmp

Download