3095816af2263f308870a666a46212057bf5e0f80643edb86d59e0f407fb0dff

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe
Size 71.9MB
Sample260601-bbqt4aax2v
SHA256 3095816af2263f308870a666a46212057bf5e0f80643edb86d59e0f407fb0dff
MD5 509162dc990c062157f79d783b2a3aea
SHA1 51b6c37387f4e0936e2c0126b0781c553584b19a
SHA512 adb7bb3f2c7109a9cfcc31e5f9bfce2ecd112fb367c7f12c01d49ef8ac618de70435226b5033873fa34408a696134cc85f3866784a4df9d41cda476a2afe2766
SSDEEP 393216:I9tttttG0n9ttG9FB9ttttttttGl09tttttstttttttBttttGHWSYc9k7wwF/5jY:R0k9F+lCHWGYFfCwfUQ5idwjXC
TLSH
T1F0F7CE70F7D3C716CB07417CA47EBC3B5B29AED912C1450B01A72C2A2861F79969B63E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1761203239\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_706524540\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1761203239\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_706524540\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247491497005546"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{F702B775-FF4E-4612-B007-3A27A72DD87D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
396	msedge.exe
396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
844	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 844	3076	2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe	80
PID 844 wrote to memory of 1060	844	msedge.exe	81
PID 844 wrote to memory of 2904	844	msedge.exe	82
PID 844 wrote to memory of 2980	844	msedge.exe	83
PID 844 wrote to memory of 2980	844	msedge.exe	83
PID 844 wrote to memory of 2980	844	msedge.exe	83
PID 844 wrote to memory of 3904	844	msedge.exe	84
PID 844 wrote to memory of 3904	844	msedge.exe	84
PID 844 wrote to memory of 3452	844	msedge.exe	85
PID 844 wrote to memory of 3452	844	msedge.exe	85
PID 844 wrote to memory of 3452	844	msedge.exe	85
PID 844 wrote to memory of 3848	844	msedge.exe	86
PID 844 wrote to memory of 3848	844	msedge.exe	86
PID 844 wrote to memory of 3848	844	msedge.exe	86
PID 844 wrote to memory of 2476	844	msedge.exe	89
PID 844 wrote to memory of 2476	844	msedge.exe	89
PID 844 wrote to memory of 2476	844	msedge.exe	89
PID 3076 wrote to memory of 6040	3076	2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe	90
PID 844 wrote to memory of 5504	844	msedge.exe	91
PID 844 wrote to memory of 5504	844	msedge.exe	91
PID 844 wrote to memory of 5504	844	msedge.exe	91
PID 844 wrote to memory of 5508	844	msedge.exe	92
PID 844 wrote to memory of 4092	844	msedge.exe	93
PID 844 wrote to memory of 5508	844	msedge.exe	92
PID 844 wrote to memory of 4092	844	msedge.exe	93
PID 844 wrote to memory of 796	844	msedge.exe	95
PID 844 wrote to memory of 4108	844	msedge.exe	96
PID 4108 wrote to memory of 5180	4108	msedge.exe	97
PID 844 wrote to memory of 5604	844	msedge.exe	100
PID 844 wrote to memory of 5604	844	msedge.exe	100
PID 844 wrote to memory of 5604	844	msedge.exe	100
PID 844 wrote to memory of 3156	844	msedge.exe	101
PID 844 wrote to memory of 5164	844	msedge.exe	102
PID 844 wrote to memory of 2488	844	msedge.exe	103
PID 844 wrote to memory of 4988	844	msedge.exe	104
PID 844 wrote to memory of 4988	844	msedge.exe	104
PID 844 wrote to memory of 5304	844	msedge.exe	107
PID 844 wrote to memory of 5304	844	msedge.exe	107
PID 844 wrote to memory of 1408	844	msedge.exe	108
PID 844 wrote to memory of 1408	844	msedge.exe	108
PID 844 wrote to memory of 396	844	msedge.exe	109
PID 844 wrote to memory of 5264	844	msedge.exe	110
PID 844 wrote to memory of 5264	844	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ffa3939c188,0x7ffa3939c194,0x7ffa3939c1a0
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,4257517240521484792,3488522819477042509,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,12606327485664356191,12743711052012076472,262144 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,12256787980772631226,4662229829136065876,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,17320931607694856892,8407535552530651455,2097152 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,1838815552207815911,787382273397142150,2097152 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,3817098227373766992,16962183591660334120,2097152 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5156,i,16534774121704960054,17727591306252296276,2097152 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,12653282359840155875,11900652080795717434,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,11831617807584990859,5841085952795656366,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,328652541526410619,8935951255530079538,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,328652541526410619,8935951255530079538,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2918472574996345012,5198266333348942953,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5340,i,3113023871204104774,11196017450276928704,2097152 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11559284419688438450,8616551939035639589,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,14747146853000267221,2341392576462473002,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7858687087801428438,15217970412022006545,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,13182758546208156146,18325986952575977197,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,15727221862465464927,6817136234379355786,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,17999967635977051892,13531567045438166058,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,7969665043416365216,1271400977642776319,262144 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,10446281296713212447,2521169737461058849,524288 --field-trial-handle=2032,i,16302864506843740025,5716527426127632520,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-06-01_509162dc990c062157f79d783b2a3aea_amadey_cova_cryptbot_darkgate_elex_emotet_gcleaner_glass.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 612f579e440ddd91fdb40b235214ea398affac15a4b0e8b364c9fad1f01e5c9a
MD5 1c82b13a495c161350e96758534eeb79
SHA1 fbe598b384060facbe1214ae45c8e73f9fb3356f
SHA512 0042b6380279b7dfe0ff79a927968a1206cb3d57ed0b8b8e70024e4fbaf41010806dccec256493712069fc0cfea4724899646c2cc8870c96435dfa643129dacc
TLSH
T1E5F028F6C8219C3B08FD0B2934945B06E751176B2B40895F3B3D920CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c828468a5120966f845eeb4cc3313f9556282824c52a61c80058ef901961b41
MD5 7662319c4902d02a388e5fa9698480a2
SHA1 4ade185cbcaced73e379ba7817e7b9dd5496e06a
SHA512 792db409ba7755699f285e1740eca14cbbf9bad30ca5184a0fd6dc71720d3785e370f5eee6713ac2edc541bb886206e94f3bb6d358af3fd9a50f777218170ad0
TLSH
T13481C51B02B1C941F7260D71B7D0960CF9B0634F3947AFA21ED8993119DB7E2C0D65D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5911c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5911c9.TMP
Size 3KB
SHA256 a4b74785dd6590733098e2520b8e9ecdc1981a4df7a78238480e0190062bd1a3
MD5 6634a8fac7fe4044bd2c0cf3da85ebb1
SHA1 e4bf525de399da24d12a0648d5ac768fecd02051
SHA512 a959cbd0742e82fce30731e4e6bcdc6ba8e5f733b33a7632e61e942c4275fda185a1cbc0369f58e95c3ee0520a7457a94078898d61c80eb329af87c37728220c
TLSH
T19371A2170272C941F3660E72B7C0824DF5B0A38F394B9FA21EDC953169DA7E2C0E65D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9bcf8974a12f02ecf3c6fe51284e4152645cf6d7686d238530cf5c375951bed7
MD5 6282bbb00ebf33cf2eff403c0402075b
SHA1 7d8c229ca1078afd486aabb6a631e873d61e153e
SHA512 88f3a67d240589cb70fb0065eda13c63b5dc260699e3e6cff71c1f0e369734ba8e5b493361711bc787c1568bb943fc0224873b4df1df9609b2cbf94679d5c6d0
TLSH
T1C751ADF787E4856E8A0195F0AA18AE2FDF2D0515432C3C5A89E4AF1793E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7d7a587a7b4c7a54d80c7840c6edbc0b4e17570a530e56738fd1e235c9e8bbfa
MD5 8f04991b420d558d87a461be1ef75312
SHA1 1cc2db5143b11b7e6a7eb42fa6b273671272c020
SHA512 17c80af08081083c64e31e2e8ed831cfd9206ad13b3908751b981f81c3ef5b7f6104f863fe197482dda3f8a6356ede2c51275ca44ce11abf844fa99e4df626d6
SSDEEP 192:sxZMR2yMqZjK1Ml8McA/fDs++4KQ7PgYsV0ezodp56/W6+WNH1jfYfUZHItIg5dP:sxZMP0A/fDs++4V7orV0Fg/b9f9irJt
TLSH
T11D720956AA3859779CDBD219FA457B53D7F9157392804E44AAFCCB0C00E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2313258ee7d377b5b867292943073cea95821af15b80873f96dc83b57b3956a0
MD5 e4e7538a77766360ff7563ba147ffaa9
SHA1 c88ea905b84ed060a1b785889c10349fd916fd41
SHA512 165f1b585dddc5434aa24b0b2b6beb85af5d45d6196940839be96362bb288b2e0a9a7fe0b702ac37f1731e5cefa968e4168e68a4f811586e7dd31b69cb70a024
SSDEEP 192:sxZAR2yMqZjK1Ml8McA/fDsH+4KQ7PgYs70ezodp5x/W6+WNHGk/Y0ZwCXIgjJbJ:sxZAP0A/fDsH+4V7or70F7/bx/5LjJt
TLSH
T12262F9166A3859779CDBD319FA457B53D7F91563D2900E44AAFC8B0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 145254b56745e546bfc5e26f2d7bab69cbbc976c8f694d26f56c053e4c3e201f
MD5 68462b5424b84cb30fbd12d9bd7ebda0
SHA1 b686104c1930ce5e430ca0224c6b00b2a8de81d3
SHA512 f9711e4fddf656cf5724cf23c537e29c7f6c1db29fd3f462a6cda99d490b3da36566d07447ed25b2e7d8ecbe2e349c39cb3de516894f2890bd035bf82df86991
SSDEEP 384:sxZMPq+A/fDs++1V7orV0Fg/b9f9q805u:sky+A/fN+1xO/bh9z
TLSH
T16D720956AA3859779CDBD219FA457B53D7F9157392804E44AAFCCB0C00E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 77d65a9bf81866e9c96fcc18e1e8f61663e1372c1b6c36a6a19253556be71975
MD5 d87a5f34bf845ba6e8a974b17291d4a8
SHA1 4b33847d042b55dfa519e76e487880c60e7090bc
SHA512 8771556c6e05a3436a4b966fb2c12ed263744a394a21165fdb718b4bc3b8e5e923d8b57c58954a0960d9b87b8554a0db2889384007d60490d55b80524137e58d
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CGq9Llq:XwZh38Dv2SkEnZFWRm6GQFmu1jaKCGqK
TLSH
T147030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c638faf4f3cd8148f46fe78f61c64336287b7cae4f2118a36ae658b1106816d1
MD5 1f83c88607816e276d0fbff5e7266a4b
SHA1 8c2018e26a75130b10be94e33ea46b83f2f757a7
SHA512 c7672861000e74d7e07f1b04f3cc09be857f77ffeab5c2833d0ea3d1b8288dce1ffd93283b68cf668e47365ad8bf141c815bd2e802c3f819c54b69ddca3df6b5
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlFpHD:ctGj+BCNC5qFVpKxFZD
TLSH
T12CB27A1632BA02033C3D791D87A59B375A42B1633428E93B7BE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 91de9fe036e4b0df1a5c558f3538705bca28b7cd5789cf5d33686df94c0304de
MD5 a380f199c752eaad9b846a97d1292ad5
SHA1 107884ab1962f2598828be3cb57d3fbe1014d6b0
SHA512 ea1446fde3509a6b649087a4182a9959cef6cbabd24c0c3fbd0f5556c25ad42a6423674f66207631fbe13c09851a757843476f0eaf4ea39276a0c911188a9b20
SSDEEP 384:yk9iF1tNnNnb9k38Nt8TUNTUlIRhrk6JqB21zCfbLo/4AXfUyxoeD7DRi2AI19lr:t0F1jZb23iwg4hB8Oo/Psyxo+N9DEK
TLSH
T121D24C36DCA8CAA7EDE74F95F30E7643AFE00167858856C4E9D91E4E00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 681bbb374f7cbd6689d2972503804ba646baf7d99262c41194d0bec7ac275efb
MD5 f12b13e872141d939f088dffaa318541
SHA1 ffd4fdd9ab23719cf888165384cb403518b8b954
SHA512 f4940ba87701a47384eb79667402f6c79485f791a8cf77c463e5e598428d4bf8b8d79f8692b2842d15ca034743c97246be5c63dfa1de1af04904199ed45d72f6
SSDEEP 384:n0jiF9CcmyWCJ38Nt8TUNTUlIRNrk6/FQ1zCfbLo/4AXfRloOty/7Ig5:0OFccpJ3iwg44SOo/PploD
TLSH
T14FB24A36EC99CAB7EDEB4F99E74E7643DEE01163868C4AD4D9D90E0D009B19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f647d4e383493fee4f42223f01f305dcff2c7cc2ecbe2ecc7d860858cba5a891
MD5 87b5928784b38f75b9e245b69e11e471
SHA1 ff2d4a739962fecab8136f816f3b04f508dcca48
SHA512 580d812ded22f5623f5c9635a8f129ff0220aea14b99eac4f243c79c349192fe28d9a5d12bf3631271950e1d77839e2ac2c9cc9d8c7a843d4e49ecfe0a2ff438
SSDEEP 384:nbiF9CcmyWCs38NA8TUNTUlIxBrk6olzF1zCfbLo/qSCe4KV8p0Ajty/7Igj:2Fccps3bwg4pzzOo/qSCI8p07
TLSH
T14CB26C36EC98CAF7EDDB4F99E74E7A03DEE0616786888AD4D9D81D4D008719D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3b4fe9d789d70139f4394cbbc4194524c3f23f10edc1a06e835a21b1d57fb268
MD5 876ae5aeec281ee2532eaee7db73d874
SHA1 54e4d25d4fb1fabb17f806a56821d58b5d08d8db
SHA512 ff10e342b8144fc30b0c4f5016cc37f38ec05dced21f16e04c264b328f1540f9691f44ffa951ee4d4ea320ab072fe3ad3d8030fe3f2ec8da29d5c01ab30ce1ef
SSDEEP 384:y0jiF9CcmyWCl38Nt8TUNTUlIRhrk6/qB21zCfbLo/4AXfRloOty/7Ig5:9OFccpl3iwg4vB8Oo/PploD
TLSH
T1E8B24A36EC99CAB7EDEB4F99F74E7603DEE0016386884AD4D9D91E0D009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 980cb67f2d74bbc790fd382fdb210c343404291e8689095c48a7dd68e2ea826f
MD5 544eb33afe5b38df8f521dfd42846e51
SHA1 33d8e3d683717c75f7f25f1e12e08fd20d7546b3
SHA512 0f4e9ec1f20bc1a02582c76dd323e553ff1a671d4655b38d07c00f1d72c6e31faba30ba19a5b4d1d12e4e291c2f24d53e3e119d1a2eb3b6ccbb4dfcaa111d59d
SSDEEP 384:ykjiF1tNnNnb9q38Nt8TUNTUlIRhrk6JqB21zCfbLo/4AXf2loeD7DRi2AI19lhF:tOF1jZbw3iwg4hB8Oo/Pelo+N9DEK
TLSH
T12AD25B36DCA8CAA7EDEB4F99F30A7643AFE0016785C85AC4D9D91E4E00D719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 86564b030a460b6b0cb64b84713f1d13cc249260aaa6216dad247c3e851d45fa
MD5 e575ff9e306035a30b979f5876469dec
SHA1 d5ddc4d85364c50a622647e76af70269e6a14d9d
SHA512 fa806210bd4c29b149b5e8016d6114d8f227ebd529054176ee5266dab297515932bf6c1ab76e50dfb6a260a76d982a30495ba5bf37af61d72c76e4e536dbddd2
SSDEEP 384:y0jiF1tNnNnb9q38Nt8TUNTUlIRhrk6JqB21zCfbLo/4AXf2loeD7DRi2AI19lhF:9OF1jZbw3iwg4hB8Oo/Pelo+N9DEK
TLSH
T1CBD25B36DCA8CAA7EDEB4F99F30A7643AFE0016385C85AC4D9D91E4E00D719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6278efbd1ea2a760694d83a82bf9482772b9d4ee00ca57c1ef7e9fd320658bf2
MD5 63955388065e5e6c4efdaefdb91bea43
SHA1 89e8101317be9d2a14bba8e7f265d385a530e7ab
SHA512 d1e85ad1cfe03e9334e55d4354750519dd153d0d9bfc6efbacebb1c623b579a030d337c0ad9dc9500567ff911039e174cb74887098404e9af16e329cb6eec6de
TLSH
T11A5150E14C7D1AC1D4BE0A7F608B38FC81ECD736F5A034792858EA950A79A2C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0186b92294e7f94bd315d9c1d64a0f0245b36b024e1c943e0a5995e05dc23533
MD5 509c091d91ff3aa0c102172431a4fc31
SHA1 33f19f5dca042924c0a2d191ea4e3303dc0d2d93
SHA512 18fbc162db36f718d28c33cc8c054711391c309a4f1fb193c11a3c5a7ac2e099e52f1c0b850ea694f09b7ae149043ba26e17af385d1feb98d300d68fb6ec5eb9
TLSH
T1AF514FE14C7D1AC0E4BD0A7F608B38FC85E8D725F5A034792854EAC90A79A2C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 99eed550224da0ac033a7de3ebc6b465509e6b232fdfe2cfd7f4c71438df5e03
MD5 5cf2f4d9e9f25810371bd85a6374fd0c
SHA1 796ec1a31fe238fc5193d146362f132deaf969f4
SHA512 4878ca0e4051fb07fa509de7a3adfa7d87623a9395630ffa1820322c8f2680711d4d8c7dddd3da24d441e5c8aa76d48f08f4ac572e9c47eb9130e276e388d125
TLSH
T129515FE14C7D6AC1D4BE0E6F648B38FC82E8D735F1A0347D6868EA950A7961C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1097860754\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1761203239\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_1761203239\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping844_706524540\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-267-0x000001A700000000-0x000001A701000000-memory.dmp

Download