ce8b58273588cbf111ed640924a2c3269c787f3fe363cfb6e71a3d8acddb281a

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsignn.html
Size 16KB
Sample260601-pfe52sbs3x
SHA256 ce8b58273588cbf111ed640924a2c3269c787f3fe363cfb6e71a3d8acddb281a
MD5 abe11ea3a6f8d971c7d5804945ba3500
SHA1 7976a6b0474744d72f8628303f046799c9d1c062
SHA512 a7849a2266c592cd704f27d5dcad22a617fe7522293b55f7c563f7d5dcfe0dc22dbddce95c0230d5b4a013fc800acd31382cffb56e172005de007322a43b9c15
SSDEEP 384:9OAc1YSWxrd30zIgi+i+fPizici+ib30KB0y:IAc/Wxrx0CP+CWRP70W0y
TLSH
T119729216B8850A921933A3A9AF76870DFF66411B4600C7187DED76929F71F0AE523FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	api.ipify.org
56	api.ipify.org
57	api.ipify.org

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1342558731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1342558731\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1323278839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1410911559\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1410911559\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1410911559\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5352_1965654119\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1410911559\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1931676267\_locales\km\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247897779638610"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{78B33612-ADFA-4E05-9F5E-1B3D65300DDC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 1156	5352	msedge.exe	80
PID 5352 wrote to memory of 4772	5352	msedge.exe	81
PID 5352 wrote to memory of 5760	5352	msedge.exe	82
PID 5352 wrote to memory of 5760	5352	msedge.exe	82
PID 5352 wrote to memory of 5760	5352	msedge.exe	82
PID 5352 wrote to memory of 4192	5352	msedge.exe	83
PID 5352 wrote to memory of 4192	5352	msedge.exe	83
PID 5352 wrote to memory of 3760	5352	msedge.exe	84
PID 5352 wrote to memory of 3760	5352	msedge.exe	84
PID 5352 wrote to memory of 1548	5352	msedge.exe	85
PID 5352 wrote to memory of 3760	5352	msedge.exe	84
PID 5352 wrote to memory of 1548	5352	msedge.exe	85
PID 5352 wrote to memory of 1548	5352	msedge.exe	85
PID 5352 wrote to memory of 1808	5352	msedge.exe	88
PID 5352 wrote to memory of 2880	5352	msedge.exe	89
PID 5352 wrote to memory of 1808	5352	msedge.exe	88
PID 5352 wrote to memory of 2880	5352	msedge.exe	89
PID 5352 wrote to memory of 3144	5352	msedge.exe	90
PID 5352 wrote to memory of 1932	5352	msedge.exe	92
PID 3144 wrote to memory of 6084	3144	msedge.exe	93
PID 5352 wrote to memory of 2132	5352	msedge.exe	96
PID 5352 wrote to memory of 1648	5352	msedge.exe	97
PID 5352 wrote to memory of 4896	5352	msedge.exe	98
PID 5352 wrote to memory of 488	5352	msedge.exe	99
PID 5352 wrote to memory of 488	5352	msedge.exe	99
PID 5352 wrote to memory of 5576	5352	msedge.exe	100
PID 5352 wrote to memory of 5576	5352	msedge.exe	100
PID 5352 wrote to memory of 5560	5352	msedge.exe	101
PID 5352 wrote to memory of 5560	5352	msedge.exe	101
PID 5352 wrote to memory of 1884	5352	msedge.exe	104
PID 5352 wrote to memory of 1884	5352	msedge.exe	104
PID 5352 wrote to memory of 5520	5352	msedge.exe	105
PID 5352 wrote to memory of 5520	5352	msedge.exe	105
PID 5352 wrote to memory of 3816	5352	msedge.exe	106
PID 5352 wrote to memory of 3416	5352	msedge.exe	107
PID 5352 wrote to memory of 3416	5352	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsignn.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffa3af8c188,0x7ffa3af8c194,0x7ffa3af8c1a0
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,804476925251039862,8430381103765466951,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3657371238217153123,18108846098502663626,262144 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,17141955852991701701,8978637751651344189,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3228,i,14990730824437414541,11090615582552861004,2097152 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3336,i,5659201168367556619,16548993265496000564,2097152 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12542620205846504759,17448343043591686802,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,18413477509066554049,11334951840634896235,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9061902226674596221,16924666623290721963,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2776521388798816866,15754203470808580637,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2776521388798816866,15754203470808580637,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15150074146981782184,15245477071966361910,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8221862758650664834,1259077671770344233,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,11979581591492742648,5629823536952510708,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,6026634530125604450,3331393456742035250,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,15212936306587200316,5058715231867917621,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2428318121381521399,1782867891417839970,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7607072985103506729,2584455358751847304,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17678496254951960710,15012827919930513401,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,4365630270735383162,7379867015471111295,262144 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3310488580803134115,13416911635616894342,524288 --field-trial-handle=2116,i,4312366263155979585,16250035034499039448,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 75b09fa99a189bfcff1ff8092788cdf8602ce259794eeaf3c7177117b5d9837a
MD5 c372df831db6d595f161a87045d7b84f
SHA1 ec266c7d62248a74caea31441446ded68674338c
SHA512 faed56302147aa5cf2a51d51bb34ca3841c40c71a9ffcd72d322c568911ad7b72e56d94f602fb0f6c3ede0b951f357be998991b4479411aaf8838072134f33b4
TLSH
T1ABF0D1B6C9219C6B08FD0B2934A55B46E751232B2B80895F3A3D820C8FB463B459A96C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8764ce6b1356bdaa52682669289f0cc59a79decfbf17d26678d0c1a557a5e3fb
MD5 3ad70245e9d8843adb2d7eb64b0069e3
SHA1 7db78d0617289277d3f778b9691f53ea04a645f3
SHA512 ca585741082ce2d0ac16ed861b6bba634530a2c92345193ced879e77e5dd4c7a87e3897debc6e88c8e5e1049ef638c83a9ffa9f68bba56864622eb895b35acd5
SSDEEP 96:D/O1npAmazBij6VpFu84KZorOGZQKeiTwQN2x:DW1npAma1ij6VpFu84KZorOGZQPiTXNS
TLSH
T15D919EF783E8876D851191F4AB296E2BCE1D055A432C3C5AC9F4AF0B63E24B1E14179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a9801113b6995e570f928c4296df67ce5db6c95e5879cb03dd42a0cf2cd91927
MD5 7e34451db0f2a42f048e72fe3b14e254
SHA1 81ce5a46b56270c087a9fe64d1ab9a758ffc8a13
SHA512 58a7e39a96acc8516b7170d1e5b022f4b00650c7a5b6920675658aefb5f0904f5e3f27a2c6925a2db638b78a22563f7e07302efa18dda2600c7c18678f8c18d0
SSDEEP 384:sxZLsdM/ffsb+ZV7org0Vj/bGgKZ+HjJ8:szgM/fo+ZYJ/bGgKZ+K
TLSH
T1C172F9166A3859779CDBD319FA457F53D7F9166392800E44AAFC8B0C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3a35e1bece9b870c6d1ccbf8e10e6f89f8c54deb244715767fcd2643cc54fd96
MD5 95a59f06463e2744b5569320b3cf21fd
SHA1 164d6c9ee7fe7a9f425715b51e35e3972bf22f4a
SHA512 f0f49e5741b888ad96da3a8e6d87b4dad9823b1f0eb261139a4134525535cfb6ed2dccded3a4475e5c7ed4e686a2a7398ebed6fc09a712ef35e1a0c73b687cfe
SSDEEP 384:sxZLsqoM/ffsJ+TV7org0Vj/bGgdZ+HY5t:szboM/fC+TYJ/bGgdZ+0
TLSH
T1F972F916AA384977DCDBD219FA557B93D7F9156391900E44AAFCCB0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 36c5b89ef71233d9b310c4722b7b0e8b19a316ca04b8c46cd5aacc3065e762de
MD5 3dbe6e931c8130ddf5d4be5b11f6c872
SHA1 5551f326f40a72ed23570ad3c32779288daa3bf9
SHA512 4df7839316e330a24ada285c7d99b9bc3582b236ffac77ad9ba711e09b32a24f02ac004aec2af9e15d59009f3fe14666e8ac3a2edb0222c22727b1337491ef1a
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3DGq9Lla:XwZh38Dv2SkEnZFWRm6GQFmu1jaKDGq6
TLSH
T19A030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 fcd6b6080cf496799a6c868f2d4daf091f1fcde1094e9cd340c1581d961a97d5
MD5 1457a5b8d12857242b8106a1a0718d8a
SHA1 66a8120326966e762edde26af39e74aced7e5df3
SHA512 befc915e143a28635b385cec41f28b9c48223ad80483eb16566d7bbf6336c958be8cdb6bd651be750e33251b61c89c1a3607a2c330c917bf67c00c3d6eab7306
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlBN9DVT:ctGj+BCNC5qFVpKxBLDp
TLSH
T1B1C2A71632BA02023C3DB91D87A5D7371A42B2633058E97B7BE954B60E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c6385ce2bc8fa099de4394928a8a993b5a64a05ebfa9373955df6d58eea8b22d
MD5 ed811913b585c8905fadd34aea52f367
SHA1 179024ed9107c115ca32907fd2bf2d2decb6ae1b
SHA512 5294d6539a537eba1ec9b7862471725466b6cb6ede8c7a5727af54c9071503f440446c8a84f34e309256b9010b65cfc2d0adee3984587af704bf418b2c2843bd
SSDEEP 384:nniF9CcmyWCs38N78TUNTUlIxBrk6ojnF1zCfbLoaKpgF90yZSoe4KV8p0+Ity/Z:iFccps3Mwg4vnzOoNG5SoI8p0S
TLSH
T166B25B36EC69CAE7ECDB4F99E34E7607CEE01167869C9AD4DAC81E0D00C719D530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 862b9b97e76864ad70be256c75f38e711570978d7ac1ac2bda47311fb446e18a
MD5 6984566146de4d334c00e02acbf03ffb
SHA1 e236aec8fa6578b2a3f47ff1ddc93562450c2be5
SHA512 cb043d3280d82fbd09e49dc9ed9508b8a6231d99173dc367a13c0f4520161aa1b51347c2b357b246fd4e17aaeda50addfc0b1c7b2a1f80ca28e64033a6c07e7d
SSDEEP 384:y/iF3tNnNnb9D38NP8TUNTUlIRArk6IXt1zCfbLoaKpgF90yzX3MHa/hJkP8ty/J:DF3jZbB3AwgdX7OoNG73MHACXf
TLSH
T118D24A36E868DAA7EDEB4F95E34E7643DFE4019386885ED4EAC84E0D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4a6ecc05bea4736caacc895516e17bd2874919fadc131e30d1d0deec136cc353
MD5 3c15faf924e8c2fa0e3abfa6a8d9d0e4
SHA1 8d114fdc40890b534a3367b61e0d5c3b2f08880c
SHA512 59fe942f8fd47aacb39cbf7f7ae37285a87514d5dfa491fcbdce3af48f3d85ee25719848123ebdc1e1969e56ee994ee46c3f798b1326c7c6f90dddd51beeab96
SSDEEP 384:yXiF3tNnNnb9R38NP8TUNTUlIRArk6IXt1zCfbLoaKpgF90yzXfcHa/hJkP8ty/J:/F3jZb/3AwgdX7OoNG7fcHACXf
TLSH
T150D24B36E869DAE7EDEB4F95E34A7643DFE0019396885ED4EAC84E0D00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 705dcb6dcb96c2fceeb46673d89ea876ae4795bae4a13e5b5e06d111939050a9
MD5 5cb2b25ceda2aaf73786ead5cba017fe
SHA1 ff4ebef955ecdd025f30375224273a6241dc1eec
SHA512 775f9299a9bb7b67fe62424e134cbd45ce809dc346dd63686fc7211ca7c64149cc1a0eea77a4d9233ce6e5a3a1b0e9e4308a4e2345c4ca00825d445bbe6ae40b
SSDEEP 384:yqiF3tNnNnb9R38NP8TUNTUlIRLrk6IXt1zCfbLoaKpgF90yzXfcHa/hJkP8ty/J:IF3jZb/3AwgqX7OoNG7fcHACXf
TLSH
T1F4D24B36E869DAE7EDEB4F95E34A7643DFE0019386885ED4DAC84E0D00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c86125f4488d2b6e19e041eed81ca6ee739ffd2ccee4ce6668d69afebdf1bea7
MD5 3fa371071592b767cc13ea733a75ed65
SHA1 da0a8aa546cd2cd628881337c400eccf51cb0a2f
SHA512 82b096951a1a65d11f9d4ceaaab274cbbe4aef3dfe530f38b3ae453b324158ad78c0a2055e98fdeb2ab1a73d94d841f572545bd6f8a6d86aa5cf59c6f028628f
SSDEEP 384:yqiF1tNnNnb9R38NP8TUNTUlIRHrk6IXt1zCfbLoaKpgF90yzXfcHa/hJkP8ty/J:IF1jZb/3AwgqX7OoNG7fcHACXf
TLSH
T120D24B36E869DAE7EDEB4F95E34A7643DFE0119386885ED4EAC84E0D00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 99eed550224da0ac033a7de3ebc6b465509e6b232fdfe2cfd7f4c71438df5e03
MD5 5cf2f4d9e9f25810371bd85a6374fd0c
SHA1 796ec1a31fe238fc5193d146362f132deaf969f4
SHA512 4878ca0e4051fb07fa509de7a3adfa7d87623a9395630ffa1820322c8f2680711d4d8c7dddd3da24d441e5c8aa76d48f08f4ac572e9c47eb9130e276e388d125
TLSH
T129515FE14C7D6AC1D4BE0E6F648B38FC82E8D735F1A0347D6868EA950A7961C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6278efbd1ea2a760694d83a82bf9482772b9d4ee00ca57c1ef7e9fd320658bf2
MD5 63955388065e5e6c4efdaefdb91bea43
SHA1 89e8101317be9d2a14bba8e7f265d385a530e7ab
SHA512 d1e85ad1cfe03e9334e55d4354750519dd153d0d9bfc6efbacebb1c623b579a030d337c0ad9dc9500567ff911039e174cb74887098404e9af16e329cb6eec6de
TLSH
T11A5150E14C7D1AC1D4BE0A7F608B38FC81ECD736F5A034792858EA950A79A2C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0186b92294e7f94bd315d9c1d64a0f0245b36b024e1c943e0a5995e05dc23533
MD5 509c091d91ff3aa0c102172431a4fc31
SHA1 33f19f5dca042924c0a2d191ea4e3303dc0d2d93
SHA512 18fbc162db36f718d28c33cc8c054711391c309a4f1fb193c11a3c5a7ac2e099e52f1c0b850ea694f09b7ae149043ba26e17af385d1feb98d300d68fb6ec5eb9
TLSH
T1AF514FE14C7D1AC0E4BD0A7F608B38FC85E8D725F5A034792854EAC90A79A2C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1323278839\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1323278839\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1342558731\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5352_1410911559\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download