7b93d7c4fae015cf19ba7cb28d3e8d49bf6b0be7d6aa783646b0ef33bc19ea39

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JAVA/TP1/Visages/docs/serialized-form.html
Size 4KB
Sample260601-pgalysdt2r
SHA256 7b93d7c4fae015cf19ba7cb28d3e8d49bf6b0be7d6aa783646b0ef33bc19ea39
MD5 9788b3817c4d7760919e967c196a76a3
SHA1 02dbb84c19850587367ff23ae1ebd4f8ff98a965
SHA512 13ce8de1728fea7880415485a317dd7093b853cddb22d2c40e7ee1822da8a80ca1f7f6077e73598d1f08fbaa2a624ca169b6d4f4fd4572d808b07382e49250e1
SSDEEP 96:OAlgWe5dYpDhFiEXiwjGigv3y0qPdYpDpvZiEXiwc:9SXwDhFici6Zgv3yTaDpvZici7
TLSH
T1AC81321E2C4EB973034A13ADADF10364B6E34037D6B86945A5F9D5273681FCA0F06A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_364505225\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1701382887\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_364505225\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1701382887\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-tk.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247900907635984"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{D80BECD5-B3A7-46EF-8F51-8627ABE50DEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4864	4388	msedge.exe	84
PID 4388 wrote to memory of 688	4388	msedge.exe	86
PID 4388 wrote to memory of 2804	4388	msedge.exe	87
PID 4388 wrote to memory of 2804	4388	msedge.exe	87
PID 4388 wrote to memory of 2804	4388	msedge.exe	87
PID 4388 wrote to memory of 4220	4388	msedge.exe	89
PID 4388 wrote to memory of 4220	4388	msedge.exe	89
PID 4388 wrote to memory of 5260	4388	msedge.exe	90
PID 4388 wrote to memory of 5260	4388	msedge.exe	90
PID 4388 wrote to memory of 5784	4388	msedge.exe	91
PID 4388 wrote to memory of 5260	4388	msedge.exe	90
PID 4388 wrote to memory of 5784	4388	msedge.exe	91
PID 4388 wrote to memory of 5784	4388	msedge.exe	91
PID 4388 wrote to memory of 5412	4388	msedge.exe	94
PID 4388 wrote to memory of 2004	4388	msedge.exe	95
PID 4388 wrote to memory of 5412	4388	msedge.exe	94
PID 4388 wrote to memory of 2004	4388	msedge.exe	95
PID 4388 wrote to memory of 2324	4388	msedge.exe	97
PID 4388 wrote to memory of 5456	4388	msedge.exe	111
PID 4388 wrote to memory of 5184	4388	msedge.exe	112
PID 4388 wrote to memory of 3624	4388	msedge.exe	113
PID 4388 wrote to memory of 5252	4388	msedge.exe	119
PID 4388 wrote to memory of 5252	4388	msedge.exe	119
PID 4388 wrote to memory of 4312	4388	msedge.exe	128
PID 4388 wrote to memory of 4312	4388	msedge.exe	128
PID 4388 wrote to memory of 5792	4388	msedge.exe	132
PID 4388 wrote to memory of 5792	4388	msedge.exe	132
PID 4388 wrote to memory of 3028	4388	msedge.exe	133
PID 4388 wrote to memory of 5356	4388	msedge.exe	134
PID 4388 wrote to memory of 5356	4388	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\JAVA\TP1\Visages\docs\serialized-form.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84671c188,0x7ff84671c194,0x7ff84671c1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13639439381236064215,11349217164122201742,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,10144204515154811952,9828140341003430181,262144 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,13763238473465088519,10974186345841773618,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,11739335504413345132,16907547036385580829,2097152 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,6867817735819754077,10219915360372543034,2097152 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11950492307603235773,15789108930499885970,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6392208426627741946,13797721290008946626,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10338154324677924226,4873721534594911558,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10338154324677924226,4873721534594911558,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9693033304811411474,17799809697075361285,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,4933187596269239828,17711687097499104985,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3698778439516639411,9921599486596633345,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,17482812250227334181,549300565827341227,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,11436140257471766196,185282282099776274,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,13877689543300939894,14523382852035191137,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,11159833035460413351,6924011882563587721,262144 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=768,i,3557057302508392527,5339941730112389075,524288 --field-trial-handle=2260,i,8197454510038008194,15229030505420703342,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1655533689\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1701382887\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_1701382887\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4388_364505225\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

278322e0-c407-4e62-ae5a-153bc4bceb58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\278322e0-c407-4e62-ae5a-153bc4bceb58.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7222c2d04cde814ed656d9e66b156924448070ce6fe2a0698f69f30f295677b0
MD5 5b05f4e8f73a565d2aa8e025bc458ce0
SHA1 43e048d6b9a70f7b16a150ad019fe9e7463e08dd
SHA512 47759651f48a276ef237d31b271812193fbc400742de058a4a82a5fcd0b18fc687ff896d6b3b35e9407d00c7f3c377b1127e3cb112b00e1d0c0289d32e6f981e
TLSH
T182F0F4B6C921EC3718FD0B6870998B4AE75113273B80999F3B3D930C8FB463B868581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45adb14af1bed4dce927a94055c57ea88dfb62267de63b79773efbe75e918a75
MD5 481b7fbbe438b52566606f8777cc107d
SHA1 40808a5d498d7c48213d185fcd15929ab6d0ba0a
SHA512 8ddf1825d2af108d6bc9e4d979c82b4da157f5b0caee2b66402274a365c635828597a164c49478cd2b9607079c6bcc6039f65b8138347de34667c93c1950b3e7
TLSH
T11541C0F3C3E8866DC91195F0BA287E2BCE1D0914432C3D5AC9E4AF1B93E2470E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c0352da7-15fe-44fa-ba1a-7a6aaec3a0f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0352da7-15fe-44fa-ba1a-7a6aaec3a0f7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3e337adcb7f486f2c3397ab67ef2a51f4ae2ba1a77f3fab817d21f542a47d286
MD5 49f52254b8b92ecc81ae10c4e623d514
SHA1 04206394c895a771efaef9b84465e78628443513
SHA512 93e024999fd3d90117e260e5081bafe14291e67c5f19f6167240630299c6e083d02a44b34bde9237d61db4ae407aec3800e30360901731f3f36d6f9fc70f774c
SSDEEP 192:sxZARCyMqZjK1Ml8MkW/fnsspHoaZdIaRuvczodpHjHW6+WNGYvICAeRIgjCJ:sxZAjMW/fnssZoazIKY/DHbGP+je
TLSH
T14462E8066A3899778DD7D209FA45BF53D7F91563A2905E449AFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 34954edc06150c09acca4f2996607e3659a7a032ad24077c980fad82fc457f56
MD5 eaad76f6706bc2fd66782cbaaad924d9
SHA1 9913cb781fcf67210a688be8c346c9c34286dfde
SHA512 7b0595be130fc9528299fd8551c7d4d81b6e5f08c022159bcedf49152d84ac30f4d98f015efdb3d6203995afe51e90663f97ab7f6e4c62b34e1c7300df954e33
SSDEEP 192:sxZARCyMqZjK1Ml8UQekW/fns+HIQZdIaRuvczodpHjHW6+WNGYvLAeRIg5QBbSJ:sxZAjq1W/fnsIpzIKY/DHbGB+cS
TLSH
T1F672F816AA3899778CD7D219FA45BF53D7F9156392944E44A9FCCB0C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 82e362bf178a0a7bc2b818f25e7e414bed4292b97cda77d6e26d035e9056a691
MD5 444c911e3b9e1a520cc3bbffe4ccf59b
SHA1 365e7aa0b912bbc14bbf3b3455246df04036d049
SHA512 a4b4d08db048ac1afb5186102150a00f32f4cc6ff54882cea80b4a0fecf256d8e250c002a659e2b4b05192290f74cf8ae885c6cf879a9b6e09c3fcbaa0fba69b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEysy10Lle:eY8Od/HEnFhWvFvmXu1jawt10Lm2NurB
TLSH
T1FAF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 a4b005a3cb315394987cc36f318c0a75bae9a121ccb0f1096eaeb72aac34a901
MD5 8458698e0c776408ef2273787fb0e5a7
SHA1 2576897171cb4186ed128faf04b07a66be4945db
SHA512 6f3b91e73eaf00edd2b1d69684337a7f926b4256c9340528e99414d883305f62512f64eda3d97dd1732a6cf2382e1697ed2b3e42856976bc1412b714bbedbd95
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG8:05ppxnY753RNBvRJJdt7p5J91dXWD
TLSH
T1EBB27C5A713A0212397E3988B39696364F4135A37058E4AF7FB814A14F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 efc01827a04292692afa68fd5c40f031406d6aa49d81426a03539699011cd6fd
MD5 71f7c1377c77c9797d688ec5db86809a
SHA1 727d66f776ef34a149ac2e0b117b69c6ce564ef9
SHA512 901be03bdf1f265c22375c5e523bb690862e8fa080aca6ea35ef50ca23f975e7d3730b952084cf3af730f4e1c2e794a2b7acb5d1443eec584ff39bd9de5d5937
SSDEEP 384:yNiF9CcmyWCI3sN08TUNTUlI47QckCrkRJphiftGWE3jY18pG+SoVKz6Zl1zr9ya:5FccpI3lwg6kZ3oGWOin+SoVXzjyE/
TLSH
T142D26C32E868DAB7EDE75FC9B74A3A03DEE411A789C85AD4DAD94D4C00C719C070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5b0360296fe3d6d93ae6191fb3638e143f9d729c3638fd7f0921701e16d2f012
MD5 88a62816e1803ba75de1815a3b9974fe
SHA1 4f0bba954787f91b7acd9e65e4ceb1b59f648d9a
SHA512 8937985ec2f67cb32934219658258dc7a50c20b49fbeb3461195d3e88be33e1b84df364e5489985d59bc2a3e88760460db0968f6510b7c1ed54d7d09f32778fd
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9lqKphiftGWE3jyAphe4KV8p0xHDty/8:puFccps35wgbkUUkoGWOW8I8p0hvV
TLSH
T1E2B26D36EC68CABBECE74F99B74A7A03DEE0517785D859D4CAD84E4C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1adecdd6a474b1cd115e682c68d486f449c99767de2ec78723b285db777e0f6
MD5 3a92a4e266381fbf5ad84b89bf432fad
SHA1 f14269e31fb49018eddad80a6327c5ce528c6460
SHA512 ce514878de1b7b01115bc1450f03531a15e80ed6f9aac01e00b7d4cf75d6b1c0f8eee5a6ec3a4e1ad54c41a96913bf15f04b405d66885a5615bb48d6002f98b4
SSDEEP 384:ypjiF9CcmyWCI3sN08TUNTUlI47QckCrARJphiftGWE3jY18pG+SoVKz6Zl1zr9m:8OFccpI3lwg6k93oGWOin+SoVXzjyR/
TLSH
T130D26C32E868DAB7EDE75FC9B74A3A03DEE411A789C85AD4DAD94D4C00C719C070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b9328d49fd014c0309b9af5fc128f2012a320fffea9f37bda64103c0d6f590e6
MD5 7c69a90a7050dbb9c079537ebc552783
SHA1 dc062a0a344c26cbffbc2af0659a9d2896bb3f04
SHA512 e2f0b3ae08a4fc76ac5beea7ab270b2f127aee516cacd829f3ef7fab55287a959b4ea73d2b840a13e66aaeb9b14ffa2997f4ed39ca7cfacc7e2d290ad43db167
SSDEEP 384:yPiF9CcmyWCuU3sN08TUNTUlI47QckCrkRJphiftGWE3jYB8pG+SoVKz6Zl1zr9V:DFccpT3lwg6kZ3oGWOIn+SoVXzjyE/
TLSH
T1BFD26C32E868DAB7EDE74FC9B74A3603DEE4116789C85AD4DAD94E4C00C719C070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 40796bc0d09d6684d27d1bdc3928437e6850b0dc7d3def9d2b6fd28930fe1e3c
MD5 93f6ef23875ac5f74b0ee82356f5ccb9
SHA1 4638a99e5a51ace55bca98531e80faa9d2b4580d
SHA512 7f7ad157832cba2267601604813aefb4c763a50c69a8553dc343fd23569a50d22060669a0cb4af9bc0b41b524240a8014a0c60a89a896059e7de37936cfb71e4
TLSH
T1F24123E21C381AD1D4BD0A7EB48B38FC94DCD726F5A430BD6858DA940629A4D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 43f97e6eb7c84bde5c33060a765d8b91dff2220f67332c2bc903b6830468ef28
MD5 75cec7d417767c25127fde29ddfdf0e4
SHA1 bc29c823683e9500beb9ac460fb044562325448b
SHA512 acffb33a51a58872d479b8bff881ceacc10781d1931b7f17fbbed75a53bb42cf02c3b53faa4f2734ba7c7e7e558cbdcadd11338d191fb5aeed85f0d5a9aeae6b
TLSH
T1484122E11C381AD1D4BD0A7EB48B78FC85ECD72AF5A430BE6C58DA940A29A1D748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4adba7a01ed9db0fec5d6d993185f4ece486ff65b290eaa69b8a7ad0433a5c21
MD5 c18e22fb24b29bb0180ff8598d293d9c
SHA1 2c56b34baecc75f34a6f8f4d0a8e5d34edf03e9c
SHA512 10b1c6302b40b390a747fe1eee2d215c237fb25eeddfcfd0bc2167c188c6283c05ce15cfc965c3d46bbb40d10bbcd1ad310e0ae74743b2c7ebd0aa6342f59ca3
TLSH
T1034141D25C381AD2C4BD0E7EB49B38FC81E8D626F1A4307D6858EA940A3D90EB08143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d14215fc4810c37f0140b406c86871f473b267c4ed72280d7da201f33caa97e3
MD5 99cfeb2e6cd7630f9de4534131a7a39c
SHA1 8e4b2d5d0f928edc86d21e6a4aac9740ffff8394
SHA512 dd6e5410c844e5a1357a1dd110667df9bcd7a1459fe30097afbbd07f42efa5a2a6f4487e9821896865a3af84233326d39af802d8352c9840bff38a845880ed4d
TLSH
T13E41EB48A6FD5148B3776F5A9BF6B86E487FBD772E0A945E10010D4F0A26B04C861737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-170-0x0000021BEC9B0000-0x0000021BED9B0000-memory.dmp

Download