e40c34970877e4f1f3443fb0eac9f9ce1020d2eb257332208a9107b1415962e7

Analysis

max time kernel
148s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 777B
Sample260602-phx4mses6j
SHA256 e40c34970877e4f1f3443fb0eac9f9ce1020d2eb257332208a9107b1415962e7
MD5 c5e4ce957bfdc0d1355d6cddecb508ac
SHA1 893104d5ec34522d452506d0f69b24d1f5f6f660
SHA512 3d4e55598d464db38be117d073d21e7fac218e8b2667739afa005f162d2304c01acd889a7f177f2dfcc85998772e5793f6c9898758ed8e0e08b8dc58841076c9
TLSH
T18601F1C21C50E44D0720854534B6E22E89D64AB56950DC603CDC2AFC4BD0B8ACE7F810
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_1808468869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_275698434\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_275698434\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_1808468869\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_275698434\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_275698434\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6044_914627201\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\sv\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_878334463\_locales\as\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248767496729827"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{75E910CF-A35F-4A07-9F8F-E231C214C9C3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6068	msedge.exe
6068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 5140	6044	msedge.exe	80
PID 6044 wrote to memory of 4488	6044	msedge.exe	81
PID 6044 wrote to memory of 4544	6044	msedge.exe	82
PID 6044 wrote to memory of 4544	6044	msedge.exe	82
PID 6044 wrote to memory of 4544	6044	msedge.exe	82
PID 6044 wrote to memory of 640	6044	msedge.exe	83
PID 6044 wrote to memory of 640	6044	msedge.exe	83
PID 6044 wrote to memory of 2332	6044	msedge.exe	84
PID 6044 wrote to memory of 2332	6044	msedge.exe	84
PID 6044 wrote to memory of 2332	6044	msedge.exe	84
PID 6044 wrote to memory of 3312	6044	msedge.exe	85
PID 6044 wrote to memory of 3312	6044	msedge.exe	85
PID 6044 wrote to memory of 3312	6044	msedge.exe	85
PID 6044 wrote to memory of 5772	6044	msedge.exe	88
PID 6044 wrote to memory of 5772	6044	msedge.exe	88
PID 6044 wrote to memory of 3440	6044	msedge.exe	89
PID 6044 wrote to memory of 3440	6044	msedge.exe	89
PID 6044 wrote to memory of 3464	6044	msedge.exe	91
PID 6044 wrote to memory of 1560	6044	msedge.exe	92
PID 3464 wrote to memory of 4064	3464	msedge.exe	93
PID 6044 wrote to memory of 5956	6044	msedge.exe	96
PID 6044 wrote to memory of 5352	6044	msedge.exe	97
PID 6044 wrote to memory of 5388	6044	msedge.exe	98
PID 6044 wrote to memory of 1948	6044	msedge.exe	99
PID 6044 wrote to memory of 1948	6044	msedge.exe	99
PID 6044 wrote to memory of 2796	6044	msedge.exe	100
PID 6044 wrote to memory of 2796	6044	msedge.exe	100
PID 6044 wrote to memory of 1548	6044	msedge.exe	101
PID 6044 wrote to memory of 1548	6044	msedge.exe	101
PID 6044 wrote to memory of 1588	6044	msedge.exe	104
PID 6044 wrote to memory of 1588	6044	msedge.exe	104
PID 6044 wrote to memory of 4900	6044	msedge.exe	105
PID 6044 wrote to memory of 4900	6044	msedge.exe	105
PID 6044 wrote to memory of 6068	6044	msedge.exe	106
PID 6044 wrote to memory of 3624	6044	msedge.exe	107
PID 6044 wrote to memory of 3624	6044	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ffdcee7c188,0x7ffdcee7c194,0x7ffdcee7c1a0
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,8026137238479285047,12343512690739409877,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,15092256377873180574,8953967534914008719,262144 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2642168638297699047,13621144878015988117,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,16957288837421779781,5922366161960881974,2097152 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,10829651292369894106,7514417632929401946,2097152 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,9340152167921884234,10287905365452883307,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,11275560752247727432,11217375109740690146,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9978353560453742285,9922027395550231402,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,18315328447622455928,16697417611113292698,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9978353560453742285,9922027395550231402,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4066717164769935533,4294326612867091767,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13722655165957700211,5134275215178251231,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15811945672347127880,8206323979741181483,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,9826828578145234226,9914414896102822607,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,14644041649942470943,2272535864959747819,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14031223683448803601,16458732803007777319,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17190248948531126081,15333239063624844994,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17992226961928390261,4327856244592731175,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,16608795453240659977,6458241582171959315,262144 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,1399415103911541457,12037756914797390294,524288 --field-trial-handle=2200,i,7535587583349949336,14243905348334315280,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 224a29b7baee72c99cc6da95ff1c3d38d8cc903a2520e972359149ae551c022d
MD5 3e52c3fce1a01430ca6a96a2fb681899
SHA1 4db7e697b5a6b1796bf191aa09e6acb389af561b
SHA512 76c1d47cf0e65387b7fd7ac3edd92fd81ab1581c1537b4ed4228bcd1a79d87e6a8c9d054c6258a4000d18e2382b6cfa983af0d8beea6daadf269445e314afec0
TLSH
T1D541CEF7C2E8856D890195F0AB19BE2BCE2D0914432C3D5AC9E4EF1B93E2471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fc7759c6bb234d5a0a79d9275dc28ba42e2086c2843d8d57a2a000f64176041c
MD5 5f19fe4dbf6902afb9e4a5bc2463eb85
SHA1 f3de17be5d646c6e191cf592ea697cb213c1f40e
SHA512 a3c8916fd53739c0e973c526d00265347d8c45e23e694bbe0b765f2aff21e510711487f0d674c4d59b37e675136b8ef163e8e87e54261043bd7af575e259a821
SSDEEP 192:sxZVRVyMqZjK1Ml8MFY/fmsT+tKQ7PgYsv0+zodpE0/W6+WNGY0ZkY1IgjJ7J:sxZV6dY/fmsT+tV7orv0lB/bG5hjJN
TLSH
T13A62E91A6A3459778CDBD319FA557B53D7F95523E1800E48AAFC8B0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 09dfb805c00726786da189d24ecb34ff07afb815af4f78c484c0894324b2f77d
MD5 2243e07dbcc09300404e02cb03ae2998
SHA1 ca2b2fa28a3729a7ad3b8e77ffff86d714ef4cbc
SHA512 768d7ac120848d94bfbd5c478e6d0c76045a723caeb89ab085ddde55beca9426e5fa2a908d84f3d72ac0c69d0941d94bf0d5c5c4557a2d6746b42fce56999a74
SSDEEP 192:sxZVRVyMqZjK1Ml8UQ9FY/fmsB+bKQ7PgYsv0+zodpE0/W6+WNGY0ZpY1Ig55mSh:sxZV6qbY/fmsB+bV7orv0lB/bG5Q6Sh
TLSH
T15472E81A6A345977CCDBD319FA557B53D3F95523E1800E48AAFC8B0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8db2624b77b6e1c17fc4bbb3962c2b2567a4465cd87394ef6fdc1e3c216130ab
MD5 7a68a07f5480e5427ab5cf9964c483eb
SHA1 b41c84147a73355631f8a29d0e20927ee13ea324
SHA512 d1ced24abce6bccd8fc6fb7e5e45ecb9ca1141f1d4b27879ed78ea5e02559d596c7baf2c70449d2a7120e9ba9df231c45ca2b8ab41336442510bee380f9da830
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XGq9LlS:XwZh38Dv2SkEnZFWRm6GQFmu1jaKXGqy
TLSH
T186030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 3519577c55798628d8d4bcb645d82b24fd84f289990ace02bb9ef1ab73bf6b13
MD5 36e2c43088dd48d24c890223300a70be
SHA1 d6f9322036da49fbd7cdb35907cecdf434f196e9
SHA512 644a6912720911a58d5ea87846cb2854fee54bb40c2304001c6e6ed0e8d08b5fca30f3ef75909d1f7310d16a873d06a02670320c8320d0d0e1a5b3059be53e6e
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl5tj4V/bb23rxlBA:ctGj+BCNC5qFVpKx554t/
TLSH
T16AC2871672BA02023C3D791C87A597371A42B1B33428E93B7BE854B65E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3fbf75a-35fb-4f14-9dcd-4dfa03565fb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3fbf75a-35fb-4f14-9dcd-4dfa03565fb1.tmp
Size 649B
SHA256 700e1f6637311a53bf00f7a0dfe1dc45157e5be2aa6894f18a432f5de0dbe3cd
MD5 0163e3420a314ce7f0d9c90c11ae20b0
SHA1 ff94a403df35c3309147dc0b75dfb28671c3578c
SHA512 e1b9a0edf380d0825b63a9c4ffd2ef00921ababdcac1161169327d5155a3f3245f5d83d79795f2c56f586e41076ebcaa5768536a60ff7ce21f410bec7b23daad
TLSH
T1B8F02DF5CC219C2708FD0B2934945B06E751137B2B40495F3B3C930D8FB563B459591C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dc0fc8109a53022b430f168e145427371658f981fe5509f9ce4aed62f452af66
MD5 6a3835a02ef5e370236838b554b46b7f
SHA1 662e8fb839019a945be5d9aa2c879c2057b8c958
SHA512 13029c70aff555ea8d6c66cd10f2cf01cf5b3a636dfa5c53266deb15775de111f28f4d24a20e5f4647dd0cbd3233282e96e5d44175f15bcf0583dfb5dad4e705
SSDEEP 384:yviFStNnNnb9t38NW8TUNTUlIRrrk6yUX1zCfbLoAjFQXOyFDV8jZALEnh5uty/E:3FSjZbv31wgeCBOoAGlFDV6fDo
TLSH
T16CD24A369C65CAE7EDE64F9AE71F72439FE401A3958C2AD4DAD84E0D00CB19C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c3e064ca47f74bb19f06b84bdbcbc76953044c83a12b0322f8fcf14e3013cb0e
MD5 e879329b5739c4bb97bd8e631365a15e
SHA1 4e315676637b065756149ab82df30b9727e0ec32
SHA512 7eab29569e06196d6e09a4d589adf5c5ed5a234247dc7e7b91ac08a65e77158241e4b815ab999f63ba26e25beb23297eb7dc5d9152f34c7940f1f24a91ca24e7
SSDEEP 384:n5iF9CcmyWCs38Nm8TUNTUlIxBrk6oLUF1zCfbLoAjFISwe4KV8p0CPty/7Igr:QFccps39wg4nUzOoA6SwI8p0R
TLSH
T1D9B25C36EC68CAB7ECD74F99E74E6A03DEE0616385885AD4DAD81E0D00C71EC170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6453e0df57a9a4a4bd3dc54c8c62952e0c282331b81c2ea93ab143539b2ee721
MD5 b81d04a709cf5a6986d3511600949f27
SHA1 0251b699f0ec297ce6a13218a6ed0a0519d05efe
SHA512 613f21b7c36102c2efa876085eb269c53c9a8e2fe35393f72d22662e9b1230db902eec6941c084e5ccb613398669f7674089eb123406cdff0fd347f09cef10be
SSDEEP 384:ymiF1tNnNnb9j38NW8TUNTUlIRXrk66UX1zCfbLoAjFQXOyT3V8jZALEnh5uty/E:AF1jZb931wgeiBOoAGlT3V6fDo
TLSH
T183D23A369865CAE7EDE64F9AE70F7643DFE401A3D58C2AD4DAD85E0D00DB19C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4ad23f5e43c9af5abec1286adeea9a77c56b58f57ec02306722fab4aff1b9f51
MD5 26550519e250eb68b6b38d2cef0904a1
SHA1 1efeae0039203b34e11893875a004556f2227755
SHA512 2a2ff9fc5b734d603e82fefe5091385683614bc07e6e196879971cf9379d71363473f6a018559a14927b4dae207bedd1759a787f0c3d2d7677e454672d65fc4c
SSDEEP 384:ymiFStNnNnb9r38NW8TUNTUlIRrrk6yUX1zCfbLoAjFQXOyT3V8jZALEnh5uty/E:AFSjZb931wgeCBOoAGlT3V6fDo
TLSH
T1C2D24A369C65CAE7EDE64F9AE70F7643DFE401A3958C2AD4DAD85E0D00DB19C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1a85d45e6f82a472b620796ca5eebf759e7d5f008e3b524f9bc99dc91a9e5f6d
MD5 8e0ac76aef3180878db958990684e87d
SHA1 62bedfab55a5d42be02e42957b6250f8a3b1325c
SHA512 7c4e8628febd3d82660c2d7694211db82f1ae269338147ff333dfe61698aa183bd95591296dc4a02b8f564c38e1e317df0b95fbd110e7bbfae6fa68c325cc216
SSDEEP 384:y5iFStNnNnb9r38NW8TUNTUlIRrrk6yUX1zCfbLoAjFQXOyT3V8jZALEnh5uty/E:VFSjZb931wgeCBOoAGlT3V6fDo
TLSH
T1FCD24A369C65CAE7EDE64F9AE70F7643DFE001A3958C2AD4DAD85E0D00DB19C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b05f73ae147214b282c65ffadbb38f536298c01ddaf1cdb02981159ed61ee07d
MD5 5c8a1202d65e6e6ef5c4f223f4b72113
SHA1 9cf1b1cdce3dee34a564e70748ae8734aefcf4e5
SHA512 dd5ec9c716341d40c09c126d1fb4e05bf5907f56a55c36aeac2a5cb7bc3cc49812b7649c2d78c1269ba83ca90bab749ee1d32dbe2cd1345735895da8f8f85eea
TLSH
T1CA415EE14C7C1AC1D4BD0E7F608B38FC82E8D736F1A035396864EA940A79A1C748483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cb64f8db0760053b1af16fed98a479d575db30958b474e3fafd733233d32cd20
MD5 6ed8e47f0c650d06d7dfc4ab2491b285
SHA1 5843fab2bcd9f6e446bbbf8d275cb543f001fda8
SHA512 1f4bf323974dc4447feb5f146c7c874ea2fc44a401f47cfa642b09fd78cfac91a310127f212c61ef0343211eeb27719dc58fc995a2093df65bac2ebc3edbf42c
TLSH
T102513DE10C7C1AC0E4BD0A7E608B38FC91E8D626F5A034792894EAC90A79A2C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e8968aafa0c49a10870f4596b517ddf52279d67e760948e7ea1453635a8e2093
MD5 b9c7ca929030b4e2d67a1fd39b9e0e98
SHA1 414e37e1760301881052ae77ee158f309ecc58ee
SHA512 cff3aea49a74e85c3a524e752357d1dd3178048b91366ae7f486ce88a809fa6f5860eb74aa757a7715e73cff808edc6858bff8bc0652d1c04772dca40a97066f
TLSH
T153412DE10C7C1AC1E4BD1A7E608B38FC91ECD736F5A034792864EAD50A79A2C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_1165882695\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_1808468869\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_1808468869\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6044_275698434\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1560-166-0x00000220ED8F0000-0x00000220EE8F0000-memory.dmp

Download