f3a33ad0c5dcdbba535684fc8f6f8514cc144bea144f099f48e632e724f76eba

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/index.html
Size 27KB
Sample260603-25mmmsgv5q
SHA256 f3a33ad0c5dcdbba535684fc8f6f8514cc144bea144f099f48e632e724f76eba
MD5 2d53b20d968ed838e92efec419fb03f1
SHA1 c12bb51b851e94bd28c35a88e4796da33452199f
SHA512 66e2794754798183109d69097ea9d11cff7fa9d545cd230d03cead441a4bb47d0d23b74a85c3286b21cd9ad734042042e5284f438af1c4ac3ddeb46882cb77fb
SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnE++ggevsu5SwU:z5XX/seq06IfLglbyMai5n30u0wU
TLSH
T167C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1360_1251131757\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1551418797\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250018297254278"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{4E4F9DB7-6BD1-4F92-9D10-F7F93526C44F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 5200	1360	msedge.exe	80
PID 1360 wrote to memory of 6012	1360	msedge.exe	83
PID 1360 wrote to memory of 3776	1360	msedge.exe	84
PID 1360 wrote to memory of 3776	1360	msedge.exe	84
PID 1360 wrote to memory of 3276	1360	msedge.exe	85
PID 1360 wrote to memory of 3776	1360	msedge.exe	84
PID 1360 wrote to memory of 3276	1360	msedge.exe	85
PID 1360 wrote to memory of 2280	1360	msedge.exe	86
PID 1360 wrote to memory of 2280	1360	msedge.exe	86
PID 1360 wrote to memory of 2280	1360	msedge.exe	86
PID 1360 wrote to memory of 3076	1360	msedge.exe	87
PID 1360 wrote to memory of 3076	1360	msedge.exe	87
PID 1360 wrote to memory of 3076	1360	msedge.exe	87
PID 1360 wrote to memory of 2584	1360	msedge.exe	88
PID 1360 wrote to memory of 2584	1360	msedge.exe	88
PID 1360 wrote to memory of 2740	1360	msedge.exe	89
PID 1360 wrote to memory of 2740	1360	msedge.exe	89
PID 1360 wrote to memory of 1772	1360	msedge.exe	91
PID 1360 wrote to memory of 2632	1360	msedge.exe	92
PID 1772 wrote to memory of 2192	1772	msedge.exe	93
PID 1360 wrote to memory of 404	1360	msedge.exe	96
PID 1360 wrote to memory of 228	1360	msedge.exe	97
PID 1360 wrote to memory of 236	1360	msedge.exe	98
PID 1360 wrote to memory of 4344	1360	msedge.exe	99
PID 1360 wrote to memory of 4344	1360	msedge.exe	99
PID 1360 wrote to memory of 1452	1360	msedge.exe	100
PID 1360 wrote to memory of 1452	1360	msedge.exe	100
PID 1360 wrote to memory of 6000	1360	msedge.exe	101
PID 1360 wrote to memory of 6000	1360	msedge.exe	101
PID 1360 wrote to memory of 2844	1360	msedge.exe	104
PID 1360 wrote to memory of 2844	1360	msedge.exe	104
PID 1360 wrote to memory of 3376	1360	msedge.exe	105
PID 1360 wrote to memory of 3376	1360	msedge.exe	105
PID 1360 wrote to memory of 1832	1360	msedge.exe	106
PID 1360 wrote to memory of 5400	1360	msedge.exe	107
PID 1360 wrote to memory of 5400	1360	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffcfe6fc188,0x7ffcfe6fc194,0x7ffcfe6fc1a0
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,11150411374684962965,10256748712650595360,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,12000262102962164239,1192695215544187384,262144 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,3989099859455354819,16789619356498236389,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:13
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3064,i,17814048276294846800,11207360517903542672,2097152 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3068,i,12014314772107075643,5246443296374479851,2097152 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,9122864273324780409,12768896087087204418,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,13278437221765883504,2075498063234348764,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,16277861309275628769,2972907176361305935,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,998483513844534026,2790774757733908177,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,16277861309275628769,2972907176361305935,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5824090397520135899,7520947986898918303,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,12155870510061934897,7469812773110407823,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,8188090841507850660,17679818037125821391,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13363764676936920151,10962970385949848678,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11441418388503339192,12735072743530105842,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,10780706116642050226,16588782401386744099,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18265086514099101373,16768895242706618136,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,7415396667136713286,7068049306304750133,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5084,i,3752401402562311733,16868587887640165749,262144 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,18248808190616930402,10906457250555825115,524288 --field-trial-handle=3724,i,17051369307842739486,5949285115927078418,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3d0016221efd44c1f44ad4120144cde04b1d509ec0e8c3e6f0769f6a0312a676
MD5 0376a97607818d5e37c19b5ab55c875a
SHA1 5189a2c0562297f3716069aa8aa688378111011d
SHA512 bc3bd175a892e53e388249933311231967193b2394fa42067f3e6947edaf3535f6441564647a58e683bc081782c95dbcce51d34968cf9cbdb573770834a0cf3b
TLSH
T158F0A9BAC921AC2714FD0B2A70A51B4AE75513572781845F3B3D960C4FB563B468585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 206e25ef3694d59e65c0d0f1f2ffe22e74fa590df0c48217166ee72997ba5532
MD5 01f3b24dc6f3840552bdf0507a42fe15
SHA1 6376525ec012898d4ea0b310d71ef4e4d5ab0403
SHA512 088a2ed130e0072d6b2242c74f2d238e4c768888219eb94ca6cc78c5994dd842f7c2f98e2338b410e855051993529279b0f8110090e00f2816cdd75746f00802
TLSH
T1CA519DF7C2F8866D890195F0AB18BE2FCE2D0955432C3D5A89E4AF1B93E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8834555e3044e1b96f8fee107babbf6c819647f84cdfd50f81f5323a6c7e6abb
MD5 3477523c7844ad9b5d3888bc85bb6753
SHA1 494be1d9a1f407630e35918aa251c1c8cd416b76
SHA512 c857a2f5e73efa9d396cdfc778ceee0db0892af0e166af35d2db5a4878b8726c8ec8526aead77a9493e5f8cc12e0a85bc3065ddaf42cf07b0d56d6c126b032b3
SSDEEP 192:sxZgRtVyMqZjK1Ml8MFo/fCs8oAYxE0CXUyynDNzodpE9/W6+WNGY0dg8g9IgjeJ:sxZg/Ido/fCs8dY60Ly8G0/bG5nwjq
TLSH
T16262E816AA3459778CDBD309FA457F63D7F9152392504E44AAFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ac449e05c6fdc0eb6fbddc0bc545b70b7c4a78c56f440824ab392d5c2f3a7e7b
MD5 5232ffd680737d95df191b53cb4e8e54
SHA1 3da62f149a2868e1e25103a943c9acf57dfaefd6
SHA512 bb82af67e523054b9cc2278afb512ed1f78ecc29f50376d8364585fb3dba144d63db91a67025f86ba1a629c9eb603daea2c65aa1e441b8bf4e1e563f1ad0c87f
SSDEEP 192:sxZgRtVyMqZjK1Ml8UQmFo/fCsRAoE0CXUyynDNzodpE9/W6+WNGY0d98g9Ig5Nx:sxZg/Iq0o/fCsuH0Ly8G0/bG58wZf
TLSH
T17A72E816AA34597B8CDBD219FA457F63D6F9112292504E44AAFCCE0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7dfb657c2ea87b7f411bdbb0dbf8c41c814dd7c5a07e705035540ad3f435fd5f
MD5 6f3d5a420130d984300262fd40525d35
SHA1 c60b36beb0a248a0587baeb6b1cd14ad1e566b03
SHA512 a89386747fca4c2951d518a421f7bfa71c4a6fdada3b6d8b8b3033cc88dbf3ee67d4ab8ec010790875b300e37e0921f92f0af7e35e5224204e20b975cf89f91d
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3k3pQLl7:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKk3p8
TLSH
T191030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 53b471af7271d8fd497f5ebb85d5c781de34fe3ed232ef2d872c71fee8b753b3
MD5 0ccbabe36c8f3f66ca2a35f33aae5dd3
SHA1 3f86a662218a2c62d536ec2de69e92da95275bdd
SHA512 a400b438fd74f5904631e0dd437739415ca464ecba0b0b42f1029ee01e33dacac95d647f01200e8aa5c513a6de99004dc2c336bd10d61d3aebd4892f661da5ba
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7EL9:AFBHhTofhno2mB21q3Llbfe3sLDdeEpU
TLSH
T134B29F57717B12423C3D290CA7929B770E8272A33458A56F3BB800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4879ae5-d51b-425d-b341-89a874193f53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4879ae5-d51b-425d-b341-89a874193f53.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 065ff03bac83b0730bdef9c1c8efe4947bd7fbc39957743801becaf87746b1e1
MD5 0ef57ef32feafb5ee78109e65be6f5b6
SHA1 57d24b0832ed4a912c587de9787b239c4b7d60c7
SHA512 9b4690d4e2a103d84629f4d5698e8aa226e3c36f2e0a3c968b6c23135153b060341a71632395b70e5071f122c34139d4d812446f5a272d42f27b54f0b161b501
SSDEEP 384:nJiFNtNnNnb9r38NX8TUNTUlIRHyqJljGfb8o/8mkafBQCdLxBagoMgIEVh/Hy/y:gFNjZbF3kwgZhoV5fBhxBanMJEBX
TLSH
T176D23B36EC65DEF7EDE78E89B71A76079FE0115385885AC4DAD85E0D00CB29D230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 db0987c44f44bde199360760f2f4731082c7685e7ae3ae9b57faab12124d3ba4
MD5 280cce488890f61865b26d8896930277
SHA1 3d276830f710230610e076e4828190f6d8b4fd7a
SHA512 8680a0f8298678a66ee0402616f78c84bc8e1fb3b3a98bb63c55e9592efd4ed7f1098768c2836a51ba110b9cc652da1d3f34fddaada7fe30453e0f0b45d2ec7a
SSDEEP 384:n5kiF9CcmyWCs38NR8TUNTUlIxBydv6oSajGfb8o/8mkafBQCHghkP+lFYS/1PHA:xFccps3KwgrvOoV5fBjghkoFYS/6
TLSH
T1B4B25C36EC68CAB7EDE64F89EB4A7A03DEE01163C59889D4CAD81D4D00CB1DD1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d01b46c0ce3a065508338572d6d21a6b377df6fd436202fb26de196126076707
MD5 bc48855afaa9c2d2809a3ce4463287b8
SHA1 ddae3cad67cbec7df2ba4cd7ab15b8b0fd545f93
SHA512 05194d2ad714e39ec820b0e9a2ab636ea27f9d7c95984f442d2b12d4015108c37cedac69d1d8463629a322958f02edca4461a0ec812f15f06ca7064e3ef30087
SSDEEP 384:nqiFNtNnNnb9838NX8TUNTUlIRHyqJljGfb8o/8mkafBQCd4xBagoMgIEVh/Hy/y:hFNjZbG3kwgZhoV5fBKxBanMJEBX
TLSH
T198D24B36EC25DEF7EDE78E89B71A76079FE01153C5885AC4DAD85E0D008B29D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7b531c7f0cae03ee93dfc2cee833c25a1d8e89cfe3545b50608bfc107d27ceb3
MD5 d619e541deb8ff8f1a65869a44c34be2
SHA1 6a42726266dcb8622e6e0fe481285440027b67fb
SHA512 c396ab1693ca2bdb73f56a9f4bf9496fe222f5ad5cd20b541da3b8587a7c63747c09924878360bfd985718ae4e6c2e40f5980fdf9c769623db7a908bd22158ef
SSDEEP 384:n5UiFNtNnNnb9838NX8TUNTUlIRHyqJljGfb8o/8mkafBQCd4xBagoMgIEVh/Hyq:1FNjZbG3kwgZhoV5fBKxBanMJEBX
TLSH
T121D24B36EC25DEF7EDE78E89B71A76079FE01153C5885AC4DAD85E0D008B2AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 604d93ecb2c984ccca1340641372fc541e230f329e87c63b23c2b58e48d00199
MD5 b124892cfa5a22b1038c045e09001d78
SHA1 46fc6e9fd0c4e805a843c0f8ed436255fc665a25
SHA512 dbb86b4eed556b4bf862cc8082c931326720a5b523a917a26dd97eb13f0ba79550724715221a825e20db5504922b43f3246477cd9af0cc5e082cb306a0ce224c
SSDEEP 384:n5UiF1tNnNnb9f38NX8TUNTUlIRLyQJljGfb8o/8mkafBQCd4xBagoMgIEVh/Hyq:1F1jZb53kwg7hoV5fBKxBanMJEBX
TLSH
T13CD24B36EC25DEF7EDE78E89B70A76079FE01153D5885AD8D9D85E0D008B2AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.3.2\typosquatting_list.pb
Size 517KB
SHA256 11b1bddabaa5cf6005782a0dc1a19060440b8197c32d3cdc1bd33c6dec9541f0
MD5 659ffd17d4a31fa1244b7065b3e317c7
SHA1 98945de704d7fa4c6c6daca6db00baa30912183e
SHA512 f609e0007515cd608c69b59961302efc55edbb3b8fc45e0bfeded4bbac92ee3c1bfc88b228c5f7bfc1f21bd3660b2a23db5d690c1410634e2f6800ca5ec7b471
SSDEEP 3072:tibsRz1ELJN1UkUhOnDPvuVUL7PkPPDNzBJHfHQ1vJ//Q8fX0/1R+kRME71RDoDs:UsrELJNiIl7cnJ/IJ/lX0/71mM1oDs
TLSH
T1F2B4C5B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ae892492d31cd3b0c80a2e01b94f29129b99dfc46a4325183d60712c90d5ba42
MD5 66e846276cb0b17f596e303db2c49ee8
SHA1 4b569399f11fa7a1e405c487482641f9c9623831
SHA512 392f51295fd3388f5364b7c665b28d1fc6e322c3ef709fad2e2712506834471c48d58f75a55421246c3b177575af9fb684ded5738b4a6cd6768466b59458a4b6
TLSH
T146411EE15C3C2AC1D0BE0E6FA48B38FC82E89725F5A435396858EA94193960D648187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 da6708b22e3e6c8aa9f3b0f5f3b55caa848395c90f9e67b5e14f09308d2c9b26
MD5 1f5e95782924a5140f9723daee9774dc
SHA1 ea949b38eb0a47461cd8c03bdbd314af99f93d33
SHA512 38e8dc90f335f4cf0f07409206b70f708acc0be4daa9400e81ee76468ebe8a8cdfa6f4e25796990e50e8f0695ca363de762a8a66bdb666da5604ad6545b089da
TLSH
T114412FE11D3C2AC2E0BE0A6F748B38FC81ECD725F49434396818EA98193960D648587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9654a8f462ef9093798c72af4bc02468b138356987b58378c895bea45bef07e2
MD5 2fff429e6e06a4f4e0cf79ef599b59c2
SHA1 98cb72e5d9037bdfab760bcf51178f5ff75413ef
SHA512 b8d8faae836b8628a83a076c0079b7aaea65ff00f6c50a5dee2fee39296baa9eeaf346fe53bfba1ca690b87027749fb7636533c13b496700e376e7a60f2dee30
TLSH
T1054141E11D7C2AC1D0BE1A6F608B38FC81EC8725F4A434396818DED81A7961D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1100537287\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1100537287\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_115941346\manifest.json
Size 117B
SHA256 473b5d6799fcebb95d36a41984295e959b5a68511b680e16c14931b6916838d3
MD5 c430c940527eb60cc47a78b6d396b0db
SHA1 0def56c8552852d1e3a44d7a590bd4260a55379c
SHA512 d0d7e119653231d7759507d52cdffbaf965d806caed3323d2d8be8a21ae36ad7f330c2052b96d690677c8271ffd73b75cbb51a0573b28c3e92795df569e8b6a8
TLSH
T18DB092B00C0AA03B22809760EDB066C2C3F80218F8011B1E088032491F8817880366E1
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1360_1241697143\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2632-160-0x000001BC653F0000-0x000001BC663F0000-memory.dmp

Download