0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca

Analysis

max time kernel
148s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260603-2bt5maez21
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24
SSDEEP 24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
TLSH
T15296A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\af\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_320002036\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1621953245\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1621953245\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_320002036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1947271632\_locales\lt\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2096	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249995869631535"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{499BC42A-45D9-41E0-BEEC-2A4E3276C3A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 5784	4000	msedge.exe	80
PID 4000 wrote to memory of 6036	4000	msedge.exe	81
PID 4000 wrote to memory of 2096	4000	msedge.exe	82
PID 4000 wrote to memory of 6036	4000	msedge.exe	81
PID 4000 wrote to memory of 6036	4000	msedge.exe	81
PID 4000 wrote to memory of 5652	4000	msedge.exe	84
PID 4000 wrote to memory of 5652	4000	msedge.exe	84
PID 4000 wrote to memory of 1860	4000	msedge.exe	85
PID 4000 wrote to memory of 1860	4000	msedge.exe	85
PID 4000 wrote to memory of 2064	4000	msedge.exe	86
PID 4000 wrote to memory of 1860	4000	msedge.exe	85
PID 4000 wrote to memory of 2064	4000	msedge.exe	86
PID 4000 wrote to memory of 2064	4000	msedge.exe	86
PID 4000 wrote to memory of 5752	4000	msedge.exe	88
PID 4000 wrote to memory of 5752	4000	msedge.exe	88
PID 4000 wrote to memory of 2300	4000	msedge.exe	89
PID 4000 wrote to memory of 2300	4000	msedge.exe	89
PID 4000 wrote to memory of 828	4000	msedge.exe	90
PID 4000 wrote to memory of 5560	4000	msedge.exe	92
PID 828 wrote to memory of 3332	828	msedge.exe	93
PID 4000 wrote to memory of 5860	4000	msedge.exe	96
PID 4000 wrote to memory of 5876	4000	msedge.exe	97
PID 4000 wrote to memory of 4628	4000	msedge.exe	98
PID 4000 wrote to memory of 4528	4000	msedge.exe	99
PID 4000 wrote to memory of 4528	4000	msedge.exe	99
PID 4000 wrote to memory of 4408	4000	msedge.exe	100
PID 4000 wrote to memory of 4408	4000	msedge.exe	100
PID 4000 wrote to memory of 4648	4000	msedge.exe	101
PID 4000 wrote to memory of 4648	4000	msedge.exe	101
PID 4000 wrote to memory of 2536	4000	msedge.exe	104
PID 4000 wrote to memory of 2536	4000	msedge.exe	104
PID 4000 wrote to memory of 1052	4000	msedge.exe	105
PID 4000 wrote to memory of 1052	4000	msedge.exe	105
PID 4000 wrote to memory of 4900	4000	msedge.exe	106
PID 4000 wrote to memory of 1904	4000	msedge.exe	107
PID 4000 wrote to memory of 1904	4000	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa2decc188,0x7ffa2decc194,0x7ffa2decc1a0
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,7892611457862260365,16004419372199616070,262144 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,12683081021733294809,8376427409604279141,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,8146466468591969861,14300523837406601059,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6073337376824732938,8398024863794101880,2097152 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11371433149151402584,11553614320734465126,2097152 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4014707334560790289,16932625784826238719,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,3106590723302013021,11500031002552651925,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1721784497800399292,3628143007221752474,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,16180023164551693935,16856554562742750826,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,16180023164551693935,16856554562742750826,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,4230233687498344677,14199939194864486867,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7258656154134862261,11938238372322227724,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18436890315881538152,3309597355547324259,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,8582474530031000584,18229168507113628256,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6269040252829245637,11864581264258729032,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,18004575605470884575,15695763000937778800,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,15164326033640284509,4430623109518458146,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3136626510162664216,13962515062092931505,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,7681681983390513922,14236016633619435885,262144 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6188010647603990459,6626374537248912052,524288 --field-trial-handle=2984,i,15553917950986383378,10915656949099537041,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

4678b175-f322-469f-95fb-7fcf81479dd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4678b175-f322-469f-95fb-7fcf81479dd2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bc700d003481e11ea775698f3bdbe6917a9a213e0e5147b908ad478c383660a8
MD5 aa7ed8084b53a6ea96bf49d625773f68
SHA1 79e01a6348d9e5a4a701124c4206c105753a19a0
SHA512 da92ed22fba2374ed137cfe70b57edc5aae3fdc07c2924c4dd3d35faeaa39ec435decaf107e8918723a32e57cbadd99130c6ce6d16a3da2454b70cad44f595c8
TLSH
T14BF0F4B6C921EC3B18FD2B2A60A4574AE74513572B81894B3A3CC20D8FB163B4685C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a4deec15d79c4fae993426e135bd7c4a3a42d392446089dad6056df4ab660bfe
MD5 6832f6e3f9877926c3591890deb038be
SHA1 a2fc760fbf0366db68efedb2360c36ed7f172d77
SHA512 bdd28baeae93e504f3ca6eacbc3e3f6a741a364e4e3f6697f8980988aa854ea23505b9252ad849b7be9309c863cabd5d0aa7a4b32a1edd9c211d7f9a3ca9a105
TLSH
T1A74180F7C2E8856D890196F0AB14BE2FCE2D0954432C3D5AC9E4AF5B93E2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9a016e78cf45ffc69bb03585988abe99007fa7d9b465ef8054b7968c68a92c59
MD5 f7cec4a87fcea341146b35f50e4491cb
SHA1 8ee1da81cc64f4d4db6bd175971987e02e5f3c63
SHA512 2a64edabfe91cce619f8da16cff5666c68fe1ee8fbcbc2ef2cd5a3ba373a4e3deb070e1edab82d2136b02f15c539264841592595e52272fd5c34d3aab5e0e0e8
SSDEEP 192:sxZNRnyMqZjK1Ml8MFi/fNsa3+KTG5GN2owUzodpE7/W6+WNGY0htj/Igj+5J:sxZNsdi/fNsa3+Uei2zC/bG5Lj+j
TLSH
T1A262E9166A64597BCCDBD31AFA55BB53D6F9153292904D44AAFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2d91690538d99572ee6c28dd4a006347b75d0606f7fb5efb669d131ebfc0a7f4
MD5 68fdb3955e6bcbaa751f3930169d200a
SHA1 55bdb777fa02d319e6f91e0938ceeb46f3999efb
SHA512 f934c583e7b64a76ef2b3085da8b6c262f9baf1b822b3f5b95022aebbbad131978110e5d4845e58e4efcbc6dcb5c0bd74ad5dec1cdb89e876e37a68bed8b095b
SSDEEP 192:sxZNRnyMqZjK1Ml8UQHFi/fNsp3EKTG5GN2owUzodpE7/W6+WNGY0h4j/Ig5LYw/:sxZNsqli/fNsp3EUei2zC/bG5Oew/
TLSH
T1B472D8166A64497BCCDBD21AFA55BB63D6F9156292504E449AFCCB0C04E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f86e544077b6d032e0394770573a23d1db0d1bccdc6e7bb6eb0578c717c54467
MD5 859386c94023b8c38b146cd2a22b3729
SHA1 1ac9cd75b6a59e650303ac823bd5d66619f91117
SHA512 0bbe7b6267a1afce0edacb3d58608cc8d5623eaba312285963ab24605ca8d4b411f0b1abdef6de57e8535802e6ffa41aa08eacf9f7b562f1bae0cab5cbde6f29
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Jzx4LlA:wQAKq8y02yqEnjbWRmj1QWTu1jaKJzxz
TLSH
T1F703FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ad5b3183464d8044d5ba86e89466b3593e6773df8f3981f438462f540bca23c4
MD5 e1955893dafa0133114340cb5b76798c
SHA1 69164ff9915ab2666e04c91fcddbfe1968000b1c
SHA512 14e5fc9e4e176b6441732c40efa3cd3cc8327f533cad66afd5de21a570adf702d470c92d5b7eef4273492e1a4671c4fdc578d7f86e4ac1310a83d57b1ba524b1
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5o:GZLVDJjEDPV0/Zdu7H7
TLSH
T1A3B2490232FA02423C7D391C92969B674A42F1633459AD3F7BB900B65E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4a3a47d2c4e5e3844440a1e75a528cd61a2da0b41175fe8b8eb7002d37c3ffca
MD5 1c2e46e5f279d1d211de683fcb417f56
SHA1 7ea61ab123dd1644a4b5da5cda3451fd08e1b8c0
SHA512 0a6c566a3eea1543305cac9b16432b36e760c39b1b81f26d623d8ccff6332e3bcb64a620cbedf33dec8898b0c7c92db39f01aed359b24028d479251a17a239d8
SSDEEP 768:7FqjZb83qwgdKekm7k6GSdZ5uN/+SoVXzjzin:oo34k0Vn5M/+SQzKn
TLSH
T148D25D329864DAABADE74FD6F70A7743EFE4026389885DD4EAD84D0D00C729D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1172c503745317d589c6b72e952c17cc24cd40bbd5693f38e0d09cfabccd331c
MD5 76cd81a8451c577436f44e32296b3c8e
SHA1 83fdb4b83ac99d7f88170c8931f4a6623fca5951
SHA512 3b163bbe998a009f8b78e37a2e73ca56853627e7116ef8c30a41ae6e5b48210b715d5744e897e2061200c9e546d894b525477163b1953225c8f137f23470038a
SSDEEP 768:TFqjZbF3qwgdKekm7k6GSdZ5xN/+SoVXzjzin:gp34k0Vn5v/+SQzKn
TLSH
T139D25C329864DAABADE74FD6F70A7643EFF4026389881DD4EAD94D0D00D729D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8f2172e775827d31049aef3c1e652146ac4dd79ed9bc46d9d33deafe62952805
MD5 b84a5c9fa97505d36dbfe9933fa4fffb
SHA1 c518d7a2c6bfaea44cf1f916f0099014458af77c
SHA512 13b7715e6c2048ca599487bd0d9098b506aceac6fecb8b9a03f82b1caa59fbd77205cc6b47567c25dd255a804e48e0fd597fdd5c6ab3254c22e7db85b4fbd084
SSDEEP 384:nuiF9CcmyWCs38NJ8TUNTUlIxBPm3ek32nn9B+QSs4Jfb8G1kdZBYN9e4KV8p0mb:FFccps3WwgPKekmGxwGSdZqN9I8p06
TLSH
T1B4B25C36EC68CABBECEA4F99F74E6607DEE05223868859D4DAD84D0D00971DD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 026fe62402b41894f5b230e6ba201ee5b42ce0b78fe246de6aec3a0735fdf2ea
MD5 db08b3a346906206da9523c1238589aa
SHA1 1866b8592e4b0205750201656c19b45322943e72
SHA512 697ad4756f64db6f651313f4a5624e62d8a92235a82637855e174270beb87ea8a1f4b03b73f8398e5730601f0f2527d1de9511d7904a2ddac5837c9a47600538
SSDEEP 768:dFqjZbF3qwgdKekm7k6GSdZ5xN/+SoVXzjzin:up34k0Vn5v/+SQzKn
TLSH
T1AAD25C329864DAABADE74FD6F70A7743EFF41263898819D4EAD84D0D00D729D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1485ffc74338175f692c74d539fa6b769a2af5799aefbc6466b1c414b446025c
MD5 11dbf83bb92e010dc3a6d2b5d2f10cf0
SHA1 0c971cbb891591df86a9f94e2e235960883ae55f
SHA512 aa2aa1084b1c38c32f9df710687bcb2e87d516a56536b7343050dd1abbd37ba287251be0ecbe842098fcdd5bf901ae8df1fb2198b264f3fe20ded0d91d0fd8a5
SSDEEP 384:nIiF9CcmyWCg38N18TUNTUlIRCPm3ek32nn9N4ru4Jfb8G1kdZBW9O5tVN/cty/D:TFccpg3qwg0KekmM6GSdZ5xN/x
TLSH
T1FDC23A32E868CAABEDEA4FDAF70A7643DEE01163858859D8DAD94D1C00871DD170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.3.2\typosquatting_list.pb
Size 517KB
SHA256 11b1bddabaa5cf6005782a0dc1a19060440b8197c32d3cdc1bd33c6dec9541f0
MD5 659ffd17d4a31fa1244b7065b3e317c7
SHA1 98945de704d7fa4c6c6daca6db00baa30912183e
SHA512 f609e0007515cd608c69b59961302efc55edbb3b8fc45e0bfeded4bbac92ee3c1bfc88b228c5f7bfc1f21bd3660b2a23db5d690c1410634e2f6800ca5ec7b471
SSDEEP 3072:tibsRz1ELJN1UkUhOnDPvuVUL7PkPPDNzBJHfHQ1vJ//Q8fX0/1R+kRME71RDoDs:UsrELJNiIl7cnJ/IJ/lX0/71mM1oDs
TLSH
T1F2B4C5B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0f7725dda07ad2522847585080e95f1d172ac6c97c56d0a473668f8a809302bb
MD5 40cc5e3db6dfb829969d743f43a12bdd
SHA1 f8db62606b3bf9030692d9eda29196a1e99c7271
SHA512 65156fa447d6f2878e5fcb268b655864f0e6cb04a40514ef16017e556c41a076083d9a6344d097fbe9d7abef833481bdd5f55091eef22f0ba4a6818f588891f4
TLSH
T1E1412EE15C3C2AD1D0BE0E6FB49B38FC81D8D726F5A4347D6868EA94063964E648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 360bb49664b3c37997462721d2ccd728cbc37192af34fa6db44645bad8a3cf0f
MD5 ccc22da45681bf5d6ee0115d2b068b39
SHA1 06cd6b76f93e5273f1a2c1dca2c9bac14e17b603
SHA512 9b48ba3c5b7820b609d0eb55d5e82894d03029d6f6fd7b5d1b82026011efa3c7525aa0f6e00370a6f1f74b28c95b444d0441cf5aa09ce5a4fb441bd09a3cdec1
TLSH
T1985130E14D7C1AD1E0BE1A6FB08B38FC80DCC726F1A4347A6858DE99067961D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 447964fbfeb7be0704d1e46d8c43ae026739a82331fc77ae23f4a5912e41853b
MD5 bf51e02e411bbb8c2530ae5d25da8af8
SHA1 e1773340086a76e23221d3179a5330576faccb91
SHA512 0615c991efa53fd9ceef87bde5d6a0754b539927461c22e24a790240ca682cbed0bb66d417a1aa95a0e88cd3b8fc3af99ac7a30360c63e323180f2abf8da98da
TLSH
T11E4121E15D3C2AD1E0BE0A7FB49B38FC80DCD726F1A4347A6858EA98063960D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1621953245\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1621953245\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_320002036\manifest.json
Size 117B
SHA256 473b5d6799fcebb95d36a41984295e959b5a68511b680e16c14931b6916838d3
MD5 c430c940527eb60cc47a78b6d396b0db
SHA1 0def56c8552852d1e3a44d7a590bd4260a55379c
SHA512 d0d7e119653231d7759507d52cdffbaf965d806caed3323d2d8be8a21ae36ad7f330c2052b96d690677c8271ffd73b75cbb51a0573b28c3e92795df569e8b6a8
TLSH
T18DB092B00C0AA03B22809760EDB066C2C3F80218F8011B1E088032491F8817880366E1
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_57934595\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5560-166-0x000001DC45AE0000-0x000001DC46AE0000-memory.dmp

Download