50f8fc00e4c29a089c5a32d75bdaaf2160fc803d26f041b77d5200743a99fb5f

Analysis

max time kernel
148s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dev/default.html
Size 1KB
Sample260604-pfejhsfs2k
SHA256 50f8fc00e4c29a089c5a32d75bdaaf2160fc803d26f041b77d5200743a99fb5f
MD5 d018dd1f572fefdc35827284971353fa
SHA1 c9dce4e37fad2bdb4d98fb1f37eaad951209a168
SHA512 f4136d23d27117c9a70ddb29eedf38f36f1326e6d95bdf74dee9b8549398233bc7d2b494b07e63fdd47c44fe3fe50fae226894c3b4c77d3494de618449f9e2cd
TLSH
T1F21121D08DC2310EA542014CD9577DD1C1E7B05EA760CDCC5C2E20AB2188ADE9C23BBE
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_783757004\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\eu\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_76826564\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_547404593\_locales\en_GB\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3856	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250489760890341"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{2269BC36-3A7E-48EB-9A25-46E93B2E4692}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 3096	6128	msedge.exe	79
PID 6128 wrote to memory of 3856	6128	msedge.exe	80
PID 6128 wrote to memory of 3352	6128	msedge.exe	82
PID 6128 wrote to memory of 3352	6128	msedge.exe	82
PID 6128 wrote to memory of 3868	6128	msedge.exe	81
PID 6128 wrote to memory of 3868	6128	msedge.exe	81
PID 6128 wrote to memory of 3868	6128	msedge.exe	81
PID 6128 wrote to memory of 4448	6128	msedge.exe	84
PID 6128 wrote to memory of 4448	6128	msedge.exe	84
PID 6128 wrote to memory of 4448	6128	msedge.exe	84
PID 6128 wrote to memory of 3756	6128	msedge.exe	85
PID 6128 wrote to memory of 3756	6128	msedge.exe	85
PID 6128 wrote to memory of 3756	6128	msedge.exe	85
PID 6128 wrote to memory of 2292	6128	msedge.exe	87
PID 6128 wrote to memory of 1708	6128	msedge.exe	88
PID 6128 wrote to memory of 2292	6128	msedge.exe	87
PID 6128 wrote to memory of 1708	6128	msedge.exe	88
PID 6128 wrote to memory of 4528	6128	msedge.exe	90
PID 6128 wrote to memory of 2420	6128	msedge.exe	91
PID 2420 wrote to memory of 1676	2420	msedge.exe	92
PID 6128 wrote to memory of 4728	6128	msedge.exe	95
PID 6128 wrote to memory of 3256	6128	msedge.exe	96
PID 6128 wrote to memory of 892	6128	msedge.exe	97
PID 6128 wrote to memory of 4552	6128	msedge.exe	98
PID 6128 wrote to memory of 4552	6128	msedge.exe	98
PID 6128 wrote to memory of 6108	6128	msedge.exe	99
PID 6128 wrote to memory of 6108	6128	msedge.exe	99
PID 6128 wrote to memory of 1544	6128	msedge.exe	100
PID 6128 wrote to memory of 1544	6128	msedge.exe	100
PID 6128 wrote to memory of 6096	6128	msedge.exe	103
PID 6128 wrote to memory of 6096	6128	msedge.exe	103
PID 6128 wrote to memory of 416	6128	msedge.exe	104
PID 6128 wrote to memory of 416	6128	msedge.exe	104
PID 6128 wrote to memory of 1132	6128	msedge.exe	105
PID 6128 wrote to memory of 3528	6128	msedge.exe	106
PID 6128 wrote to memory of 3528	6128	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\dev\default.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffd8b2bc188,0x7ffd8b2bc194,0x7ffd8b2bc1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2264101146457789921,5810481439177569719,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,2381119566408897297,6545246334799211136,262144 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2469070746959308150,17146701897012794785,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,15000536100889655757,14249836933482163362,2097152 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,17856384241277271549,10063692677046441405,2097152 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,13529569968876793940,7366441979279776957,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9254969675510947580,11434272423462701059,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3360643895996146130,13576380624189995959,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3360643895996146130,13576380624189995959,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,4637742265467285645,1549652267208710910,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5422668904859565101,946161923284212900,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9359684353906465696,16023034246018064904,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8576245384024313994,18404510466972902127,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,1653388474492920250,11236875546775239387,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,13552806392642041612,2349607630567893175,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13458180800455961726,1143268527587174681,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,726164089213973485,8593302647344822628,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14995602334692996196,1752861960668901908,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5932,i,7662287758722238452,11956880876190833772,262144 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3735728816341895849,1770067340885380995,524288 --field-trial-handle=2184,i,18178512201890358850,4853018811414627846,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4359db218bd12f739b2503cddb59df29916889efb0348c6f6d828b9cfff23a6c
MD5 b17d0e0f8bd2b169448308d9bacbc099
SHA1 fe104615b664776620345fc9128c4b0f0e393e17
SHA512 a07dc7072b7cb7c729ae40b166519563e2ea3cdeb24c5f3c3c87c957e3c483e3be42bd411569692189590976db6bbb693d8662132e96dc7152c140646789d9c8
TLSH
T1BFF0A9A6CD21AC3B18FD1B2960645786F75523672B81895F3A3C920D8FB163B4545C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e79616c1571bab214d082ca3514b28de595e8a2e16c01d8055230c22293d35a2
MD5 6db4a1e4c60906642a3d0017af9b1701
SHA1 3eed9293d0ac3fd5c0c6cae95550d202e822bcc0
SHA512 7c9cedc625a8b9f14a6b797b7372317f648cadc8cca76afc585bf66184067d1cc194837ce326aa85d3c0bbeeb153976b028ee52fb0c57031200b5e88f2187225
TLSH
T1A841AFF7C2E8856DC91196F0BB18BE1BDE2D0914532C3D9A88E4AF1B93E2471D18165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 aceac5d7880a70c91db9b82b6b2232fc22c4a8c5397b67d02ec44264cf6419a0
MD5 f6c3d88ff8de964ca26bdcf3066d236e
SHA1 d42b59a5f3b7b96ad5475ae72797387f6a6d8d8a
SHA512 aa443f2a564e30aa331054fa156657e935d32b063fe033b0be49e8ee1b354f94bb8414e93279cf0f5bbdba27f24670e1ecf7042325a3dc8e2bf28ef98c19e723
SSDEEP 192:sxZPRn1yMqZjK1Ml8MFz/fasIFKTG5GN2Ow9zodpEx/W6+WNGY0ht0+5Igj+JJ:sxZPVodz/fasIFUei2g8/bG5sSj+z
TLSH
T15B62FA066A64897BCCDBD319FA557B53D6F9553292904E489AFCDB0C04D6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 02f539dd46ae805f56a749b7c8019fde05d3f17785faf6fdb57aa7327814f676
MD5 6bcd3d5cf12866692be134febe7f8f72
SHA1 fde83c2c4b2b8cdb6a165b22450d389346277512
SHA512 54f128daad32c09a92acdcd6b154c8baa693db02839408f3b7a247c2e13290ccf1d6bd37433fbb8e83145566767c2475b6504fb8886b1e1875e20819622e7f02
SSDEEP 192:sxZPRn1yMqZjK1Ml8UQ4Fz/faswpKTG5GN2Ow9zodpEx/W6+WNGY0ht0+5Ig5NB4:sxZPVoquz/faswpUei2g8/bG5ASFXo
TLSH
T1E8720A06AA34897BCCDBD219FA557B93D6F9557291804E489AFCDF0C05D6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b366aa6d104d366d0deb6f1b088ecb48d22ee0f3553d5e1b2807e9b2106fbde4
MD5 02d1e17cfc881951100af3c058597a70
SHA1 631068f1924ed23e2a52e12c861b3fdea0392cbf
SHA512 8a681cfc82a8f694a290d9eeb6c1d7955b80978b02ae37ab5658b847b91e943714ae5a291f38e38572acbc152fed73a3e05852ebce84d8efbf999f6ed8f0b6ce
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3rzx4LlI:wQAKq8y02yqEnjbWRmj1QWTu1jaKrzxf
TLSH
T1F0030A3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6b394b00ea09005ca37a6fcbee84e3d7414685733643eed9f1efb8cbed435c1d
MD5 d45fdcd4e24ddb97c2eb80942f68714d
SHA1 4966476d987f632712564bf7339da19c69256645
SHA512 4c3a1684b33b45636d1b137f5d57383c8c72cfbae68279efe3f4d54e927fec749f85389af38364fb1af36995962becf51f57729581ed8f597b2fbfd087e4e37b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5j:GZLVDJjEDPV0/ZdAbhevU4ek0rotkAy2
TLSH
T1A7B2480232BA02423C7D390C939687674A42F5633059ED7F7BA940B64E67E225EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 733d38c64325512b7a378af7f6f82ac9110e12a7403bd621c273a41a3815ba4c
MD5 2e922397512513f6d037b4aa26ffc09d
SHA1 62d9722750ac9a06f4851138d7cf235d39f024e4
SHA512 0cec518326327d42687fb160f3022a5793db6a78341c1ab39098858eb588dc5a8f086015ea00d5931fafa82b1966f081967ee3c4fed852697a24bd8a6a82835d
SSDEEP 768:mIF/jZbi34wg0KekmOKLbEaVvyqUTZrUJS6idW:mEW3NkybEdtrUU3W
TLSH
T17ED24A32D864CDEBEDEA4E95F61FB2479FF002A3998819D8DAD85D0D01971DC130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ca09704cef7095561238c84992eeb1914e6c2de513831ec2eab1081366471e8d
MD5 7b33eabebaf1755e237617fcb436e5c8
SHA1 28a4b0de4ecb9c47a1a792190ba3de113a433ba1
SHA512 2478f1943070b8d031ad7d1c458bbd45da2378387b15df1a09a4436ed9e54177b1433950b6cf2ae9c3fb9b466d35e71c40e249d4e340f740ad75f634c33e525f
SSDEEP 768:mIF/jZbU34wg0KekmOKLrGqUTZroS6idW:mEo3NkystrJ3W
TLSH
T12FD23A32D864CEEBEDE64E95F71AB6479FE002A3898C19D8DADC5D1D00971DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1226d986993f2d9f0da7b4f958dd74bc01bbe97dd90f346e0ab005798212739e
MD5 240bbff17fbbf8f7dca01cb6879095c4
SHA1 cc4dddcaaf73030fafee5ced9a264d9408f48d53
SHA512 330f15848b1bf71c803675d8119d36446ffb952a9bf0a53ff2d80f994fd0b032bda2614fc84f210d8c12e0a2dbea2a374bf9d955171bd48fcbb63ae080d63427
SSDEEP 384:nQiF9CcmyWCs38Nf8TUNTUlIxBPm3ek32nn9BSQKsSufC8GVMUTZXbPPuLe4KV8I:rFccps3QwgPKekmqpwGqUTZruLI8p0x
TLSH
T1B3B25A35EC98CABBECE74F99F70EA607DEE01263859C59D8DAD81D0D10971DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2f1e34df9c4352747f6e428c6bce4a4af257b1070648749e43fe1790ddb347f1
MD5 ca329fbb8972c060c48ddfe54b63a551
SHA1 7c2cbd3702e60aa88ec3972d94b5bfddbfc1b11d
SHA512 f536878d701a0a70cc8f8956249ecaff869448fcb6ba8ba031c540401e7c07df6b9599a37fbd3afddcf26e97a859d2a01cc7cff016cfcf8a886b4a0a950e63e0
SSDEEP 768:mIF/jZbU34wg0KekmOKLrGqUTZroS6idW:mEo3NkystrJ3W
TLSH
T104D23A32D864DEEBEDE64E95F71AB2479FE002A3898C19D8DADC5D1D00971DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 087b775ec990d6267e12b10b2794a87dc991f807b99f356f69f369212fceff32
MD5 e2bdec4aab4137ae3c1545dc5b9aed57
SHA1 9edd3169480347fa5c2ef1738c14473cc25b675e
SHA512 04fc5e6b28dd22aa107d755ecd7d43dd6c36e3925bde54daed162d6313d6eaed2084441ed801eb2c95932faa3b351f8fc11044b815fbfd436118c4483efae43b
SSDEEP 768:mIF1jZbr34wg0KekmnKLrGqUTZroS6idW:mMH3NkbstrJ3W
TLSH
T1B2D23A32D864CEEBEDE64E95F71AB6479FE002A3898C19D8DADC5D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d5fc1a1c335638cbb38ffcecc303db7575afb72b2800705f403d0af837ef97e4
MD5 9037cb2e7f046a42cd4719561feea7ca
SHA1 be1754b5538b8c2f2a76997c9bfac074b3e53143
SHA512 19eea43b7bf42fa352658554d83fe511e375f4d59219c8d23ddcdabf6b4dd7a53f03f5e9794ff861bf3edb6845d5a96b67d1f313f3dea97347f9abab54542db3
TLSH
T1464130E1593C2AD1D4BE09AFB08B34EC80E8D726F1A470796C58ED984679A4D254183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c6d80be0a11a2a5c72279672eba63f12542ecffd843f32ae97e171967ec45bf1
MD5 63d50e531ade13582f6466f33818ec2b
SHA1 b71339735c7cd67f4b9a8df3a57ace1d8f976b12
SHA512 3dbec0e97a273adb840716e92d160db94b56121ad12303900a97d7a4694ed2024c973db4004655b7615c9b872528ee67afce860b0912e702275d5726d0ef5532
TLSH
T1F3414FE14D3C2AC0D4BE0EAFB48B34EC90DCD726F2A474392858E998473964D254183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_104166602\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_76826564\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_76826564\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_783757004\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download