f43ac6168294067f51aa499bb191c1876f93ac73b0517bc3f9edb74638e6a90f

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260604-ph16asft8m
SHA256 f43ac6168294067f51aa499bb191c1876f93ac73b0517bc3f9edb74638e6a90f
MD5 16fe4a66b3f6895cf3541063714c6d50
SHA1 066c42e2f5cb35a00f8eeef1743b9c698412f648
SHA512 89ff4e1c8d3fdc1ff00c0d49beb41f3385c7470314aa1beb33aaaa67b5032e83ed878749990432818acb84cd6f7dba9b1957a5d1a317159a630c2b12e09c1d65
TLSH
T16051206CA4F6200C6267246E77DF1205B425511B3909FC84FEAEC3106F4262A9AA37FD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_594791436\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_1294637706\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_594791436\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\us_tv_and_film.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_870362548\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\test.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250498054004831"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{0D8AF394-67DE-4366-B85B-C4A00F35D2E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 6136	5156	msedge.exe	81
PID 5156 wrote to memory of 412	5156	msedge.exe	82
PID 5156 wrote to memory of 2112	5156	msedge.exe	83
PID 5156 wrote to memory of 2112	5156	msedge.exe	83
PID 5156 wrote to memory of 2112	5156	msedge.exe	83
PID 5156 wrote to memory of 1248	5156	msedge.exe	84
PID 5156 wrote to memory of 1248	5156	msedge.exe	84
PID 5156 wrote to memory of 1176	5156	msedge.exe	86
PID 5156 wrote to memory of 1176	5156	msedge.exe	86
PID 5156 wrote to memory of 1176	5156	msedge.exe	86
PID 5156 wrote to memory of 1164	5156	msedge.exe	87
PID 5156 wrote to memory of 1164	5156	msedge.exe	87
PID 5156 wrote to memory of 1164	5156	msedge.exe	87
PID 5156 wrote to memory of 4576	5156	msedge.exe	89
PID 5156 wrote to memory of 6132	5156	msedge.exe	90
PID 5156 wrote to memory of 1968	5156	msedge.exe	91
PID 5156 wrote to memory of 3488	5156	msedge.exe	93
PID 5156 wrote to memory of 4192	5156	msedge.exe	94
PID 5156 wrote to memory of 2264	5156	msedge.exe	92
PID 5156 wrote to memory of 4192	5156	msedge.exe	94
PID 5156 wrote to memory of 3488	5156	msedge.exe	93
PID 5156 wrote to memory of 2264	5156	msedge.exe	92
PID 5156 wrote to memory of 1780	5156	msedge.exe	97
PID 5156 wrote to memory of 1800	5156	msedge.exe	98
PID 1800 wrote to memory of 1216	1800	msedge.exe	99
PID 5156 wrote to memory of 5052	5156	msedge.exe	103
PID 5156 wrote to memory of 5052	5156	msedge.exe	103
PID 5156 wrote to memory of 5268	5156	msedge.exe	104
PID 5156 wrote to memory of 5268	5156	msedge.exe	104
PID 5156 wrote to memory of 5684	5156	msedge.exe	105
PID 5156 wrote to memory of 5684	5156	msedge.exe	105
PID 5156 wrote to memory of 248	5156	msedge.exe	106
PID 5156 wrote to memory of 248	5156	msedge.exe	106
PID 5156 wrote to memory of 5384	5156	msedge.exe	107
PID 5156 wrote to memory of 2012	5156	msedge.exe	108
PID 5156 wrote to memory of 2012	5156	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe8468c188,0x7ffe8468c194,0x7ffe8468c1a0
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2573164309306950066,17434059471320201344,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,16500383389459756635,18409230529984035412,262144 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,5942318421560056031,17309007921676325598,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,11170273086337936268,4486875899805268732,2097152 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2425274865091428295,16338035567461466376,2097152 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6897452718006621619,15722029866129445288,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,15159623880367975067,1725491565039296740,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,341619407018506085,13898179351270424976,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,5695166748289932444,12600268174816011778,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,11009922059517735603,6669851503035306733,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,10457647681414281447,13226813142636548054,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,5550161179687037700,8567022733711291213,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,5550161179687037700,8567022733711291213,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,975433134899732498,917868665572108524,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15182365685510586149,846946050078086595,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,17325156634742928031,6133596773896557905,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,9722957238397448824,2248687520229929399,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,16498279760765764090,11843653772268893746,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,18290129406898647722,519611867245323951,262144 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,935308393316711300,887632978934953470,524288 --field-trial-handle=2192,i,4784241747342799700,17389677915394461472,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0619002255dc749dfc3d68bc85043cd691db5daa91d94c3ce0e6ab9bc5bdee0e
MD5 74cea417fdbcfb613ae7a2f12943d5aa
SHA1 5a059d339bab4d43424b0f2560a5922a201e2249
SHA512 3bb115a5035fd4132e3534d16d0c892dd5414b7c08a91f03617229e7f71a8e35c68e02ead5787bdc3ed9917043c0d92ebae1363f460b72f7de8a1e59bfcc0d34
TLSH
T15DD0A7A655263457FB28A67AB193D603234B84314D825202D149DD084B5C5E245C10C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 aed93fca10b8fc76f1faac03eda245a48a3d7e3ea1adf5fc83d94a88e9505e3b
MD5 d7f0b78c44a3195a1dd227c31f032fab
SHA1 f506d50da3be24e2c4e74b730f05e5881ac9c0e1
SHA512 0fbf271cd8afc159e52fa9ad6ed237795ff1663541dc0a01d3334c9758a5fe09c0d57b291b8857bde955fe9753e9a07835a6e44f9ef301c56ec2fa72e7e74c3c
TLSH
T1F5F0A9BAC921AC2718FD4B1971A5174EE75113672780945F3B3D960C4FF563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dccf5688fdc1c983563a569ccef02f661226f9816cbebed7ac5effa8e56612c8
MD5 2e4524ca1a682d745cbe24831012b8de
SHA1 eabc6179efab8ee7a7f1480e96069538288fc17f
SHA512 667f0c84604b938056a08a1b5601c3591ad45b1738a89f7b61dce6b5c7baf78921a3ec2513a2837b425efaf81c704d3b6121fb40f3e476a8971cd187b8983ae1
TLSH
T10341AFF7C2E8856DCA1196F0AA18BE2FCE2D0914432C3D5A89E4AF1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7fe24bac5a039e4d086f6ddca545827b6a83ac5963ccb8ccd4093f79cfee61fd
MD5 ebb3341d4a43351e32d4513d106bff3a
SHA1 6a3242c3d4c4998b2812d666181bea4df64bc726
SHA512 610f9626773eb2c1f02eee180cd956e4dbb78c8bf64c903a1e4cdefad9c66c81900ffc56ef22271e1fd1f5be82c13e103863dc0197fa27ef82c03531d2180bc0
TLSH
T1AC416EF7C3E4856DCA0156F0BA28AE2FCE2D0915432C3D5A85E4AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cbf12cc97bd6ac596bfe2259a70a633385b58056cd0891757a93ee6b5d3f3753
MD5 977823dc61e324ec5d8e2bf9e1e4da78
SHA1 272d160c35c5630ed5fc50e189b1d5790023cc7c
SHA512 a6a3f5ac69a10ec04851ceed14f356c9753406e272652ff13b7d71450c5bde1bd6844b9a23c0bd7c8d831f63dc589b05006f97ed054328d1002551f8f7e49ca7
SSDEEP 192:sxZTRFyMqZjK1Ml8MFs/fcsle/E0CXUyynDqzodpEu/W6+WNGY0d+G0WIg5ZL2J:sxZTuds/fcs0c0Ly8R7/bG5v/zC
TLSH
T1CC72F806AA385D7B8CDBD219FA457F63D7F9157292401E449AFC8F0C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 538ccf27ce651f7b854f79342f484d64eeeb68784e2fa742ee89f5d4b0b7b122
MD5 2b61ee8d30461279f95f0b2cd74e26e8
SHA1 399697ad5f328ea85b4f31f78dd8b771d32241d1
SHA512 810e0ec6e71743ea8df15651fbfdb3664db985331d73950421e7bee3325f510420aab1c93580f89f454ba98d2d25f17eda573b16681aa6187bdb5e84bac4b397
SSDEEP 192:sxZDRFyMqZjK1Ml8MFs/fcs8zeAxE0CXUyynDwzodpEu/W6+WNGY0dgW0uIgjdJ:sxZDuds/fcs8KA60Ly8z7/bG5jdjn
TLSH
T12A62E706AA3859778CDBD309FA457F53D7F9157292905E44AAFC8A0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 615ac5d254d12ee59ece1b63c84016fb6f2ced9dd3a6677bf705fda17eef413c
MD5 040f4d54552e57ad1342bfa90bf6fa03
SHA1 9405b3d7ded03233c2a0037422754b296b079350
SHA512 8df6f56547889a07e6df84a9f98d481520a03a08101e8cc42ba8a770f0c97832a1a1e9ecc7dfb6de6a307d4e9bc03c92fa409d8dbf63e1b070a861a789bcb367
SSDEEP 192:sxZTRFyMqZjK1Ml8UQBFs/fcsle/E0CXUyynDqzodpEu/W6+WNGY0d+G0WIg5ZLC:sxZTuqHs/fcs0c0Ly8R7/bG5v/zC
TLSH
T10372F806AA385D778CDBD219FA457F63D7F9157292401E44AAFC8F0C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5b7eb819a7137fb0e6443b545ef4f3ba0a351bb473bdac596b9907f17590ee39
MD5 1213bdc86f5eb7f55891e1f5193c9980
SHA1 cab7b4412122aae0f48e0e2f5a29a3dedd79f496
SHA512 b30d9a9154f62fc23aa7a0b8e55571bb4df1c135a9f5e59ed2fc4eb14ac53ab35b84cd73a8358cc7e64cd1efc2526bb859f8eaad018c50a6a1dbcc103dad5ae5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3K3pQLls:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKK3pj
TLSH
T1C7031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 83f78bf54095cb8539c060a47894c798c5d16b29f72713d35ccfb30bf70c94de
MD5 aaf2664fcd53eccbe460b1d8296fa702
SHA1 1e281097b0e59b122f7c6032066a54f058c701ad
SHA512 c3787698cc8bc6f0b38840d10dadf03a7ec0087d77f8be5f58b8ab4c9d9ea2d712c73c02544b50c5a0996020f455f5132d3761610ef51d1f2fae968ea574b52c
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72ji:AFBHhTofhno2mB21q3Llbfe3sLDdeEpx
TLSH
T15EB29F52717B12023C3D291CA7A29B370E8272A3345CA56F77B900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 397d025ca1e1e26df1c4dd415f3f6380076b83b2c0b68e0cf70b801302192273
MD5 a175596aa397ee84bca714b164772942
SHA1 a6710bc087adca38f06acda51bc5c20914511e63
SHA512 7e60ba1589b9a82f62e5c74d7e335c025e28c8494809f0f7fd71610c0e3dfcec7bb4da3000fcd60c5557cfeec0e91d705225064787a80efb0548cc4ee846e4fe
SSDEEP 384:n5diF9CcmyWCb38Na8TUNTUlIRsyIbhxdjf+8oug9FfggF1wKxZTHy/7IgsPa:yFccpb3lwgshtoug95vTw0Zm
TLSH
T1F3B23A32EC64DAB7FCE65F99F70E7A07DEE05163858889D4DAD80D4D108B19E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 747024c7e0d773be428b2372cc959c4cd10d54d9e77d33bec79d171e175266a6
MD5 5ae1d57a655c49d0d29db5c7a002af78
SHA1 4796510811b12b31acbfb4939506d378cdd6973b
SHA512 2283c0e6a7cd8f94d0a1aa7c389f725f3014e2651f3f19259163ef86049cf47b8a01054148b9d3873ccfcb82b20df521b38f7bcada29caecc8e45cf70836b37c
SSDEEP 384:n0iFACcmyWCb38Na8TUNTUlIRsyIbhxdjf+8oug9FfggF1wKxZTHy/7IgsPa:PFjcpb3lwgshtoug95vTw0Zm
TLSH
T197B23A32EC64DAB7FCE65F99F71E7607DEE05163858889D4DAD80D4D108B19E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0a181957eab215115c5f655a1ae1f5f8ab6014d03f88cd3e06fe2bb447dbe530
MD5 b92e3e771b9fe48a80775b86519b5145
SHA1 d25a9ac9a7b736998e7e112780e38f33c51aa71b
SHA512 b232c4a20cac236d4de10f568ebf84f62bbd4dfe492924aeba9eb0400b75f30d92a58750bf84dc429105bcc904c5f51a34eed4a1f1d992f0eb3eeee62f632ab6
SSDEEP 384:n56iF9CcmyWCs38N88TUNTUlIxBydvxoiadjf+8oug9FfggF1wRzhkP+lFYS/r15:jFccps3/wgMTOoug95vTwRzhkoFYS/fz
TLSH
T1C6B26C32ECA8DABBFCE64F89F74A7A07EEE10163858889D4DAD81D5D00CB19D1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 564e13ab36093d08223af39f040476a3bf26bac99d854a71a2b25c7e43153aa1
MD5 ff984edb87b8ea7c1d89e85d675db7b2
SHA1 51748036bd04d54c0258a832dae0abb03b85af6f
SHA512 92bc9df6f7aa863fe73c057216e7022ca35f29cf09fd2ef7009e4b12ec707e711431326b71a0c13953762804e32bd662c04d69f1ec4dc2783bb18ba0249ebf83
SSDEEP 384:nBiFWtNnNnb9J38Na8TUNTUlIRwyIbhxdjf+8oug9FfggF1wKxZBagoMgIEiHy/6:oFWjZb33lwgshtoug95vTw0ZBanMJkk
TLSH
T1CBD24B32DC65DAB7FDE68F89F31A76079FE0415385885AD4D9D85E0D01CB29E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 69b5accf14154bfc010ae3443dbe480c8480e986303618c5240f24607daa5e5e
MD5 06893861ce24eb3687d0959a571cd93c
SHA1 f6ce0b71f06bb7facd80892888bb22945fae7814
SHA512 f9aed862d3b64c54bcefce4581f61059f14c67208d67c41417ef12fde0a572f30398887cc7bf5e4f3b047f8e5667727cbdce4a50b02cc0e959caefb8c0d7788e
SSDEEP 384:n5diFACcmyWCb38Na8TUNTUlIRsyIbhxdjf+8oug9FfggF1wKxZTHy/7IgsPa:yFjcpb3lwgshtoug95vTw0Zm
TLSH
T16EB23A32EC64DAB7FCE65F99F71E7607DEE05163868889D4DAD80D4D108B19E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 959c933ba2cea11c53af7ab6dcfdbdbb0bb03c81e773cc32f76fff9d2df34356
MD5 29b681da7ef6f4edf703bbde9d171c0c
SHA1 31d5c10dbf1df9d5e5b3d1087fd159dc6526d8b7
SHA512 40ee925ed3bc63c1e8b970061864c42317aba3e617e63d82499acd7e42e5ccca6838e8237029ab41b54ae0a7a224eec352e2a5fa777ecc182387a038f9613cbd
TLSH
T1B0415EE15D3C2AC1E0BE0E6FA84738FC91ECD32AF5A474396848E9D8067924D254183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ea25463caaa1ed6ff256546a188a9000a171bdd7715f064cc13a5c63cb933dc7
MD5 f348c4bd5e41bc8ce562d482cc3b648b
SHA1 dff854f842e5496a1dc50e45d021d35bd2de27d8
SHA512 01783d28a79315ee5d9f0d7669dc63c72c5ab44805701b2f8a06bf852a54d31da0fa10311c65e2a0f31268fea067060dff503c4cf6a7b0bbff451ed6e23c9fc2
TLSH
T158313FE15E3C2AC1D4BE0EAF644738EC91ECD726F5A474396458EDD8063924D664183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 490b6b45971a8ac651a52e0d4b53a9db1dec10f5f0cdc0b2ca77b937ad7a6c92
MD5 c6bfbb292fa5ade957d47c416e506fa2
SHA1 72e4632e36607166f084a10e7aa4dd03b3a0b996
SHA512 abd6bf807ae61cf266beb57b9925e032fd4ddd6f458985552e40743e69eb38b2a19a0e9ee2549c9c4071794b9f985bac31769b3f2783ab1d5ec12f13df3a878b
TLSH
T10E3141E15D3C2AC1D4BE0EAF744B38FC92ECD726F5A471396448EDA8063924D618183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_1294637706\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_1294637706\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_594791436\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5156_88501773\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download