248592feddb036c7d635c5349952dc473fc26de5eabccadcee94b64e929670d0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
utility.html
Size 295KB
Sample260604-phm9faft4p
SHA256 248592feddb036c7d635c5349952dc473fc26de5eabccadcee94b64e929670d0
MD5 1c0484ceaf14bea6d8066e638dfbd49c
SHA1 4a7e7fc951e63663d95d471b782d88e2c124a516
SHA512 658c3311819c5f43240a88e9a73c3143aa68f842539eeb6d0e16ef8730b65ae7810648bbe8823babe71eddeb711b781b0801bd6ec6eca0e829cc7a01d0d8a81d
SSDEEP 6144:1Edo2Cp6Edo2Cp9lNuO+L6qFnxw7A+27rpZioI:1Edo2Cp6Edo2Cp9lNuODqFnqk+27rpZg
TLSH
T17A54123157813DBB583CCA8C71D13E842E98DECFC6B8924535F6A0E382EE751ADB1259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_1107502103\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_1088753544\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4724_1775093684\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4724_234179581\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1780	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250493251117563"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{E4C9662F-1B6D-47A1-AEF0-F8C88321170F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5696	msedge.exe
5696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 6112	4724	msedge.exe	84
PID 4724 wrote to memory of 1780	4724	msedge.exe	85
PID 4724 wrote to memory of 856	4724	msedge.exe	86
PID 4724 wrote to memory of 856	4724	msedge.exe	86
PID 4724 wrote to memory of 856	4724	msedge.exe	86
PID 4724 wrote to memory of 1188	4724	msedge.exe	87
PID 4724 wrote to memory of 1188	4724	msedge.exe	87
PID 4724 wrote to memory of 5836	4724	msedge.exe	88
PID 4724 wrote to memory of 5836	4724	msedge.exe	88
PID 4724 wrote to memory of 1924	4724	msedge.exe	89
PID 4724 wrote to memory of 5836	4724	msedge.exe	88
PID 4724 wrote to memory of 1924	4724	msedge.exe	89
PID 4724 wrote to memory of 1924	4724	msedge.exe	89
PID 4724 wrote to memory of 3848	4724	msedge.exe	97
PID 4724 wrote to memory of 3848	4724	msedge.exe	97
PID 4724 wrote to memory of 5920	4724	msedge.exe	98
PID 4724 wrote to memory of 5920	4724	msedge.exe	98
PID 4724 wrote to memory of 4424	4724	msedge.exe	101
PID 4724 wrote to memory of 3660	4724	msedge.exe	104
PID 4724 wrote to memory of 3660	4724	msedge.exe	104
PID 4724 wrote to memory of 3660	4724	msedge.exe	104
PID 4724 wrote to memory of 5068	4724	msedge.exe	107
PID 4724 wrote to memory of 5068	4724	msedge.exe	107
PID 4724 wrote to memory of 4788	4724	msedge.exe	108
PID 4724 wrote to memory of 4788	4724	msedge.exe	108
PID 4724 wrote to memory of 4788	4724	msedge.exe	108
PID 4724 wrote to memory of 4252	4724	msedge.exe	109
PID 4724 wrote to memory of 1660	4724	msedge.exe	125
PID 4724 wrote to memory of 4296	4724	msedge.exe	126
PID 4724 wrote to memory of 3724	4724	msedge.exe	127
PID 4724 wrote to memory of 3668	4724	msedge.exe	128
PID 4724 wrote to memory of 3668	4724	msedge.exe	128
PID 4724 wrote to memory of 1972	4724	msedge.exe	129
PID 4724 wrote to memory of 1972	4724	msedge.exe	129
PID 4724 wrote to memory of 4008	4724	msedge.exe	132
PID 4724 wrote to memory of 4008	4724	msedge.exe	132
PID 4724 wrote to memory of 3584	4724	msedge.exe	136
PID 4724 wrote to memory of 3584	4724	msedge.exe	136
PID 4724 wrote to memory of 6008	4724	msedge.exe	139
PID 4724 wrote to memory of 6008	4724	msedge.exe	139
PID 4724 wrote to memory of 5696	4724	msedge.exe	141
PID 4724 wrote to memory of 5592	4724	msedge.exe	142
PID 4724 wrote to memory of 5592	4724	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\utility.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff988d4c188,0x7ff988d4c194,0x7ff988d4c1a0
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,1527281853094830031,18216104142475432406,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,6999022078240156362,6410618750088585490,262144 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,10992015864767123726,5962662496137566721,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18166938140590185420,9468043935584182322,2097152 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,15070653737958949058,760901313057384965,2097152 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,13515041555509927424,4122493096005295729,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7204797290541573447,1065249240740847465,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15678083275509353135,18037266921444558030,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15678083275509353135,18037266921444558030,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6012,i,14052985955781039209,17728078519455726080,2097152 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3324480664592985649,13734299215634422319,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3604,i,2336337175618433231,15027769485178150065,2097152 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3005604019165730543,3770663833359556878,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16059901744027416613,4590966975496286288,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,1237093207568659383,11658638415074290864,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,3304341831538016349,8347412681276417419,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15194716900406108594,824506262121066909,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,10744436147172487266,3537011517545175964,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,5950561497134420671,12405388631739255150,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,7075442734876298657,8787267897011094876,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,11889203427131912631,6600950560012867916,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,12395242789397473510,4541069056645347029,262144 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6544752741736315738,11784857927867098259,524288 --field-trial-handle=2276,i,15301591043112869885,14364742175780004889,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4724_1088753544\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4724_1088753544\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4724_1107502103\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4724_2101195475\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

816b62fc-ce85-4e69-9798-0b04c5f286da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\816b62fc-ce85-4e69-9798-0b04c5f286da.tmp
Size 27KB
SHA256 6606bf3258f9a6001018121171dc9bdb0fe96b011b2b0c41253c28d6b54013d2
MD5 1403103cdd3ad1c098e8b8de941c67a3
SHA1 205419389a429c339357d2963eb73e7ef8c5aee5
SHA512 7b728c0cf55743b4d1b291c3e9f307ffbe64152f65f3b6e7b53338d810409fa5ed63014b4383e689508dc432bfdb6af8983c544184981c1b3693d671b1a70b77
SSDEEP 384:nSiF1urQXin91ferIsNc8TUNTUlI4sQckCrlFG4pvBftGp+Mgj4Q4LHppX2BRr49:ZF1urh9QrI5wgjk2GujGPVQu7uT/xQX
TLSH
T180D24A36D864DA7BEDE74F85F70A7603AFF441A785D85AD8EAD80E1C01872AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

485e8f39-35d5-4c29-99ce-768cb6cbd817.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\485e8f39-35d5-4c29-99ce-768cb6cbd817.tmp
Size 15KB
SHA256 3edce2e17790746929bc1ba4b8848907715f2768d88fe966ba07024a514a7245
MD5 6d6abf230555936e64635c6ca7aabd9c
SHA1 7b51da34ed0ec4f6cc34bc7759ffd12b1cb027f3
SHA512 2ae2c2d2868646b811cd7ff3c0f1e7a0d2b043a64c96403d5c118d2d8c75e1d04934a4549443f6de179fa8c810b46e97c8c782adbcef3957c5c9f250918322c8
SSDEEP 192:sxZMR6yMqZjK1Ml8UQK99/flsTICiZdIaRuvtzodpHLHW6+WNGYvHSLzIg5U8BJ:sxZMPq89/fls/izIKYmrHbGj3nL
TLSH
T1CC72F806AA3449778DD7D209FA45BF53D6F91573A2904E8869FC8B0C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7737e4714177345b12cf36caa9c8aac80eb8cd332edb7873f2281bad27a78934
MD5 bb2cfe6a872f1fa0266c93fa572005cc
SHA1 0406f48c43c0d4e19c5c690b5e8d4ceaf3fc41d2
SHA512 8fae0cb99f8bed3848fcf34026f43eafacb89c3fe9d851305e22b35ce54d94fb940a02bb56fcd2919aa543100e19c58d40f554e3a0fb5357c7eec380b94a4f58
TLSH
T179F028B6CC21FC3718FD0B6870594B4AE75113272781889F3B3C920C8FB463B458981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89db83d32c4adfa0417daeeef6ce4b0afe9aa6fc803f6f1ec25661cf964f07a5
MD5 3cad4025966f0948b910bdadddd65731
SHA1 71351599bf2c6dd6a6c835e3c59de07253753f58
SHA512 f506ccbfa064808e5243355887aaf027583b545d9f082a337ea4885a1992899c692e0520cff2dc9761563aacf07d1affb697038862ca5a1d349ca7d199740ac5
TLSH
T1F6419FF7C3E8856E891195F0A728BE1FDE1D0514432C3D5E85E4AF1B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6a7a0ea97ce489c0b0c42fa48f74e38d2d0cda181455639dcfdb26892f7ebf89
MD5 dc48110baa76c4774956e67cb6bccc96
SHA1 c6436d685a952994b5673c63d506d8e916a9380c
SHA512 c23c6d7e9caaf81643ea9154f2b3473868fa951a8ffc93231bc679b92717004a4ff38af0e76709fa3bf012bd97a2b7ad78ad064d7c818e2066a64aa1e2c2aae5
SSDEEP 192:sxZMR6yMqZjK1Ml8M99/flsshIC+aZdIaRuvtzodpHLHW6+WNGYvICSLzIgjxJ:sxZMP19/flssZ+azIKYmrHbGN3j7
TLSH
T17662F906AA3459778DDBD209FA45BF53D6F91173A2905D4899FCCB0C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 263a5ddd44befd8c0e218c6588e107bba07f5632228c907460ff52391b7981df
MD5 d5ef2cc9fbb30e21d9e12ee10495badd
SHA1 60d725bbfefbd1626b2ffe4a1c44775c1d2b9687
SHA512 8f89a9660401f71fcb917fd9f8a7273a1622489e4115df3a2c1806457ddf700b301f2d95fb118329b4799de7cd91af4ad0dbcb4531123981c17a69900f385900
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpysy10LlJ:eY8Od/HEnFhWvFvmXu1ja5t10Lm2NuXi
TLSH
T135F2FA3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 024927515c8cbdd853d161dee05d1a73e8099a7e75eab77557a17bf41b05b809
MD5 ad28a592757d026b7ad6f979e8bfe3c7
SHA1 1252430d08053f268c87c82966e662381b7bdd07
SHA512 1480fa997d7eefa7472de90c733bcd61d1aa32b37fba36e1e48b6f48184f9f42421f338527b5a3a8abdaf1db0f286791b799810777f68a8e48d770ed0081b379
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrU:0LppY93PBZJPtN53Jpb
TLSH
T14EB27B5A703E0211393E2988B39696364F4235A37058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bb0b4b9635467c8293217a3b95250b344a2c43527acccadb5d695f99194bc7f2
MD5 0132e9544545ce8f3f8b5a0f7166896f
SHA1 2bcb37cb91451298d1251824ebcaeaac5e946258
SHA512 e9c093805b2872093a7e09dc8daa6c67f2f1bc04606d42b3d5688f840bbcdd4e8ab4ba96dd635211f58875d8ef2a4b2a4c6a18737984f7f37dbe16317a2d8a9c
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lRKpvBftGp+Mgj4KXphe4KV8p0PHTt+:pAFccps3iwgbkU3kjGPVKHI8p0PU
TLSH
T1C9B25C36EC68CABBEDE74F89B74A7A03DEE0126785D859E4DADC1D0C00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d7df589190ff5e89ee5f1167d78a99eb3a2d0f9ba2035d4806bca447deb56bfc
MD5 89142cf898bb3a037692b24d653f13a8
SHA1 bb7d31566acbbbf2e7e3b217eaa839e20b9d1ecc
SHA512 6cbc3ed0bf35965bd734842087ba6cc1eeeb41716f229bc6c3facc127f8a838377a610a92bc988548e2303581825805fc72bcbd74168362f7c3888880bbb5198
SSDEEP 384:npViF9CcmyWCx3sNc8TUNTUlI47QckCrlFG4pvBftGp+Mgj4Q4LHppX2BRr4s/xW:pcFccpx35wg6kuGujGPVQu7uT/xQ7
TLSH
T137D25A36D868DAB7E9E74F89F70A7603EFE4526785D899D8DAD90E0C01872DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6558c4264912de15b79f2f55a1b7bd3549ea22966d699a092d3bc384bca5f89b
MD5 43443432b76108d7930bac6d654650a2
SHA1 c27ea00b8836df8204aa08f508586dd4e4a76c35
SHA512 4066ee28bca448fd603b53568c373a50200b911a64bc1aee2c3e918ec1f670c6af65a27427c42851f8f148fff87bbc2828132c64c27040b62b57591d96e103ad
SSDEEP 384:npViF1urQXin91ferIsNc8TUNTUlI4sQckCrlFG4pvBftGp+Mgj4Q4LHppX2BRrA:pcF1urh9QrI5wgjk2GujGPVQu7uT/xQX
TLSH
T185D24A36D864DA7BEDE74F85F70A7603AFF441A785D85AD8EAD80E1C01872AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 327f508f16f50f81bba3463b7e496977a9dd7da07beddcc1c0b870e2481180f7
MD5 5527fcc2eb7b74a010e970f13441c683
SHA1 67c8dbaec7b3204c1da36cafd5427bc1ec295b3c
SHA512 b8d54ae945aaae1ce6868eeb2e8e27084daf6e2360a06d9c7a55215bf6bc6a331dcf6f060c12b614cc2ba614d937a01a31e063f02f15084e485056b87481ce5e
SSDEEP 384:n5iF1urQXin91feru3sNc8TUNTUlI4sQckCrlFG4pvBftGp+Mgj4Q4LUppX2BRrA:QF1urh9QrO5wgjk2GujGPVQb7uT/xQX
TLSH
T17BD24936D864DA7BEDE74F85F70A3603AFF4416785D85AC8EAD81E1C01872AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c72f5978cd5cc492d92399dd59b178ca615bd8cd201a2237343ed9434bed09ba
MD5 32c79477eaddd63353ab56bfc0b54391
SHA1 5e8284770a3fb1c6c3401d13bd62922bab8fc95e
SHA512 1bac80c9084734149c0875296c055f629132b9bbdcdece431677b46d79947c71ff8a48671e6cd7fc9b07113cfb93d40c311f615cfbe402e39d85cd14e5253651
TLSH
T1693121E25D3C1AD1C4BD0EAFB48774FC95E8D726F2E471796858E994063C94D608183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5b3dae7f1983863fea623391dd2a57ea066e42cbe2bf24acd6077112c8d061f9
MD5 034c27c876ecf9f0d28b33dc4a33f1a9
SHA1 ed0790849169e47ec2df9228493423fb6cf05884
SHA512 86a2abad927190d35c4cee177650b2adf50c4e34d95b68e653546369acadbcd6546e78c270c296d8a1666cf5a03792a28c33455d77b174c2c6868826577e81d9
TLSH
T1AF3121E25E3C2AD1C4BD0ABFA48774FC94E8D72AF2E470796858E9980738A4D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3dfdbe1f75558d40958a26919ee90fcdad292fee99db0b2fbedcf5ef6700045e
MD5 e43b097f69583882b4b0f600281982ab
SHA1 aa2ce2979ac585e4d37f57eb5c45cf756d6fdb00
SHA512 44b5ecd625b1af379cba0f356f6df2a915eafc5968e8004f085a2241a076425c7a074041d7b222fa9b01683a9be5bc4b68794e3a8cfeaa94cca41d49f8600543
TLSH
T1DD4140E25D3C2AD1C4BD0ABEA48774FC94E8D72AF2E474792858E9980738A4D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d4dfd1031a3034ba322d01a1161622318b7b55572910cf194bf925798957b8cd
MD5 d931f0b276c0a1860589e23393ec6fd4
SHA1 c440026dc0b07ad700d6c66284382e7e9073aeaf
SHA512 d2be71f9a8662c890410f7631ffe75c3d80da41ce9c6284558395b6c7104b9a9739c98655bc1fddcce4782f16423bcebe3928e0a6e029747b42d75b0e1ba4ada
TLSH
T14841295CB6F91108B3B37F5AABF2A86E487AB8772F46D55D10110E4F0A76E44C861733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4424-175-0x0000018280000000-0x0000018281000000-memory.dmp

Download