c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f

Analysis

max time kernel
148s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260604-v677eabv7w
SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
MD5 edaeffe92dbfd973958c9d2267201b32
SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
TLSH
T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1724603403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_779382433\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_779382433\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1282230277\_locales\fil\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250687938243738"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{D03D3185-7A62-44B4-9405-0C17A377928C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 4116	5684	msedge.exe	80
PID 5684 wrote to memory of 4060	5684	msedge.exe	81
PID 5684 wrote to memory of 2512	5684	msedge.exe	82
PID 5684 wrote to memory of 2512	5684	msedge.exe	82
PID 5684 wrote to memory of 2512	5684	msedge.exe	82
PID 5684 wrote to memory of 3360	5684	msedge.exe	84
PID 5684 wrote to memory of 3360	5684	msedge.exe	84
PID 5684 wrote to memory of 5724	5684	msedge.exe	85
PID 5684 wrote to memory of 564	5684	msedge.exe	86
PID 5684 wrote to memory of 5724	5684	msedge.exe	85
PID 5684 wrote to memory of 5724	5684	msedge.exe	85
PID 5684 wrote to memory of 564	5684	msedge.exe	86
PID 5684 wrote to memory of 564	5684	msedge.exe	86
PID 5684 wrote to memory of 752	5684	msedge.exe	88
PID 5684 wrote to memory of 752	5684	msedge.exe	88
PID 5684 wrote to memory of 2532	5684	msedge.exe	89
PID 5684 wrote to memory of 2532	5684	msedge.exe	89
PID 5684 wrote to memory of 2536	5684	msedge.exe	90
PID 5684 wrote to memory of 1108	5684	msedge.exe	92
PID 2536 wrote to memory of 5356	2536	msedge.exe	93
PID 5684 wrote to memory of 72	5684	msedge.exe	96
PID 5684 wrote to memory of 4660	5684	msedge.exe	97
PID 5684 wrote to memory of 2240	5684	msedge.exe	98
PID 5684 wrote to memory of 1388	5684	msedge.exe	99
PID 5684 wrote to memory of 1388	5684	msedge.exe	99
PID 5684 wrote to memory of 4752	5684	msedge.exe	100
PID 5684 wrote to memory of 4752	5684	msedge.exe	100
PID 5684 wrote to memory of 4384	5684	msedge.exe	101
PID 5684 wrote to memory of 4384	5684	msedge.exe	101
PID 5684 wrote to memory of 6104	5684	msedge.exe	104
PID 5684 wrote to memory of 6104	5684	msedge.exe	104
PID 5684 wrote to memory of 2404	5684	msedge.exe	105
PID 5684 wrote to memory of 1840	5684	msedge.exe	106
PID 5684 wrote to memory of 1840	5684	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x214,0x7ffed267c188,0x7ffed267c194,0x7ffed267c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,15987431779034990105,13619212330440684318,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9455526776317957118,9575933189061433314,262144 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13189338767489986733,3159076955971924266,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4173657958231602003,10205572985994360028,2097152 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4236091018636661947,16832105672756643988,2097152 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,17147826016726693505,2123388705719111300,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9520788276335799166,14477252821549877405,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,16819153306615084087,3089267304772709176,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,10022831007004666702,6652538614817390191,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,10022831007004666702,6652538614817390191,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17731370707541631564,15219459604768370362,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,976376233597125360,6241031633003020603,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11168786665030899438,16442109282288954268,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18202249440819637748,5977431001927022949,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18430625602455728118,6415588688893053413,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,9759241503895550468,14993618985639159366,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,3398583477874847667,11786097759884676744,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6428,i,5066399414304937064,16167914318892676517,262144 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5842651828785116139,4220434017463027490,524288 --field-trial-handle=2300,i,14567422535022573421,12036333492892130685,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 40e6fe388915bdae31099c379202d9eb5ed2e230782ef4d5d7d3e2e4e37d5727
MD5 d367d713ead1fa8acacc720bf6e04f76
SHA1 237d18f7411ecc81778b9e57cb629ef1b7101757
SHA512 f0af3d47f3f280666eb40d77713fd6144826470bbc1c2774b28214b08e50d193fda4fb016a2bde5ab7f0dd6a7ef75c77203cb710561a8fe4b613490df7506250
TLSH
T1B7F0F4A6C9229C6B18FD0B2974941B0AE751232B2B80895F3B3C920C8FB463B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4b480bc5d015b2bf062988de45bf3ccb281418c4575173b1faa8cce5c51a2cf3
MD5 3e6a2c98f9643501e1a42eee8402cbf6
SHA1 2cf122b63797c63ebd4b9df3bb7268a6df243be8
SHA512 5581a4786cb361d97720828ac9d54892485e93cf38de0374f831d4b26339bc758f515a0b78722066e7cc411c27317f75f32f667c709d16cdc3a1221f2065ad20
TLSH
T172419DF7C2E8866DC90196F0AA18BE2FCE2D0954532C3D5A89E4AF1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dfc492e5bffddd32d656ab8aa0489ec2ca5a38c024c9717f99682fbc453f9fff
MD5 c01ce1606db5e48f46fedde0f25c342f
SHA1 19945e2080a9f57b476020cb92b2c7437ace9af1
SHA512 3d4124a83ca25d682a588af7b59fa47713e9205980f130df15da4ce192b9c87c84712cf89ea2b34973d24a6e9408ba9411b90698c51a5d148efba87740f113d1
SSDEEP 192:sxZYRpyMqZjK1Ml8MFE/fHsl+HKQ7PgYsE0uzodpEY/W6+WNGY0ZkJ15IgjJyJ:sxZYedE/fHsl+HV7orE01N/bG5+DjJO
TLSH
T1BB62E9166A345977CCDBD309FA457B53D6F95623A2900E44AAFC9B0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 75b66aba410a21258dab20e798028ef1dce8d9c2423c2d99c97d3b015fbaf71e
MD5 0fb5982be028c836d8026e25d3c4effc
SHA1 a598589a665dd4de52665b1142505a742fd3cbb7
SHA512 606d897bbb34c42f261f96fc2a592779ee60eb4a5870f318c6439b9df5e98f880c9a3d1e92839f2a8fcbcb60c1053c2e49f6a6eaca026b10549da2d49167038f
SSDEEP 192:sxZYRpyMqZjK1Ml8UQ1FE/fHsb+nKQ7PgYsE0uzodpEY/W6+WNGY0ZbJ15Ig5mCu:sxZYeqTE/fHsb+nV7orE01N/bG5/DXUt
TLSH
T1B972F91AAA345977CCDBD219FA457B53D6F95523A1800E48AAFCDB0C04E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 6dad6b18f04dd65d325ebe5a5361abea125c24418322747e4eb075573699ae21
MD5 0d49242f6eacda086a961071fc2213a2
SHA1 3abef4c45aa1912269e1edb16c4a4819affce663
SHA512 075c64504dabe247ee1bab19804889422abc1a6ec7829d74b9b6d3eec907909c7f1e6fe674e37948adc2c2b69b86290c4a4626273ba53f1e9f7dc10c70e2a1b4
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CGq9LlU:XwZh38Dv2SkEnZFWRm6GQFmu1jaKCGq0
TLSH
T1C7030A3B280CCB7E4F844E9CED267F8A6DE8028B56988D5447FA494C03C66EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 106a8a6c6cfda1419d0b094a8c93682d2b855699be81f5e301c8731d90b10651
MD5 9d81a3012165a5aca3832d0ae5cfd90b
SHA1 d1830ddb8cdbd40193edb98e95ea79c497680839
SHA512 8d27ca8b99758486252814004329ac985d4dae96c5be1e6b237ad087df86a8139027a7ee86876db139d28b2501c05cb297bc3d3de4236fe1ddfc0a401c1ec7a5
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlNrOJ1blR6ZsFdT2MHwJ:ctGj+BCNC5qFVpKxfnZ
TLSH
T1D1B29A1632BA02033C3DB91D87A497375A42B1633068E97B7BE854B60E67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ee295c7ad722604ce778adb71750b549798f6cab06808dd59d51b2e9e8011683
MD5 26f66417a6f3c447864feb523602dc44
SHA1 bb48bac5c80d188a06be74de2067e5f89f7ea754
SHA512 bff3a16005fa51793a20ddc4c4d64ce334ff3ee53f4ca4caded1615340158ffa312f3fae0284b09c43ead06ab3e105f87f95d0a377084c52e6eefd10994839b4
SSDEEP 384:nYiFKtNnNnb9T38NN8TUNTUlIRkrk60bDLu1zCfbLocBEsbI3e7XxFbhyWBbIWZs:jFKjZbZ3Owg5RQOoRsz7XxBhDE
TLSH
T1FCD25B369C69CAA7ECE74F89E74A7607DFE01163968C5ED4D9D85E0D00D718D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ef4c282cdc4e628bc7eb314e2acadd9a0178cf98d090cdf1ddd7e05f6864325a
MD5 11ab1fc7d5d9cf8ad391a56356a791c2
SHA1 05031680aa1fb5536b1dffebb9dbfa14b923ecc7
SHA512 07a7e93b571c449ddf03ee12bf71157ef392f623cffe65582f9d88adf6e220f669e544bb6740f79e99f051c3226296adbb28132f5be78d8e298ef393c66c21a7
SSDEEP 384:nPiF9CcmyWCs38N28TUNTUlIxBrk6o/MF1zCfbLocBEsbIRS1e4KV8p0QEty/7IV:aFccps3twg4rMzOoRsIS1I8p0J
TLSH
T11BB24B36EC59CAB7ECDA4F99E74E6507DEE02167868C9EE4DAD81E0D008719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bf7fd3c82cbaa76377852f5c05d38456741b76c119c7f1ef3d9073a562959e75
MD5 33e4a30e4e2a32a6b8d5903e047bda8a
SHA1 19bc39c1467720e6429c1c4500fe4d35980f0d7f
SHA512 2259da2b68792c3ba3176892ad3327c6aa972ce55d9c3f548754e15ebedefaedaa9ef05be5759cea9184ab0a22a9bb40257c4dfa9d1a3f62e07e516bb92783bf
SSDEEP 384:n0iFKtNnNnb9U38NN8TUNTUlIRkrk60bDLu1zCfbLocBEsbI3e1LxFbhyWBbIWZs:PFKjZby3Owg5RQOoRsz1LxBhDE
TLSH
T1C9D25B369C69CAA7ECE74F89E74A7607DFE01163958C5ED4D9D85E0D00D718D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 18082ee7356eecef0dde8fcb80820c807373877e91a892b6113e0c655a5002b6
MD5 ad1527c52c0665e6bd957636d016bbda
SHA1 eb46c8e860edcebf55a8aeb51071b912bfded0d9
SHA512 1d122db1785ba23928d21b66674bb37ec3fdee888194742eff52f57942a7956c1ab5cb4ab8ae6b49aad50c04156ab482a61d9652af90354e8967a48affc9398a
SSDEEP 384:nViF9CcmyWC338NN8TUNTUlIRwrk6fDLu1zCfbLocBEsbI3eqLxM1ty/7Igsd:cFccp33Owg5aQOoRszqLxA
TLSH
T175B24A76EC99CAA7EDDB4F99F74EB603DEE01163868C59D4DAD81E0D008B19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3da1b02ceeabb9f52d6d407ae46aedd56624f9ff3e8bcc1bf653039057fa5688
MD5 d46dfa26a15cfa49d47196486795dc08
SHA1 e73ed8871ef0cf474f8f332887e19c5f825dedd9
SHA512 fe82f6da5df183049959cee590adf3da5b3610b29c95fb530b9dba081081f2d12cf054d0a4383ddc9f5fb7319d884522b4b79dc73777a1aeb52523fc401b2712
SSDEEP 384:nViFKtNnNnb9U38NN8TUNTUlIRkrk60bDLu1zCfbLocBEsbI3e1LxFbhyWBbIWZs:cFKjZby3Owg5RQOoRsz1LxBhDE
TLSH
T166D25B369C69CAA7ECEB4F89E74AB607DFE01163968C5ED4D9D85E0D00C718D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c70a49b0fb58dacb1e50954797d76a50e13226b23140d6860974fac0d84b84d2
MD5 6f2c45e82087501acca2d1a6b74f3247
SHA1 1ef4c006135af8270248375e485c6b5baf1b76b0
SHA512 dbae4e6c0901b7331aa8b394e25a6c15b8ecb6e3919e6ebdc98c0e7cfabf26ec7ab01402a010fa55867c6babbcbb3697d6b294278bd26cc99bccb8843294cbfd
TLSH
T18B515FE04C7D6AC1D4BD0E6F708B34FC82E8D725F5A035796868E999097962C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7e54bdec83d30c8a98bbf7b7ecda5784362493d13f9516a787c863816cbbb400
MD5 4149f2ce83cf8de9afbaca5605cc90ac
SHA1 dd4e83b6827f3e16bcac508d06a9e7298c73324c
SHA512 7342ab0b67b43bfd79e613a4a8cb574165ba0520147162605adc1f2030178be3b0b164a34e5a42aac69136fb627bb1d44eea532fefced151aacc20d4f1da0cea
TLSH
T1E4515FE04C7C6BC0D4BD0A7F748B34EC91ECD725F5A038792868EA890A7962C348583F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1724603403\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_1724603403\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5684_779382433\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download