hxxp://mail-japaneastazolkn19013084[.]outbound[.]protection[.]outlook[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
08/06/2026, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mail-japaneastazolkn19013084.outbound.protection.outlook.com/
Sample260608-z1bcpse16w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_937349436\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_937349436\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_880152117\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254266532006707"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{428B4271-B909-4540-A543-631E6E4D1EEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1680	4208	msedge.exe	85
PID 4208 wrote to memory of 4436	4208	msedge.exe	86
PID 4208 wrote to memory of 4588	4208	msedge.exe	87
PID 4208 wrote to memory of 4588	4208	msedge.exe	87
PID 4208 wrote to memory of 4588	4208	msedge.exe	87
PID 4208 wrote to memory of 1120	4208	msedge.exe	88
PID 4208 wrote to memory of 1120	4208	msedge.exe	88
PID 4208 wrote to memory of 3408	4208	msedge.exe	89
PID 4208 wrote to memory of 3408	4208	msedge.exe	89
PID 4208 wrote to memory of 3408	4208	msedge.exe	89
PID 4208 wrote to memory of 2936	4208	msedge.exe	90
PID 4208 wrote to memory of 2936	4208	msedge.exe	90
PID 4208 wrote to memory of 2936	4208	msedge.exe	90
PID 4208 wrote to memory of 5196	4208	msedge.exe	97
PID 4208 wrote to memory of 5196	4208	msedge.exe	97
PID 4208 wrote to memory of 4004	4208	msedge.exe	98
PID 4208 wrote to memory of 4004	4208	msedge.exe	98
PID 4208 wrote to memory of 2380	4208	msedge.exe	100
PID 4208 wrote to memory of 3848	4208	msedge.exe	110
PID 4208 wrote to memory of 6128	4208	msedge.exe	111
PID 4208 wrote to memory of 3588	4208	msedge.exe	112
PID 4208 wrote to memory of 2780	4208	msedge.exe	115
PID 4208 wrote to memory of 2780	4208	msedge.exe	115
PID 4208 wrote to memory of 5296	4208	msedge.exe	117
PID 4208 wrote to memory of 5296	4208	msedge.exe	117
PID 4208 wrote to memory of 5440	4208	msedge.exe	128
PID 4208 wrote to memory of 5440	4208	msedge.exe	128
PID 4208 wrote to memory of 4240	4208	msedge.exe	132
PID 4208 wrote to memory of 4240	4208	msedge.exe	132
PID 4208 wrote to memory of 2964	4208	msedge.exe	134
PID 4208 wrote to memory of 2964	4208	msedge.exe	134
PID 4208 wrote to memory of 2792	4208	msedge.exe	135
PID 4208 wrote to memory of 3708	4208	msedge.exe	136
PID 4208 wrote to memory of 3708	4208	msedge.exe	136
PID 4208 wrote to memory of 5152	4208	msedge.exe	140
PID 4208 wrote to memory of 5152	4208	msedge.exe	140
PID 4208 wrote to memory of 5152	4208	msedge.exe	140
PID 4208 wrote to memory of 4480	4208	msedge.exe	141
PID 4208 wrote to memory of 4480	4208	msedge.exe	141
PID 4208 wrote to memory of 4480	4208	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mail-japaneastazolkn19013084.outbound.protection.outlook.com/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc5939c188,0x7ffc5939c194,0x7ffc5939c1a0
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,5934142332751521317,11723181602815726282,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15868324366058822292,6612962501357018717,262144 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,11380198643751362784,6027003477702048656,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15526129411108116493,10720947301740468335,2097152 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15794737182764001983,17824102961424579989,2097152 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,18096587881431211619,6516811587501018640,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,8155027837392500654,15076593857112244158,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2498815364012822349,6889923828364239578,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2498815364012822349,6889923828364239578,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13565831696433041692,8099698110893129186,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9512796634254703681,6579314189740230965,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,11293725222422232294,12485313380859565544,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3507172827812021418,15060550803812909439,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1682472196699912298,14595357291681119716,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9371396929992710926,12045710376807198338,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11850469279097801889,8843981382385579799,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,15367303623535555775,15164835804398439097,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,1835508498723006900,10840360430391642628,262144 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,7180288656105474640,17607060994239982942,524288 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6160,i,7466398906697221075,9504563927756232519,2097152 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5456,i,5286831855340961453,6611988032765048569,2097152 --field-trial-handle=2264,i,7839615652501964537,3614131319759949807,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4208_540837690\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f89d096d4931f102ed0d846cf7c00628e918bf6ece6e67672df102a3827d7001
MD5 df26a001d19a02865f3796364cdc5da9
SHA1 eaa88c3939bdb0b5f62c93b1a8a962eb7578ec6e
SHA512 e881032fa0b755ffaa5bfe96f40ab025af45de1280276abb3fc0c11281f633356a804feb4a4869cda2d7d425bdd5f22b67272724472a7610f8665ca0dfad767b
TLSH
T1D5D012B62A4A7110F2694A31B456CB00776D15A12852A705E22D944CA9A90B562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

2cad697b-d70a-48a7-baf9-ffe61acd3370.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cad697b-d70a-48a7-baf9-ffe61acd3370.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f6798873de34fed13913b4ac1eb00944933105debb18f9d0c7d0f577c9204a23
MD5 0b89d86be3035d6a86e33a2673669b23
SHA1 44c258532b515111cafab550436ee3c803154c2d
SHA512 a9e1f8a102c2efb8c1e206a4b789a09780229787fb437cc4acac1e13e65dc62db335f9a42660c88c1c151d88f0dddb9389998ee788f6edc7fd3213a8c29d6089
TLSH
T18DF0F976CC21EC3718FD0B6970595B4AE75113672790589F3B3C520C4FB567B85C981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0fd54b4efd738e20b5cff24de461913c2a56dfdb5b5061e336e0931abe3dfcd6
MD5 af04bf2b027554af6c07f5354607a532
SHA1 051a19f7e660f86a2bc42d6cda8447ed80f452f3
SHA512 51ddb3cf8daf5e17566f3942a7493dbdcace5f30cd40e37e856269134bf7e84bac5a931f7cd9fc82d95a90056b7e68c4aca7ba829882deca5e298ecfd85075fb
TLSH
T155419FF783E8856D890195F0BA18BE2FDE2D0514532C3D9A89E4AF1B93E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bd4ca6cb-8df3-4adf-b684-9189ed800cbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd4ca6cb-8df3-4adf-b684-9189ed800cbf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b6c67b14a57f2057aa089240ffef4af58b3fbf9194d498965abdf5701c151303
MD5 1358e300937efd95f8d847f6e5c3e39b
SHA1 4dd31608bc5b4158e1df4aee10aa57eeaef552b6
SHA512 ce185f89c1022805a3f537a63da4e784b0a68c6f355d6b231c2668097968cae995b8054da470b6cc504c48029a532ee962838505468d07bc13da9d5dbbf927cf
SSDEEP 192:sxZaRc7ywFXNKOMl8UQYgkZ/fvsdBZiZdIaRuv2zodpLHlYC6+WNGYv3OqbOIg5v:sxZaaIqYzZ/fvsd3izIKYNLH+vGxRSk
TLSH
T1F162F906AA24597B8CD7D21AF645BF53D6F91563A1905E48A9FCCF0C04EB7EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cc67c2682fa9e78a9aaf94f475b7e8c4825a5d3fca1f47f87e47bfe807a2cd48
MD5 6baa8acbe1d5d28630b81129ad718259
SHA1 80f7794e93fcc97770f11a1e4871ac1d71de74c1
SHA512 78d0d89c617efdaf6c548edfb1a0429dcc72931275e64baaf85649f119765d463bc60a82392199d520329a242b4d52032fa6b1be48f8a6ab9f6208e882901c4c
SSDEEP 192:sxZaRc7ywFXNKOMl8MkZ/fvssmBZJaZdIaRuv2zodpLHlYC6+WNGYv0COqbOIgj+:sxZaaIMZ/fvssm3JazIKYNLH+vG/Rj+
TLSH
T1596209066A24597B8DD7D219FA45BF53D7F90523A1905E48A9FCCB0C04EBBEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f6f9c0234870ff3d3e4e8bcba0f4cbba9b8e575fb506dbde0a8bb78f80dfdd34
MD5 ec3cedf07370701f15f89fbfb6840eea
SHA1 d6458343fae9184772cffec3ebfa962ac9e88c89
SHA512 87b2432f5a6c0f64212c7e231250c1bafa493b9afd12717be64fcca805464bd8976117d4802c977174b0242feb6c35726441928224282e21f37ac54cece55eeb
SSDEEP 768:ZYsv8OdF6ssi7pLILZFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvysy10Lls:eY8Od/H2ZFhWvFvmXu1jaft10Lm2Nuzj
TLSH
T120F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 67de453642a60d4f73a6f7f21baa8f85eae35918b13b60e075763ee39fd7a272
MD5 9163924b8ddb6b266d6f6b482529584a
SHA1 94e75fa905272724d5d63ff0b7aaff2c1c545265
SHA512 94cf27bc359d8d434cf14e9bcd19c0edd76fe52aa62651f0223bdbc3feeccb6a3f1d9df91897d36686990be4a1dc8cb1ae789bc51d7ca0cf18d3084f7440a09d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGO:05ppxnY753RNBvRJJdt7ph5X2lfyBF0
TLSH
T165C26716713A0212397E3948B79696364F4235A33058E8BF7FB810A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0085e84f586e6cf9abb4aac63af7c8d30786101449a8e54fb20fe3069e7e03d8
MD5 67e4c903d93adb64c89229f6d11d37f0
SHA1 70553f075509fe1ff6fe1aa5b33eb0a50bedba8c
SHA512 2d9fccf6619cb4d56dd5a267010eb4bf09d3dd9c41cdc885ea71ee81fe4dfdf663cba92f83373a7e10788e034e68dfb77599323ceaecb1337497f7b72fc395c4
SSDEEP 384:nziF1tNn/s3n9Sxo3sNZ8TUNTUlI49QckCrfGZphiftGzxwtMfpEzVpG3d8t1JVD:eF1j+9n3Awg4knHoGVuMWJ+yl2JvS
TLSH
T1E6D26B36D858D9A7EDE74FC6B70A3A07EFE401A788C85ED8D9D96E5C008B19D030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e69b5575da2897062b0b56616a29c93d8769a7cf1de8cb5553fa5d8b1bc77824
MD5 86c8724f4b999676b39188223a899cd9
SHA1 5c91e549a76c5b20e687e9108609323aa2483f11
SHA512 82e56f5b0b56e6b4035450e0d596f838cd09b31cba35e0d71bf754db217ac26d35746e625ee868124c41b899cb6c41bf642d9d263dee8418848d9ac96a7a2a80
SSDEEP 384:npmiF9CcmyWCs3sNH8TUNTUlIm2QckCr9liKphiftGzxwtT6p0e4KV8p0eZty/77:pNFccps36wgbkU4koGVuTXI8p0eE
TLSH
T159B26C36EC68CAB7EDE74F99B70E3A07DEE0516785E85AD4DAD81E0C00971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 533b3f93772431a827c41a82cc08dd783bee3a9fd8cd5a9b4b29515557c75a8b
MD5 032394e25155bf80c0414b34249549e6
SHA1 1d5a61acfda77e94a5527df4ba14c02b6f5ccf6f
SHA512 c19371a07cf7857f7f365859d3b4638c0e9657e1f7d63cc86ab880bfc717b5ef1e7e7c41dacfa0aaa3e9868fed6c2c42da22c5ba1172b7c206e8284c283cea90
SSDEEP 384:n8iF1tNn/s3n9Sk3sNZ8TUNTUlI49QckCrfGZphiftGzxwt9fpEzVpG3d8t1JV0k:nF1j+9t3Awg4knHoGVu9WJ+yl2JvS
TLSH
T17CD26B36D858D9A7EDE74FC6B70A3A07EFE401A788C85ED8D9D96E4C008B59D030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0195efb1c4a007c2b1b58db8bc4566887d1e74524670c36befcd82b455d0e408
MD5 41985be1db337dcc4302ef3518e6fd07
SHA1 82970352a6018c4dba12192a7f15cb31e71aeb5c
SHA512 1df5a0fefa422f29be79738082242a942db6e7cd25c442219ae18cdd208694b9c8aaf5ade9baffb932fc31935edac656429643060359d3a05643d14d709f7e7d
SSDEEP 384:nphiF1tNn/s3n9Sk3sNZ8TUNTUlI49QckCrWGZphiftGzxwt9fpEzVpG3d8t1JVD:pIF1j+9t3Awg4kMHoGVu9WJ+yl2JvS
TLSH
T105D26B36D858D9A7EDE74FC6B70A3A07EFE041A788C85ED8D9D95E4C008B59D030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.6.1\manifest.json
Size 117B
SHA256 0f38d58679ba75ccf1b80144c998549e09e08e8fce7e1c6ecf35142ef004131f
MD5 5836d59405b134944c3f2b02fb148539
SHA1 c577f1816960edd81a8fb469bc1ceb4e05bd0c55
SHA512 cb8c568105000d84c46aaadb4ab34c5a3747c9e588707dd4f3a5dc24ee3458983aec3e1ffca1a108ae47408daa6c96a0625dcc6e4a6970c8114f62eed82f20cf
TLSH
T1B3B092B00C0AA03B22849320EDA06A8283F80218E8021B1E088036481F8917880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.6.1\typosquatting_list.pb
Size 555KB
SHA256 b95639cf9dc46683acccb9ead8440ae9d6a852a37407cc7cd9c0b309acf7af1a
MD5 fa2f059815f3357487cf7fc8f93e5252
SHA1 d7affd654c8571ba0177750adb5f63ab3443496e
SHA512 729e3443b5da00521d52c60acdc9056b11229d8ce69d47e2a1e1c12cb1784dac58c51f49e5f3423a687aecdcf5ed79697e855a353d5c253756857b7ad186d136
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDh:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhfk
TLSH
T1F3C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9977497d6617365b76a375067dc69371695cf062bc8525a75e94845ef647e6b6
MD5 cb68712bd7c8b13dbfee0172a22402d1
SHA1 085e20658034f08156771370412ab5d656a8967a
SHA512 fb887d0489b227ed5b06b478fcf76bb4b65bd8ef16d4843ce32b1d6458b4c8916de3a1ac0b5244ae6a229c2c7a710b9b7d8f6e5b8380e198f234da6bc51d478e
TLSH
T1C34162E10D386AC1C4BD0A7EB08B74FC81E8CB29F1D0747D6C18EA880A3DA4D208183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2d5d9b48e1da1376414ac3c80648dfbd82ca4ec51904ff5e22db89fcace33e61
MD5 c1c1f98f8239d1582dbf68a882643867
SHA1 ec08ba09cbba175de7707654488d9fc3aeb17791
SHA512 e5dea1c030178688b7552cea8a049390620c1c266955b0b1f101f0dfe02dbbe43b04ba8aebfbdc944a8192df880dce3432c34e4f5f502fde685c7e14821c05b2
TLSH
T1804141E10D3C6AD1C4BD0A7EB48734FC95D8D72AF1E474796C58EA98063DA4E608183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a6187938f08a9b348d3287d1062b2d2f0912e2a57425a9c1579157a5c92229e5
MD5 202e834b5b0dac873bb5bfb47fec3fac
SHA1 387bf3fce31f9970dddbb24bfc40404957c58df0
SHA512 c354762f75f6efb6ff6aea80b03b0616bfd8cdd7cb5bc48add75b31582a2f2a97a11684688d3d292404420b80ee1943440c2a0f6bbcd72da6345a57225aaf8b2
TLSH
T1114150E11D385AD1C4BD0E6EB48B34FC81D8D625F2E070796858EA84063C94E608183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a043e8d1b5e0bd97011a840c819b6866e3a3934158d271c19b2b57b195d658d0
MD5 175ed3365dd2c3bd9e0adc7560deccdb
SHA1 620b7d29abcd0e7cd85c79cc3503ab72fe0bbe95
SHA512 aee0bd1ea629fb5dce5518755dfde92b6a4e4e937687388445cf86bb74bd211d189cc74d85cfe1a1b95f294351ca20d9db45d5659f250ebac30bca854c994b85
TLSH
T14B41E6987AE91144B3B77F4A9BF6A9AD487F78372E06C49D10110E4E0A27B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download