a98fd54e0d0b25160e4fe026216b9db0e2b5a62ebaa73b21c269693a5e3dee2e

Analysis

max time kernel
299s
max time network
295s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Among.Us/Nblog.url
Size 108B
Sample260623-xdgj4afv2m
SHA256 a98fd54e0d0b25160e4fe026216b9db0e2b5a62ebaa73b21c269693a5e3dee2e
MD5 05e54e7120da01222fc3e481dc472308
SHA1 cae53269698bca9d3a092c3d8944e7933e6bc047
SHA512 082d4ebabbd522008ec5e073503cfd1a87e7dc4abbc72bfba499e0a9d99b834c301dc85f4d8e5b52c1c3d89a9990fc7152bb5e8c2747039d38d667323dc61ab7
TLSH
T17CB012AE54098699D241454E8071F808880F79A00CD3D06CA14CDEEB1C080E5C448B36
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1500	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_398601514\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_324499905\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_767038190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_767038190\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_324499905\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1245944059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1245944059\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_398601514\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_252639366\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_398601514\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_252639366\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_1699026275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-uk.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267139081638980"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-958335860-2021930596-4099878453-1000\{CA70EA06-8370-4B35-896B-E23C3B236907}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 1500	5796	rundll32.exe	88
PID 1500 wrote to memory of 4920	1500	msedge.exe	89
PID 1500 wrote to memory of 2336	1500	msedge.exe	91
PID 1500 wrote to memory of 3780	1500	msedge.exe	90
PID 1500 wrote to memory of 2336	1500	msedge.exe	91
PID 1500 wrote to memory of 2336	1500	msedge.exe	91
PID 1500 wrote to memory of 5568	1500	msedge.exe	92
PID 1500 wrote to memory of 5568	1500	msedge.exe	92
PID 1500 wrote to memory of 5168	1500	msedge.exe	94
PID 1500 wrote to memory of 5168	1500	msedge.exe	94
PID 1500 wrote to memory of 6956	1500	msedge.exe	95
PID 1500 wrote to memory of 5168	1500	msedge.exe	94
PID 1500 wrote to memory of 6956	1500	msedge.exe	95
PID 1500 wrote to memory of 6956	1500	msedge.exe	95
PID 1500 wrote to memory of 6796	1500	msedge.exe	96
PID 1500 wrote to memory of 6796	1500	msedge.exe	96
PID 1500 wrote to memory of 2820	1500	msedge.exe	97
PID 1500 wrote to memory of 2820	1500	msedge.exe	97
PID 1500 wrote to memory of 4200	1500	msedge.exe	99
PID 1500 wrote to memory of 236	1500	msedge.exe	103
PID 1500 wrote to memory of 688	1500	msedge.exe	104
PID 1500 wrote to memory of 5456	1500	msedge.exe	105
PID 1500 wrote to memory of 2744	1500	msedge.exe	106
PID 1500 wrote to memory of 2744	1500	msedge.exe	106
PID 1500 wrote to memory of 5000	1500	msedge.exe	109
PID 1500 wrote to memory of 5000	1500	msedge.exe	109
PID 1500 wrote to memory of 2524	1500	msedge.exe	110
PID 1500 wrote to memory of 2524	1500	msedge.exe	110
PID 1500 wrote to memory of 4072	1500	msedge.exe	111
PID 1500 wrote to memory of 6544	1500	msedge.exe	112
PID 1500 wrote to memory of 6544	1500	msedge.exe	112
PID 1500 wrote to memory of 3844	1500	msedge.exe	113
PID 1500 wrote to memory of 3844	1500	msedge.exe	113
PID 1500 wrote to memory of 2888	1500	msedge.exe	114
PID 1500 wrote to memory of 2888	1500	msedge.exe	114
PID 1500 wrote to memory of 1140	1500	msedge.exe	115
PID 1500 wrote to memory of 1140	1500	msedge.exe	115
PID 1500 wrote to memory of 5580	1500	msedge.exe	116
PID 1500 wrote to memory of 5580	1500	msedge.exe	116
PID 1500 wrote to memory of 4172	1500	msedge.exe	117
PID 1500 wrote to memory of 4172	1500	msedge.exe	117

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Among.Us\Nblog.url
1⤵
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nblog.org/
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffbd019c188,0x7ffbd019c194,0x7ffbd019c1a0
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11842829021582121401,10187801164800457356,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9170617791136282026,17919866777007914874,262144 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,17098705763085231227,16237005732143774391,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,7453401846313903719,15127580156139087581,2097152 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,12903512800519993902,8158682351481620153,2097152 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:6956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2528315987882133641,6151325922362033232,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16858003078775305938,9419549263449141555,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,1342906490201130247,16041757353840548950,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,1342906490201130247,16041757353840548950,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,956915785733109037,11387339097291634208,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,4910838026051416915,3932655802230164201,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6500075239830379735,11306373751840304165,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6222916481572663972,11163690381238359436,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,17355642380240385206,17193746827613584098,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,8797309105846261387,3697525795388319062,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,5581412347538827910,15144659689682936285,262144 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,7712453123169850616,17080051459518812085,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10886573523832908079,10539712197549255241,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,17879950707822516705,7128951267941016090,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,6556896748138817984,15707638270263195445,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,16946774855300482731,15709818862468204853,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,8431596202765040416,2158077312050750428,524288 --field-trial-handle=2344,i,15126552407664956778,7085766998173744962,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19509664097c265b613b84702dd83a5bf5de055759de5b566057524c40ef7e6a
MD5 21b7bb74a7a973f055e2b6a521d9b7cb
SHA1 3d70b3b2cde84afbf3f8734366a34038d4e9a9d8
SHA512 c0e322927c0dd573b4065c0af844b7689ba9ed346bc20367531c7f58dfc0db9d330f64bb479ece7c9e93e6ef8165c09293c33482618cb351288c8e942ef968f0
TLSH
T109D0C03136146102C21A22B06C00631C605D82123192C10774E1E00ECC9FA60B7C6503
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54c2f594ac5ab8cb2c84ac95854712b1d39191769839007889ad58d0a8acb09b
MD5 35a353c55b125bcf6e8367640eeea748
SHA1 1655243ec502fb3b5a85abd22fbd1f62cd1c2d0c
SHA512 2da841d1abcd6407ef04255ba7b81e4a131a12cc27032c43d6d17f9e17a75ddd466b533c45594f0e81eda5c450b35a336c6eed9c4f2302f610f34731bf1aea49
TLSH
T170D0C03136146102C21A22706C10632C605D82563591C10770E1900ECCDFA6077C6503
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c77c3f0cddc0e120e4cb2ca4ebbd57610a98f54209abed885e5686ff4b2135f2
MD5 0fec92d61bb0e494196acbe3c21224bb
SHA1 9c38957409a57a2c1b6e76c3ad9991d635d140c6
SHA512 e20e35519d60c19be25c1b2825c9fcd17595e83caaf835750fdf9f7db2010b62fdd3c6ac89be055f87706b130e7b7f5d31620901fadbdb7604caa94c2e0c20e6
TLSH
T1BAE0268984C8E31F928478874569930CD380360F97CB794E271A88DA30052D0A2E66D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 746bc37bae33425abb5bc7da5e2507e1e5202ec8666be82b7cee831339c7071c
MD5 58705de883a96fd5d96ded9cdfe67fc6
SHA1 3d2f01d4e926df5bebf6755636b301693cc763a0
SHA512 2e6b1cb6804cd9c21af96003c1bd298031c1a29df01873076a5b84d226d8b02e906f63bf163a448ada1bc7d729e5e5db240131416828fbac45b6390917277cea
TLSH
T1D4E02BB5CC65EC3708FD175814540B86D65403477650958B763ED2084FB153A5645C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88738caa8d72abfb195dda6e8f1cc46b79d579e0b399a289a6ae6b51fdef4932
MD5 0344c84afbaaa4b547b08e8efb62bd16
SHA1 42568889342dbfca2d91e33a5aa65e9d66bbb5e8
SHA512 d2d65d6a091edbc700679a8fbc5a736170bab51dee8fc2fdc63f4d133fc8f815b35bb00130670d1177d1bffa794b97bd044e9991ccb9d185f2c272910589ae9d
TLSH
T1FB51B1F3C2F9866DC91156F0AB14BE2BCE1D0954832C3D5AC9E4EF4BA3E2471E141A1E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c49d5ad90c999d6ea7829a16d72cb718b0c5138bc536cc803307b247a4a7c147
MD5 22e20d434c3e9445aece01fe8d67a02c
SHA1 8648135f92a2bef6b89c843cba8ca87884813a55
SHA512 a372414c56f8f7953ff2b7579268ecfbec4578418520cb1d1c0972079f7b7c503cf79cd1f376a5599b273cb4222ccfb7347086b6cab0f617e1ce58956474588b
SSDEEP 192:sxR4R3yMqZjK1Ml8wcU/flsO8vcZaJ0/RCzoA8paQ/g6+WN40L/Y/EKRGpIgjTJ:sxR4gCU/flsOaiU0/RP//5X/TjF
TLSH
T13672D8166938597B8CDBD209FA557B53D6F81573F2804E48AAFC8B0C00E6ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c520ece7a0895bf7ef3d9424ede447429da8f0a17835fe85c45d6fd9172e2b76
MD5 78e0f9be9cb11be1feb7987517719fe9
SHA1 b8c059a9ee58c1ec72e3c561aa6000acb7c68339
SHA512 7663a2e812dfcab11974cf9c7889304ccb1d3b5b983c7646aeacd2d95c3cbe3fb184b9c56503e1b8a4209cd4d65a92d78d85fae189ce8c9e23e475498674d720
SSDEEP 192:sxR4R3yMqZjK1Ml8UQIIcU/flsb8wcZaJ0/RCzoA8paQ/g6+WN40L/Y/EORGpIg+:sxR4gqqU/flsbhiU0/RP//5X/XDS
TLSH
T1FE72D81A6938597B8CDBD219F6957B53D2F81573B2844E48AAFC8B0C00E6ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d4804dc22b9eb3f9ee877470bad06f4287c32228130219ab3d319311e5194b6a
MD5 35ae47b1a0b8f1b711f30ad49e4ce4a2
SHA1 722d313be2b3ef6e06e46972428bca15d02dae01
SHA512 880dad94f68918686c9d941aa6e598f9e792005428d0631e3cf57b63d88d7dcc14ff3f39be9775d5980832cad93a13277c96a5aca14c60ac5de5a4f47be5b0ed
SSDEEP 768:zEX1hN7pLuL7w9WgLLfzE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0FmZwD/rooUsf:zEX1h7E7w9WgLLfzEu1jafFm2DsoUw
TLSH
T1F5E2FC7B680CCB7E4F444ADCEC29BD9B6DE802CF96D8C95447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 01dc196832afb77ee46b5a6f461554323c0cc441fcfff77470936c09aa979e4b
MD5 aa77e83cf6986bd4bdff34d53be5a773
SHA1 cbc42472308783600fcae9818965f07a03dc0b4c
SHA512 94436e292123fbd1e0c030a949b156fc30b53e815ae048915ab370dd9683cc1b290cc858d5189489a5444cd8ee43bd06e14777cc05617887a49fcf2102f936c0
SSDEEP 384:83lTzBt/l8joMOimxiVwEQhoGhsM1OsBcxGNwqcjk:83lTzBt/l8joMOimxiVwEQhoGhsM1OsH
TLSH
T1BDB27D117A7E224138BE290CE1A5956F674130B3305AB63B7BBD60E60DA7E001EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 68d7f899ca56153c3896fe4bf381cc865c6c6222207b17d4a663aab5e57326c1
MD5 9f5c662683ab355a4b5347231f678df8
SHA1 9aacbf119e687edca1728ba5ab1c26cb1f94bdec
SHA512 12a21953fa9dee711bb5051fcd81491fff9638263b265442b948ecbebb5adef9f89f752e7ac79c5d2c2d53d8b8dc742457625e62c63adec11bf3018b52e0ebc7
SSDEEP 384:nliF1tNn/s3n9Sx8N58TUNTUlIRmgqB9YbdmqOfMPG3ugowjfwljuITGT0IK8Lkx:sF1j+9UUwg5qAUqpG5owjfIjui+0jvF
TLSH
T10CE2C4F288D78977D89E4B87633D2E4699FCC163B4885988B7C91D4CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7986290330b28b0ab3060ff992aa00a37a2334c18922e9d78201f3d02513dee2
MD5 1d7e7e0c25d920bdd072ec0a9d774b84
SHA1 30c41c94cbd070f8f6e5c1126ac3aab646c97f8c
SHA512 3e2a05a1018190d3f19c068f96b66920ee37ca2f1ea9e5802a08dd6bdaa097af6b1f5ba1210b192808e651e38562bc8e2500c72d23b376fac2835bdc8a205094
SSDEEP 384:nciF1tNn/s3n9S58N98TUNTUlIR1igqB5EUdmqOfMPG3ugoww5ITGT0IQaN8Lk1X:HF1j+9IQwgX3qIxqpG5oww5i+0zaUvc
TLSH
T16BC24B32DC64CE67ADFA5FC9B30A7A4BAEF002A385C859D8D9D91D4C00976DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a1f79ced48b323127da991c1e7a9cab2638d072f57f8c6b8869e73757d7ca3d3
MD5 ee9fe6aa86c861649b63b984fa027d26
SHA1 d3346fe45234ccfc7df2ac238e4dfb14eb8f6a5f
SHA512 ada04d4e4987dea2e49dc8f61646309dd3da6e3e5fde50a93cf21c01d517a7aca058fb16f0aa29799e018bcae6dd68a7dd25f6b55adc4455b51d12cbe45e4843
SSDEEP 384:nriF1tNn/s3n9Sd8N58TUNTUlIRmgqB9AbdmqOfMPG3ugowjfwbjuITGT0IK8Lkx:GF1j+9EUwg5qoUqpG5owjfAjui+0jvF
TLSH
T178C26C32DC64CD67ACEA5FC9B30A76479EF0026398C8AAD8D9D91E4C00872DD174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 64a283d8af2d1c591ed3321599b0f1f794980794af0dff5f0a02e31b74189fdc
MD5 3b6a272133369fbb737c2f734a860954
SHA1 4bc7acb5ac95bc2e602d40718629dd483c278532
SHA512 c2d14ad94af6a845acbdb1df4ffd2348c4d7159dfe5b202e72e4d72595fe9a4b0a0001b06df4b36e8968fed1799bc5cf88f0b54a793d5e537a535effa05c9642
SSDEEP 384:nqiF1tNn/s3n9Sd8N58TUNTUlIRmgqBVAbdmqOfMPG3ugowjfwbjuITGT0IK8Lkx:hF1j+9EUwg5qwUqpG5owjfAjui+0jvF
TLSH
T111C26C32DCA4CD67ACEA5FC9B30A76479EF002A398C8AED8D9D95D4C00972DD174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d63dada1dcebde30141bda60e76596d8d0922750b06b6a0a9334ba32089d3fee
MD5 abbc0c45a9f2e485adfa941d42294c53
SHA1 cae9dcf6b3247d9b5d7fe28f4f4aa497cdf8001f
SHA512 db3c0af14c86bf3440737a351241163b50d69179afcfc207f94b1eab0ce2f0379312c09196e0ec959b0b554984645d2523fd26fa406485709504886f5532d182
TLSH
T1453162E05C381AD2C4BE0DAFA05B35FC94D8C326F5A470792C54EC68163964E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ddd3e7673f80b16900e8e0f9a761f48731dae168d7a60937bcd6447179e5ee42
MD5 ca477f443fc77300e6d5033a6a3c7351
SHA1 a29c813e45ceac8f0555a1bc5818c8a107b70fd3
SHA512 ef8b10aeb370adf785b3c280913858c6f7e1b0759bfc2cb0d90e6c93934add74ff6358fd320110478161c273efca5c8859d7e75563d6446866a19843ec24659c
TLSH
T1924160E098382ED1D4BE09AF709734FC94E8D736F5A4347D2C98E8A8567A64D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c6f83e48a65c1c9a1c7e6832f2a410301ff5ebdab1ee45fb15efe3238e2ea9f0
MD5 b4a2202cdb7fa50eb4044fc1001cd159
SHA1 713a35ef9954dd165ceeea648de0078fd479664e
SHA512 8f05f1512cb44663943a5b4385b9fe8beab7baa58a8e7bfb82b31597f8dfa1c950d887bfb9b3407f4043fabdc6e6ab6d0a5d16263f1484b98fd2141d7f838d6a
TLSH
T1DB4140D05C386AD2D4BE0A6EB09734FC94E8D725F5A0347D2C58E998567E64D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0c93bf31095d106df29dbfc4781f132f4a3575795b8ed87693d5f43427343546
MD5 375278c0e4f5d905e2dcde9b56e5e9b3
SHA1 733851c7cdc03253e74a44aaa5b9d6945d62be37
SHA512 65890ac693ea300b7f54f1c13769503f42c50184eac612c96a3046f102e69ce4c2043d266dcad15273b64fd6baa73522abe8654ee2ba3f7e8535b3b555895824
TLSH
T1794171E05C382ED1D4BE0A6FB49734FC90E8C726F4A0347D2C58E898467DA0D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dfe242b604d2d1c7727cab871c24d888887ef9107e94c1629a59a64e47e78213
MD5 669c2e86e30c25597b71b3ab2a37abc7
SHA1 d70a8f0f715635ace75b50fa01ae0524f70073eb
SHA512 51226bb0ac97c97190094f28785c87a59e6ab652f367992003b484b2279dbdd183b3a44553871cc9eff223d989f837a02f5b132dd6e0b32f8be710ae1e9ec8b3
TLSH
T13A4160E05C386AD1D4BE0A7EB09B34ECC1E8C725F5A0347E2C58E9985A7E64D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f3620765d0226ae59815e9014e637aea654bff60a5c7a7a243cf4c68f142199e
MD5 e202c46d115137cfbbcebffc30499f24
SHA1 9089be923fd12dfda91b9d88c436cd4b4936f712
SHA512 27e422376d95b2677526b6ee3eedb673ba6a0beac92ace47bcb74489b77d991b96a687c8005ab20e621261f401ebf5327e20ee62ac66cd46ddf9ba6431f31186
TLSH
T1293141E0A9382ED2D4BE0DAFB09735FC94D8C226F56474792C54EC68563D54D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ef49c0e6aab403bbb053f3ea5c75706156e06417bc9f6f3b2f70f93ca0421312
MD5 284c23e43f7ef8a774eefdbcf1137d9c
SHA1 7563eb8b65525dc5b97f54c1c2f21875d207b3b4
SHA512 352f286c0846f8c507916e47d3abe023e6a00c93d2ddf314e30a4b1914b89f1189875c3d8034551ff161adf8d6c8cfcc82fa33bfd521b8a3829f304ba053e905
TLSH
T1D53140E099382ED2D4BE0DAFB49B34FC94D8D626F5A4347D2C54EC64563DA4D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1500_2059632823\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download