576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeltaExecutor.exe
Size 305KB
Sample260722-vwkncszekc
SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
MD5 6d9dcaa75e1846e79d6f0eeef87aae10
SHA1 0d6231f8ed4445e7b1e716bb34b55e5e362a825d
SHA512 eb8edd40ff7881b15c809febdcab209ebaed7a6ea1098425f035d2b0cdac3f4e0ce832ef35b5e3802e7cbb4c7df661c38f471145c584ec3ff167654ca6c4f88e
SSDEEP 6144:jIQ4WYGDlFUBnNgVUq19v5pwOMw1cilZg:0Q4AFUBNgVr7FMQPlZg
TLSH
T14C644B86636CC7A1E16F1F76B86282EA8733F9069CA5D7DD194CE7EC18637818C10727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1323117465\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_802015296\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_637103213\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1323117465\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292144942517651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{01C956AC-C72B-4C71-80B2-29CB1979EE8D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4344	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4344	3156	DeltaExecutor.exe	80
PID 4344 wrote to memory of 4376	4344	msedge.exe	81
PID 4344 wrote to memory of 2492	4344	msedge.exe	82
PID 4344 wrote to memory of 1616	4344	msedge.exe	83
PID 4344 wrote to memory of 1616	4344	msedge.exe	83
PID 4344 wrote to memory of 1616	4344	msedge.exe	83
PID 4344 wrote to memory of 5052	4344	msedge.exe	85
PID 4344 wrote to memory of 5052	4344	msedge.exe	85
PID 4344 wrote to memory of 4564	4344	msedge.exe	86
PID 4344 wrote to memory of 4564	4344	msedge.exe	86
PID 4344 wrote to memory of 4564	4344	msedge.exe	86
PID 4344 wrote to memory of 900	4344	msedge.exe	87
PID 4344 wrote to memory of 900	4344	msedge.exe	87
PID 4344 wrote to memory of 900	4344	msedge.exe	87
PID 4344 wrote to memory of 5936	4344	msedge.exe	89
PID 4344 wrote to memory of 5936	4344	msedge.exe	89
PID 4344 wrote to memory of 5936	4344	msedge.exe	89
PID 4344 wrote to memory of 244	4344	msedge.exe	90
PID 4344 wrote to memory of 244	4344	msedge.exe	90
PID 4344 wrote to memory of 244	4344	msedge.exe	90
PID 4344 wrote to memory of 1656	4344	msedge.exe	91
PID 4344 wrote to memory of 4728	4344	msedge.exe	92
PID 4344 wrote to memory of 1656	4344	msedge.exe	91
PID 4344 wrote to memory of 4728	4344	msedge.exe	92
PID 4344 wrote to memory of 4420	4344	msedge.exe	94
PID 4344 wrote to memory of 1212	4344	msedge.exe	95
PID 1212 wrote to memory of 5476	1212	msedge.exe	96
PID 4344 wrote to memory of 6104	4344	msedge.exe	99
PID 4344 wrote to memory of 3308	4344	msedge.exe	100
PID 4344 wrote to memory of 764	4344	msedge.exe	101
PID 4344 wrote to memory of 4340	4344	msedge.exe	102
PID 4344 wrote to memory of 4340	4344	msedge.exe	102
PID 4344 wrote to memory of 3812	4344	msedge.exe	103
PID 4344 wrote to memory of 3812	4344	msedge.exe	103
PID 4344 wrote to memory of 4696	4344	msedge.exe	104
PID 4344 wrote to memory of 4696	4344	msedge.exe	104
PID 4344 wrote to memory of 4364	4344	msedge.exe	107
PID 4344 wrote to memory of 4364	4344	msedge.exe	107
PID 4344 wrote to memory of 5688	4344	msedge.exe	108
PID 4344 wrote to memory of 5688	4344	msedge.exe	108
PID 4344 wrote to memory of 3884	4344	msedge.exe	109
PID 4344 wrote to memory of 3884	4344	msedge.exe	109
PID 4344 wrote to memory of 3336	4344	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7fff0103c188,0x7fff0103c194,0x7fff0103c1a0
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,5131809338354126179,1884903940160579822,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,4106723739260384844,13814481749187260005,262144 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,2088608864493034707,17163777964588092954,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,12677861836171044125,11183699692146788750,2097152 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,1184798855029137487,3440331826526938764,2097152 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3468,i,5619910479507574415,14654987329495100400,2097152 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4884,i,13187615630491090702,15351186389172283523,2097152 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,10615518614590070395,2207245370158836763,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,3727855112233652173,14665810040509458527,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,14627532177467222177,9538688793296397944,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,14627532177467222177,9538688793296397944,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,10170114554286486982,1084443482799683629,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12198085154971214543,15331702924716055156,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,5092211004527227604,3302521580365740913,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5028059818516904470,7207864092026740082,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,44128925882287310,15675149987762438627,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9459783512331494371,18409690146407190444,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,12099644207633634492,1904561439277585594,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12674635787801860534,11752290161151531411,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,9897243895187227907,6741836628459155688,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,6387899901353658603,5444215723190870942,524288 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6064,i,13968974585363210056,14424943913829607742,262144 --field-trial-handle=2124,i,17443036551181041661,1184233915036382109,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

47d42fe9-62e2-4326-aa95-91be95d55ffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47d42fe9-62e2-4326-aa95-91be95d55ffc.tmp
Size 16KB
SHA256 07d0ef43fd0c00f61f70761576a26295dc209652ee2983536766ccbe520dc319
MD5 77f240fa3457f727ce9c42d66e229e9d
SHA1 5b47973d301d92206b2c6a45450a78e7a332b6f5
SHA512 0c38177715e37249f8c64ed9ff538bc43ff0798dc2a56cc1e136e7fb552cccde472730c58bbd66c7eb1f30e75972f06ff32154a26c56753e339fc1fd1a733d6a
SSDEEP 192:sxZfRJyMqZjK1Ml8UQ6cG/fxsg9TKTG5GN2kwczodpvsI/W6+WN5cdK/e3Dgn0ha:sxZfqqJG/fxsyTUei2fF/bx/eTBY+bo
TLSH
T1EE72E65AAA74497B8CD7D219F945BB53D2F91562D2904E849AFCCB0C01E6BEC630383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f889d72d3de544965d8f2a9f5a65b8617b81eea9a02dd3f6f64408c112ef8f4c
MD5 b13b03ecdb403c15e45c95c94dc95867
SHA1 c65fa5f170363d4a7d184fdf878bd5c9d41e3e31
SHA512 4eceff3eda3243bac6bd44c8b89cd55f6cfee1ee7a2c6a17e3a4c9250fd1c5ac1df657e0db60b02809350d8d17c4c3f4923af8cb53c621c22c2f37b483660302
TLSH
T124E02BAACD21BC3B09FD1B59A0546747EB0513976B418A1F3E3CC1088FF463A468585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2161f65ff4a748fedfd5dccc9851f32b24b4987b8463d0e432cbc8601e246d80
MD5 228fccac83bc17aa43066fc02e780264
SHA1 eea7fcd5927020d59289f1386a783dc315c0c250
SHA512 98365fac42126477f9cc284fac15efa2ab7fb50dcd64145e6715181d1bb233d26b7f88fe5fecbe3f9f3c3dc9fc16c21b65e4cb9feee13e6e4b88891c5fc146ff
TLSH
T10A712BD982D120B1F3610278B4D1FA10F1BCF0AF0B9B8ED6B3F0987F299AB614517548
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58966f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58966f.TMP
Size 3KB
SHA256 1d673fe66d3e02c7842ce76f326ffefe7adf1752974b3e75a8a8f5815179001a
MD5 bbacea7cb02086e69b42fa05f11827aa
SHA1 431f661585d1444c5409b512ad5f12b4e343c9c9
SHA512 6e97af9bc4290c8753eaef02601a78c53a473dd00c5d72c8c65ffa9ab7957c09e5dd5bcb80ece3f4be5fd3f622e2d4d8f594ff3b5e68f500a6591634eadc68c3
TLSH
T12D713ED982D520B1F3610239B4D1FA10F5BCF4AF0B9B4ED2B7F0587F2949B610517548
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b51d944a8628661e60521e399837696add3bbaff358a4df65578cb6f8236dc55
MD5 372ba54d75ab7f966a418d4d47f17ef6
SHA1 8d747cc0bd0c3dd2c6afc41c5cf5e88cc75c6f1e
SHA512 52499d2a457315a96df5eab85dfef67bc406b1a6d4f75ad8cdfdab09f3c3bc3cd844a0d4045ba2d35752acd1591b0ab792de90ad15fd4e1b7b0334f08218d4f9
SSDEEP 96:D1z9zOpeShPbxaij6Vztz+pWiav9h6v65PSXawQ:D1z9KIShPbxaij6VRz+kiav9h6v65PSA
TLSH
T1DBB1ABF782E4876DD81166F4AA187E1ADE3E0924432C3D5BC4E8AF5F93F2470E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f65a64859fa05ec84098e5081f06a82f64cf872fa405f0d9430609b6c5d1f1ba
MD5 c32c209ba66a18823e1182034b1b2510
SHA1 fe3cb342ed053da12cf622c27403d5868b5d9d4e
SHA512 15d4995202d8c86920d6bdc128c53c33dbd9fa548640408e7c7a01df5e17220757abed88fd36f2c4d269b5450b22c6a981908e13a5575531c2f0fc6536dd3e37
SSDEEP 192:sxZfRJyMqZjK1Ml8McG/fxsg9TKTG5GN2kwczodpvsI/W6+WN5cdK/e3Dgn0hLSA:sxZfq0G/fxsyTUei2fF/bx/eTBjUbo
TLSH
T18672E75A6A74497B8CDBD219F945BB53D2F91562D2904E449AFCCB0C05E6BEC230383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24e79504611e02527df72dfb682250ce802073d3468835165b2cc14b996d8ee8
MD5 ff1e66ddaf98a6e15a337c538c0f925c
SHA1 84cc57584435839ae10869e259e34a18ae3f3685
SHA512 175aabbc192f632bb566271fa854554f94a32a47199f3fad4ecb93b8a855c223ab4c64b47090496a03524e388fde8b653db276a1090912cc41b709525f03d154
SSDEEP 192:sxZfRJyMqZjK1Ml8McG/fxsPvKTG5GN2owczodp+I/W6+WN3dK/Y0hdecIgj+ZJ:sxZfC0G/fxsPvUei2LT/bM/5Bj+D
TLSH
T18762E7066A34597BCCDBD319FA55BB53D6F91563A2904E449AFCCB0C05E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8020f2e0d3beebc6243f38c5fe0796d1aa0ab51032161a5d07127ddef946c847
MD5 3feae424ef45eeb1019da4699fac8200
SHA1 794d843f707810654a9c3aed04548ec9d7e918f1
SHA512 f5ef380eb6453f664fd6e81b97a132854e8ebc9ebf56ace2694d6aa20a0f580a7458bc976f2d075922710662ee04e89fcbab76f4c505e478e9e4dda8b9b8c1c0
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Azx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKAzxj
TLSH
T1D1030A3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 d851c677b7d1f15408ef584041c1b8c04c8a64757d99b1cccad1421dbd7d249f
MD5 5a3824b96fe52a58fdd9f7226a8557e7
SHA1 45330a571dc6d774508974e34d8d97a3eb304b4a
SHA512 673113cd2fc5f6691ed3c2335e5432aa76fb9bf303258880f1844b8923e963b73bb87a532bdeec7ead1262095f04fa08e5e7e250338f62836961ed49c569f443
SSDEEP 384:GZLVDJjEDPV0/ZdWiPWS84U945+qeB20NySZ8Wk:GZLVDJjEDPV0/ZdWiPWS84U945+qeB2h
TLSH
T1B8A2491232BA02423C7E390893968B674A42F1633459ED7F7BB940B64E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 25db4b9669c379416eb85e2d363f080e0f95c9023707290527703db83fc28b24
MD5 5f86b8f97fe12e67b8c7dcd6fd898e79
SHA1 8b2699f6aaa836044971ddbc0a4a59820db33a5d
SHA512 f03794a0a8080bf08661318a1a57ed81bc4fc91ca7d2fb17cdb3e86ecdedaa57ae043f3ba1d53ce0a868a3f9467d0a74636cace25c18fb88a0f2a032e49bf140
SSDEEP 384:n+iFZtNn/s3n9Sl8NN8TUNTUlIR+Pm3ek32nn9HLT4Jfb8Gqic3ZffwL9o2osScC:VFZj+9o6wgQKekm15GwfY5os1jO
TLSH
T107D25C36EC55CEB7ADEA4ED9B74A7643DEE001B389884AC8D9D85D5C00C32DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7d84e065b8a11edce0f50bd96cbfd9c613d85159a02ee0039015e4417988a4b2
MD5 eb780668293b1181e20fb0ed5f217892
SHA1 37b455f07c4546f6cd4b83831242dec65fd14766
SHA512 1e14ed8805cde940d5a85289fbb2782d713755c41ce82949bdeb854ec72fc95836fde66cdee9e7da6c7f38ac70d294236e750db5eea35b7f4016376da5285feb
SSDEEP 384:ntiF9CcmyWCs38Nj8TUNTUlIxBPm3ek32nn9BXQys4Jfb8Gqic3ZffwLdsqe4KVy:kFccps3MwgPKekmPBwGwfYxsqI8p0e
TLSH
T175B26B36EC68CAFBEDE64F99B74E7606DEE01123859899E4DAD85D1C00971DD130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f653fe93131be4a08b0c68a31f56d6e56ce82066babfdb25428af62d7fd95864
MD5 125b0fa77a1511e600022d4cd425f3d7
SHA1 89e17577af1ae92c904e83c9560bfd625a2d88bf
SHA512 54b2100b2d60b687e5b30baea034538686b14f30174b3c91cd4c10b6bfd3cc7203e6a5435013b4ffc569db3f2795a091842e3285c5ee518861d258d4c33e971e
SSDEEP 384:nAiF9CcmyWCs38NR8TUNTUlIxBPm3ek32nn9MXg4Jfb8Gqic3ZffwL9oqse4KV8f:bFccps3KwgPKekmAMGwfYxsI8p0e
TLSH
T18FC26B75E868CEBBEDDA4F99B74A7643CDE01163898C8AE8DAC85D1C00971DD170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0d4dc7404ab6efe4950aab884b09b4d385c62fcf5d83fd968df08315678b0e3a
MD5 9e2a557a77649542d0f64a247ef39d22
SHA1 15e313500e9d48181e32c4e51a5c284c3b1064b1
SHA512 3245aa6a808ff211dd36140340e99821e428dc35e048d009ac529eda7bc8de2b2fd53fc30255110ac245dea90202fcdef3fe892d2a1c6e873519e275cade215b
SSDEEP 384:noiFZtNn/s3n9SM8NN8TUNTUlIR+Pm3ek32nn9HLT4Jfb8Gqic3ZffwL9o6sScjO:zFZj+9L6wgQKekm15GwfY/s1jO
TLSH
T11AD26C36EC55CEABADEA4ED9B74A7643DEE001B389884EC8D9D85D5C00D32DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5dc4ccce4b8cc6155f4b187c63accc6537b78daef5566a03966663ee2967ea9a
MD5 ba5b137fdb5afa7d3c6733a0febbb060
SHA1 f608d1ffc47545ff988c72dce5855c703a078741
SHA512 5ec811d363e9c70d20443bdb8f896317ed4b16e0b33033061170e7625f4dfc3e87202628811234bff2c8b3eb811e932bc407b03a07e2bc8868e08e3c37192650
SSDEEP 384:n1iFRCcmyWC438NN8TUNTUlIR/XPm3ek32nn9HLT4Jfb8Gqic3ZffwL9o6se4KVr:8FYcp436wgp/Kekm15GwfY/sI8p0H
TLSH
T1B1C26B75EC64CEBBECEA4B99B74A7643CDE01163858C8EE8DAD85D1C00971DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6482727ce381a56cd503d6bdf5c4363f0fb926355c6e9777242d25babb2c718a
MD5 d6e88db23c972de3e5899b59a3059a58
SHA1 9961e43f4775bcd430c5782cee3f96bf4f54a303
SHA512 1dabaa585147e8e3e5493c658ecb131405d25b790b33595eca6787bb93be20a40d3c3a4807487fe92741408018691fb287c36c8592284cd9cefc6b6df4cc3468
SSDEEP 384:n1iFZtNn/s3n9SM8NN8TUNTUlIR+Pm3ek32nn9HLT4Jfb8Gqic3ZffwL9o6sScjO:8FZj+9L6wgQKekm15GwfY/s1jO
TLSH
T1B0D26B36EC55CEABADEA4ED9B74A7643DEE001B389884EC8D9D85D5C00C32DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8240193f7df3e381e98aece681b37ccc8727b6853741c3c86a84a192f6436b9d
MD5 a8b1166ebbedfd67e8b3346ffa6179f3
SHA1 4467d3f9dd4c1021667acf9f599dd8f87a53790e
SHA512 e7815a9a84d1bca6f9326fe7f0c7ce36ddd3fa1d8ce24c3cdfabf5c0ecc7f6b578b2b628022aaa0af1b234592b6470b3eef288e523ade21ae47ed209c32ac856
TLSH
T1B95130E15C385AD1D4BD0E7FB09B34FC84E8D726F990347D2C98EA984A79A1D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cb5659a75ed0ed5be98792d07de54e60c2dec3a06ee8508afc5679717193a932
MD5 075b5a3c982f53ec1d78083dd4c54288
SHA1 a1bdc8b1b6059e418e8b8c9df13d765d5c422e24
SHA512 bfe2e29376181d728394501f8fe93e9c6515cba86782ae53baeeed6b941346dc1e3c727abfba2bdcc634dbded784320c0a866bde44b5281970e21e5b552994f2
TLSH
T175512EE15C385AD1D4BD0E7FB09B34FC85E8D626F5A0347D6858EA984A7DA0D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f3adc31655c90fd92d39defc3872c904fac65fdef60421250aacafedd3caade
MD5 f09ddc8bd05eca3087bdcd6708121b2b
SHA1 f2a649561e836230959a31288fce5e5ce8b03695
SHA512 af5111603475a23204e587b6030055f435f0dac48d4eee615fe7600aafa368520f8921e46bac1a081aa711327f7105c89f0ce54f57e42018e1daa794cc8d6ca4
TLSH
T1B2511DE05C381AD1D0BD0E7FB48B38EC85E8D726F5A0347D6C98E9984A7A60D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1323117465\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_802015296\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_982939194\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3156-3-0x000001F490990000-0x000001F490A16000-memory.dmp

Download

memory/3156-0-0x000001F48EAE0000-0x000001F48EB2E000-memory.dmp

Download

memory/3156-4-0x000001F48EF90000-0x000001F48EFA2000-memory.dmp

Download

memory/3156-5-0x000001F48EF70000-0x000001F48EF7A000-memory.dmp

Download

memory/3156-2-0x000001F48EF60000-0x000001F48EF70000-memory.dmp

Download

memory/3156-1-0x000001F490870000-0x000001F4908AA000-memory.dmp

Download