8dfd8de2e3ad00d90b7b3a0dbcf66ebbf347551fd97167a467ab6701bba67f88

Analysis

max time kernel
148s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SJTweaks Controller Macro cracked by mochii/SJTweaks Controller Macro cracked by mochii/SJTweaks Con.svg
Size 6KB
Sample260727-dewkvsgl2z
SHA256 8dfd8de2e3ad00d90b7b3a0dbcf66ebbf347551fd97167a467ab6701bba67f88
MD5 2a8667bbe46cca3f31a4eb0bcea6c55a
SHA1 7e2b602d124ab4983c3a907edb841e05cb4030b0
SHA512 80ce80eb76820c604814148851b858f7453748b49de57e9bbc52b01f6b5b982cd40ca88240aba5e60bf0849e208c2601014942acb68c3ecda4efc81b127ecfd1
SSDEEP 192:q9Sf/t67p25DGs6+ldsIXo+A8zqz436jblLQ36jPNF:uct67c5Ss12Sou2c36jRLQ36jPNF
TLSH
T168D174DC6B70A5F8A2CF4F9FEF3528992E0D6CBD1EB604A182BE9E4844D38C4D914D54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2122171569\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2122171569\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_894563529\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5968_1422836151\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1868605893\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1806629286\_locales\th\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31268233"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2576659347"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295951751972127"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{125ACA67-3E7B-4C60-9CA4-2D7B6FA032A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5968	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 5968	4312	iexplore.exe	78
PID 5968 wrote to memory of 5972	5968	msedge.exe	79
PID 5968 wrote to memory of 1132	5968	msedge.exe	80
PID 5968 wrote to memory of 2912	5968	msedge.exe	81
PID 5968 wrote to memory of 2912	5968	msedge.exe	81
PID 5968 wrote to memory of 2912	5968	msedge.exe	81
PID 5968 wrote to memory of 5984	5968	msedge.exe	83
PID 5968 wrote to memory of 5984	5968	msedge.exe	83
PID 5968 wrote to memory of 2076	5968	msedge.exe	84
PID 5968 wrote to memory of 5644	5968	msedge.exe	85
PID 5968 wrote to memory of 2076	5968	msedge.exe	84
PID 5968 wrote to memory of 2076	5968	msedge.exe	84
PID 5968 wrote to memory of 5644	5968	msedge.exe	85
PID 5968 wrote to memory of 5644	5968	msedge.exe	85
PID 5968 wrote to memory of 3324	5968	msedge.exe	87
PID 5968 wrote to memory of 3324	5968	msedge.exe	87
PID 5968 wrote to memory of 5924	5968	msedge.exe	88
PID 5968 wrote to memory of 5924	5968	msedge.exe	88
PID 5968 wrote to memory of 5992	5968	msedge.exe	90
PID 5968 wrote to memory of 1900	5968	msedge.exe	91
PID 5992 wrote to memory of 2216	5992	msedge.exe	92
PID 5968 wrote to memory of 3996	5968	msedge.exe	95
PID 5968 wrote to memory of 1044	5968	msedge.exe	96
PID 5968 wrote to memory of 1984	5968	msedge.exe	97
PID 5968 wrote to memory of 2444	5968	msedge.exe	98
PID 5968 wrote to memory of 2444	5968	msedge.exe	98
PID 5968 wrote to memory of 5116	5968	msedge.exe	99
PID 5968 wrote to memory of 5116	5968	msedge.exe	99
PID 5968 wrote to memory of 4612	5968	msedge.exe	100
PID 5968 wrote to memory of 4612	5968	msedge.exe	100
PID 5968 wrote to memory of 1016	5968	msedge.exe	103
PID 5968 wrote to memory of 1016	5968	msedge.exe	103
PID 5968 wrote to memory of 1020	5968	msedge.exe	104
PID 5968 wrote to memory of 1020	5968	msedge.exe	104
PID 5968 wrote to memory of 5728	5968	msedge.exe	105
PID 5968 wrote to memory of 5728	5968	msedge.exe	105
PID 5968 wrote to memory of 1960	5968	msedge.exe	106
PID 5968 wrote to memory of 1004	5968	msedge.exe	107
PID 5968 wrote to memory of 1004	5968	msedge.exe	107

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\SJTweaks Controller Macro cracked by mochii\SJTweaks Controller Macro cracked by mochii\SJTweaks Con.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Con.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff91bcac188,0x7ff91bcac194,0x7ff91bcac1a0
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,12413092504934950415,6102634115971913067,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17407184107007825711,13977014037320992303,262144 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,1948786262186796624,14709028046421445445,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9677248386395913584,4580393916881386391,2097152 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6622137697973956915,986865885014558677,2097152 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,1870092098892574634,2604254293533580069,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,17403385011613973976,4717440074943279175,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7308327143802574236,8260486439694387738,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1737641925784562136,730930977726004142,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7308327143802574236,8260486439694387738,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7983703032637722738,17522709987946102120,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14767798148583910495,159289440566499182,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,4885358368596197293,15205582002535344072,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11156841245564404049,3204932519385604869,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10643594629718747595,6311749067541784105,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16524422368590378512,17823539264451082332,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,13374637977087935324,10123459426239178492,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,2372459273673457594,10602337570165771518,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14413147216616617482,7945343746734771109,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6696,i,3398032637768008082,13813026134875051190,262144 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7202966295687295357,1317798048456261103,524288 --field-trial-handle=2192,i,16112471319686271835,7141516254367200222,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 323c0a730b15a1caa9fa8d94e6c847b4b05ad9123754622d35decef5c3550887
MD5 e247add8dbd5e2168e8d347e3fcec057
SHA1 a42d7427e5ed2f3eed9c1be837cf8695aa7ae00d
SHA512 62718591a5d0337891b4149bf8d1c8a945979fcfec4ec562ae3fe15dab6be7941207c74608d645a4d615e0a1d2421861cfd749e9eeae1aa752038b63cd970e1f
TLSH
T15EE02BEEC930EC3758FD0B1DB1550689EAA013671AC0895F7A3D450C8FF473A068685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d24bc16f69595cf1ecaf9983a5fd740fe9b86a080ad938897f7a7075863397d
MD5 c0bbe943c8bdabb6b51d3ace022dd9db
SHA1 8552b21973afcb8244912fb9867a4bae02b0a8b7
SHA512 f0f3edde4b0ccccc7dd98d247b12756fe0a06f28031761d7336a60641638a3a1c23075505c52c77420dcbeb5db05d1907938f4b016c8adcab605c6307277e9c3
TLSH
T1D241ADF783E8866ECA0196F0AA187E2BCE2D0514432C3D9A85E4EF1B93E3571E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c95dd96010d5893cb234ec0338c19ef365d9f01181147b717bcde221487f9cec
MD5 fa66a65ae2ff92ae5098b5d898f99d28
SHA1 764ffdda0e6100d98bda3aae1949be5d1b767ac2
SHA512 60ef52e301fa1d9ff6f9c04fbc1617f4fef66742fe241781617ac8a845f20edcdaa5f5f760d6f3d1b5dac9b5511776d9d185542047a2913b190cd2cc1a9e8677
SSDEEP 192:sxZ2RjyMqZjK1Ml8UQfcy/f0seoE0CXUyynD/zodpEd/W6+WNGY0dhw5T+hIg5rp:sxZ20q0y/f0seH0Ly8UU/bG5kTyIE
TLSH
T11F72F91AAA34897BDCDBD219F6457B53D3F9152292904E44A9FCCE0C04E7AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1d2c190df290fb0afefe572e682e709d98e6ba9cc99b121a88760161a4fdb9b8
MD5 7f59602d5d0232fcb5faa3973e7a2c5d
SHA1 20667e32bcabf961d2a16375a995c3152323cf5a
SHA512 63018cfbf018cfaca93111d85caacd42740221c730354dc45bc2cb9aaaace7f4524b489567c2ef63cb8297c83a9d9dcd963d596a8e7a678db7778fce73f9212e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV383pQLli:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK83pJ
TLSH
T130030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ae4ffc127731cb2dd4e3e6284886b186f521ce70c163b24cca364340b378053f
MD5 61da600d31aabd77e756b5e2fef4f7b6
SHA1 4cc3c83a776ddae33954309d172df8f434d317c0
SHA512 40333af11f1ec41d3184f260e619e01b5261dd7c1088962fda3ccb4fe9ad2eb7a643d83a22a5f54f3262ba094504d7da1cc8acaeb23f42e7f678f363ffbce0cf
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ODT:AFBHhTofhno2mB21q3Llbfe3sLDdeEp4
TLSH
T172B28F56717B12023C3E291CA7929B370E8272A3345CA56F77B900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf9f634c-7ac6-4a7e-86a8-6af0642c08fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf9f634c-7ac6-4a7e-86a8-6af0642c08fc.tmp
Size 15KB
SHA256 c7fe0bf16be991c88854df39a70aa508a7b6b347e0f675e742dc8aeaf4c627a9
MD5 eb731e01fceadac8baa4189f5e6826ee
SHA1 d01ef79c83777a193ed7b4757421504b8b3dabc4
SHA512 c02b620eca1be96990d240595ab35e5e8cb498f7ff000f2bd9cd28d8f24338b3cee30fa41bb4b6f48e0a41bed5743e4769b555d9df166b3d47a7ac7acf74be8f
SSDEEP 192:sxZ2RjyMqZjK1Ml8Mcy/f0s8fHxE0CXUyynD/zodpEd/W6+WNGY0dRlzT+hIgjev:sxZ200y/f0s8fH60Ly8UU/bG5pTyjeF9
TLSH
T1FB62F816AA34997B9CDBD319FA457F53D2F9152392904E44A9FCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a3de02e429978c0ce3fa4e1abf37e4ced2e133fcce44944cbb422ba4bc7e3fe7
MD5 11a3c7cb9efef9cad961927149e92f15
SHA1 651277452125d12bde5e8992c370db49a2f039c8
SHA512 5fd4b1ff04f178d97a32b3a980cc3bf3767318ee8fc4f1f4b5fd675ddffeefb0fd1f94fb1c1f4056f13ee8101865c0d1ac3fae5664746ea793f0ac2b11998eba
SSDEEP 384:n2iFpZcIb38Nv8TUNTUlIRDycH/jkpfb7ofalgAYSJnSOObjI9G6w7t3Hy/7Igr:dFhb30wgtIJofatRnS29MtY
TLSH
T17DD24B32EC65C9B7FCEB4A99B78A3A43DEE41163C5CC9AC8D5D95E0C008719D1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a80eacc4786a7497294561f5b6a5fcb82cb76608c72c7ddd4afd248c7cbd7e22
MD5 bb7a492e99ef825a602f575697a9999f
SHA1 27bfa17d7d6a6ecdc01e162cc994cd315ffe925b
SHA512 1bf1c5e578fc053de176fbeac8af58e22c288dd581ba8c452f63255f0d4d4a54ffe7cc04e68d78803f534afd559431f5967de300ecfd86d921be75a88337ce94
SSDEEP 384:n5fiF9CcmyWCs38NP8TUNTUlIxBydvFo/ajkpfb7ofalgAqKOhkP+lFYS/TsHy/9:wFccps3Awg0I7JofatqThkoFYS/F
TLSH
T1A1C24A32ECA9C9B7ECE74F99E74A7A02EEE01163859C99D4DAC81D4D00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1beecdbb5738c0f68062cbfb231415a77e9b11699de1d563c06b323d9b7b586b
MD5 3cb05be30bf0119df88555ce274b39c1
SHA1 543e96953f870e71ec2193ea3a5da073ae94d652
SHA512 5b072b47af675cb5455a0d939b71b7633a03dcee36f1d4125e571b254e14e940f3c01745c814f78752c43602bf06e5c195a062701ce90ec76be579d4ca8ee867
SSDEEP 384:nUiFpZcId38Nv8TUNTUlIRDycH/jkpfb7ofalgAYSJJSOObjI9G6w7t3Hy/7Igr:vFhd30wgtIJofatRJS29MtY
TLSH
T117D25B32EC65C9B7ECEB4EA9B78A3A43DEE41163C5DC9AC8D5D95E0C008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a92b269e00a8f45fc1a49761c71f4a84b74e5fde8853edded287c02a04788735
MD5 cedfc1acdd0f58aed4b0163cb9328ce2
SHA1 62a5d69d761a8507ff66b6d452aa0d2916a6c4f2
SHA512 7ffce3733486df99b14dbb5950209e7cff5575f9ac134e09680df09739fc2737223aa16e42b10bbfbe905083338222c8701caa81adfd00db2bb0108365c4e00b
SSDEEP 384:n5PiF9CcmyWCs38NT8TUNTUlIxBydUOcjkpfb7ofalgAYSJwShkP+lFYS/TsHy/9:MFccps3EwgIhJofatRwShkoFYS/F
TLSH
T1A7C25C32E8A9CDA7ECDB4A99F78A7A42DDE011A3C58C9AD4D6C91D4D00CB1DD1B0BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 38f57ce4107c7dca7d5f7cee93c9053353d69c2f41d1c7b2baeb5888297ba574
MD5 498ce7b781bfa592654d5a2d4c5bc48b
SHA1 a027b5e17e950ee2b362fa017d2b1e3fe3782db1
SHA512 52e675cc7c4eeb21b20d3e241266ebbda84f4ec53ddeba8299656d8f5d4c02a0a04b6a0d6d575a65be8f5001615ef0e939b358e9a5078283b1b18e9f74dd3e4b
SSDEEP 384:n5CiFpZcId38Nv8TUNTUlIRDycH/jkpfb7ofalgAYSJJSOObjI9G6w7t3Hy/7Igr:bFhd30wgtIJofatRJS29MtY
TLSH
T138D24B32EC65C9B7ECEB4EA9B78A3A43DEE41163C5DC9AC8D5D95E0C008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e4c986a956d24a24ab92b344c3137179958ddae003e94ba1d70c57e1c814e3af
MD5 1783bedcfc61512180d58d296b234257
SHA1 c35ee2606ac55c9725fc8d43f3750296abca51fa
SHA512 c89571a292d52fd9886c8081368e88612e9cadfb62bd4d33357127c9fd85ae94553b5f0b95085a4ce55feb71cddafcc8c5beafa945c7f6e1bc2f76f65f895fb4
SSDEEP 384:n5CiF9CcmyWCU38Nv8TUNTUlIRuyRaH/jkpfb7ofalgAYSJwSOObjI9G6w7t3HyM:bFccpU30wgmIJofatRwS29Mth
TLSH
T1D9D24B32EC65CDB7ECDB5AA9B78A3A43DEE0116389CC9AD4D6C95E0C00C71DD5B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a0efc2d7a9a076292a25eaa5268f9fed60a0ad89902a06e271b8549c4746d878
MD5 aef2d44466a95fba2afebf1de837a33c
SHA1 3950512efd439d8aa7521077b13837e8f94201e3
SHA512 f31ea77f0cb681b5c6e02ed5369c65f49bd77ea4332d8fd10ff7e43bb6243c0b4dd2b4bde8a4668e40873fd23f210f364d04855a0d2adf0827972dbb90b9aa43
TLSH
T15D5132E15C7D1AC1D5BE0E6FB48738FC81E89725F4A034396858E99849BA61D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6f5eeac10390bcfe3385a6ee341e5aaad3e2d9e40d34168d2b9022378ea2f888
MD5 38f16b38415347229948948a87e60c81
SHA1 52baa07e339eacc2b2a684a3e6985633ee1ccca7
SHA512 474ba5c5f4141a176e6a857ca4b336e4638ef8160290097138957af30190fde03adaf63f93d27b2037b0e940d54bcb6ba4cd6a0c415bbc0dbe2734d6e142f804
TLSH
T1BF5130E18C3C2AC1D4BE0E7FB48738FC85E89715F4A0743A6858EA98597A71D608087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 125628879ac31a9ca995929a7b152ebc044081bff3685909379f2667254f21cb
MD5 8783dc5df8581eecb6edbd58891ae455
SHA1 77b890fd5961abd4f2a12dae3948885308c6d37c
SHA512 34e20efdf2dc3ef67d0f4bc44ccb2ba7e74510ffd97986f79e549476c899bdb5371b18f4ebc8d2219eec1fb51e108ad79573dbc671d6e2d614adea82bc9fcd9b
TLSH
T12E5132D08C7C2AC1D4BE0E7FB48738FC81E89725F4A034396858EA98497A61D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 356a4ede1e6106d7d213fa14907970aa4a9324f65ce348058c1c4cedbf729e49
MD5 b8f26b5de2a0c83281c43b6c1f78742a
SHA1 a28e1fb043a2056823fd14b1b9eb1b3f7831ea3b
SHA512 a7298cfe379da59fde9b90477c5c5df023c858631cb0983ef6550634014d34b312eadaf8310198df4b084aa109685ddd2358e1b2fe5799924e45ed15e47656b2
TLSH
T1AC513FE05C7D1AC1D1BE0E6FA48738FC81E8D725F4A0747D6848EA980ABA61D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1868605893\manifest.json
Size 53B
SHA256 6954daa257636bd6d9563ff3568dcd9845bf9b99e587d490da2306bf0938b684
MD5 caf17c4608f6bf58bf0d56e1e63c1570
SHA1 5cbd60bf29e30e477627bb8d094272a35a3cfa65
SHA512 92126322986cdc0ce8ea76ed1ee484b9955aa3dc061156f2e0012d9f1bd5b1583f9f2e4d9eebaa6db250c95de6b1cb44b30a4a3180a01f2724947fffbb9ebd18
TLSH
T1D59002604414951716D10E5066B0B8819391661995850D1D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2043076870\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2122171569\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_2122171569\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_894563529\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download