3a7485eeb611010b0214b043ea65e5d1e652f9d4d354c28146bcc632213f6267

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SJTweaks Controller Macro cracked by mochii/SJTweaks Controller Macro cracked by mochii/SJTweaks Con.svg
Size 513B
Sample260727-dewkvsgl2z
SHA256 3a7485eeb611010b0214b043ea65e5d1e652f9d4d354c28146bcc632213f6267
MD5 2181f86ed45f4ef2fca2f6cd5a35ade1
SHA1 3a96e09048f446a7b22a18511315e19462c0049d
SHA512 356c140b4ea4f75884ff715d1d722fb0af94a6f7fb13bf68c428e6c1d64bba4682ff8998a3172b388ab3061cecbf0b78b1343daea5e592c296c5409688b2cf95
TLSH
T140F0599FC1D44338E3340F3A5260F2E0CE6E526A24F540C591F69E333D9A4C4A89D8E1
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_107153397\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_289144583\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_1786027896\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_303379059\_locales\uz\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31268243"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "25476918"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295951458420723"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{DBBE35AA-30AE-4956-9D6B-68238E4D2CD9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3428	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3428	3056	iexplore.exe	79
PID 3428 wrote to memory of 2772	3428	msedge.exe	80
PID 3428 wrote to memory of 1900	3428	msedge.exe	81
PID 3428 wrote to memory of 5580	3428	msedge.exe	84
PID 3428 wrote to memory of 2776	3428	msedge.exe	82
PID 3428 wrote to memory of 5580	3428	msedge.exe	84
PID 3428 wrote to memory of 2776	3428	msedge.exe	82
PID 3428 wrote to memory of 2776	3428	msedge.exe	82
PID 3428 wrote to memory of 3016	3428	msedge.exe	85
PID 3428 wrote to memory of 3016	3428	msedge.exe	85
PID 3428 wrote to memory of 3016	3428	msedge.exe	85
PID 3428 wrote to memory of 3888	3428	msedge.exe	86
PID 3428 wrote to memory of 3888	3428	msedge.exe	86
PID 3428 wrote to memory of 3888	3428	msedge.exe	86
PID 3428 wrote to memory of 4948	3428	msedge.exe	88
PID 3428 wrote to memory of 1936	3428	msedge.exe	89
PID 3428 wrote to memory of 4948	3428	msedge.exe	88
PID 3428 wrote to memory of 1936	3428	msedge.exe	89
PID 3428 wrote to memory of 3880	3428	msedge.exe	91
PID 3428 wrote to memory of 2352	3428	msedge.exe	92
PID 2352 wrote to memory of 4792	2352	msedge.exe	93
PID 3428 wrote to memory of 5108	3428	msedge.exe	96
PID 3428 wrote to memory of 3376	3428	msedge.exe	97
PID 3428 wrote to memory of 2944	3428	msedge.exe	98
PID 3428 wrote to memory of 3632	3428	msedge.exe	99
PID 3428 wrote to memory of 3632	3428	msedge.exe	99
PID 3428 wrote to memory of 2300	3428	msedge.exe	100
PID 3428 wrote to memory of 2300	3428	msedge.exe	100
PID 3428 wrote to memory of 580	3428	msedge.exe	101
PID 3428 wrote to memory of 580	3428	msedge.exe	101
PID 3428 wrote to memory of 3552	3428	msedge.exe	104
PID 3428 wrote to memory of 3552	3428	msedge.exe	104
PID 3428 wrote to memory of 3408	3428	msedge.exe	105
PID 3428 wrote to memory of 3408	3428	msedge.exe	105
PID 3428 wrote to memory of 1656	3428	msedge.exe	106
PID 3428 wrote to memory of 1656	3428	msedge.exe	106
PID 3428 wrote to memory of 5060	3428	msedge.exe	107
PID 3428 wrote to memory of 2596	3428	msedge.exe	108
PID 3428 wrote to memory of 2596	3428	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\SJTweaks Controller Macro cracked by mochii\SJTweaks Controller Macro cracked by mochii\SJTweaks Con.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Con.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2fc,0x7ff978e6c188,0x7ff978e6c194,0x7ff978e6c1a0
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1999041253885867017,9586640453626546863,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,16329235831759954326,10333927958746463248,262144 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,7032565943917506892,16769606247178299962,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17961838199501519316,15323377531845635333,2097152 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15398418750900001298,2228983968677890660,2097152 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,9596808623104654659,9822531667291903288,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,11212786853447856516,14488602144533468321,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9606917609388133533,4967450809110518060,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9606917609388133533,4967450809110518060,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12672841397657185233,12275673715133393355,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17021136726649744144,5232836214502739178,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2743956594128240045,13349496181689857610,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,15160339188662992944,9498775103119888232,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,3593377743269092465,12169111960379737815,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8807481434009001364,14711718436473357895,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,8506764595093208423,5851347980372026422,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,9281483685241799162,17659829772501101809,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,5393345523501834408,5942703247220000309,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5752310690607804797,8870612385178989056,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,12287637621453306820,4988793645689306843,262144 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,18207358601965824586,12197135394653901917,524288 --field-trial-handle=2556,i,8084870569998967079,7286989912193076680,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cc0c7d23042a5208173a02e47a19a9c212fbc564758b94267ac52e6ed668f50e
MD5 6e1605c94ef4429d16a78109c8f415cc
SHA1 651b5793c20450818146c4089f2fdacc00fbdc8d
SHA512 e0d72a15cbaabd537c07d7688960301b67279904e28ffd26e53fc7526d05d1ae511024c0df00f215fa9ae1391b6a050ed04f93e9f60c34fdc5687970170d4a69
TLSH
T1A6E02BAACC21AC3B18FE2B58A0605746E70513571F815A4F7A3CD1098FF1A3B468589C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 10da2c2921381198c582e17b4e2504b21bba066151680a5ebd1412fbff360e1f
MD5 6b9e813c945c17da151737631e0c01dd
SHA1 8587e225c17ad29202b1e73caf1488c0e7c1c84b
SHA512 2141e6332b63037a395aa69611d4e5ee7da237a3115b4e802869e6c7340c57c2c4eadbc0cce86499c2958b1e0d7ea509a7dd2837b2ff54e8305945c9b25b37b1
TLSH
T18641BDF783E4856E8A1195F0AA18AE2BCE1D0510432C3D9AC4E4EE1B93E3571E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ce11ba427afdce738f88533bb6e957c026451fb77fe2bac65ee5f8c1fdea0309
MD5 9ddefa8952ee7cd1f582733c6fd3cb9d
SHA1 f0b5367eef25c19f2192b265d403725450d945d9
SHA512 08bae7f2cdba6698cb48d2580fd4614082d6a25bc334f5e7f1470c700340f4fe2e7e82f420aaeae4bcef87c08ff9a5278aeb7a87ad5de5d61eef682f216c788e
SSDEEP 192:sxZURXyMqZjK1Ml8UQPcB/fwsNrjKTG5GN25wnzodpEp5q/W6+WNGY0h90vwcIgp:sxZUoqEB/fwsBjUei2Hw5q/bG5yp3uM
TLSH
T13A72E8166A74497BDCDBD219FA45BB93D6F91532D2904E44AAFCCA0C04D6AEC231383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c6b81df0125c944741b3c0390c3ef2ac7d4e5116724d5b4ef942d0d4b42934f2
MD5 c288e2609c464126407247772f1a7842
SHA1 404c69ac2313b81b5ad8a2dbdc5c591599571ade
SHA512 cdadce1272d78a93f6040d80cbdb2b0d7d5f98ca08d3c1c392dcdcc8c50a06ca705a710d6ac14724c1d6c308676a1796fae48933be5439edfede6b6b3e4d3d2f
SSDEEP 192:sxZURXyMqZjK1Ml8McB/fws9DKTG5GN25wnzodpEp5q/W6+WNGY0hfNfwcIgj+OJ:sxZUo0B/fws9DUei2Hw5q/bG57pj+a
TLSH
T1AF62F8066A64597BCCDBD319FA45BF53D6F91532D2904E489AFCCA0C04E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 51720d6e670cd2ed1753669ad317d4e5a1f96370c5d1d70ef92c6f32058ac335
MD5 0df1151d86fa3f15afd6419033397649
SHA1 9c5e2437d0475bc10d1c7002ff97c8c50c2b7a14
SHA512 01248940fd97b650dbdbb2bb333b875e65b41a09ae730b94415f1d17d4f83065faa183e510bdb45280706e96507d98961766adc6f862c8008f224b0721d6e53f
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3czx4LlG:wQAKq8y02yqEnjbWRmj1QWTu1jaKczx5
TLSH
T1AD03FA3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 59048d904e4dbe5c88c36cf219f2a9708d23b59d99d0de9e9064c42182594d6b
MD5 fa9409bfbfde6613f1429ff7a2d857bc
SHA1 e92486a9a7bedd88b5ffc57961de4a4c2eb172b1
SHA512 189e271979894ff6fca7aff48e87e023babac85069617e8b56215a78170adb6052d41776aa5bcdf70c7d367154c95f60b9bd7e38f502122e0b2579ad7526cc28
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F52:GZLVDJjEDPV0/Zd+hunVo
TLSH
T1CBC2480236FA42423C7D690C939687674A82F1633069AD3F7BB904B64E67E115EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b2fe1fe6fb608174eb0891b4df6c3f42cc15ac8ed1808b7f32b8b159a60bfcea
MD5 1afb19cc5372bd6da552f02d6eaf648b
SHA1 fbff8440373afafa25b7d609d31b22e912ce0343
SHA512 4780814fe23b7cce84a6513d179150d622eeda730ec33c0c10598ddfa7bdd8ad1c9542160377a997a4754c8e586ec4a9608af69d25a62ed788f0346c09e25f52
SSDEEP 384:njiFXZcIG38NW8TUNTUlIRmPm3ek32nn9wAN4Jfb8GHg6k0gLOObjI9G6w7Q9tyS:OFfG3FwgAKekmbfGHglL29MQL
TLSH
T157D25B36EC54C9B7FCEA8E95B75A3A53DEE01163C99C4AC8E6D95E0C00931DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 78504b4fe5d011058ac5e50bf613a6632664423eb77c703226261a37d50c1bd9
MD5 a544b4dfe5612d714e45e55b6705cab2
SHA1 df2504556dc066bb95b94d287fb3811c85f9cbbc
SHA512 88e11ca23ada457cd5cbfb7f1175b8b3b58efc52cda6dafe7cedac1e9810c309084fca4f09bcaefcc51018f4c6f35b6c98591c26629d77aab7bdec3d02c0bb9f
SSDEEP 384:njiF9CcmyWCs38ND8TUNTUlIxBPm3ek32nn9BDQ9s4Jfb8GHg6W8e4KV8p0bWtyi:OFccps3QwgPKekmrKwGHgX8I8p0e
TLSH
T159B25A35EC68C9FBECEA4F99B70A7A03DEE01223859C5AD8DAD81D1D009718D174BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7fb9de50c6451c83b5383b38d9702908579d4df235c74dc1d555a36e55136eee
MD5 62f2d6d1833f5752b346502185872f9d
SHA1 12be97e89e9e0593185d870b0baf994da9594df4
SHA512 ed837f15d5c26d448989677071cbe418892a79396433874b5ef2415da9399b332a25f9469cda1765c15caf140196e3877fad29afbf4ccb6a82c327a6687decdf
SSDEEP 384:nkiFXZcIG38NW8TUNTUlIRmPm3ek32nn9wAN4Jfb8GHg6k0kLOObjI9G6w7Q9tyS:/FfG3FwgAKekmbfGHgbL29MQL
TLSH
T128D25B36EC54CAB7FCEA8E95B35A7A53DEE01163C99C4AC8E6D95E0C00931DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 da99cb288e66cbe66071a5027ad49aaefbe6ea2ccb156e9eb9bf5d5ebf3a8df1
MD5 9a83725a716d5526d75eb61191788629
SHA1 632d864de00ea5b8fb32ea9be4cf08b416fc680d
SHA512 f58087cc3d0759910044ce9d49fb68abaa08471a5877b8fb115a2da0ae228b8c19901a7c76db81f7892465eccdc139473614da22be263c0ecd3279a2d3fe1697
SSDEEP 384:njiF9CcmyWCs38Na8TUNTUlIxBPm3ek32nn9Ohe4Jfb8GHg6k09Le4KV8p0bWtyi:OFccps3VwgPKekmg+GHgALI8p0e
TLSH
T181C24A35EC54CDBBECEA4F99B70A7643DEE01163898C8ED8DAD85D1C00972DD1B4B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e0d0ed5a4fbed4cc927c05ae4729a92078ab02bc00f0fbc72814292380edabde
MD5 d6dbbbd00132b8537919d5c404e7b485
SHA1 cffed8c9d56a307a95fae714f3773661b99558c0
SHA512 4c32c767289be30799b0e4a4c6fe212dc58b4cf327b4439fec0db3270f26d55cd77bcbbae0608378de252958c9f5e253464cd5a993ba7d2be6db650d02677104
SSDEEP 384:nliFXZcIG38NW8TUNTUlIRmPm3ek32nn9wAN4Jfb8GHg6k0kLOObjI9G6w7Q9tyS:sFfG3FwgAKekmbfGHgbL29MQL
TLSH
T164D25B36EC54CAB7F8EA8E95B35A7A53DEE01163C99C4AC8E6D95E0C00931DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 59059d2d6b6c5fa40116ea00e2eb2aa460fa66ee88e7e1cb475effda65dec8b2
MD5 8a770021ba79eda5bebb2757b42f45b8
SHA1 145ca2a6139d7f6d0cc07c505d782fcb1df63d30
SHA512 c8005261007d70d1034b501fad245faeb5bfbaea83ea5c7084b7f83a06c18dfcda518f90b33b50e086e4acf96f6d639f7a04ffc99d57924944a03518ff3446be
SSDEEP 384:nliFiZcI338NW8TUNTUlIRCPm3ek32nn9VAN4Jfb8GHg6k09LOObjI9G6w7Q9tyS:sFQ33FwgAKekmMfGHgAL29MQL
TLSH
T18ED25B36EC54CAB7FCEA8E95B74A3A53DEE01163C99C4AC8E5D95E0C00931DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 860022c81dd9e5f435e0affbdf0232f58d62f8cfa6dc2e02d75dd9893cd85c9a
MD5 0fa8cbcb9287b7d78de9ccd01bf9b58e
SHA1 b019fd61260a37968c05abbbfb43528bf1e72fd1
SHA512 679d85b23c452e80e3c5369da20e561c69b6d27a03d7930873d41e910cbbc0a1e220cf87d755289284a6aa66ebd7c8023081e88d88a295641139dc513aff1488
TLSH
T12E5132D14C385AD1D4BD0A7FB48B34FC84E8D725F590347A3858EA985A7D65D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d116ed9eb6306e383921f9336694f7d4b71d44daf60919e21bba72eae1328918
MD5 237497902229828eab096ebd62ac3a3d
SHA1 8a7dcddaf9a540d3fa66b4604a066d17700c4925
SHA512 d4c48efd5759c442aefcd1f0be083cc05d6de8c0d075db5d5548ba72ca9cb7d5c269fdc869d89c569d743da4fb36df0c705448dceac76a20da5764bae9033359
TLSH
T1135132D04C381AD1D4BD0A7FB48B34FC84E8D725F590343A2C58EA984A7A60D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ade96512e7649313fce1203da953bc865a49b51592df751f5fc18239b5e25d55
MD5 a5f557f82deede0f4e097a3350511e74
SHA1 0934ab8df7f73e45c053214ae3abec180c89d16d
SHA512 0004c596f0b092cd67737f7ec7825e9087bc85573c6701c32d9c5444040815a147ba561807b2e379c975b19c52ece0d528720d950d72a17fb8c5171d7c4fbcd5
TLSH
T164512FE15C381AD1D4BD0E7FB48B38FCC1E8D625F5A0347E6858E9944A7E60D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f3adc31655c90fd92d39defc3872c904fac65fdef60421250aacafedd3caade
MD5 f09ddc8bd05eca3087bdcd6708121b2b
SHA1 f2a649561e836230959a31288fce5e5ce8b03695
SHA512 af5111603475a23204e587b6030055f435f0dac48d4eee615fe7600aafa368520f8921e46bac1a081aa711327f7105c89f0ce54f57e42018e1daa794cc8d6ca4
TLSH
T1B2511DE05C381AD1D0BD0E7FB48B38EC85E8D726F5A0347D6C98E9984A7A60D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_107153397\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_107153397\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_1786027896\manifest.json
Size 53B
SHA256 6954daa257636bd6d9563ff3568dcd9845bf9b99e587d490da2306bf0938b684
MD5 caf17c4608f6bf58bf0d56e1e63c1570
SHA1 5cbd60bf29e30e477627bb8d094272a35a3cfa65
SHA512 92126322986cdc0ce8ea76ed1ee484b9955aa3dc061156f2e0012d9f1bd5b1583f9f2e4d9eebaa6db250c95de6b1cb44b30a4a3180a01f2724947fffbb9ebd18
TLSH
T1D59002604414951716D10E5066B0B8819391661995850D1D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_289144583\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3428_359898144\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download