bffc68c7d5267e733052f2e84882f0813a23c15aa5039949be7c08fc8a988423

Analysis

max time kernel
148s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SJTweaks Controller Macro cracked by mochii/SJTweaks Controller Macro cracked by mochii/SJTweaks Con.svg
Size 1KB
Sample260727-dewkvsgl2z
SHA256 bffc68c7d5267e733052f2e84882f0813a23c15aa5039949be7c08fc8a988423
MD5 60de3eff1108a275b76579f4d1f7141d
SHA1 88312d1150ec8ff2b227986e21d85ec3881ec4fa
SHA512 7f66e468ca8cdd7dfd3dda9e5c27abb6c43e5dc8702ab27fe72c5ab1dee1777993d6dd5312d43135c71c68ac5d7188d36070658be7fe6673759bc3998a350550
TLSH
T1B92161EDA1F46B15CF34C2D4972FB8CD4FC9A44F2C21435A344198151E6744F84CF924
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_172941387\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1785180622\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1785180622\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_80933494\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6012_352340570\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_172941387\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_80933494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_506657665\_locales\te\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2011465793"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31268290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295951721460162"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{033A7FB9-ADB4-46C7-B69D-CDA4E9AD9EF6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6012	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 6012	4216	iexplore.exe	79
PID 6012 wrote to memory of 4880	6012	msedge.exe	80
PID 6012 wrote to memory of 764	6012	msedge.exe	81
PID 6012 wrote to memory of 4116	6012	msedge.exe	82
PID 6012 wrote to memory of 4116	6012	msedge.exe	82
PID 6012 wrote to memory of 4116	6012	msedge.exe	82
PID 6012 wrote to memory of 1416	6012	msedge.exe	84
PID 6012 wrote to memory of 1416	6012	msedge.exe	84
PID 6012 wrote to memory of 5764	6012	msedge.exe	85
PID 6012 wrote to memory of 1704	6012	msedge.exe	86
PID 6012 wrote to memory of 5764	6012	msedge.exe	85
PID 6012 wrote to memory of 5764	6012	msedge.exe	85
PID 6012 wrote to memory of 1704	6012	msedge.exe	86
PID 6012 wrote to memory of 1704	6012	msedge.exe	86
PID 6012 wrote to memory of 2564	6012	msedge.exe	88
PID 6012 wrote to memory of 2480	6012	msedge.exe	89
PID 6012 wrote to memory of 2564	6012	msedge.exe	88
PID 6012 wrote to memory of 2480	6012	msedge.exe	89
PID 6012 wrote to memory of 3728	6012	msedge.exe	91
PID 6012 wrote to memory of 3240	6012	msedge.exe	92
PID 3728 wrote to memory of 5176	3728	msedge.exe	93
PID 6012 wrote to memory of 1552	6012	msedge.exe	96
PID 6012 wrote to memory of 2600	6012	msedge.exe	97
PID 6012 wrote to memory of 4708	6012	msedge.exe	98
PID 6012 wrote to memory of 2772	6012	msedge.exe	99
PID 6012 wrote to memory of 2772	6012	msedge.exe	99
PID 6012 wrote to memory of 1128	6012	msedge.exe	100
PID 6012 wrote to memory of 1128	6012	msedge.exe	100
PID 6012 wrote to memory of 5876	6012	msedge.exe	101
PID 6012 wrote to memory of 5876	6012	msedge.exe	101
PID 6012 wrote to memory of 1660	6012	msedge.exe	104
PID 6012 wrote to memory of 1660	6012	msedge.exe	104
PID 6012 wrote to memory of 2524	6012	msedge.exe	105
PID 6012 wrote to memory of 2524	6012	msedge.exe	105
PID 6012 wrote to memory of 4344	6012	msedge.exe	106
PID 6012 wrote to memory of 4344	6012	msedge.exe	106
PID 6012 wrote to memory of 4672	6012	msedge.exe	107
PID 6012 wrote to memory of 4576	6012	msedge.exe	108
PID 6012 wrote to memory of 4576	6012	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\SJTweaks Controller Macro cracked by mochii\SJTweaks Controller Macro cracked by mochii\SJTweaks Con.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Controller%20Macro%20cracked%20by%20mochii/SJTweaks%20Con.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffb44e2c188,0x7ffb44e2c194,0x7ffb44e2c1a0
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,11178119924924720316,11672974753807176976,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
    3⤵
    - System Time Discovery
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16156241658872990743,9578639269080128930,262144 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,12606237262109041169,10229301092860217619,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4329698198442915838,642026709044201522,2097152 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7265183399714008643,1362024615842256851,2097152 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,2865986151829081511,3633334464383007382,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,10382130256243492337,7710165081369268104,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16763527664359654813,2393984452140648734,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,700679197070323325,16079694506309685943,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16763527664359654813,2393984452140648734,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,11601275622318582484,750125489372483512,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,92057627988443209,8552864169615448901,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3096986818700684324,3651490638219217529,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,2681359032549426863,11820491961951553646,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,10363861398969499113,11314249677694727638,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,6014252746089072846,9419307449578973476,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13668800259088686605,8832127618715891752,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=872,i,10212586710375520051,16055432246200999951,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,6049384033453238813,13274061516847921630,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6480,i,2918943807743382683,3966236353456947698,262144 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,7037691568372425959,12855379696641564527,524288 --field-trial-handle=2372,i,2687527123959363584,7138049870760533271,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d6b2cb304f41545053c31103ad54edf3046cea191bb06d336afaf30fd181bdc4
MD5 4118c14a52c4d1a4c759b9c146d428f0
SHA1 83c13a6d432cd669c9ac4989784afc26234fd0b9
SHA512 b85f4c8035896b77b81465ad6e961aa0f772405e3bb10fb6db07d3312670b4bc4ee2fc9be4613843ce4e281f0ffc855c6d504dd85f5b73c429ff13f31b7b33d7
TLSH
T1FFE02BBEDD20EC3759FD0B1DA0590645EA9013671AC0885F7A3D650C8FB473A0A8685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dabe8b304d13ee690eeb6cb4ac061b2d488d19fd08a85de35cfb54c9df582ddd
MD5 f26cd5fc42ead65bcfa999c8a741f147
SHA1 765b2d58f042c1927b55abf0ff7a9516a74712a7
SHA512 a54263a9813b7354bc00c6fbc8c49a22c8adf796c5d8b26204fcbf46f36a640b68aa0b61748de3d72d50eecc726f19e10dc1ce6fec24242111d62509b3cf9d11
TLSH
T17B4190F783E4856ECA0195F0AB187E1BCE2D0514432C7D9AC5E4AF2B93E3471D145A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2b432bc7e12e832e4fcccd38ebf824fc7a010b478c7ea899e8e08c7c3c9de109
MD5 ad7d7247d4aceee19812dbd609e6638c
SHA1 dde9c846c61aba480a7d76447631e9ef4b4e36ec
SHA512 c2716c764a0097c22d6496d202e8804c812e1690a0063647cc1551c47f3b91d0e3b87b1dca71128f852b6e9af096c339d9a0a5d5bdc709226b618ca522924e0c
SSDEEP 192:sxZSlRLyMqZjK1Ml8UQFcK/fRsaWE0CXUyynDfzodpEb/W6+WNGY0dZ82RwIg5fS:sxZSlUqqK/fRsaZ0Ly80a/bG53eno
TLSH
T1C8720916AA34997BDCCBD219F5457B53D7F91123D2805E44AAFC8E0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6e6f81a773a2efba1235ddaddff783afd2aa07b73f0df27e5a432b6d7012f600
MD5 4cad159fbe498f96b2d728a9caa086f6
SHA1 c50f2a22e652b9e7bf39304b56e67fe75ddbd951
SHA512 4bb13de291c45bfb8d036d2e12a0641b1d737df49b5c1b1998672a08e96d18f9901df8bf34989a37c7415e8bcfa2f220a0c5ee5ebc69687d05cfa27544225db3
SSDEEP 192:sxZSlRLyMqZjK1Ml8McK/fRs8Q7xE0CXUyynDfzodpEb/W6+WNGY0dRBYRwIgj0J:sxZSlU0K/fRs8Q760Ly80a/bG56ej4
TLSH
T1496209166A34997B9CDBD309FA457F53D7F9152392904E44AAFCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e3810716f0ab4d823aca74589bca6e92205d54739bf5ad86859491035fb8f2d8
MD5 73fd6088be0a11a4e8f1b73d49605b46
SHA1 65b00464bd2a35a72efb7ea7d059870028241c50
SHA512 e5e1777913a91ac8fd5b82d981946bdfd2eb86a798b9cf01394a313ff14387190290d55cf47d583cdab1b33a614b14f706b03436f1438690de875b56c238656e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV323pQLlj:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK23pA
TLSH
T103031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 278ff3a6dda5daa70d49405578c09f1bb80abb8e8dc36c62a85aca2d0e7a50dd
MD5 7d1063f0e8c4ecd7aab3e492efe525bc
SHA1 35930a2f1a745a6102480dc207799e4ec19d7c60
SHA512 3c6803377ba60d5b0267d5f044edf24215c7eee4c3d082792fe4df5c439f8ab2ad6fd4046b73ef924b984dd02925fe16638abbfe6dbb41fe8b5f52ede88cb2e4
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7KPm:AFBHhTofhno2mB21q3Llbfe3sLDdeEp5
TLSH
T125B27F56717B12023C3E290CA6929B370E8272A3345CA56F77B900BA4E67E615DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cc428da3500ca8ba0ed9522a494b1a828f13318e739a4b686d7160e4cc6e3c5d
MD5 227ee5e34dc3f3a2c0690b866b3ab1f6
SHA1 66b565e5634987cb7580e44dab789e6a754342ba
SHA512 fed2d2cbf11cf7086c3c4ddd648dae288a841c9c9afcee9ddbd46c121a7646c353b05dea99f7a8a8f77b2332198f9ec7f26cea453f27ca932fc2863f9826d61e
SSDEEP 384:nBiFTZcIj38N/8TUNTUlIRSyA5VjGfb7odYxLbeN1sk+OOObjI9G6w7mHy/7IgX:oFLj38wgmko69yOk+O29MX
TLSH
T1E2D25D32EC55CAB7FDEB8E99B64A3A47DEE01163C58C8AC8D5C89E0D00D719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 87e5478a8091fee1e56a36e93dcd03e7e7cc8461fcceba694ffa3c87b8101516
MD5 22e7e7a3edfcd4c41e10fa0f5e56f7e0
SHA1 242fc570d79105593c5ec4eac6cc60e2b9a61eb4
SHA512 d992d3c2378792e9841ccac4c69bda795f34cb14d6f22cd7933de667059c8ba5e744c886241162a1a662d5b4552a568b4e04f77e090b66059bae46cfba039fe6
SSDEEP 384:n5wiF9CcmyWCs38Np8TUNTUlIxBydvWoNajGfb7odYxLbeNvuhkP+lFYS/npHy/K:1Fccps3KwgnSxo69yvuhkoFYS/H
TLSH
T1EEB25B36EC68CAB7EDE74F99EB4E7A07DEE01163858889D4CAC81D5D00DB1DD170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d8b0479c0d15d4612bc71cc6f9f999632184ff437b7e45b8993baae790663acd
MD5 ed7c8abc850c5154aaf4c785c025755c
SHA1 0791ebf2a9c62f27aa121976b0dc54eecdde0318
SHA512 74ec9f109e66d927a36f8a07b351b2367f31ab0fe1dcb8e2b428fa055d3ede9baf3db534321c7e308d8df4abf0a2964924ced6ef0d9413340fea964050da23f0
SSDEEP 384:n52iFiZcIf38N/8TUNTUlIR+yg5VjGfb7odYxLbeN1Dk+OOObjI9G6w7mHy/7IgX:PFQf38wguko69ydk+O29MX
TLSH
T1BFD25D32EC55CAB7FDE78E99B68A3A57DEE01173C58C8AC8D5C89E0D009719D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 88d12f298ce27452da8d2824fd953a161198464071eb9027b30007d3170095ff
MD5 e37048f924d7eadb35111a08d9fe803c
SHA1 70f3e337c41ba329984639b85c67f7964146b3dc
SHA512 712da2206a2fcde98de5ae26303fef248460f479ba6302a7d4cdd542e6dd7066bde7223c0f5a5219d1285c897708983771e7c8b49eecfbb2d0bc905a5a0c1b2f
SSDEEP 384:nPiFTZcIb38N/8TUNTUlIRSyA5VjGfb7odYxLbeN1Zk+OOObjI9G6w7mHy/7IgX:aFLb38wgmko69yDk+O29MX
TLSH
T1ECD26D32EC55CAB7F9EB8E99B64A7A57DEE01173C58C8AC8D5C89E0D009719D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2a8232b03e6711f03b8cec211a8c7ec703cb13ea7d680a1deecfefc0b3438ac1
MD5 56d15df41f3c34eb131cf5144ab4df7f
SHA1 7c1bc78544efa277dfc74cae31068db4164690ba
SHA512 3f4beff2c1c04b0139b1358a1ab28791d43903842c2bc5e96c9f99258cc84d6492aff6becb1e8591ecbd5eab9d7483c28b54bf55380791efea503fb664824969
SSDEEP 384:n52iFTZcIb38N/8TUNTUlIRSyA5VjGfb7odYxLbeN1Zk+OOObjI9G6w7mHy/7IgX:PFLb38wgmko69yDk+O29MX
TLSH
T1B8D26D32EC55CAB7F9EB8E99B64A7A57DEE01173C58C8AC8D5C89E0D009719D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1a4da3f565b11ee96a2cd977364c2c8d713792602a5040194fa06441a9ebcaaf
MD5 5468ad60a7a152d34f4ed56313a52fae
SHA1 0ce9c8c7053ac4f2b278ee3939949e996cdc92cd
SHA512 14c3e9a99756e40c0802c9aeb019e5aa622777410e740e02221f354e37a5600d186cf1043ca645bdad64a5bb657958c476695b6766bc0a1023a41a3239c221d4
SSDEEP 384:n57iF9CcmyWCs38ND8TUNTUlIxBydmSWjGfb7odYxLbeN1Dk+OhkP+lFYS/npHyy:AFccps3Mwgy9o69ydk+OhkoFYS/H
TLSH
T179C26C32E855C9B7ECD74F99F64A7A43DDE001A3858C8AD4D6C84E5D00DB2DE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e832a9d6dbf59c6feaa70385b2832430ac92b96e841196c8f6a914f44e0e58b4
MD5 200fbba1e2dec48d900b81c428078116
SHA1 7ca15ff7981f545c0778b7c4b6d44b66e203c210
SHA512 2cb91744bac0a3d863690b4480ddabc5083f2a2f7b4639482978eac5828e7eaff38b6b09b473354b49d6c9331d4c2440ca89da5539aaf42380acf65ed57c3141
TLSH
T15B4121D15C3C1AC1D4BD1E7FB48738FC81EC9725F89034396858EAD8597A61D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d7eed8907e547c26b093124104a78922281247b27770e8268dc43b4b7161f4ac
MD5 0619cd237125e4c9682ce44254062a17
SHA1 05e10d467193ceb54137741ef918df3cfc2370de
SHA512 45eac312b11522968f4c06d4fec3f0908ca9f247e98dc2e7a1e475d9cfbc77fbd8d5c5b7efa84a034258009232133523e07243bb621dd83f33ca70488a4af8e9
TLSH
T1824130E15C3D1AC1D4BD0E7FB48B38FC82EC9725F5A035396858EAD8497A61D608087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 48b6ddbc017c3c2fd11974491ad67ae46a9890237f760680e92fce7c043f4882
MD5 bd953c2c13eb2da3cb875c4093dc976a
SHA1 011b1f329d28bf74da3d74ddf124237ed5ae418f
SHA512 a224d61120c79c06ae16700afb385c5883cebc90cbbc2da2f539be13c029e442b2981fcb18385d68243891c892e1a883d1d11bcc87e12547d428b6b05c401723
TLSH
T1834121D14C3C2AC1D4BD0E7FB48738FC85E89715F490343A6858EA98597A71D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ba8297265d7748cb8b218bf70c7c70f2e7ffa4350bd05b1e0df9e6d373e6b65f
MD5 8680f895bfb773a0abdbb371f24c92c1
SHA1 a53e567e4c8f3f425bde9109bca58cd60b751672
SHA512 9ed716e4c832e039dc7ec7f25a338b8c615987e5a635bc439686a221ad03490faff5f9da1ffe7b19f1684b1c10149816123d7b9df2878c2c5cd5b2362501c1d8
TLSH
T1CF4130E15C3C1AC1D5BD0E7FA48B38FC82EC9725F4A035396844EAD80A7A61D708087F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_172941387\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_172941387\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1785180622\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_2124584230\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_80933494\manifest.json
Size 53B
SHA256 6954daa257636bd6d9563ff3568dcd9845bf9b99e587d490da2306bf0938b684
MD5 caf17c4608f6bf58bf0d56e1e63c1570
SHA1 5cbd60bf29e30e477627bb8d094272a35a3cfa65
SHA512 92126322986cdc0ce8ea76ed1ee484b9955aa3dc061156f2e0012d9f1bd5b1583f9f2e4d9eebaa6db250c95de6b1cb44b30a4a3180a01f2724947fffbb9ebd18
TLSH
T1D59002604414951716D10E5066B0B8819391661995850D1D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download