06f443bed4538201a9020d5a7f2af64cdb43d313f99c60914ae71b5ecdf83653

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
etrader.jnlp
Size 2KB
Sample260812-apfevastay
SHA256 06f443bed4538201a9020d5a7f2af64cdb43d313f99c60914ae71b5ecdf83653
MD5 c0056b38cf29ded183d8d4e3a3e56c42
SHA1 2d03ab5087945855dfd065424fc1cc6c60c1d841
SHA512 1f18079342aab98b15650aa7dbf64465b24b4c3f4800468a2d0843b212b5cf39c94c3df48941782557f50b2422af1c8cc09f7ba936f70ad91bbade76b87f8e22
TLSH
T157413E1288C8B1964FB35211FC319944EF328B6BB56A4C2DBFDC1A5F2FB15578963508
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1068	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1196471335\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1794868059\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_247784875\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_247784875\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1794868059\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_247784875\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1196471335\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_247784875\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1811838674\_locales\hu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309678509657222"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F1B261FB-496C-4AC9-A70C-DC64D23F02BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5352	javaws.exe
5352	javaws.exe
5352	javaws.exe
5352	javaws.exe
1560	msedge.exe
1560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1068	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 5352	2984	jp2launcher.exe	86
PID 5352 wrote to memory of 4516	5352	javaws.exe	87
PID 5352 wrote to memory of 5716	5352	javaws.exe	88
PID 5352 wrote to memory of 5804	5352	javaws.exe	89
PID 5352 wrote to memory of 1068	5352	javaws.exe	90
PID 1068 wrote to memory of 5924	1068	msedge.exe	91
PID 1068 wrote to memory of 412	1068	msedge.exe	92
PID 1068 wrote to memory of 2576	1068	msedge.exe	93
PID 1068 wrote to memory of 2576	1068	msedge.exe	93
PID 1068 wrote to memory of 2576	1068	msedge.exe	93
PID 1068 wrote to memory of 4624	1068	msedge.exe	94
PID 1068 wrote to memory of 4624	1068	msedge.exe	94
PID 1068 wrote to memory of 4880	1068	msedge.exe	96
PID 1068 wrote to memory of 5104	1068	msedge.exe	97
PID 1068 wrote to memory of 4880	1068	msedge.exe	96
PID 1068 wrote to memory of 4880	1068	msedge.exe	96
PID 1068 wrote to memory of 5104	1068	msedge.exe	97
PID 1068 wrote to memory of 5104	1068	msedge.exe	97
PID 1068 wrote to memory of 3176	1068	msedge.exe	101
PID 1068 wrote to memory of 3176	1068	msedge.exe	101
PID 1068 wrote to memory of 3176	1068	msedge.exe	101
PID 1068 wrote to memory of 988	1068	msedge.exe	106
PID 1068 wrote to memory of 988	1068	msedge.exe	106
PID 1068 wrote to memory of 4068	1068	msedge.exe	107
PID 1068 wrote to memory of 4068	1068	msedge.exe	107
PID 1068 wrote to memory of 4412	1068	msedge.exe	109
PID 1068 wrote to memory of 4956	1068	msedge.exe	118
PID 1068 wrote to memory of 5128	1068	msedge.exe	119
PID 1068 wrote to memory of 5176	1068	msedge.exe	120
PID 1068 wrote to memory of 1764	1068	msedge.exe	122
PID 1068 wrote to memory of 1764	1068	msedge.exe	122
PID 1068 wrote to memory of 5520	1068	msedge.exe	123
PID 1068 wrote to memory of 5520	1068	msedge.exe	123
PID 1068 wrote to memory of 816	1068	msedge.exe	124
PID 1068 wrote to memory of 816	1068	msedge.exe	124
PID 1068 wrote to memory of 1156	1068	msedge.exe	129
PID 1068 wrote to memory of 1156	1068	msedge.exe	129
PID 1068 wrote to memory of 3152	1068	msedge.exe	130
PID 1068 wrote to memory of 3152	1068	msedge.exe	130
PID 1068 wrote to memory of 3508	1068	msedge.exe	131
PID 1068 wrote to memory of 3508	1068	msedge.exe	131
PID 1068 wrote to memory of 2328	1068	msedge.exe	132
PID 1068 wrote to memory of 2328	1068	msedge.exe	132
PID 1068 wrote to memory of 1560	1068	msedge.exe	133
PID 1068 wrote to memory of 5480	1068	msedge.exe	134
PID 1068 wrote to memory of 5480	1068	msedge.exe	134

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\etrader.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\etrader.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.381.2" "update"
    3⤵
    PID:4516
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.381.2" "1786494241"
    3⤵
    PID:5716
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.381.2" "false"
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com/inst-dl-redirect
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffcff79c188,0x7ffcff79c194,0x7ffcff79c1a0
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,17515208362780865399,11055632646042486330,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
      4⤵
      System Time Discovery
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,15239217528317487750,14667797699223318663,262144 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,8688591201222234085,16927128823234881887,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4338020969969348860,1759510085004916773,2097152 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14758762365964243992,7301884528509677621,2097152 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,5110309368463528357,8955981242018998720,2097152 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17448766608685000279,3557688223580997012,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,10475031534128164627,18165558291984632740,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7520996595306078869,14437374008865317164,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7520996595306078869,14437374008865317164,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,10619509042371931185,1792606951944353542,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6932708321420502606,8337532964449813654,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14100754742701555781,11626211177602615761,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7924297092951666148,6692349352651742925,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,10510971998940135453,3618655732848602449,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13516839904882139877,7397567664738249126,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:8
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7560916614415625752,4430194610803672094,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,12218439973694254190,14575026486748894242,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5922688128374775076,15982589278642919754,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,11277840389748806328,12009159059436203604,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5956,i,4993460601572828094,1969492157844584368,262144 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,505930044798126942,10590554263046528506,524288 --field-trial-handle=2288,i,12875360658026614195,16734744578072089281,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
      4⤵
      PID:5480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1196471335\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1068_1794868059\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1068_247784875\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 efebdd47516a5dde232cc9459e972f00fb3bc264c80a596efec868ddb35146a0
MD5 8372ffb0cc3f5cfbda0806c90d83a112
SHA1 026db1465224536f04b5de2841a8d845ec690cc6
SHA512 a94636d5a2b89eddb75ed74a266ab78711a1d0b790d5fa239e94175cd52e7b2c629754fa4ae48675f1f46ae4603aa9cc7742abc2050b6144be40785277d3ca7d
TLSH
T13D110482B82BA07079513132F9CF42F73BB1973D09A52275B1C058CEB871F3606A3C28
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 6294b9d5a6001c6436616514fbb326c86d863cba730ae8157f34c3d71b94a031
MD5 f19944176c5583acdf71abdf2150fef5
SHA1 2ae66ffa365db92ff0984e8fa7f4978854f6daa4
SHA512 fb44a9f6968542c44d1560dd4a2a7346b9ceb2fad5a5b64ef4d636cf77124f497d93101a70270b30fffbfc693e512556b8d5b5ec14d529295365baee72c99292
TLSH
T1EB110892782BA07069513132F9CF43FA3BB5973D48952275B1C059CEB871F3616A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 9785b981f2c512ef20d16850694ef3feb67e4231bbe2d1ca2b21a120085337fc
MD5 1e1a0e0527bc1194b62339ef803f77fb
SHA1 f6a9293e7b3ffaa6474d17b1418c0c0173f275f4
SHA512 1fc1fcb5ab550e9d3001b3b0ca060ac525b48d47c41edbd44b797572d0c91b802e6099f8e3360fc38e0630351bf9e15faf3159174ce9117dd09aa73ba85f7ca7
TLSH
T17411E592782BA47029513172F9CF43F63BB5973C48A52275B1C059CEB871F3616A3C28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a123b6182c34fff5da9d00a80c09fd9a43d4cbfdb60b6d1ad41618eb9560cb96
MD5 42cd9a8c7d23b9b539d147701765f33f
SHA1 57a4fc36e6204fdf005131c16b9a2b53df1591d0
SHA512 84865c4687197aa138131194a6d6aa0270d56ab2d9b76976d24ee48ad26a71f81f86052282ab4d89072e4f1bcf0cbab25be3e6866284aafd8eca046969148cd3
TLSH
T1F2E02B65C821EC2718FD5729604D87AAEB1013573A40495F3B3C91598FB462A45C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebf32392a01a22cf8a9cf329810c0cf05777ce99de9f90477b3b5af9a661fe28
MD5 103272a39bcf81601f1f1a1b53dde0e4
SHA1 a6e0d13fe0a6b9b6b7900457b940f9b93543846d
SHA512 c49d505cac54d5191c66ae5301ddd64bc1f9c494bbb47feefc82808d4ecdf30f20d1dab71ca226256048bc628d9337f1ddbc31116484b6463d4dc05aad59f9e0
TLSH
T19361D4B839A1D7E2EB14D17CBCD80251B5336ED6F1D70E2411503CFA2A2DB52C0162EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f596.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f596.TMP
Size 3KB
SHA256 6370f77c4d01a6ae70e0c87817871fa81b36d973b348d4bc9c052d242bdf5fdb
MD5 e9bbbbced4b240be79d906ecdb4ec063
SHA1 d949fa23e8ce2d6ab21e8200a5be1ef67a00c8d3
SHA512 1d92c505ec049dc74a19f5f0a9ef90fde72e7d8afa663cd8ef6a57a6c71d7cf5b5ee4106b02a4805fc47d4d6a7f1fe89702af74bbccc7d0d821f3b3cf8bc803d
TLSH
T18751B4383952C7E2EB50C27DBDD4025074736ED9F5C30E6510603CF92A2CB66C15A2DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b178fe7a97466883aef5702fc0efddb8e7fa4b65b6cd6e8b92eba369e17e5b3b
MD5 b52dc6ada2dd54571902c69ba5981d22
SHA1 51369187fe01d57eff4e7e3a4712f382183b9bf8
SHA512 b5b0b00f0913b2e929bad5d789c4383c4f3ad585d7581390112683581f50b496c1aac1fe766beef4c3f5850fdf6ce9127abf53866e26040487e74b5c01726ebe
TLSH
T1435182F747B4866EDA1192F0EA186F2BDF1D0521431C7D9985E0AE2793F3470E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6ea780e0ebbeef66a448b028f55b4dc9006057a8ec578ce368671666b977b2fd
MD5 dbfc95cbe3fe4b3d4c46fbd25a7c23c8
SHA1 5ed115670b36c648ccfd0872d8cc60267e9b423f
SHA512 cfd75a61321b3cf5382d49eba2765872956d62a4a85c244f3cf322cf5f6b8e40d3691bf8e449526e216863f4f79b19f51077498d43dc5bbafda18b95976add91
SSDEEP 192:sxZQRdyMqZjK1Ml8UQTQjR/fZsAPs9ZdIaRuvbzodpKwHW6+WNwqc/IE2xIMv4Ww:sxZQ6qAR/fZsYUzIKYAnHb+/17NL
TLSH
T16D72E616AA345D779CD7D219F988BB63D6F94523A1904E44A9FCCE1C04E7AEC6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 977b9853e5b988413c73deb6c05a5037790d91735d08e84ea691773eac0070d7
MD5 b277759aecdff15f1c3c26144b65a29c
SHA1 6b75f88313756cfd5855f19662500abff93342a5
SHA512 1d4752fab0efc5f64c44fb170d61fc5bee80373f639acc05e7f64e52b5fe61cfb37d98954d99d599d04cf93326196c86db3b0e3c8571a5c2e8b291135f037c26
SSDEEP 192:sxZQRdyMqZjK1Ml8MjR/fZss2PszaZdIaRuvbzodpKwHW6+WNwqc/IE2xIMveuWd:sxZQ67R/fZss+4azIKYAnHb+/m7jc
TLSH
T19772E8166A345D7B8DD7D219F949BB63D7F90523A1904E44AAFCCA1C04E7AEC6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 514abeab8487a2037f504e66827d55e5c706b2e1f0d6b46eda7abb1b90f26fcb
MD5 731056e6150a67b657f1664d0a1c4161
SHA1 433395442ea0f8fce488d2da38474ad48fa02ec0
SHA512 fb04eabdeaccbba99cca984d2dbdd6109c79936170656dec488975a7e302498c6198da2f4dd8f6fc555069c5d7613b070ed1a89a6cb27a0312bdfab72359f87d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYysy10Ll7:eY8Od/HEnFhWvFvmXu1jaIt10Lm2NuAF
TLSH
T1D0F2EA3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 225064eda000e0b905c7d18bfe61b33c65bc919dfad60c258bc0e8ec7db9a0e1
MD5 c9ab381a19268bfe374c60a1adc11d38
SHA1 7e009f153f3df30b129928fedef529e8f308bbda
SHA512 663e533c0415c30670a364db6ab595db211f168e6b1900f8ce2602dc154e49236609ee3a9d444052b1cdd1dc9c1f797696c28d54bedd9d921728c896e8d79fc3
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG4:05ppxnY753RNBvRJJdt7p5J9D7ng
TLSH
T17AB27B5A713A0212397E2948B39696374F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 40fb0efcd61cff330908b199bc0a7e15b66e89933a5826736d853e3c0c0f421c
MD5 1850ba03b8f1d461a7dcca1c2275d3a6
SHA1 c9b631e48764705dee1ea9b29d8841b840726ec0
SHA512 e559cc65a1df1aef26daec6b16d40d4f1f811a0139f875c5f7700619c2530a0f3219bb381d3625a5795e9736976b2776831dd4dfec00dd1faa50ff372073e2a6
SSDEEP 384:npviF9CcmyWCs3sNj8TUNTUlIm2QckCr9lKKphifGGY6sKIpwe4KV8p0lHrty/7a:p6Fccps3CwgbkUYkFGYa5I8p0V7
TLSH
T17BB25B36EC58D9BBEDE74F89B74E7A07DEE0112785989AE4CAD81E1D00871DC470BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 21392e53ad69d51332dbbeb6f6f334265bfcb6ab45547138d4e7339e97ec5aab
MD5 a271273559cf077c3be2c74cc9b31f95
SHA1 77ad38ee3761ac07c98911f3e09fd44f0302d3f5
SHA512 0e3c0456a24abd12a48de416db92ba915cfa53201a0ae11850834e73181ba476892741aec2bce267104c2e0e1ed0de72aed9c9d603b2fdce60a2c623063bdf2f
SSDEEP 384:nMiFiZcIA3sN38TUNTUlI4iEQckCrpYnnphifGGY6sx8rL/MsRnlYKBLty/7Ig/:3FQA32wgHkkNnpFGYBCL/hn2mW
TLSH
T1AAF2D4F198E79977E8AE4B47A77D2E4299FCD063B4884A94B3D45D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 52d2938614656ebd96630aca016bf409c5c79afe7deba8997c4b513da677f306
MD5 5828ee0afb8afe1c61434dd270fba271
SHA1 91915e26ae797d098c1e789f0709a7648ab672a8
SHA512 291ce28ed8a3537fe047e831dff07e18b0c10ef8eea51b1e729feb39272951ae14279f14120f2ced7b6ffa3c95a7da00f96797539cf38f262fe8820405653cf3
SSDEEP 384:niiFiZcIb3sN38TUNTUlI4iEQckCrpYtnphifGGY6sx8rV/MsRnlYKBLty/7Ig/:pFQb32wgHkkNtpFGYBCV/hn2mW
TLSH
T1ABD25B32D864DE77FCEB4A86B78A3A53DEF0516399C89ED4E5D85E1C008719D030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9f7d0ae8188a40eb91810d42b475cd3a081c38dc4f5442f73ff8a4cd50524d22
MD5 e73c48595b85a8deaf99d69cc7ffd3ef
SHA1 29207a2e3a91f85e1891ba788d682a940b5e8de6
SHA512 5fa604361e8002c0d5706d24fe2aa177843d9336117e23151faf8b3422c240f7dc2d9ffa6d19a3caf19aac9d9babde366eb04c763b4c64bd8bdbc6e522039832
SSDEEP 384:np8iFiZcIb3sN38TUNTUlI4iEQckCrRYtnphifGGY6sx8rV/MsRnlYKBLty/7Ig/:pnFQb32wgHkk3tpFGYBCV/hn2mW
TLSH
T1B7D25B32D864DEB7FCFB4A86B78A3A53DEF0516399889ED4D5D85E1C008719D030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7051f82380f0a0078929ff7dc12e4fda6fe1254ac109d51756731e015371326b
MD5 877b0a838d7fd1dbb7685353f3c5b402
SHA1 6d68f547447b1455266e1b207eef0a1257ba8f2d
SHA512 fcff38cf4f6eb4f4a9de3a2aaac98387cd32903bd9d9485008de087a6cbb73aab0b7eabdcbdddeddcd610e9556d06f27d5e23fa4db691ce3e4e3110c92cae7e6
SSDEEP 384:np3iF9CcmyWCs3sNj8TUNTUlIm2QckCr9IfpUphifGGY6sx8r0/e4KV8p0lHrty2:pyFccps3GwgbkUspyFGYBC0/I8p0V7
TLSH
T16EC25A32E858DDBBFCD74B99B74E3A43DEE0516389888AE4D6D81E1D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2d2587888721b94f40a80225bb9a2e0a0468906d6f9ceeec93c856aaba38103f
MD5 a93a6fbc4da11e0b4bf89fc9ff16b80a
SHA1 1a5696ea21b8806897205ab38b0e665ef82564e1
SHA512 c47f756a356e34f5437d9119773edbddf323f4b63406a4a938b1d79bdd3bd5206a5535d43491e6dabb894398c0ffbfcfc732a8365959a3b60d260baa74141bc5
TLSH
T1594140D05C381AD2C4BC0A7EB49B38FC85E8C729B5A4347D6C98E9940A7D64D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ee470e22cb65ad3bd7b68a859c4a4449864318c080c954e8fec27e50b8008e2
MD5 4a02d6266ce72d8f800cacc488a5c2de
SHA1 4f5fe317e678759e413a497ae66c289706ff085e
SHA512 0a55acba1f92c34ffa878ac1883dde8fc088a8befc8fc6b3a3046b6574843cef950af41d4953d8cd7809cb1828588e90af3822be16b948db37ac0fd52e07e5d5
TLSH
T100413FD04C380AD6C4BC0ABEB49B39FC85E8D729B1E0347D6C98E9940A7E65D749583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3a963efaed843b79aa02d18cfbc0973c12e2516975cdc1685edf58f27f6b4b8a
MD5 bf1dd42a782c91cc51df1a37d58fd0c8
SHA1 7f825e17855f5c0471dc06410bb9bc2d88f4a482
SHA512 92df16d2d9c5d300d17f7185b875e8ae86b35fcbf458778f1bc7996b885949c26fc0a4db9f4fecf6726084511a3590750f1dc7d2abf00eea74ad60d537675d64
TLSH
T1094142D00C384AD6C5BC0E7EB48739FC85E8D725B4A4347C6C98E9944A7D60D349583F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9692f47d8f1c96128d94247e0dd6122e908e5f5d32e947166fdcd6c166175269
MD5 396f8b0a4183827fc6aedc93ac61cd4b
SHA1 418c77f9eb3716c3b597eb15696732b3638fb78e
SHA512 6911dbc524e969171b9b633ff7b29bcc5312033c2f6afb2e6ad975fcb424ae80e1e692bf46c1f2d1dfceec1d5a8a3f1e59085128daf7da581124b9d984865ba8
TLSH
T105410759BAF91108B3B76E2AABF6A46D543B7C772F0AC45D10010D4F0A62B41C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4516-2-0x0000013D70690000-0x0000013D70900000-memory.dmp

Download

memory/4516-20-0x0000013D70690000-0x0000013D70900000-memory.dmp

Download

memory/4516-19-0x0000013D70670000-0x0000013D70671000-memory.dmp

Download

memory/5716-41-0x000001EBD3590000-0x000001EBD3591000-memory.dmp

Download

memory/5804-61-0x0000015B0AF60000-0x0000015B0AF61000-memory.dmp

Download