d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity/Microsoft.Web.WebView2.Core.xml
Size 566KB
Sample260815-n9vbdsff26
SHA256 d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0
MD5 d1757131496940abcc30af78d34598a3
SHA1 446944afcdfaee9c22320e1f80e9ff43de92e6fc
SHA512 c779c90b4e6b6d54bd745954185659e9eb5c76e72cb2222f373a3b0d3ad3de4307a5b306e6832a4d721b2da3836851b05655c6e90f944488674cddbc5cb66ae6
SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+jw:CNcoUCF2
TLSH
T1FDC43F01668CD6310DF50ACA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1BF591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3424	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1176333096\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_1176333096\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_785396046\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_785396046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_785396046\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_597221740\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_597221740\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_597221740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_785396046\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_597221740\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_442063000\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_442063000\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1761764487"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31272123"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312692604707836"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{39496B4C-9D66-4B60-AA56-ECB18948E736}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3424	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5648	4284	MSOXMLED.EXE	80
PID 5648 wrote to memory of 3424	5648	iexplore.exe	81
PID 3424 wrote to memory of 5992	3424	msedge.exe	82
PID 3424 wrote to memory of 2220	3424	msedge.exe	83
PID 3424 wrote to memory of 1148	3424	msedge.exe	84
PID 3424 wrote to memory of 1148	3424	msedge.exe	84
PID 3424 wrote to memory of 1148	3424	msedge.exe	84
PID 3424 wrote to memory of 492	3424	msedge.exe	85
PID 3424 wrote to memory of 492	3424	msedge.exe	85
PID 3424 wrote to memory of 2484	3424	msedge.exe	87
PID 3424 wrote to memory of 2484	3424	msedge.exe	87
PID 3424 wrote to memory of 2484	3424	msedge.exe	87
PID 3424 wrote to memory of 5280	3424	msedge.exe	88
PID 3424 wrote to memory of 5280	3424	msedge.exe	88
PID 3424 wrote to memory of 5280	3424	msedge.exe	88
PID 3424 wrote to memory of 4148	3424	msedge.exe	90
PID 3424 wrote to memory of 2916	3424	msedge.exe	91
PID 3424 wrote to memory of 4148	3424	msedge.exe	90
PID 3424 wrote to memory of 2916	3424	msedge.exe	91
PID 3424 wrote to memory of 2232	3424	msedge.exe	93
PID 3424 wrote to memory of 2724	3424	msedge.exe	94
PID 2232 wrote to memory of 5440	2232	msedge.exe	95
PID 3424 wrote to memory of 3564	3424	msedge.exe	98
PID 3424 wrote to memory of 1312	3424	msedge.exe	99
PID 3424 wrote to memory of 2228	3424	msedge.exe	100
PID 3424 wrote to memory of 4748	3424	msedge.exe	101
PID 3424 wrote to memory of 4748	3424	msedge.exe	101
PID 3424 wrote to memory of 5028	3424	msedge.exe	102
PID 3424 wrote to memory of 5028	3424	msedge.exe	102
PID 3424 wrote to memory of 5412	3424	msedge.exe	105
PID 3424 wrote to memory of 5412	3424	msedge.exe	105
PID 3424 wrote to memory of 788	3424	msedge.exe	106
PID 3424 wrote to memory of 788	3424	msedge.exe	106
PID 3424 wrote to memory of 4544	3424	msedge.exe	107
PID 3424 wrote to memory of 4544	3424	msedge.exe	107
PID 3424 wrote to memory of 4836	3424	msedge.exe	108
PID 3424 wrote to memory of 3552	3424	msedge.exe	109
PID 3424 wrote to memory of 3552	3424	msedge.exe	109

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Velocity\Microsoft.Web.WebView2.Core.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Velocity\Microsoft.Web.WebView2.Core.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/Velocity/Microsoft.Web.WebView2.Core.xml"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffd873c188,0x7fffd873c194,0x7fffd873c1a0
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,14470948727036058099,3670430446116113023,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      System Time Discovery
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1490647157434098909,3236013995822492372,262144 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,8242706063911692635,1296934909170702227,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
      4⤵
      PID:492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,5348296959215421694,3157750240544014845,2097152 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,1546731196221305272,15210846700440461223,2097152 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,1159904269686589261,4364405447707672027,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12382863134120284892,4514361535083289319,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5950060597546023688,14193408545159390046,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13846341866581002494,1588953006470545812,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5950060597546023688,14193408545159390046,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,17295208202004218924,6829710073056707933,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4899385041649167556,3644665424031916763,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,373232551167433136,8742581108329853707,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,3235919108868801343,11517361916168885999,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1601918258442801542,3998841134419018186,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,670452774013245126,2239685809055429045,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3582239720896941605,1479656830643718466,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,17750362438923095410,4836417032158425900,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,6945226011234872787,12273879099845436429,262144 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,14423538767970488066,1046998099354044181,524288 --field-trial-handle=2092,i,10058018617777773479,12381892984973913885,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:14
      4⤵
      PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b13196b45adb3dd8e0359267e15f3d7a7ccbf95924b4e1d6096c34a44509bfb
MD5 74254121849b61e6bc17cabecca8c952
SHA1 eaaf18c5a66d22b06c737f769963502d15d89a2b
SHA512 87920877e2b60c140093517f7bbc8cbc6da31deeffcffaae5204ece59df06d4a3e5c3e43268156176b16085e940792ef131e4578e8df8293dfc0a7bcaa6b3a6d
TLSH
T10EE02BAACD30AC271AFE1B1AA055064AEB5013571A80855F3A3D461C8FF472A468689C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2870d8119aed548e0e64b1f05f6939b15a966d159fa6ee1ca629feeca277d986
MD5 2e2ab4e0d5a33edd84d164166f39f9b6
SHA1 62dc35bbf9e573606bd99490245c820f5a159289
SHA512 3f18c42523e754f742c154059e9bb12e55d4fcdc1896f7ac67e33bc0bc3ce99d278fb2841d01401d7a14af3911c177d4810e89617016d59ab849c9e24b01f247
TLSH
T19641D1F383F4856E8A1196F0AA18BE2FCE2D0510432C7D9A85E4AF1793E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7cd26542e5e3ba11d06e142f2fad9d47acdc56cd714948fcf3ef0623f1dc23a7
MD5 473072db86cc13749cb19c4b605e2aa0
SHA1 78b466238e26e2a95c3d7c238307551bd8470b35
SHA512 d393b42fa112936f5944f65b1eb70ce1afc2b48e16ea6b471297cb6dcb57b96c4bc94a9b8d0a4dd31bac5bcfcc10e090cfe7008d02e20b54e3741c706d79034f
SSDEEP 192:sxZ3R5yMqZjK1Ml8McW/fIs82YpCxE0CXUyynDWzodpEL/W6+WNGY0dR2GozIgj7:sxZ3G0W/fIs82x60Ly8t+/bG55ej7
TLSH
T16262F816AA34597B8CDBE30AFA457F53D3F9152391904E44A9FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 463fead7c562b5460de5cdfaded62fbaf457bdf46822f0597261e9f295875685
MD5 86f0260ff5945bed59442655a57b4c3b
SHA1 3dc8c59001a14a613c95d246acd1326adbef6b18
SHA512 6011d06920503e72642fd1102df98e8e463558f926a1e9f38b2bf139225ad25f8df4e653d87bdcf6cd07d5d27cc3c72c6a824cbff8ac868320fdde90ab62342e
SSDEEP 192:sxZ3R5yMqZjK1Ml8UQBcW/fIsSYpNE0CXUyynDWzodpEL/W6+WNGY0dnlwozIg52:sxZ3GqWW/fIsS/0Ly8t+/bG5Ueov
TLSH
T1A8720815AA38997BCCDBE31AB6457B53D7F9052391504E44A9FC8E0C04EBAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 581d5f90e36bc68dcfaba54bde411a71598b4a4f048babf0665d7ec29ba306f7
MD5 2adaf5f96eccbac90bf393053694ef9f
SHA1 ccf5fceaabcc4c2d74ece2ff29f0e8671e2c8d58
SHA512 e01533cb13d41a0b0440e2f5dff2700bc5b9c3e5047db0162eac39cb50ce9e58839f361c7f015198d3a0c156fa1e5500b9ddefc7594bf5f35ed7d15061b7611a
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV363pQLla:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK63p1
TLSH
T156031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 d9d2c7dffe5076e3b97cd03e03767ca7f571848a95cfe815cdc68a5953e2cd79
MD5 3b3ba54754834d08a7f54497bc2c4e5c
SHA1 b33e7b6fdcadd962f6df11704e75d882b151e2c9
SHA512 d65ac61be65c45c942813a7e00ce346fa98c32c720017315882b6f6ef6742a7a6ee88ebc30e9f880a884df318e1d6ef366bb3e3c541e8191771465f17a2e7867
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Ofd3P:AFBHhTofhno2mBeaOfd3P
TLSH
T1C9C28D57717B12023C3E291CA6A19B770E8272A33558A57F3BB800B64E67E215DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8321c92a93e908e4fa0308c2da1f1fc5beeafbb1711e8a50cde27029356a2011
MD5 fe9c89fe11f15a00d90947a376da7015
SHA1 f62b2da3902e0fd3024d8a8d2d74617e83fcdfc0
SHA512 5e203ab3628b2592d4702500f29a8aa7edc8e641ec5f7714be2fd6508fe56df2065362182c456c652e56d8e978adc999608b330ecd66ad4000c1aef4f7635836
SSDEEP 384:nfiFsZcIC38No8TUNTUlIRbyGVjjGfbwoUytO65ym5FNfbjOOPrXLpe8C/kHy/7y:qF6C3HwgRPox065ZbjOi9Pj
TLSH
T1E6D24B72E8A4CDB7ACEB9F99E75A3643EEF4016395889AC8D5D88E0C00C759D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7fc870a8d34931aef0ce5054be3645e784653772621355ce6de121911fcd3d52
MD5 9a10efcd88992c6b476f447e6105f369
SHA1 9ea9930e292f22e7f67904c8ba76ce31329849f3
SHA512 5246a62c5e6e28c0e4b680249f7bd263a9220a0ae6560d56c4d13946fe0b93769b11e2036d98c26936007fd088536a5b7068d2fb5410bfc81f35b209072cbee2
SSDEEP 384:n5siF9CcmyWCs38Ng8TUNTUlIxBydvRoEajGfbwoUytO65ym5sRhkP+lFYS/jfHA:dFccps3Hwg81iox065qRhkoFYS/k
TLSH
T15FB25C36EC98CEB7ECEA5F99E74E7A02EEE01163859899D4CAD91E1C00CB1DD1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 04204a9e3545be38c3df094104b82e00db22c1a2ea6d4e375e49497bfb3f9073
MD5 a51a514cb8c99ae45d8c96e7ed8d98ec
SHA1 278f1bb0de388d2a9e73c4df741889d10b93884c
SHA512 721785cbd973a399074c9dfb94b7404d480337273d0d5cd19fd6113fd701239313edaf4b66e1b87734732882cad32143d383c2a11beb16cfad6d1135a5f4283b
SSDEEP 384:n5siFsZcIi38No8TUNTUlIRbyGVjjGfbwoUytO65ym5FNfSjOOPrXLpe8C/kHy/+:5F6i3HwgRPox065ZSjOi9Pj
TLSH
T1A0D25B72E8A4CDB7ACEB9F99E75A3643EEF40163D5889AC8D5D89E0C00C759D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 709017081c2f3768702e52dd799e41ccf9974728cc05c218e1712d6ea4363742
MD5 289992efbd7ba6a38647edb2c843219b
SHA1 e33bee2eaa49f086f19c28a87efc54ab05c35ad1
SHA512 b6a6f4adc4c4aeb1f65156898b46d81f122944f4b73cc4a3dcf6e3951a48c9e5c57eaafd827ac245c587f597dad457b5ff4c9212147e70942e9d3cea206f9df4
SSDEEP 384:n5RiF9CcmyWCs38N08TUNTUlIxBydZMQjGfbwoUytO65ym5FNfpjhkP+lFYS/jfg:KFccps3Xwg/Yox065ZpjhkoFYS/k
TLSH
T1B3C25C32EC98CDB7ECEA5F99E74A3A42DDE011A385889AD4D6D91E1C00DB1DD1B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8623e6586fd7870833da1ca96d44e9ba06cfa394acac51a957070718187c22cf
MD5 93a682a00537e6bc8b22e51717f9ca41
SHA1 6789c05cb80c5bbc0ce02c74d6d99b71c8e87d66
SHA512 11f12744c0c6a60d75deb5dbb786586b96d84fa62f5de409ccfaa98f038a6d0b00c3ff776ed466eee57e56fbd65be6609d80e94016324252e99c00e63cac31ef
SSDEEP 384:nfiFsZcIi38No8TUNTUlIRbyGVjjGfbwoUytO65ym5FNfSjOOPrXLpe8C/kHy/7y:qF6i3HwgRPox065ZSjOi9Pj
TLSH
T130D25B72E8A4CDB7ACEB9F99E75A3643EEF40163D5889AC8D5D89E0C00C759D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9522b8fc9bb8691e1bb4fca498696ba591007944487ac17f0158a8c1adccad73
MD5 f93e8e0f3171749e38c3ad1b3f34eacf
SHA1 e4d0339856ba2cf44e222eea4b64e130adef64e8
SHA512 7fca9cb6299c04588d70ce8371e9182a85e687cfaeae554dfe4475e0e5881d617439436e41f9433ae8b8ebd3ddbfd13682e97c1bb38b5e7f1cf26e95a671c5e1
SSDEEP 384:n5siFiZcIw38No8TUNTUlIRPyzVjjGfbwoUytO65ym5FNfSjOOPrXLpe8C/kHy/+:5FQw3HwgMPox065ZSjOi9Pj
TLSH
T1AAD25B72E8A4CDB7ACEB9F99E75A3643EEF40163D5889AC8D5D89E0C00C759D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ee436cd5709e2010817d919d41fa6fcc8d34fba0dc1f44d027a39ef35b64ab95
MD5 f4770e8b099a0262d8f76284965c0aad
SHA1 cb54356064a77558241b7494da9dcb79f3a05526
SHA512 b393fbc2540d75d006b07c7405dae293c0eb29d5bba59d8f8f4ff225944d55804019fb11dd7b014fb9b2590805d9e9599385853f64127c0c5f8aed375650bc4c
TLSH
T1E34140E04C381AC2D5BD0E6F748B38FC81EC9725F4A0347C6889E9981ABE25D308487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c907fa0b0293bd26a7a672709fbc59c7f41557b2ce843573ba8d2c3491a7e50a
MD5 9297d94035af785a5a76abdf3f43b80f
SHA1 b8b1c2edca9d5c43acbcb85a82b75981695b0035
SHA512 538da4f4dbf8181b0c38bd6edc46b4e0b05f3a1dbf0fab4586d420cfccfca09060ed300feb575857f0f44608fe9aceddab918659bc8e8b86b1ff9240b69cf528
TLSH
T1C14140E05C381AC2D1BD0E6E748B38FC82EC8725F4A4357CA858E9991A7A25D748487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6347f0b94ff4f297041f186e4a11582a63198b7af9f39c59a7e0044e9a836df5
MD5 7d377d7a6b9a592dd4a6f6a77c24955c
SHA1 8133b181ee1dace604f8f9ce0683e08c7c485ad6
SHA512 fc77a965a62cc3df333b08c313b58a103f2e0cac3b03e3641099b1acf01ddded96fdb39ef4daf9f2e1e639e4e42f5ff1c88096aa61d332d16b9ffda188cbedc2
TLSH
T16A4163D04C381AD2D5BD0E6E748738FC82EC9725F4A0343C6888E9985A7E21D349487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 87786e51fcb5a31cbbe78b6ab56b7b9fb9bd4b7e7c02a1cc35d558a58bee8d5d
MD5 0b6f6562191d576eef239aebeb3660f1
SHA1 530a86fa98b8b5508e3895093f3563851f747ba6
SHA512 df77f212f70256443277c9484f17d929eb255b4ecd2328a0df10a94c936990cab48df03d2197c44a92c1475a5278ee0d8f5f0c08061496683f48187dd7fe599f
TLSH
T1664141D00C3C1AD2D1BD0E6E708739FC81EC9725F4A034386889E9A95A7E21D749487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_442063000\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_597221740\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3424_785396046\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4284-6-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-2-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-5-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-0-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-4-0x00007FFFF9D04000-0x00007FFFF9D05000-memory.dmp

Download

memory/4284-1-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-3-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-7-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-13-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-12-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-15-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-16-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-14-0x00007FFFB9CF0000-0x00007FFFB9D00000-memory.dmp

Download

memory/4284-11-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-10-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-8-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/4284-9-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download