b6306c704d81f19719e352a1065db11a368952cfb03ee5b53ab0bbb62a86a99c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
102.webp
Size 12KB
Sample260816-jyq3datvbz
SHA256 b6306c704d81f19719e352a1065db11a368952cfb03ee5b53ab0bbb62a86a99c
MD5 589f755640d1bcd30b8472c946cce430
SHA1 2d8b36e68b6443e9e0a48377ebecb315c10f39a9
SHA512 7888361497210f8fe36ce920e97903b2a1955961818565fea36d5aa73efd35b68fb3b1d17c52a44823f4034424a962f9ad4328679e5c62bacc709636fedc67ad
SSDEEP 192:UjVaMgFtootRrkh6rgC+szlnyktfMhPJQ1cI9mXXxqhDCLRpg0n/QUIghm7OMCgf:UYFSotR4hUg6zEGfgGHZCdp8sgUE
TLSH
T19642C0463E5DB21AF32097D79B55C083BE3A830F4D5574A82E002EA3D9BA443E55F74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_1136366409\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_92864980\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_92864980\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_40357251\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_40357251\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_1034355949\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_1034355949\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_40357251\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2420_40357251\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313411146880714"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{333F6E0F-1945-48B3-9F5E-A7DDC784A268}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3408	2420	msedge.exe	86
PID 2420 wrote to memory of 1692	2420	msedge.exe	87
PID 2420 wrote to memory of 2708	2420	msedge.exe	88
PID 2420 wrote to memory of 1692	2420	msedge.exe	87
PID 2420 wrote to memory of 1692	2420	msedge.exe	87
PID 2420 wrote to memory of 1528	2420	msedge.exe	89
PID 2420 wrote to memory of 1528	2420	msedge.exe	89
PID 2420 wrote to memory of 4880	2420	msedge.exe	90
PID 2420 wrote to memory of 1052	2420	msedge.exe	91
PID 2420 wrote to memory of 4880	2420	msedge.exe	90
PID 2420 wrote to memory of 4880	2420	msedge.exe	90
PID 2420 wrote to memory of 1052	2420	msedge.exe	91
PID 2420 wrote to memory of 1052	2420	msedge.exe	91
PID 2420 wrote to memory of 3384	2420	msedge.exe	93
PID 2420 wrote to memory of 736	2420	msedge.exe	94
PID 2420 wrote to memory of 3384	2420	msedge.exe	93
PID 2420 wrote to memory of 3384	2420	msedge.exe	93
PID 2420 wrote to memory of 736	2420	msedge.exe	94
PID 2420 wrote to memory of 736	2420	msedge.exe	94
PID 2420 wrote to memory of 2612	2420	msedge.exe	96
PID 2420 wrote to memory of 2612	2420	msedge.exe	96
PID 2420 wrote to memory of 4280	2420	msedge.exe	97
PID 2420 wrote to memory of 4280	2420	msedge.exe	97
PID 2420 wrote to memory of 2484	2420	msedge.exe	100
PID 2420 wrote to memory of 2484	2420	msedge.exe	100
PID 2420 wrote to memory of 4728	2420	msedge.exe	101
PID 2420 wrote to memory of 4728	2420	msedge.exe	101
PID 2420 wrote to memory of 1604	2420	msedge.exe	103
PID 2420 wrote to memory of 5100	2420	msedge.exe	104
PID 2420 wrote to memory of 5100	2420	msedge.exe	104
PID 2420 wrote to memory of 4272	2420	msedge.exe	105
PID 2420 wrote to memory of 4272	2420	msedge.exe	105
PID 2420 wrote to memory of 456	2420	msedge.exe	106
PID 2420 wrote to memory of 456	2420	msedge.exe	106
PID 2420 wrote to memory of 3672	2420	msedge.exe	107
PID 2420 wrote to memory of 3672	2420	msedge.exe	107
PID 2420 wrote to memory of 2856	2420	msedge.exe	108
PID 2420 wrote to memory of 2856	2420	msedge.exe	108
PID 2420 wrote to memory of 4332	2420	msedge.exe	112
PID 2420 wrote to memory of 4840	2420	msedge.exe	113
PID 2420 wrote to memory of 808	2420	msedge.exe	114
PID 2420 wrote to memory of 4152	2420	msedge.exe	118
PID 2420 wrote to memory of 4152	2420	msedge.exe	118
PID 2420 wrote to memory of 2648	2420	msedge.exe	126
PID 2420 wrote to memory of 2648	2420	msedge.exe	126
PID 2420 wrote to memory of 4128	2420	msedge.exe	127
PID 2420 wrote to memory of 4128	2420	msedge.exe	127
PID 2420 wrote to memory of 4208	2420	msedge.exe	128
PID 2420 wrote to memory of 4208	2420	msedge.exe	128
PID 2420 wrote to memory of 2364	2420	msedge.exe	129
PID 2420 wrote to memory of 2364	2420	msedge.exe	129
PID 2420 wrote to memory of 4824	2420	msedge.exe	130
PID 2420 wrote to memory of 4876	2420	msedge.exe	131
PID 2420 wrote to memory of 4876	2420	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\102.webp
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a0
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,3056940778246220329,7049537158393986578,262144 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1090999850917180599,6223708432943295084,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12875392877499200403,770029692110460546,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,6607441898215578626,3962453113861013370,2097152 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,3158591928571428481,18115296576909014907,2097152 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,714860704890686417,12372128875141273574,2097152 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,1310677613759560378,16906327822589152920,2097152 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12818201817722142449,539848441779704135,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,799390714257392176,7376101182798498619,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,10133045678566065650,13454439742186983250,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7977117753233475455,380978462002663377,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10665284727489949388,12570070792376340368,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10665284727489949388,12570070792376340368,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,3426509931085998664,175303233774564608,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,9990875712086017255,9112394446572104834,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,2572500085840383453,18122945785449853354,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,6892378241168376814,4996386021215095157,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8823143134135178194,18002796291818153032,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,4849000514861577034,10242102130654487821,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,6431415891010561601,16029824114807339289,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,14016169567312581432,14865888937466897107,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,12176554837927847157,8407894963261216803,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10612651239848237884,11549598731476062647,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,11858675120917365893,15004075999038568469,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,9436284639530832197,5933894906282787266,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6774415596058112931,6319685691269387504,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,5195916829724796643,6481226778967120263,262144 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,577384545872273902,13489122463805008123,524288 --field-trial-handle=3036,i,4667462486661911813,7111800111973888052,262144 --variations-seed-version --mojo-platform-channel-handle=1160 /prefetch:8
  2⤵
  PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2420_1034355949\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2420_1136366409\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2420_40357251\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2420_92864980\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ba39e449b0b6f939171018ba737eb6e1b7a8a70693dd27046f4781faf2e9a2e1
MD5 790d895123e52cdd5a430ce51833a81f
SHA1 05b596a08273db9dded20d225ff8a813b3dc0edb
SHA512 77ed339e7577d855598afaf78baa9acecf19803ec496352a3e888a2c09492f37f39537839bc22e8967d3c00d678bb34a4a96ec9d5f99620d68107076d11e7914
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T1DEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3c59e560f25e4868b2b2170968bf85d6d48b9332ae085b14ad8ec2f1a9818faa
MD5 0b72d2412cddd92385580d95f08828ee
SHA1 89ea5b86d7a71b9467bf0586cbfe6b522d4e3719
SHA512 dacea67b682a20b8d2b291ad83d50b1952b09e18727841757ff443b949c322e1b737226a05a5eac9d7ee11631e9b666491a5eb94ba2423c4b5718a9788b048c0
TLSH
T1906180773D3505A2E3AF067094E12AD23035F4DBFB4B2E4E1284B9F51524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589006.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589006.TMP
Size 3KB
SHA256 1a5578a2b26646118e56ec9b4140e75505cf657c59f033fbc1be1478b44e5d83
MD5 a2427b337ee6113051fc5d9b3853cee7
SHA1 c01d8d9ac191e3a39308371f364f9af69bdf1e88
SHA512 15cc7efaddf1fe8ec47f95a1890a6cc2471ef82bee15bcec2f442e85bb806b61f4a49609f9ecac2d8ffbfb92d9a94a4e7954817c7ba7653142d2df88a57565ac
TLSH
T1CD6180773D3505A2E3AF067094F12AD23035F4DBFA4B2E4E1588B9F55524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9cbb999f3003b76721bcb21daac815b68c647e97b1e27687c83a0c20d3125e40
MD5 20b396a312750b715ebf76472092560c
SHA1 c7ba744e81d0240312611f880d4aa99b5b4199fa
SHA512 0c7e4dca03ebda1149b4a72444aaa76e269f02a8ede49db47c7cd2aef393ec306aba1f30eb662718d301e69463be0cc88227b292bf56d72be929a9b10b78d570
TLSH
T1BC31A0F7C6E8856D890192F0AB187E1BDE1D0954532C3D5AC5E4AF1B93E2470D14095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c757a5f4-35df-4edc-9634-743d647aafcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c757a5f4-35df-4edc-9634-743d647aafcf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80c10be67896e9352cf59d9b1b242632f4f43612fc335e3cc7620b9d0d6352de
MD5 cd1d4bc2df34fcfff2ea66c44e26f749
SHA1 cd2e0793dc5187d447f3d90638e1d4dfbdcf68c7
SHA512 a4bd98e5ac151994aa103f1f28b558cbda4c4e36edc40a20dfc84ab5f3dc03f11f1eeac6f2b4180a57215e15454fa9136e18468ce82bd11ac747015d389c4cde
SSDEEP 192:sxZP/yM/jK1Ml8MiV/ftsJGBG7IdpduHW6+WNGY9IKOj+aIg4J:sxZP7qV/ftsJGBfQHbG1Fc
TLSH
T15542D811AA38A977CCDBD309FA547B53E6F5157292900E449EFCCA1C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d578e6796fc5b88148568c330551b3f9ab170beda92c9d4ed72860c188fad0a3
MD5 7b84510d677f9818c62a862a7d66c8b7
SHA1 d0d50219a4a420ff8257a90e66d8c22df542160e
SHA512 716ffa20176644317900004733778e78bef26f073593eef3a7e7d301339970f415fac434beeade09f4f853dd9506dd18d93d759a16dfd502e4a2e0c4b95ddc3d
SSDEEP 192:sxZP/yM/jK1Ml8UQYiV/ftszGm6Zv7IdpHuHW6+WNGY9IHlj+aIg5JJ:sxZP7qVV/ftszGmG8OHbGZFd
TLSH
T1BD52F815AA385977CCDBE319BA557B43E6F4147292500E449EFCCA1C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 95ed19d0dda5a8e628969b39b4a73badf827bd2a8c219dcf3332d0ce896e2429
MD5 9964578713483e4c8a65bfa1b53932cb
SHA1 0e61ba94c9ea78c7ccb892788f954ea25857d7db
SHA512 e6b6190d9f678428e898b644ed2afe4cedd1330e0b1baacff5a2fd97a089414054c1fdabbf726b24d28f5fa615c380787c180607798ae2a323dde213e6598a30
SSDEEP 768:LYcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNAroBg6t:LYcv21wWvu+Z+u1jaeFLeRNLB9
TLSH
T1CCD20B2B680CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d65616f4cfe0f08980a86da319c4c7861cfce780b9d1a5eb510f9ecdbd9c046b
MD5 a4691086f2f79ed40ddd9ac405528e60
SHA1 15dffaa291427778b6dd607d85004fe4d14c7a28
SHA512 57787aaf0bccc3588a1d6840c2eee132dc32b31b47616a2ee257037babb485d2e533bdfe46ec5c43d838a2620337b0987ad3e19623428b18ec2dd224b2efdb3b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiYa:mT5RXfdv
TLSH
T105C1DE06317E0342387D6959A7A58A378E8172A33854E9BF7BB800968F67E115CFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592cd3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9d6589451e466b8340c91d21d98eebb9b5c107394e7e5acc9895973cd2ac0709
MD5 05ba13f9b8409440909c9bdbe3d36f9f
SHA1 3370c7625d1f999c0d53ddd30fe9c82189d663f1
SHA512 99e601c1870f9f442c5b3a966e763e2e3f0b80898d129218504b49108f6235efdf7acd0c6dd106de75b89f186f6081eb862d1a0928aceb0b6a16f77839ddf617
SSDEEP 384:nasN9UG+Xk4ziACDe+C/dHeWS+2YllXaH:aPHkiHkJlYllXaH
TLSH
T19D423B35AC785C7659E6A246F5473653AFF810F7C9C62F84DAE8DF1C01CB69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd7b609a947a14acdc4d8f27f88580929c3245df77dd8b5db7c1c75a66ad8f1b
MD5 d98cbe58eb93ef20baab76cbc7228faf
SHA1 80934f5ad7c6c6020224cdb404672963469dc745
SHA512 434542c8e092ba86dab95cdbb376e64c6ff8dabf9c1bf885b09f1a7d0ad0812ae11f3c38ff88d713876252c84177fe7b2f76f9f5491e44165b1323c7ad8f425b
SSDEEP 192:JONv6v+YLNQmiUylMZh+CGx+Fdew9ohXusDfU6:JONv6vz/bZh+C/dHe5DU6
TLSH
T19302FB35AD782CBB9FF26E45F4873A175FA42177E9962F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ba18c2ffc49be8b9a5f159d7f4c3e09c23b86910da93bb84272ad099890edcb9
MD5 05d47945e7784f1dbf480b9656e678af
SHA1 c5e9590ae512a2f2bc5b3fe57a5510497322dc6a
SHA512 f0920675457264ede7bfac091e3bb869256f8ab9b83108a678eec5faa6d076798c684a871984844ea6821139a0927919f4031777c816e1cd23b9922575a7a98d
SSDEEP 384:nMiFiZcIgsNu8TUNTUlIld+Xk4ziACDZDfcS+C/dHeWS+2YGlOOPrXLpe8C/TBh:3FQgPwgyHkGSHkJlYGlOi9PIh
TLSH
T162C23971D8A8CE2BBDF79BC2F64776479EF411A399C95AC4D9D89E0C00C76AD030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9c193083fd6fcad20004611097eed7dbb1579058d9904633007dd0798e97044e
MD5 8e2d97ef60cc46dd18b5544a47e12b58
SHA1 50406fe147e59fd94a014aac02494b37782d607f
SHA512 d3c7f936a7afed869b0da013844a53fd2fc539ca8d3428ba18d67032ea45f56b2732d222197cdf82050d166e8b2705cccf62dc099a2295a9be7fee243246ac02
SSDEEP 192:XON36v+YLwQmiUyuMRh+CGx+Fdew9oh9aFS+2Z6zCHfqwNU6:XON36vz8CRh+C/dHeWS+2YAlU6
TLSH
T1CA121A34A86C5C275EE2B515F4C736579FA821B7DD872F81E9E89F0C01DB79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b8a04fdc6ffee01afb2f93654b9d94893d89278ed4704beb0e582f30114c932e
MD5 8ef24cf7671261537df4f45d15950a5e
SHA1 3826ab8ee58f5bc9876c60180154d26285977a72
SHA512 4f269e18e4f3452613bdc73ac241a69435a67009315a7dbbdf0b0b006eb8fdbbf27fddccda281c4db0642734d7a02f2eb55ae6ad92bb5eae6dcb4f712fe53259
SSDEEP 384:nOZcIhsN9Ud+Xk4ziACDe+C/dHeWS+2YllOOPrXLpe8C/TBh:shCHkiHkJlYllOi9PIh
TLSH
T199928E70A97C5C6769F6F646F5873617AFF810B7E5C11F84E9E8CB0C01DB668130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2cebd7cc-54c3-4a4f-b0d2-18aa40ed23f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2cebd7cc-54c3-4a4f-b0d2-18aa40ed23f8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f2e56ee81bf52b525509b854d5098f3c557061f71b888de870f4367a99030402
MD5 51dd390ae8e39f4a3d9f9ac41bbeb456
SHA1 90c399f61ec337f3b75afa4beb2c4d0faa984de0
SHA512 5750d3f2f22864da2aa13bc8690b4c4ffccff9570865737c0ef1883b8cb7a3975c6b4bb318396e3d2539b6268a065d9ebb5a45b81df0e84c8168663f4f48753f
TLSH
T16B413B4CABFA1148B3B76E569FF6A86D483A79332E06D45D10100D4F0673A40D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

2cded628-50bf-4976-92a8-c5ad63843695.tmp

Path C:\Users\Admin\AppData\Local\Temp\2cded628-50bf-4976-92a8-c5ad63843695.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fecfab40-fbcc-4607-9aaa-e5756da13996.tmp

Path C:\Users\Admin\AppData\Local\Temp\fecfab40-fbcc-4607-9aaa-e5756da13996.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2420_1916807077\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4852e08-33e9-4369-9a63-4f09321191d8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2420_1916807077\e4852e08-33e9-4369-9a63-4f09321191d8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download