3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe
Size 1.1MB
Sample260930-mntbjazglc
SHA256 3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6
MD5 4811a7781f3f4cc1c077c3a9f8331d83
SHA1 2af07c253a7a75ab3f1e4ce1115d8a181000a75e
SHA512 0d64bf3005451f3c7ce6b64356327d8bd70feb0514fbf141d467ceae7c724bf79900fe0345034f8b58e9af5e9b668c53178722476e35246ee616e3729974eb2c
SSDEEP 24576:NsupPVuglbiYLEk8rVl2dGNx/oX1ot9oRwr7qSRyyvM:NZpxfV8r72dGwSbMwr
TLSH
T11F35E143BAE1A0F5C609B0B10D5A6B35AA708EA90F15CFD39B65FF1D2D32580E53F11A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3164	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	93
PID 4720 set thread context of 672	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	94

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3164-1-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/672-8-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-7-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/3164-12-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/672-15-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/3164-14-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3164-11-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3164-10-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/672-6-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/3164-3-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3164-2-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/672-17-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-19-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-18-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-16-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-62-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/672-63-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/3164-99-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3164-98-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3164-270-0x0000000000400000-0x00000000004AF000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2064032797\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2064032797\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_256181397\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_256181397\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9BB8C1BF-C453-49E2-8357-1E6ED5427F82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5888	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe
4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe
3164	cmd.exe
3164	cmd.exe
672	taskmgr.exe
672	taskmgr.exe
3164	cmd.exe
3164	cmd.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3164	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	93
PID 4720 wrote to memory of 3164	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	93
PID 4720 wrote to memory of 3164	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	93
PID 4720 wrote to memory of 3164	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	93
PID 4720 wrote to memory of 672	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	94
PID 4720 wrote to memory of 672	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	94
PID 4720 wrote to memory of 672	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	94
PID 4720 wrote to memory of 672	4720	jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe	94
PID 672 wrote to memory of 3540	672	taskmgr.exe	98
PID 3540 wrote to memory of 5888	3540	rundll32.exe	99
PID 5888 wrote to memory of 2312	5888	msedge.exe	100
PID 5888 wrote to memory of 4724	5888	msedge.exe	101
PID 5888 wrote to memory of 4852	5888	msedge.exe	102
PID 5888 wrote to memory of 4852	5888	msedge.exe	102
PID 5888 wrote to memory of 4852	5888	msedge.exe	102
PID 5888 wrote to memory of 2208	5888	msedge.exe	103
PID 5888 wrote to memory of 2208	5888	msedge.exe	103
PID 5888 wrote to memory of 1728	5888	msedge.exe	104
PID 5888 wrote to memory of 5736	5888	msedge.exe	105
PID 5888 wrote to memory of 1728	5888	msedge.exe	104
PID 5888 wrote to memory of 1728	5888	msedge.exe	104
PID 5888 wrote to memory of 5736	5888	msedge.exe	105
PID 5888 wrote to memory of 5736	5888	msedge.exe	105
PID 5888 wrote to memory of 512	5888	msedge.exe	109
PID 5888 wrote to memory of 512	5888	msedge.exe	109
PID 5888 wrote to memory of 512	5888	msedge.exe	109
PID 5888 wrote to memory of 4552	5888	msedge.exe	110
PID 5888 wrote to memory of 4552	5888	msedge.exe	110
PID 5888 wrote to memory of 4552	5888	msedge.exe	110
PID 5888 wrote to memory of 372	5888	msedge.exe	111
PID 5888 wrote to memory of 372	5888	msedge.exe	111
PID 5888 wrote to memory of 5168	5888	msedge.exe	112
PID 5888 wrote to memory of 5168	5888	msedge.exe	112
PID 5888 wrote to memory of 4640	5888	msedge.exe	114
PID 5888 wrote to memory of 1904	5888	msedge.exe	117
PID 5888 wrote to memory of 1904	5888	msedge.exe	117
PID 5888 wrote to memory of 1904	5888	msedge.exe	117
PID 5888 wrote to memory of 3120	5888	msedge.exe	129
PID 5888 wrote to memory of 4188	5888	msedge.exe	130
PID 5888 wrote to memory of 2748	5888	msedge.exe	131
PID 5888 wrote to memory of 3616	5888	msedge.exe	132
PID 5888 wrote to memory of 3616	5888	msedge.exe	132
PID 5888 wrote to memory of 3616	5888	msedge.exe	132
PID 5888 wrote to memory of 3580	5888	msedge.exe	134
PID 5888 wrote to memory of 3580	5888	msedge.exe	134
PID 5888 wrote to memory of 216	5888	msedge.exe	137
PID 5888 wrote to memory of 216	5888	msedge.exe	137
PID 5888 wrote to memory of 2396	5888	msedge.exe	138
PID 5888 wrote to memory of 2396	5888	msedge.exe	138
PID 5888 wrote to memory of 1068	5888	msedge.exe	139
PID 5888 wrote to memory of 1068	5888	msedge.exe	139
PID 5888 wrote to memory of 1068	5888	msedge.exe	139
PID 5888 wrote to memory of 1252	5888	msedge.exe	145
PID 5888 wrote to memory of 3392	5888	msedge.exe	146
PID 5888 wrote to memory of 3392	5888	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d1e74334e308c8192289ec1e5f862b8c34163de5ee73f0244de06995c63b0d6.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3164
- C:\Windows\SysWOW64\taskmgr.exe
  taskmgr.exe startßÉßÉ¾«Áé5920
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" url.dll,FileProtocolHandler http://www.csoljl.com/
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.csoljl.com/
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffa2c1ac188,0x7ffa2c1ac194,0x7ffa2c1ac1a0
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13943824957021869853,4512210378375813896,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11202204052133596605,11054240792672490250,262144 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8714901141584570890,3322791469965968769,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5104502342810428880,16690032519248153107,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17937120759823170356,16661746599873691461,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,11185220814642599639,11238645032854337675,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
        5⤵
        
        PID:512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3700,i,12395535858748817451,7137757951365811229,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,17438741465075671793,9908986830097046198,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
        5⤵
        
        PID:372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,13250006572206154772,18297633395920880705,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
        5⤵
        
        PID:5168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16023922944488674045,3056204927720559650,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16023922944488674045,3056204927720559650,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
        5⤵
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6016,i,17157108632414093737,18001838008711830102,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        5⤵
        
        PID:1904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,1685739058035247491,1980241424981739924,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,11218189056663703031,2792948131408307079,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        5⤵
        
        PID:4188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,893150112477362643,4686253236517623754,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
        5⤵
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5160,i,6191840268609479675,8437486163577677737,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
        5⤵
        
        PID:3616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,9279671968259735135,3157444977815235803,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
        5⤵
        
        PID:3580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7352681718930393632,16468502323378459698,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15907683219736700534,2539309210421922815,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
        5⤵
        
        PID:2396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6264,i,6815651783932872233,1876999594137699964,2097152 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6340,i,1761602127128180483,3040322239533520566,262144 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,15345845085309644188,6757197688005838454,524288 --field-trial-handle=2180,i,6173973999699875840,7525265921420418870,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
        5⤵
        
        PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2064032797\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5888_2086160033\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5888_256181397\manifest.json
Size 118B
SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
MD5 064a722d540bb9c42e4db8268426a4e1
SHA1 dbf4fe6aba40365a0646508d6f1f558d767e234a
SHA512 ce6a19905edea82b03cc4b70907393c2fd31e308c9d6e6dac649bdfbf44b04bf0ca2ffc8f0e354784258ef3d0b25bc72655302dca37897c36f0848bc9debe394
TLSH
T196B092B00C1AA03B22849320ECA066C283F80A19E8021B1E088036481F8817881366B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8f8c7f1d355f5d2df1681aec345c5474aac2e506e43337ec969e071cc667a69a
MD5 49659c6f9bda78f4fd5042142ae6931e
SHA1 108ee7a26985b1012933748d5f0a57729d85b508
SHA512 ae103cdf2f17b3b34c714483cfeb9bf792ef2b3ed3a037a817dbbe0e63701d9ad89e33ff9a8ac08e9a81f16f429a2a4ce25f0ad1ea5a3aa377d9b3b5ea5f0939
TLSH
T140F028B5C821FC3B08FD0B3920A40746FB55232B2A41985F3B3E811C8FB563B468586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7e403a560b27e8a3632a495c382501ac39dd379f6546ceffa471d03bacbb4c49
MD5 68156c960852d0ce1ee0e8398b4de148
SHA1 0678b0f421c2e55a7d80ef4c0c4ed384b63d29be
SHA512 aa47e00a868d4f2e9aa46d4860dfddd3e2ee13716e741be1d8d5b742711df9e2998ae5b54fe94c3f829ce736e25702e08067403c4b7d590f8d610cf75caa2711
TLSH
T1E7415BF7C3E8C66E890156F4A718BE1BCE2D0A54832C7D5AC8E4AF2B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0d62a0820d853753e105af1d88bc442f5391c37326d2e9d18b63f760907d239e
MD5 f6accf78a8aab637b41673360da8b0e7
SHA1 7a4326724369c2093b4947834bb1f22b97ac8330
SHA512 30c1ddd108b6e46ac4fc92bfb49a85b157778304433f6b56cec69a457b53c90fbb168bedd2731b63a5286094fbc4968d6e8301fd8155c4deb0ace44baa4d2f8c
SSDEEP 192:sxZjRdjE/fRstaQZLjt8qzodp4jHX176+WNGYoWoSmVIgjtJVJ:sxZjPE/fRsgOPyRSHSGxSqjtJ/
TLSH
T18642C7156E38A97B4CC7D219BB557F52D3F9503390910E48AAFC8A2C15EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 81efb50fa950d81441491fb9177a1281ee7dbe4e56c1bd7332fa3bdfee2c32f5
MD5 3f06ae523a8ae8e512a99c12ea0bb09e
SHA1 5f94fd7ff6f3ee6aa6fe2cc6d96d04c5f100c521
SHA512 e9480e29c4cf21153140a88ee69ade16b4b618d2c54f80eeeaa4b2e765793f51e18a3602805fc01c8d90a1872533425f7805f4e2d00f43b4c9deadad41bf1002
SSDEEP 192:sxZjRdjE/fRs3aQZLjt8qzodp4jHX176+WNGYoWoSmVIg5ptJVJ:sxZjPE/fRsqOPyRSHSGxSqztJ/
TLSH
T11242B6156E38A97B8CC7D219FB557F52D3F9503390910E88AAFC8A2C15EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 227d3b51f762b6c4d363664087450470f54271aa8ebe1dc2c515c884f1931f01
MD5 5a0697a75475a90e3b412c1057dfd9aa
SHA1 5ce814e09ed8673317c1b3702e3da7eb1b8d2d96
SHA512 c8c837f0df9f89aa2ab39c9bc081d52d395b867997e23991e5e30679c4c978b468241a96b07dd203e289e2329fc952fbdfb713aabc0de65369805866318651a0
SSDEEP 192:sxZjRdjE/fRs0TQZLjt8qzodp4jHXZ76+WNGYo6oSmVIg5bvt7J:sxZjPE/fRs0TOPyRSH2GRSqhtN
TLSH
T16642C855AE38A97B4CC7D219FB557F53D3F9503290910E88AAFC8A2C05E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 54f39dffa6c5f03d750a8d7246ff9b6c6085e52a8c42e0e272b429a5a53542f5
MD5 0f83da1a45bb5822b8b2a4892c0ad0fb
SHA1 e00b23332d6cc8e30930639b1d941d598817be1b
SHA512 f9ba618bfa6024a5a6eab8393e247eed0790a0ae7854cec92f5a88eaf154044d2f3f3401bf7f986702c57bd982da981b5c33edc5f2ea638d12868342dd94e461
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgZ:ST/2dXOJhJlpfnpp3tNXVrN3+tf+
TLSH
T10AB2121571BB421039FE391892B58B2E064272733119E66B7FBD04B69E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae0a1b85-4f76-45fd-9a83-07b7aaf4513c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae0a1b85-4f76-45fd-9a83-07b7aaf4513c.tmp
Size 32KB
SHA256 73dbcfd317a442f710e356e9784c3a3293aa7e025f2244dd0feef1b9c0ef7f14
MD5 12c5259a5cc9d36c3614ce83efdd9684
SHA1 f53d2ffc8f5aa9e15aaf03a44198c9ac31d1dbdb
SHA512 07aa7f90b2d07f993e6213278420c1a16c151cefdbe725816890e5af774ea080c03e5b5af309d4a6a041af9bb867a2d339a638f68d7438c0ccf2759469b5118c
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jab1qpLd4jjoY
TLSH
T1D7E2F97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 404b92bfba3d1e09cfb07b801ffb8ec60ea8fd7596805d7a3aba86c5b8553788
MD5 630c357bb0e50c20eb46ae73d385e6a4
SHA1 e618429a6ab6f43d3fab7d8d9e20c16fbe405f44
SHA512 62027c31833fffdaa1e01d6a0de22e493df8d22efc4e8cace351760730c223c3e0ba4dbec3a154002a8dc1e9dc4850ed335734204a1eebba0bd5d2caa680d58c
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMi74w2fiBCC2TmDGF4u7O6R2FeoivgL/7Iz4ou:RFQ63vwgcsnBC5TmDGF4u7TRXIx
TLSH
T1FCC23A36ECA8D9ABE9F64FDAA74A7A03DEE00163858C89C4D9D81D1D00975ED130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce77ee59d7edb159114ce4ce51d2ed67b47b3235dc9fb03e921110afaad02499
MD5 923a19f07b185b01467c18ce9d5853cc
SHA1 72f4aa0ec89ff77935a75575996827c282c78d68
SHA512 5abc9fb5577e7df8de38751975672bfcf4f43dce2098b1ead878adb8168317fa76ddc417046ff6e3e357e493c6df6166d988f4bcb6eea118d54e6d34f4d6252a
SSDEEP 384:nYiFiZcIR3sN88TUNTUlI4DaKMrz9w2fiBCC2TmD9uXi4wtgOIwZOykTgL/7IzRN:jFQR35wgxNSBC5TmD9wi4wXsHN
TLSH
T106C24B36D8A8D9BBEDFB4F89A74A7603DEE0016385985AC4D9D91D5C00935DD130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1afb3198638dba7da5b6d76a0e9116910d7c15d4acc2d986c03f9b181b6c51be
MD5 54d68a86f5d1465befc0f0ac75063f92
SHA1 c135d0129c1fb2eb269bff9a469aa2ba98b30934
SHA512 08582ea38299eb04b9c18ae22edeaa24855325ff6f4552545320f74c4a07df696b3338486418ec09f3daf89cc62451bb3362e718af04bc8e1271022387858ade
SSDEEP 384:nbiFiZcIR3sN88TUNTUlI4caKMxz9w2fiBCC2TmD9uXi4wtgOIwZOykTgL/7IzAN:2FQR35wgYLSBC5TmD9wi4wXsWN
TLSH
T11DC24B36D8A8D9FBEDEB4F89A74A7603DEE0016385989AC4D9D91D6C00935DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 26c92fd73338690176c390446c7402f5a42b6cd809085e8ee37589b01c7e6c8d
MD5 f4becd99b873b9e55c471463766df491
SHA1 5092709a7dec6af09af1c3ce7179e32016fbd037
SHA512 11cda74e0b2eaf8aced833fd07c2ffd3a02941544af3de7668880356473045a02a2b74375cac561c5c74f4e101d7fcd5bb3b657d5a6be1dd2e215ded48c90f4e
SSDEEP 384:n7iFiZcI433sN88TUNTUlI4caKMxz9w2fiBCC2TmD9uy+m4wtgOIwZOykTgL/7I4:WFQi35wgYLSBC5TmD9h+m4wXsWN
TLSH
T174C24B36E8A8D9FBEDF74F89A74A7603DEE0016385989AC4D9D91D5C00935DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\typosquatting_list.pb
Size 1.4MB
SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
MD5 5bff34d92fc5a86bef266b458a6efc08
SHA1 95e2c2b9d976cb7855d6f7092ecb0cb241617182
SHA512 02625a49261c12154ebe377df81d4457ba449801273dcb27d742dfea86329b1da7088484467ff9ab6dae4e649783201a58efb9fbad630c0e29d1191b2ccec20d
SSDEEP 6144:NwUhpkDDI4SQRKjrKu5ujaJ+jb+1zIs4nKvL0+7rbKQPCL/LsBjeLXgJ1NCry25u:NtpiDI4daZHlIXKNYYZfdhvn8RZJcv+Y
TLSH
T1B365B5B9DFC00194DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 788682e14f311f73776b76c735e32430b1c5f1e9e0812328e6a200077db5e10c
MD5 d870ef5c7f49da96a8cbe2f437be4c94
SHA1 8c92d1d681f47d3249a700814b484f60c8ba9aee
SHA512 81342cbb6c12974fa292a7545f45d441d1e19e883069aa429120b1a90f43d258551635262f8d96cd75a00d4767a11fb86b608060da613e76249522378d17ccbe
TLSH
T156413FE04C385AD1D1BD0E7EB09B39EC91ECD721B8A4347D2C58E9989A7E61D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8b6a2416b70c6683e9f0e61c25d8b58d182ab843e28c740c2014934b2bb91f02
MD5 688f0adad5e6c015b822b33682251951
SHA1 e885a82b92d84c5343bc899cef47c954691bd9ab
SHA512 a7da903fa03fe9a096c48f59ad675d647e63d43470b257e827a83c97debb4f88d53311d14f8e2ada5fd2d1438a744dea3f98835cb4899e414f2cbc72debe14b3
TLSH
T1EA413FE05C385AD1D4BD0E7EB09B39EC80EC9721B8A0347D6C58ED988A7A61D2040C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3db8d8e4b86fc10d780e22fe61963f2518934da35a7594a1ddd6d21c901d2d6a
MD5 10db5984a4e1cc853581b1365c9b267a
SHA1 e4942a71ab9c13c26f7f4e820395ae219d7c1625
SHA512 bf41817d795f4d30e8f8758cfea0bd0cf678ef3feff1a2442fce8128c4ba8e960e9b0892678f452acc45c8100716ab5b8a4c0d1d58e270270ca3896165bff2d4
TLSH
T1BE412EE04C3C5AD1D4BD0E7EB49B35EC94EC9721B8A4347D7858E9989A3AA1D3040C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 02396431090cf6c50a12c521e978e63de9869f7d41a9f219d0b3d7147f308ee8
MD5 1ebba5a13bfaf3e8c304648ffab4f2fd
SHA1 57b22ceb5b17fae5b90828da5856baee3e25d59f
SHA512 b062aafbc7181c48f5ef22db83213ef140028eeb4df3e119575c6cb6e8f322b29336122138492c6725afaf4dfb6be6bd765371a2f18f8d14907a4f3d768ff114
TLSH
T168411858B6F91148B3B36E5A6FF6A86D447BBD372E06D09E00110E4E0936B00C8B2777
MD5 SHA1 SHA512 TLSH

Submit Download

ErrorPageTemplate[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\ErrorPageTemplate[1]
Size 2KB
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA512 62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436
TLSH
T11541014EA74A9C5FB3373452BBF10F50BA090582990F976274F12758E4D51FA3723389
MD5 SHA1 SHA512 TLSH

Submit Download

bullet[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\bullet[1]
Size 447B
SHA256 1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
MD5 26f971d87ca00e23bd2d064524aef838
SHA1 7440beff2f4f8fabc9315608a13bf26cabad27d9
SHA512 c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15
TLSH
T13BF0234E25B6897FFE04B61B834E3728C0123D6487C4C702D09DE18AF5764125262107
MD5 SHA1 SHA512 TLSH

Submit Download

errorPageStrings[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\errorPageStrings[1]
Size 4KB
SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
MD5 d65ec06f21c379c87040b83cc1abac6b
SHA1 208d0a0bb775661758394be7e4afb18357e46c8b
SHA512 8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
SSDEEP 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
TLSH
T1DAA1536D95DA1A22254245B3060FD2E6AAC50D949320D3B8770CD37F378C6ECD2FA7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

navcancl[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\navcancl[1]
Size 2KB
SHA256 bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
MD5 4bcfe9f8db04948cddb5e31fe6a7f984
SHA1 42464c70fc16f3f361c2419751acd57d51613cdf
SHA512 bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e
TLSH
T1AC51BB5A4CD6FA2248321682E7E1ADC9DFE1541343918894B08F221F3FF9D889F031BC
MD5 SHA1 SHA512 TLSH

Submit Download

httpErrorPagesScripts[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3H6M57B\httpErrorPagesScripts[1]
Size 11KB
SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
MD5 9234071287e637f85d721463c488704c
SHA1 cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA512 87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
SSDEEP 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
TLSH
T14E4220ED3512067687CF182B2A2B934CBC7904551E22EDA0846C88D1B5F5FDDF5ABBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info_48[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3H6M57B\info_48[1]
Size 4KB
SHA256 51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859
MD5 5565250fcc163aa3a79f0b746416ce69
SHA1 b97cc66471fcdee07d0ee36c7fb03f342c231f8f
SHA512 e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134
SSDEEP 96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
TLSH
T1AE818EB278A4EF08A99252B5416FB534E6394F76D44EBEEEE143C4D05D41C026ECE246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background_gradient[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1P4NEBX\background_gradient[1]
Size 453B
SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
MD5 20f0110ed5e4e0d5384a496e4880139b
SHA1 51f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA512 5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a
TLSH
T1DEF068631B856E36D8F459301793C310070A6919A9372F9E68C868A1F9C05E68E02615
MD5 SHA1 SHA512 TLSH

Submit Download

memory/672-6-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-8-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-7-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-63-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-62-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-16-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-15-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-18-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-19-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/672-17-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/3164-270-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-2-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-3-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-98-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-10-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-11-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-14-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-12-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-99-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3164-1-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/4640-228-0x000001DFB63F0000-0x000001DFB73F0000-memory.dmp

Download

memory/4720-0-0x0000000000400000-0x0000000000528000-memory.dmp

Download