0cd5ed464c5737eeddb4e2ee3e543c92d04b13a812f7dac3978691f935dd959e

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potential Phish - 2026-10-01T165518.783.eml
Size 63KB
Sample261001-ynvedabb26
SHA256 0cd5ed464c5737eeddb4e2ee3e543c92d04b13a812f7dac3978691f935dd959e
MD5 d8e00d282aeb6bf38996ac63daaf842e
SHA1 a8095c575608b2d12d748ccede1e8fe0b5cc9672
SHA512 f5944eec5907055f7e0e00329b0b450ee2ebef970ba97181b226c016a7e7124d58cd73ea590a9308315be8d65f737351cab983439f3f2a9a911dd83692cee63d
SSDEEP 1536:QhfnYzIIM5NExmY94O1eRhr91QZSHOzcHAQt:Qhf4i5NsmJ+eRh51hAQt
TLSH
T11F537DEA86183BF35E765E425C3D3B071611FA8BBCD26049097F47E25011BFA1AC53BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_139343338\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_94641686\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_94641686\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4720_139343338\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1364	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{D655F663-67A1-4F6E-98EB-76D462CB9B8E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
4720	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3728	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE
3728	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4720	3728	OUTLOOK.EXE	104
PID 4720 wrote to memory of 4632	4720	msedge.exe	105
PID 4720 wrote to memory of 1820	4720	msedge.exe	107
PID 4720 wrote to memory of 1364	4720	msedge.exe	108
PID 4720 wrote to memory of 1820	4720	msedge.exe	107
PID 4720 wrote to memory of 1820	4720	msedge.exe	107
PID 4720 wrote to memory of 5064	4720	msedge.exe	109
PID 4720 wrote to memory of 5064	4720	msedge.exe	109
PID 4720 wrote to memory of 4536	4720	msedge.exe	110
PID 4720 wrote to memory of 4536	4720	msedge.exe	110
PID 4720 wrote to memory of 4536	4720	msedge.exe	110
PID 4720 wrote to memory of 3336	4720	msedge.exe	111
PID 4720 wrote to memory of 3336	4720	msedge.exe	111
PID 4720 wrote to memory of 3336	4720	msedge.exe	111
PID 4720 wrote to memory of 3272	4720	msedge.exe	114
PID 4720 wrote to memory of 3272	4720	msedge.exe	114
PID 4720 wrote to memory of 3272	4720	msedge.exe	114
PID 4720 wrote to memory of 1336	4720	msedge.exe	115
PID 4720 wrote to memory of 1336	4720	msedge.exe	115
PID 4720 wrote to memory of 1336	4720	msedge.exe	115
PID 4720 wrote to memory of 3628	4720	msedge.exe	116
PID 4720 wrote to memory of 5396	4720	msedge.exe	117
PID 4720 wrote to memory of 3628	4720	msedge.exe	116
PID 4720 wrote to memory of 5396	4720	msedge.exe	117
PID 4720 wrote to memory of 5188	4720	msedge.exe	119
PID 4720 wrote to memory of 4188	4720	msedge.exe	129
PID 4720 wrote to memory of 4308	4720	msedge.exe	130
PID 4720 wrote to memory of 5076	4720	msedge.exe	131
PID 4720 wrote to memory of 2788	4720	msedge.exe	132
PID 4720 wrote to memory of 2788	4720	msedge.exe	132
PID 4720 wrote to memory of 4316	4720	msedge.exe	137
PID 4720 wrote to memory of 4316	4720	msedge.exe	137
PID 4720 wrote to memory of 4164	4720	msedge.exe	138
PID 4720 wrote to memory of 4164	4720	msedge.exe	138
PID 4720 wrote to memory of 5452	4720	msedge.exe	140
PID 4720 wrote to memory of 5452	4720	msedge.exe	140
PID 4720 wrote to memory of 2752	4720	msedge.exe	141
PID 4720 wrote to memory of 1720	4720	msedge.exe	142
PID 4720 wrote to memory of 1720	4720	msedge.exe	142

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Potential Phish - 2026-10-01T165518.783.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mibc-fr-10.mailinblack.com/securelink/?url=https://urlsand.esvalabs.com&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL3VybHNhbmQuZXN2YWxhYnMuY29tLz91PWh0dHBzJTNBJTJGJTJGc2VjdXJlLXdlYi5jaXNjby5jb20lMkYxS0NoSXZmbzl3bm00SmVBdE0zQVlBcERiTWJTeHFjMWF5ZVp0Um94UDZwQnRRT2pGX3ZEMkk2X21ScnFyZFEzWDF5R2tBWjZROGY0cGtqc2hqR2VDNHJ3NWNsb0ZZQURvVmh3aDlsb0pJQ3pXdTNQMUpmNE9WQ3RiSnFoUkx1bDhDT2hZbkhUbFZPS0V3TWlUQkVzZTB2NDYteGREdWNMSDIyTmU1bm1EckxvNVEtU2dpbnptTEppSS1ZME50aDZqUnpuR3VMMjlsSEtKNVh3RVlOUzRYb0VySGx4UmJ5M2xITDh2Z0gxOW1CTE9HVDJyZWJ5RWFWazVZaDRub01SQkM1MWZabWp6NkR5ZkYzMGZnM2dSeEVwZHg1V25YeUp4SkRobDBtZjJ4blNNYXh3d2ZzSVpjVFZ0dzRvenkzcHItUkFxSzNZLTdfdHNfS0U5V3Y0aUQ4b1ZBQ2pIQml5Ui00bGk0RklLQUxqbW1xZHI1amFhUDJtTEYwRFZ0b1hvVnFmbGNmTnRpY1pZamlJM2ZIUUpKWm9qUy1QeWxYdXZzancyZHhnWElMaWxRNDZtQ0ZYSk1RbTZOV0lPblhVbXpLU2FsVzVhaURfb3NJMkU2S0NWR1dzZ09yWkxJejhIbXZWa25oZ2FlbjQlMkZodHRwcyUyNTNBJTI1MkYlMjUyRmhmemZlcnRpbGl6YW50ZXMuY29tLmJyJTI1MkZ4eXomZT0yNDZiMzQ3OSZoPTNiMDdmYzc1JmY9biZwPXkmbT00aHFreU0wUXFIekZza00iLCJ0b2tlbiI6ImdBQUFBQUJxdEJIRjFmMFE0M3oxR2FGZjQ2dUpxX20teWVkUEVLdlRJYS1WdGR6YkpqMElrb2t6cWxUVU1QNGhSSG9pdGdTNnY2MXhybDRnTW96cURVR3pxQTYyRHlKUTNoSUFhd0lxUWdVdXRXd0xBS3M0TDQ5UVdQNTd0V1lRVGtna3p6Y25ma2NlTVlIeHNpWXdzZm5GOVQ5b045MC0tODdhMmJaRDNBR0N0ZXZnUWQ0c3lJdFZSNVhpT3VYYlB0MWVSTEtFajNVQzVzUS02cFpqcktxT3BjNHk2dmJLRGZTeTA1R1JFdXFIWEZ3TlBuTDBCSWhkd01JZlJVaC1jZm5PR0hFdm54UDZEZVJHc0MxdkRKSWVkZEk2dS0yVUcydmxxSGFOT2VQOTRhWkhOWFhXS2JOWGNWeVlxZkw0My1zUlduOW13VGl6In0=
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffe2ad1c188,0x7ffe2ad1c194,0x7ffe2ad1c1a0
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2354736073006003018,11079615249241802556,262144 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,4887541469114678496,11311942815597163512,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,12430069973166664473,379789468165892356,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,754752436917418284,10652179777157732329,2097152 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,14243999687401662181,2718452825023960242,2097152 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1632,i,351469291649373209,5849861792104980644,2097152 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4900,i,8363365917886704419,11358175750173547470,2097152 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,1928283576592495034,7895189057618270341,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,15042588909941595983,3968681237503649177,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,13914033390728452495,3801788860731660094,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,13914033390728452495,3801788860731660094,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2169696079911931251,11264447844733431703,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,7254400977498468869,14874582712217456324,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,4248189538940235886,3602471188460900611,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9651782518816176834,15506373185750358582,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,14031339640656221566,15379273733575468524,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3926077973016051796,5055093191435434910,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,2554100301187565175,12157315145864989174,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,18012077566280083821,3308676294564752040,262144 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15163066007983975703,6685769104362142394,524288 --field-trial-handle=2228,i,2544664114106284470,2317704795621707629,262144 --variations-seed-version --mojo-platform-channel-handle=888 /prefetch:8
    3⤵
    PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

typosquatting_list.pb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4720_139343338\typosquatting_list.pb
Size 1.4MB
SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
MD5 5bff34d92fc5a86bef266b458a6efc08
SHA1 95e2c2b9d976cb7855d6f7092ecb0cb241617182
SHA512 02625a49261c12154ebe377df81d4457ba449801273dcb27d742dfea86329b1da7088484467ff9ab6dae4e649783201a58efb9fbad630c0e29d1191b2ccec20d
SSDEEP 6144:NwUhpkDDI4SQRKjrKu5ujaJ+jb+1zIs4nKvL0+7rbKQPCL/LsBjeLXgJ1NCry25u:NtpiDI4daZHlIXKNYYZfdhvn8RZJcv+Y
TLSH
T1B365B5B9DFC00194DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\deny_etld1_domains.list
Size 6KB
SHA256 2a9b59ec22bbd49e4475d2d350d496023551953c8b5ebe97266aefe51a0c5c36
MD5 3ca9dab6be71da08f51aede14b0e900c
SHA1 2ca6be97955e3c31a0f3f3cef0182fca93db171e
SHA512 16c2e3694f48b8695eb725969d89669bbb1b7b01cf5fe1fa4e69aa919050ad6d60ce47e8fc18b030c94b15d171543420338700226dfd13bf226b74aa85de5539
SSDEEP 192:7y+Ncyo37Cu1+F8/fi3E6Cfr/z+lhLg3ZRfceMBjcvXmgqqE7:7Tc3bqUB/z+l1g3ZmeTfmf7
TLSH
T15FD19FE4B7F1C94D5DE027C9DE7E204B3B9286A7D228F86022319C27023F33C194A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\deny_full_domains.list
Size 12KB
SHA256 f154d0bc65cd130b16d1b6471df8ed2841b2f2f6d90e9912b73b37985062e623
MD5 d46f0f6333abf9bbb92ea260bd257b20
SHA1 5da02d8b3d87b5bb18b36f969efdbf8645e7977c
SHA512 9da29f3a8e7d2681666bdee5436e9a95b1c840d0d4906c85fd71725b041f5a1fb0ed30f6151a5737eb08ec42b8ee3e9ab2beced4c8b57785abfd55186bcf16ba
SSDEEP 192:xQDXUZT4QcnYNTprtSa625Tf7wykvSYJ5cGuVeeg4+YxujfKg6VFvfItXlS0GcZK:x604Qcncg25lkj5cvkY8jKLnvgtxLEV
TLSH
T1C642BF8CB2479A85C491BF97F1082614888DDF3BF95327942C693CEAC59F40F5197283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4720_2012929342\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4720_94641686\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

046fb090-352b-4e58-9fbc-898ce04cbd17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\046fb090-352b-4e58-9fbc-898ce04cbd17.tmp
Size 25KB
SHA256 e6232d947cc4e20b108c383ea04d63723a0366c6230211fe66179e0c2f7abc70
MD5 274280ce2f6ea2e3245ee35dad05a085
SHA1 e194a33a96754285fea75234c985c32acd6f469d
SHA512 ad410bd86964060c0920a12172d90472d5fe58f719e8b1fd7aa863cec75c7d021a0d5a6307b8957aeb0eb2b5134cabf3aaa1a73fbe77c685052d90c055162b1c
SSDEEP 384:npiFiZcI63sN08TUNTUlIm25mg5knK2fMBPOmJu/LBX67O6R2Feo4gL/7IzQo9:AFQ63pwgSbQBPWX67TRya
TLSH
T1A2C24B32EC94C9BBEDFB8F95A74A7A07DEF41263859C4AC4DAD95D1D00871AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46375e22-f4c4-45a2-8e82-6e541893aaf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46375e22-f4c4-45a2-8e82-6e541893aaf4.tmp
Size 26KB
SHA256 c3338ed586f22044f2c9b62f9ea9b535e011b8bb3ec6b7a65804f60e2270cf62
MD5 64e528a949d928b65398c43137154781
SHA1 f06d33cf84e9b34c745d65e6721dc3d81e6dbad9
SHA512 c5268220d089c94d79f1a19cab8aa55611cb5739c9be4fa4129912c6ff8577acdaeb8f7505abd89acde8b2b75c01693e32a2f3d269bd4e00cb665f531126db6c
SSDEEP 384:nOiFiZcI1sNm8TUNTUlI4v5mgberK2fMBPOmJu/LQG2RVZh6DKhH4igL/7IzBoJ:lFQ1TwgrFEBP7RfYGH4e6
TLSH
T112C26B32ECA8CDBBECEB9B95B74A3A47DEE05163859D8AC4D5C54D4C00872DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88af2272-b010-4700-b8d0-57d080825a15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88af2272-b010-4700-b8d0-57d080825a15.tmp
Size 32KB
SHA256 b43f2588b56a94011022c10e507dd8ed32157088cb216689c04baca62096d331
MD5 920357269d6bdd9a9d9b8b51ef66aab5
SHA1 c461f1bce3eed3f3bcb2580ed2da9823331a6936
SHA512 e79730ef7bbe7c656f40390ad9c4524941362158a7129a1cb4dda78a74a7256b99b3d36afeb79e86c8a43c3442893e96cdb046ef84a0ede46d38c993b01e2b2c
SSDEEP 384:nEiF4ZcIJ3DsNio8TUNTUlI4j5mgbDrK2fuBPOmJu/LQGgRVZh6DKhH4igL/7Iz0:fFGpTowg/82BPLRfYGH4e6
TLSH
T183E2B2F198D789B6E8AE4B87A73D2E4699FCD153B4884A84B7C54D0CCC821BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

4e2ce6fc-1447-4849-9bec-243006abbf59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e2ce6fc-1447-4849-9bec-243006abbf59.tmp
Size 649B
SHA256 00d04f9fd20f3d8088b424bcc7b4e4512d7e494d8ab6641670d99aa0a7e7e755
MD5 5fbf48cbd80f755a26800f093c806727
SHA1 971614296ec5d64dc4476882d591dab9ec0eb7d7
SHA512 de48650a1c393c6a472aa7d016f028e1ab9183c3b6d19543ae4459a4de301983d16419f6c4c15efeb91040b3789548db912dab2396941309b27c5c89a1390e43
TLSH
T141F02DB5CD25BC3B18FC1B1910950A46F75523673781988F3B3D811D8FB163B859685C
MD5 SHA1 SHA512 TLSH

Submit Download

52f3af79-d1bb-4135-a61f-8f0829d9b8f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52f3af79-d1bb-4135-a61f-8f0829d9b8f0.tmp
Size 13KB
SHA256 1ce2e972844bbf070961f2c73f6341b0eb355bfea319333c01b5a5dc9f41bb51
MD5 ac19c290299fbd88d294d780383536db
SHA1 cd06f353cb86c505366baebf8f3e452a2b9673d0
SHA512 5fe65df65327cbaa86f3a9e4ced8a5acd10566870e229cc38f655ec55577fd2a756f8e8affb23271f8c733c6e492e79ad6d9654b17f883b1ca30ffc5333b642c
SSDEEP 192:sxZ7RAj7/fosmQZZNIN/AzodpAxA9HW6+WNj0M6/YbI26YY+rIg5xsJ:sxZ7i7/fosmOZNcjtHbu/F5YYOvQ
TLSH
T17752F815AD38697B8CC7D219FA55BF53E3FD203290955E48AAFC8A1C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60352db7-dab5-41ea-9f00-ca81b593d096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60352db7-dab5-41ea-9f00-ca81b593d096.tmp
Size 13KB
SHA256 6a2af7b6cfb5c42e94751553d8eba7fc14606dce3ff3dabf7bd490d6bf340d5a
MD5 4c59d9a5661e7e0e81980a01f82e4b44
SHA1 a4cab3fbf69d226f7e9a3821f0848d9e4969ca0b
SHA512 0356bdb7e7d15a6b40bbafd51ba102bdaabdbd0768642de26d23a83541119b629034af13170699f513a464bae28ecf1524eacb5228307fddc696ed01a8c4ac81
SSDEEP 192:sxZ7RAj7/fosOQZZNIN/AzodpAxA9HW6+WNj0M6/YbIw6YY+rIg5DI7WJ:sxZ7i7/fosOOZNcjtHbu/FXYYO2i
TLSH
T12852D815AD34A97B8CC7D219FA55BF53D3FD603290951E48AAFC8A1C04EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2f005cd06a6706408d0e700afdd86ad5426c66a8c5f42d417b216ea3435fecc6
MD5 2fe00214e505b92a58e3466b47d7496c
SHA1 8dfbf9f42a7a8f2ac9a8e3a82140cec57e9524c7
SHA512 4ebc83cb8c0fe548d0f0ac99bec46ebb8dc2fadc5412241a4b89e7ea72e80f8a4ba96bf1f01ae4cc04ba813f37a9b04de5af996ab7187347e08d2d1d9e2ae099
TLSH
T114E026F406CCC32EA658648751BC470CC3C0371F9AC8691E1F08C5847409A48A2C76B2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f74ba6428d8d8d5e35e40212cdbea3ab5e3bcd1e9c5e282fd4a80433b9baf29d
MD5 5a7ebe420e6a0f8aca0143b406b08b87
SHA1 998afe392e2a5f4b8e9239a4ad8462be89cf8873
SHA512 90dbea179a9285f607e024a666d49bf468444e368d50e7167374a79ffe533ed784597a57958ad7f7d0e323e037ccaf3095d010965cc544bb4c732ce4ff4ea9cd
TLSH
T1FE710986EE40440BFFA87FF1ACE0157739B845F051835E1602F8E4F57BA23F44185A85
MD5 SHA1 SHA512 TLSH

Submit Download

ad333b7b-1b99-425d-a2ae-38372d0f6298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ad333b7b-1b99-425d-a2ae-38372d0f6298.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8a3c46b1-5e0a-4aa1-a3ae-01e9eb5ccc51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a3c46b1-5e0a-4aa1-a3ae-01e9eb5ccc51.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d838b9a9-c68b-4bce-b26f-6339368043f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d838b9a9-c68b-4bce-b26f-6339368043f9.tmp
Size 2KB
SHA256 38a6131ed26d091409ef76d5ed8d2aaf3eb523983a30d507b66307fa4d8fd74a
MD5 164e3f41254b365351976a4f9c51c366
SHA1 d96828ee178a69917f9f2ca70bdf86928d79155a
SHA512 dc94d96d5b692a1aa99c31376fb042923013bb6588a36ef22277b1065c228f39e9b011af79de6bce6f9f5bdfe2f7e21c616d2abc0b72b369f088f0a02aa30079
TLSH
T19451DDF783F8863D8E01D6F0AB18AE1FCE2D0914432C7D5A88D4AE1B93E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

f199d12a-852d-4e39-b9a7-08741bc9f907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f199d12a-852d-4e39-b9a7-08741bc9f907.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 669476d31bae2e8369f61158e174496a279e7ff1b24595feb7e923d8695950bc
MD5 f442cbe63a3a18aa73a9b1ef57af483c
SHA1 b1b68e72e0b87a76b9f70c02cee50d1c549f7156
SHA512 c03201ffb305dbf601ef7350ab7235f67c533796b91ec56fc5a6766f78b1153f5c23c3aaf9f6b942e92be3c73d567151252cd096e6bea3aa8ca61aa5e349f824
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXal1P:OtfFvpopPxrB4RhfarP
TLSH
T10DB2661471BA021038FE791881B5876F064232B37159EA7B7FBD14A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4de3ea7-1940-4f06-9aef-72419cde6f8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4de3ea7-1940-4f06-9aef-72419cde6f8e.tmp
Size 32KB
SHA256 68d67d9c1fe02a97a9a68c4b98f52c1625382cfb3a296da65b91be28d5ea0f49
MD5 284605b00dd576f3c8e6f238fcb1d797
SHA1 eaa425bc66e081684fe12346558e0533218fed82
SHA512 93f06e1a7471951e37cd3697fc162e6de8d6e1b10d08dadbb3aa1605a70cd34811e66e6c2825604a764fcdd14593a210516662e56f683b7c9629a28e152b5e8e
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OViwLWLlMC7fnroU:0RyktjYEbvnWvDBltu1jaPwLWLywf0L4
TLSH
T1C9E2FA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e983034c-a3d1-4154-abbb-8efef7799bd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e983034c-a3d1-4154-abbb-8efef7799bd4.tmp
Size 12KB
SHA256 d46f14fc5413c99a84ab794394695d58bda1ce58204707a62c438a2ad592b2c5
MD5 8a2c599cee11eaa3c95bbfb26116f2f9
SHA1 91a078c19bf239665bf7a9b3867dd1f7886a58d3
SHA512 9405d7e3d3549e21050a2fe4c07906ffe75551bcd2696e37b3ce50b925c63740a9a095c810a1d8fe57b858953314b769d06ae698a3d6000a72695ba106656c9b
SSDEEP 192:sxZ7RAi7/foszQZZNIN/AzodpAxA9HW6+WNj0M6/YbI2FYY+rIgjsJ:sxZ7f7/foszOZNcjtHbu/FcYYOjQ
TLSH
T13242E815AD28697B8CC7D219FA55BF13E3F9603290D55E48AAFC8A1C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4ace97c-0724-412a-81cd-5eddffa10c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4ace97c-0724-412a-81cd-5eddffa10c3d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\manifest.json
Size 118B
SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
MD5 064a722d540bb9c42e4db8268426a4e1
SHA1 dbf4fe6aba40365a0646508d6f1f558d767e234a
SHA512 ce6a19905edea82b03cc4b70907393c2fd31e308c9d6e6dac649bdfbf44b04bf0ca2ffc8f0e354784258ef3d0b25bc72655302dca37897c36f0848bc9debe394
TLSH
T196B092B00C1AA03B22849320ECA066C283F80A19E8021B1E088036481F8817881366B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.153\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

c706da4a-7a04-4d31-b028-dfc7fc9b8d35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c706da4a-7a04-4d31-b028-dfc7fc9b8d35.tmp
Size 27KB
SHA256 0291a74b6c23035587cc15c31ce3ce26de111e3ac7772020769c705b4bb69227
MD5 c3b3bfd331d2b864a12014e2740a8df9
SHA1 0ece6726878c28ae22f7f62296f68092c6794665
SHA512 c51bd04273a2fffb643c27d80b6390bcbb801fa404d5c360e94ad39ec465d4a00558efc6e266a7909fae71aa5a82c93e0de4e46958ada0345a0a87779b83c7b4
SSDEEP 384:nEiFiZcIJXsNm8TUNTUlI4v5mgberK2fMBPOmJu/LQGgRVZh6DKhH4igL/7IzBoJ:fFQtTwgrFEBPLRfYGH4e6
TLSH
T1D0C26B32E8A8CDBBECEB8B95B74A3A47DEF05163859D8AC4D5C54D4C00872DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30d10632-4ecf-42ce-bd06-eba08b4880f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\30d10632-4ecf-42ce-bd06-eba08b4880f9.tmp
Size 2KB
SHA256 254fe2918b9258f377f6edd2f24e7c921a96e0f6dc13fbe8f37f802bfcb79b84
MD5 764e8828fb77c9d63c86bade61b7072d
SHA1 9875dae0a301f82eb5ad44fee81b44425a67f6c5
SHA512 1f6171bfa446fb341086efa50ab9a6e64ec7dc7799fb7a50161c9096b75cde2faf5cc837813febcd4d74a59e890f7c07fed45901342cbb6b22bde7786a511c38
TLSH
T17B411FE04C3D6AD1D4BD0E7EB49B35EC94EC9722B8A4347D7858E9988A7E51E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

34e5475e-ff6f-47e9-9d3c-d0b785750b20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\34e5475e-ff6f-47e9-9d3c-d0b785750b20.tmp
Size 2KB
SHA256 b3229618d27424ed589ea3279df1225cbe2ebef394ef28086836bb5531f8a5ee
MD5 4217f8fcfd0180c4ba6ec8024ebfd31f
SHA1 5553d6ad47cf0a46bf16d335bb6b4cddc4ea9d7c
SHA512 e8c3715a5eea14365b1f76a1b2b14dc44e1c795e47f99675ed118ea2c972d594129066d7a6ea1d7f7a5b3cbc96ddc936fb86318c3ea7d24eb3b600d157bd0852
TLSH
T170411FE05C385AD1D4BD0E7EB49B39FC94EC9721B8A4347D685CED988A7A61E204083F
MD5 SHA1 SHA512 TLSH

Submit Download

f4d50f1c-bfc8-4d35-94f7-afb4ec07f6ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f4d50f1c-bfc8-4d35-94f7-afb4ec07f6ad.tmp
Size 2KB
SHA256 9d58ff718bb7c8f523f73dd96a149e43a5f43661c49580c12e54b26fc91c0b9b
MD5 9f53b3bad9a3b130b6046906a48db1c9
SHA1 65c6ab83c3c190de86dcc5563952c7a04e1cf918
SHA512 5194ae8ceab83be3a90a8dc1c2b051f5e360b837021753992fea0c636657ade786ca914bf4969078b03a72029e6a9a4180a0603ebe951fc23de7c223f064940c
TLSH
T1BB410EE04C385AD1D1BD0E7EB09B39EC90EC9722B8E4347D6C59E9989A7A61D204083F
MD5 SHA1 SHA512 TLSH

Submit Download

e44a056d-88e6-4151-90ee-41636db16d62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e44a056d-88e6-4151-90ee-41636db16d62.tmp
Size 25KB
SHA256 d4007f7a2a2cf1e7e35b16e7a2b4c239e76d153ba17f211d4de3b7faa2ffad88
MD5 0265572a10948390d46576286fe8eb76
SHA1 958e4f4f387bd1ffce6e4b3967f5bbd21eb4605c
SHA512 894ea27569e8dd3f2b70a0b7c94dec516ddf9fe86f532ef8a07eab5bdb1ddedf1e12726ed46a1903cc37cf2e8dfcabebc6575ec2b0872a3c0e0afd21338bf3cc
SSDEEP 384:nmiFiZcI2sNm8TUNTUlI4r5mg0erK2fMBPOmJu/LQG2Rj3jgL/7Iz2oT:NFQ2TwgtWEBP7Rj3aw
TLSH
T1A0B24B31ECA4CDBBECEB8B95A74A3A43DEF45263899C8AC4D5D55D1C00972ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 f8246da9fa483f729b6d57f76d1e8a00bebbba852eee52ae8ed7bbd418bb9bf0
MD5 04cbda603d3885cad3cc3bcd1893de9b
SHA1 2946b31d5a70c80da131ea04e03d010e336a4088
SHA512 8475bf7855f47976d641d162055d67d9d5c29243a0be3ffec2c84a6bb3756127a67e4d7d1c591a1a3697a7d49c93cd9073b967368ca849c1ea015282d4f80b35
TLSH
T19241405CAAEA1008B3B77F56ABF2A96D587FBC772E0A914D00110D4E4A63B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d5ccf691ac455f4e86257af996e15337359200fb18c67381f1771fbb505c795a
MD5 affab13665a61c0e7c9707b1f350669b
SHA1 b1680a4f72eb0b6c1683c95987c690fc0b415107
SHA512 c23efde6102c6fab58485b922615eb01f0646de52d1a5fdbb0c34e4f5a50d270c01807f5076c5f6d90ec144ffbbc723a3d218215dae930908d63588bab0ddeeb
TLSH
T172412858BAF9115CB3B77F569BF268AE447ABD772F06845D20110E4E0A63B00C4B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres
Size 4KB
SHA256 3d332641ab4be7df09a3f5a9ae9c61005d18a2e0a78fda528ecf8d5c670ee9f6
MD5 93a45a66a89ee2d1629df5c94a437ec7
SHA1 dbfb332220062da34114563b849b1fda931af651
SHA512 2bd7e064996ca2ff0bd8094c8885982ddfe5713c021443cadcb001562d5cdb21fdabd290bf6eb270cd1a2534510e24aeddc5176da616cea5341b9b153b752184
SSDEEP 96:7YX6mYbZ9vzi9ZqXMcBov0iTlDqIEbrcDoRUml+2:7QOT7ckX1/ixW1rcD+USB
TLSH
T19B91DE6439EA1109B3737E566FF5A99E887FB9732B07945E10110F4F4A23A01CDA1B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3728-12-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-7-0x00007FFE140D0000-0x00007FFE140E0000-memory.dmp

Download

memory/3728-9-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-11-0x00007FFE11D20000-0x00007FFE11D30000-memory.dmp

Download

memory/3728-8-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-4-0x00007FFE140D0000-0x00007FFE140E0000-memory.dmp

Download

memory/3728-5-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-13-0x00007FFE11D20000-0x00007FFE11D30000-memory.dmp

Download

memory/3728-6-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-10-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-105-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-106-0x00007FFE540ED000-0x00007FFE540EE000-memory.dmp

Download

memory/3728-0-0x00007FFE140D0000-0x00007FFE140E0000-memory.dmp

Download

memory/3728-1-0x00007FFE540ED000-0x00007FFE540EE000-memory.dmp

Download

memory/3728-107-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download

memory/3728-3-0x00007FFE140D0000-0x00007FFE140E0000-memory.dmp

Download

memory/3728-2-0x00007FFE140D0000-0x00007FFE140E0000-memory.dmp

Download

memory/3728-108-0x00007FFE54050000-0x00007FFE54245000-memory.dmp

Download