1a60b62c774861c62ba2817b0bab22bde5288ee400539269bc8adfce71fbfacd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sioa.jnlp
Size 2KB
Sample261015-ppaa6ac16s
SHA256 1a60b62c774861c62ba2817b0bab22bde5288ee400539269bc8adfce71fbfacd
MD5 cf673e8aa934ef4160c9ec2d37e610de
SHA1 17fd98f315a8df2b3719dc02ff2a89138cea05b4
SHA512 d9844ab374e0cb1212f9c54bf60f2bd7a255e8539a41e3737d1b5a305c23113fdb4be5fe6999aae4740fbac3bfa8d6b7a1755b801add55f643127b04f7f43055
TLSH
T1D441ED67B8C599F625720345FBB2F408DB335528B06698EC8FFB15991C942CF07AA1C3
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
220	msedge.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_653301767\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_653301767\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_753445127\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_753445127\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{8CC72AC2-5D69-4592-B4A6-E0E8A4178E47}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4568	javaws.exe
4568	javaws.exe
4568	javaws.exe
4568	javaws.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
220	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4568	4524	jp2launcher.exe	85
PID 4568 wrote to memory of 4692	4568	javaws.exe	94
PID 4568 wrote to memory of 5888	4568	javaws.exe	98
PID 4568 wrote to memory of 5008	4568	javaws.exe	99
PID 4568 wrote to memory of 220	4568	javaws.exe	100
PID 220 wrote to memory of 5216	220	msedge.exe	101
PID 220 wrote to memory of 4712	220	msedge.exe	102
PID 220 wrote to memory of 5504	220	msedge.exe	103
PID 220 wrote to memory of 5504	220	msedge.exe	103
PID 220 wrote to memory of 5504	220	msedge.exe	103
PID 220 wrote to memory of 5860	220	msedge.exe	104
PID 220 wrote to memory of 5860	220	msedge.exe	104
PID 220 wrote to memory of 5788	220	msedge.exe	105
PID 220 wrote to memory of 3600	220	msedge.exe	106
PID 220 wrote to memory of 5788	220	msedge.exe	105
PID 220 wrote to memory of 5788	220	msedge.exe	105
PID 220 wrote to memory of 3600	220	msedge.exe	106
PID 220 wrote to memory of 3600	220	msedge.exe	106
PID 220 wrote to memory of 1476	220	msedge.exe	110
PID 220 wrote to memory of 1476	220	msedge.exe	110
PID 220 wrote to memory of 1476	220	msedge.exe	110
PID 220 wrote to memory of 972	220	msedge.exe	111
PID 220 wrote to memory of 972	220	msedge.exe	111
PID 220 wrote to memory of 972	220	msedge.exe	111
PID 220 wrote to memory of 4420	220	msedge.exe	112
PID 220 wrote to memory of 4420	220	msedge.exe	112
PID 220 wrote to memory of 3156	220	msedge.exe	113
PID 220 wrote to memory of 3156	220	msedge.exe	113
PID 220 wrote to memory of 928	220	msedge.exe	115
PID 220 wrote to memory of 672	220	msedge.exe	129
PID 220 wrote to memory of 2452	220	msedge.exe	130
PID 220 wrote to memory of 5872	220	msedge.exe	131
PID 220 wrote to memory of 4896	220	msedge.exe	132
PID 220 wrote to memory of 4896	220	msedge.exe	132
PID 220 wrote to memory of 624	220	msedge.exe	136
PID 220 wrote to memory of 624	220	msedge.exe	136
PID 220 wrote to memory of 4608	220	msedge.exe	137
PID 220 wrote to memory of 4608	220	msedge.exe	137
PID 220 wrote to memory of 3640	220	msedge.exe	138
PID 220 wrote to memory of 3640	220	msedge.exe	138
PID 220 wrote to memory of 4872	220	msedge.exe	139
PID 220 wrote to memory of 4872	220	msedge.exe	139
PID 220 wrote to memory of 4644	220	msedge.exe	145
PID 220 wrote to memory of 3184	220	msedge.exe	146
PID 220 wrote to memory of 3184	220	msedge.exe	146

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\sioa.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\sioa.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.381.2" "update"
    3⤵
    PID:4692
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.381.2" "1792067448"
    3⤵
    PID:5888
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.381.2" "false"
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com/inst-dl-redirect
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x310,0x7fff2f1cc188,0x7fff2f1cc194,0x7fff2f1cc1a0
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,552977354384270270,6771079833878774034,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      System Time Discovery
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,2253293515431868463,2093285226001378998,262144 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,5879289238780939757,16722758779913825193,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,4580239216969171706,11776341613789120625,2097152 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,4871370485633305070,1932792604676637335,2097152 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,12998451158203820566,10252588604817668975,2097152 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3528,i,16377060276680164348,165432240503191222,2097152 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,15998333156505504415,14462848992123083965,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,7243788861408211507,17585716872473734167,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11415282183838580986,7084250299169094453,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11415282183838580986,7084250299169094453,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9467633548488349722,13034792354115245674,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,15454859965099981815,18167261087497904515,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3139961489224526044,5526106802734457008,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,5909918462497294935,17591351062702546118,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15776533081199704345,11155485141154703354,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,2096826154570951596,12900726615271932689,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9877171386462227555,10040379872520768794,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,17298290680372098625,12744186394541751780,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3660,i,3837110377115121218,6768513598971306303,262144 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14832769147070788437,16339982887478243489,524288 --field-trial-handle=2304,i,5091394517608203501,16100551076762319154,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_etld1_domains.list
Size 6KB
SHA256 8babf90cf0c44b6e36537a8535a0e3d89e04001ae8b08a7fb50a51419c88a2e9
MD5 412aad0c01696dda21dfd839dc7ae2c7
SHA1 28a3a41d4d8dfee7fcda638c4373aeb2b384cad9
SHA512 944d8cb2340ba8fe3dfb84dcaf2b600f33f5e944e488be0bcade0787a73d3f6fa4255f005d230d74e0d8d13a7ccd4d3e2144626d6ea4ea3beb078f3cdcf71e31
SSDEEP 192:6D8dUysbBX9GyjW7xeU1ypJ5cz626OpqRiaFDBGUPJ:I8dUystXqsU16J5lvoEFlFB
TLSH
T1C7E1BFECF4C887F13BF43727C47F2A431A0EA119BD5A5229C91E6F00311D748182553D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_1868061453\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_653301767\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_753445127\data.txt
Size 152KB
SHA256 bf2c0a94df6f6a32ea1072e61ed3767c23fb8b3e864b0f6144f65c4b8e477338
MD5 6dd40551f20e2c6ad5dc991e60a7d4cb
SHA1 1147d32c228d4def80fb6415d1f58c1edad29055
SHA512 0d654ba49f9c53349b90cd2ce15424477b9c06ae3ae7bcfa09f61e12607f94750cc065d85458e985632f7c316e79d3b9ff279248fa1e6e4181f16e37ab31023c
SSDEEP 3072:GPAgDcCHaLHl65aynyosxb3+BLvf5yTewIjNq/eq:6X1aI5aZoKzMD4Ajy
TLSH
T19FE3F2608EC45F99CFE4292C90BF1F1A63E18BCD811A698EDB63FD066FA7A0415271D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_931161105\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e6d76d0cd147e5870e93b05e98946b4ce8831a08c75d71d80d19cd09e118fab9
MD5 5e168797fb147fd4d54c1e81fa894324
SHA1 b00150bd853b0b5254e4dcab703fe85eea93f250
SHA512 8b9fd03345fadbe632c410c99575963ac5826ce4a28deabd81f6ab051ab4b5dea5ed5412fda3bae4268a7b9d488e299febcddc3f478c8b885afc6e4d2f332381
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 ae904389c276db5036113cc0836ed1414c4c152d2bbe54ec34ee995b3219f90d
MD5 0b20575923e1b2b77e82f1b0f00feb97
SHA1 66f90ed325c3d5840654268c040779c1efaf55f3
SHA512 2f49cf34761af8c8d9a106a58f94b54d5ddd7eb6958c003a7a3d97e2922a4725f6bf956151e101c3bb1cf1ccf1dd1e632a80b14d9905c208362759a6b4177429
TLSH
T16011E582B82BA0706D513172E9CF43F63BB59B3C19E52175B1C058CEB870F3606A3C64
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 c87397db7e4a0de0ace9537c3007bdcfc53c2da754d5111743153704406d863c
MD5 0ce2ac57f6561207035088117071d3b8
SHA1 4a2bbb832bb587655f65476ae1c742d5b72e9fe6
SHA512 2866389d48460e66168a2df1378e3b766c6566513f1b63de17a272b61dbf2b8a10b8cce0cd775cb801f019f308e3d1645552169449b74e3fb50610ba42ec3986
TLSH
T17811CE82B86BA47068513172E9DF83F63BB59B7D09E52175B1C058CEB8A0F3646A3C64
MD5 SHA1 SHA512 TLSH

Submit Download

63d982ff-c8b6-4ec4-8662-9a6427e1e4ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63d982ff-c8b6-4ec4-8662-9a6427e1e4ee.tmp
Size 26KB
SHA256 f5a9f3a54f4af363234ff827f2ad48b54ffe184ca758db06aebf71d7676fac9c
MD5 60439ab51b614da45ea8322b4141b57f
SHA1 05373eb45d5d2f347af4518d54a663e6a0fdca9f
SHA512 9dd48af3bd3754f8b306ee06138d5b589576737cecc21035cbdb741bb3a43b9f8e3bb8a3546fae0cd980bfc3d2305d70bdf6497ed5ff3385102309a79232cd82
SSDEEP 384:nbiFzQkUSvXsNy8TUNTUlI4YaKMPnULuw2f0BChCAQPwuYkFMTp6gL/7IzCIIlx:2FdXHwgo5UHBChFQYbkFMTpDLX
TLSH
T121C26C32E899DEA7E9E74B95B35E3683DEE01163D88C5AD8D9C85D1C00872CE270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

00f5b788-5ae7-4001-be9b-8936ce5fe07c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00f5b788-5ae7-4001-be9b-8936ce5fe07c.tmp
Size 13KB
SHA256 7dd849a16d1a319742968aa49d78f165dc8daba3d6efbd073bca91f641523723
MD5 e8f51e23fd9a1033e8c53dcd1bfeb54d
SHA1 0f4f207cf038b1b7624ca9ec5d5b07279f3bfb34
SHA512 573377a94b1c717aaa655385ab0bd355545fbb40aea2fc818bb08b4c6548d41d7b8e592c60453945e76e51ed5f88a0baef4f2e1f588e42789fbf169e0945e611
SSDEEP 192:sxZLRPjI/f2sPQZLjs8yzodpKjHXu6+WNwLb/ISNwzyoVRxFSwxIg5fkWtqJ:sxZL5I/f2sPOPjJsHTY/CFSoztm
TLSH
T1A952FA55AD24697B4CD7D21AFB85BF63D3F95032A4810E88A6FCCA1C04E76DD620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d11dfd2-ae96-43f3-992d-b13a9897ffab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d11dfd2-ae96-43f3-992d-b13a9897ffab.tmp
Size 13KB
SHA256 9b871dcecfda056b4e5211b08c5febc0a7f4c85fdf0227a5db0aebc875492b59
MD5 65c78448187c6ac47b3dd44e91beb721
SHA1 0a32dfbbb900afdeb89a7b2014727cfe56f8b045
SHA512 47ddfd6b69743907cbd42559994e8c616f67562da604566c161f42129e478f49db54dc5a5325f28dcc0a4a2becbef4dee9e49596df0eb1029d60e8622009c87d
SSDEEP 192:sxZLRPjI/f2s2aQZLjs8yzodpKjHXu6+WNwLb/ISNwzyoqRxFSwxIgjt9J:sxZL5I/f2sPOPjJsHTY/PFSojtH
TLSH
T17E52E916AD24697B4CD7D21AFB45BF63E3F95032A4810E48AAFCCA2C14E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67aea509-7093-4600-8f15-a9c0a29aa6ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67aea509-7093-4600-8f15-a9c0a29aa6ae.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

70046b2c-bbb2-4b41-8211-a06ac8fa01c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70046b2c-bbb2-4b41-8211-a06ac8fa01c2.tmp
Size 414B
SHA256 42dcd9863347f77792e4653b626452a4d89ee0f3944f1a7de54f05058fa0bd38
MD5 d0156ce321a892b96e8ba9f9f3459df8
SHA1 c35207ab832a7b51d966e8463eea1c0912ef8fc3
SHA512 841433a5a3edc1dd54283ac9ada14476f56ffbb7a1e40de1ed8dd5015bac2add48f47aac68cb808f22acaf362fc7de78543d485f17efa6856c31046da84e2e63
TLSH
T106E02B6AC911EC3B09FE1B7964940745E70023672A41984F3B3D81088FB46365685C6C
MD5 SHA1 SHA512 TLSH

Submit Download

9a2bf6bc-dd72-4554-813b-9d24acd1b37d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a2bf6bc-dd72-4554-813b-9d24acd1b37d.tmp
Size 32KB
SHA256 9f6bb943d96cb16828a1e38678c0e838cf2c04dd3c2ef0097733f6545183e773
MD5 26b559f21c892147bcf4b58c348f175a
SHA1 ff497a4871868d458df0677ad992c6c2ef3ece41
SHA512 cae26c558b66783bd9e21a23eb920802de4d7edd28fdab83b212d546e27d9d9b5574e70712069889a14eebca6e951b8807430e769208f0b1dd5004005d5d54b8
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY1qpLlvVajYro4:Px6r8s2EbG+WviyUKu1jaN1qpLd4jjoZ
TLSH
T138E2E97B780CCE7E4FC04A9DDD1A7F8B6DA802CB9698C95087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3ebc2f1302fbdf04d5c1f0de56013cd386867bc2ce6ea4a2ff1baf8e1dfcd1fb
MD5 447fa71dacbd11b345a7ba32cb39b9b6
SHA1 22ab23570a54be2b32cb43f1ba1cf0d3dde82e9e
SHA512 e7e5cad1a33b586c17b304a2cd23c590c94d55dfd016afb79b1de617606c36961201abb687a10b24d7bc62a2d551fe295d3f39fac724f4c13e1cee0801c4ca24
TLSH
T133E0208905D5C35DF3046B8701ACA30C87843BAA96C4ED0E1704C9C470892506382A50
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 06f30b69babb17fc169c31ba77e4707701c9cfe9742b25bd5edfcb1e048aa680
MD5 65f52bc1198a44390bfa31a1a6d5611a
SHA1 730a869fec5cbd84e1c1e78b0b65835f44889246
SHA512 05d38109177ca578d90c8bce716c705e777b09290545269d489b3c9c7f4f152cfa32d27dcf5af3e88afafa8bd5f5c576c6c54a29f348065718a3a3a2166fc08b
TLSH
T130516C4195EC50A5FB6D157BACD02EB3B6344683FD934EBE0D97F3B858063D041902B4
MD5 SHA1 SHA512 TLSH

Submit Download

f371f384-1d67-4457-b40e-d7f93b315fc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f371f384-1d67-4457-b40e-d7f93b315fc1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5614c4da-e2c2-45a7-a5d4-97a7d857a12a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5614c4da-e2c2-45a7-a5d4-97a7d857a12a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

941cffeb-35a8-4caf-997a-0815fa7c46df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\941cffeb-35a8-4caf-997a-0815fa7c46df.tmp
Size 2KB
SHA256 14488fc656bc7845a870e5ee3440641c1a192957e932569719bf6726a387699a
MD5 251dc025a97a2141461c4b8e361741c3
SHA1 f70dc2785920b101058e0d435b78037d977fcb0d
SHA512 bca1622c15139f24fcd4e3585d75c3ba0db29017e0112ebd33f6ddc39d9bee5c4dc1dd5aa2e0947d9db0d39739f7f4f553b589382f3a12ebeb6798809c37f418
TLSH
T1A851AFF747B4866EDA1192F0AA186F2BDF1D0521431C7C9984E0AE2793F3470E181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

9b27b4f8-bcb5-4020-9002-2ea424fc42ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9b27b4f8-bcb5-4020-9002-2ea424fc42ad.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8569caa9712dff9540f2c4474beba70f5b33cf02679f88d48446fe86687bd992
MD5 a6c43c8fd7eb7efc7f1a272adf4450b0
SHA1 2113b0d81721318e056f4b5e1821ad365d523c6d
SHA512 424b63933f1c0f3a9a896819ede0800ebaa90cbdd801d89f5b120aacb21d26e052a05090147cee6e27f0e6bbe28f5b47d5ee91d2a3467dac998d98a8e309d6b4
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN38I5pvIhMoS66O:SL29ObJffppdNlrt8IrvIhMoS66O
TLSH
T149B2211571BB425039FE291891B69B2E064231B33119E67B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc88ad20-12d5-46a8-b44f-6e228d642d2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc88ad20-12d5-46a8-b44f-6e228d642d2c.tmp
Size 13KB
SHA256 da6b9327ab7c26670893ac5bd433ab22ef1c5990e42beb514f65d33ea3c22f28
MD5 c734bc685db9f83cefdf1a72ded014af
SHA1 213a63c7ea235463a00ab51303ab6c6f18ebad34
SHA512 094eff85b10858f9ba4338916b048371eeb0e314242c8993b49d3ff5c426a876d47cca8ef91d8dda0d33ceee835e3e96b26217344f45e3f6401747615eeaf25f
SSDEEP 192:sxZLRPjI/f2sQaQZLjs8yzodpKjHXu6+WNwLb/ISNwzyoqRxFSwxIg5Nt9J:sxZL5I/f2sJOPjJsHTY/PFSo3tH
TLSH
T19852EA55AD24697B4CD7D21AFB85BF63D3F95032A4910E48AAFCCA2C14E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.26\manifest.json
Size 53B
SHA256 e1cd8395b2a987ed86c356bfae0952ae09f0cb012030690d6e23615698478f77
MD5 231f4c6814bd04e1dff159c333e99a8f
SHA1 e7a5e431643eb7e17b88cd2bc6d76be5be95edf2
SHA512 10edf632be82534001690da65ece25b5c0882a44afd68b54ba078676f06cc19183c50e64b771f36b1d5a52ce2e885dc34ca4f4c049eb517770ee33c03ae06d21
TLSH
T1A29002600814921716C14E506570B882A391661955950D1D04455558029586CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 15a8cb7381afa84d728a124f2f5ddfd245f3a477a83da296469bea9de630b8dd
MD5 04ead7c4834006b36dbed2e43c8c9930
SHA1 0bf3ba3d5a4a061101a04a5379eb0cc259c7761d
SHA512 7f48b8e3b68311006cd8d6da6f52ce0cfdc9067600bb4c665d5bbae27427b37e4ed21b25f831f53c5c9289ae71b6d4d45286abb0de86bd58e513477474c1cdf5
SSDEEP 384:n/iFiZcI63sN38TUNTUlIm2aKMi04w2f0BChCAQP4XX7O6R2FeoZgL/7IzEoj:KFQ63WwgcnZBChFQwXX7TRrg
TLSH
T14DC25B32EC98DAABECFA4F9AA74E3A47EEF00163949C5AC4D9D81D1D008359D1707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.155\manifest.json
Size 177B
SHA256 77a882c1ca9977c89f8e67a15ec1854a8eb84e1e79bf7009808ae9eaf5193b65
MD5 b9662cf1a01e6a1e875d12cf69862abf
SHA1 8644cbd5900e21cf6422e12dcd8b12c203f32504
SHA512 840e37081ac9b9974a0c9c151d17c04544be2b70810a0a2d5baf30f0decfa927596df9282a8b9728f9588a6da051962b45b3198328c1df05bec31c2a7b9b0858
TLSH
T109C012EFDC509DB115EB4323156D43C4E733CF0B1546450935FB66082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

a79f2f6c-23c5-48ab-a455-f7cf56808a34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a79f2f6c-23c5-48ab-a455-f7cf56808a34.tmp
Size 31KB
SHA256 a298d4cb552c3dd28ca8e40960e9627d9d51893d27b3340f26b8496b049888ea
MD5 8b483d2561970fd69ebb1b7925345851
SHA1 731b76aa042ea421b30065f4fa102a6055b19f53
SHA512 c37bc632b3d540ffa8935379db48c366c8900e45b7e5a000868af3346bf864579062a81c02c9e6175663120e337dfeae6aa67fc1dc59c8efd2ad3a4109c8ebaf
SSDEEP 384:nkiFzQkUSvT0sNy8TUNTUlI4YaKMPnxpLuw2f0BChCAQPwuxsFMTp6gL/7IzCIIX:/FdIHwgo5xpHBChFQYksFMTpDLX
TLSH
T111E291F198D79977D8AE4B47A37D2E4299BCD163B4884A98F7C44D1CCC821BFD706806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c806c75d-0bad-4222-931d-e92f6b7a9782.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c806c75d-0bad-4222-931d-e92f6b7a9782.tmp
Size 26KB
SHA256 fb7dc9ae1b8ad6c8bcda429501d3e5e14ee3e029026d8bc543d918b211f4f44d
MD5 a93a469e5ca0384a33b32412f3fa1dba
SHA1 9aee6af6afd637bf781fa7a0fff6e2e6775921ab
SHA512 5180e8926d8e4b632c63e81bfd4c9c1e5142a8c71971cbb93e289b140a0df6a815eeefea5db2788d08f17a28685f2036b024c728012f4b6dd633d2c7e5dca763
SSDEEP 384:nfiFzQkUSvXsNy8TUNTUlI4YaKMPULuw2f0BChCAQPwuYkFMTp6gL/7IzCIIlx:qFdXHwgouHBChFQYbkFMTpDLX
TLSH
T17BC26C32E899DEA7E9E74B95B35E3683DEE01163D88C5AD8D9C95D1C00832CE270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44c61440-de4a-487d-81b7-b3dfd18b11d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\44c61440-de4a-487d-81b7-b3dfd18b11d1.tmp
Size 2KB
SHA256 718948e2480d298ffacee7928714283b879d477ca07a8dd58010c43b7f51de32
MD5 f2629f44f904309122414d0f98ea7374
SHA1 926e49bacae9a7de25aa236c163f7a14b0de4fcf
SHA512 7d55567e9a575a81bc02bab8d542929ea244382353016ceed8a7363ac0c22cb62777a7471c5598ec484ce6ff4a35fbdd26e043ee1ed10b0edcd765d1cf4eca61
TLSH
T19F511EE05C385AD1D1BD0E7EB49B35EC90EC8721B4A4387E3868ED984A7A61D708483F
MD5 SHA1 SHA512 TLSH

Submit Download

55079d2d-f68c-49c4-879c-762dda7cf8ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\55079d2d-f68c-49c4-879c-762dda7cf8ab.tmp
Size 2KB
SHA256 afa940dba154165541dd17593783cab9180a37a5e4c182148e436878a2f11f81
MD5 95f790db9c93f0a31845538cd81fb105
SHA1 7db175430b82ecdf2ad8464e7553fae864cc6342
SHA512 a3aa85c2741ecc86ccadcf9d1e4c9d92751bd1a86d29bc54170601754aec27e4e6e653a6b29a90089c6b492e670eafb4d631c3e4139af7d245522d5feda361d7
TLSH
T1FD510FD05C385AD1D1BD0E7EE49B35FC94DC8621B4A4387E2868ED98897AA1D7044C3F
MD5 SHA1 SHA512 TLSH

Submit Download

dc05f161-bc6f-48f4-8113-73d4d3d894b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dc05f161-bc6f-48f4-8113-73d4d3d894b4.tmp
Size 2KB
SHA256 20ba2e358e3c132c870e955be160aedd3194ca6317733c11995a9f47ede2c337
MD5 e6a1ca020e86e9319bae7d943801f621
SHA1 fe3f1029547c52fa937cd3bf95cefc0a909106b8
SHA512 9191717e2ff8f3f2d622ede4bec97a5a0eee2f6b11acb0dd2c17a264c1df600d67d5f9bdf4f86a5a6a6440ae1c0ad5afa776c88684245afcd2050b2acb9e4c51
TLSH
T156411BE058386AD1D0BD0E6EB49B35EC90EC8621B490387E7858ED988A7A61D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

e26eae86-b416-4f23-bfb5-d9c087acd5b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e26eae86-b416-4f23-bfb5-d9c087acd5b2.tmp
Size 26KB
SHA256 90a72a366e2142a95a7b21f5d45ccf3cfae55ef4628977cbbc30fddea4c69200
MD5 6d770f7557f3220f4af8df7ba4f0f3a6
SHA1 988bf022a575feb98da3f4133597bc53b45ca6c1
SHA512 a2e09f0d39030056da8436bc3e8f12624c9f8bea739d3a791b6d70fd817f2fdb2f7c4294afbc3700f796213431a0cece3afcfea4d35a42ee1f835a14bae69cc2
SSDEEP 384:nhiFiZcI63sN28TUNTUlIm2aKMhrzw2f0BChCAQPwuYkF7O6R2FeoZgL/7IzEoj:IFQ63XwgczGBChFQYJkF7TRrg
TLSH
T131C26B72E899CEA7F8EA8F99A74A3643DDF00163D88C9AC4D9D85D2D009369D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef82648856454378668559488845ac4c9df7bbf354d403aef64caa936f6b57dc
MD5 a3fb35393db800146e9ab1e618d64a95
SHA1 4bf890ddb6a7d286e23721104984485b0741ad08
SHA512 b5525a1751a4bab9f0ab22e04452eb59f0eb11cb8dbd07c245d3bb0f8d75adddd173d6c76e4cff576cf37fbab246ea5c17190a7a6f7d8510cc285384f950dea8
TLSH
T1B541295CA6FA1148B3B76F16ABF6686E587FBC232F07D49D10100E4E0622B40CD61B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4692-20-0x000002358C940000-0x000002358CBB0000-memory.dmp

Download

memory/4692-2-0x000002358C940000-0x000002358CBB0000-memory.dmp

Download

memory/4692-19-0x000002358B0C0000-0x000002358B0C1000-memory.dmp

Download

memory/5008-61-0x000001ACA7E30000-0x000001ACA7E31000-memory.dmp

Download

memory/5888-41-0x0000026FF0570000-0x0000026FF0571000-memory.dmp

Download