c37e163fa76629c196460c7b4d54e95b1a46a4c66ab7b6f3311959c8137dc5f1

Analysis

max time kernel
118s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CheatPractice1.0.4.1/System.ValueTuple.xml
Size 142B
Sample261024-pxtprsbx9l
SHA256 c37e163fa76629c196460c7b4d54e95b1a46a4c66ab7b6f3311959c8137dc5f1
MD5 b6e60687ae5db6d011e21e6993620745
SHA1 b117c6bbddc72e7f4b590173992ee17bfdde4be1
SHA512 709212b6cb36f57b92a82def810f9c075a91b3e6a5fd330dcfb563d94a320783509441347d63bde97f530c6b10ce6aa769ca11f7fc39acf1b25d5c8f9dcbb389
TLSH
T141C09B0559D4E5155D3215172EB3F900FE15C75B14D11435745D0F036F354491367431
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_1902168546\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_107650594\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_1902168546\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_107650594\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_524721975\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3253990836"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31286259"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{F6E3A08C-58D3-433F-83E4-E4F18F3BA288}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5656	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3500	1400	MSOXMLED.EXE	81
PID 3500 wrote to memory of 5656	3500	iexplore.exe	83
PID 5656 wrote to memory of 2200	5656	msedge.exe	84
PID 5656 wrote to memory of 4536	5656	msedge.exe	85
PID 5656 wrote to memory of 2552	5656	msedge.exe	86
PID 5656 wrote to memory of 2552	5656	msedge.exe	86
PID 5656 wrote to memory of 2552	5656	msedge.exe	86
PID 5656 wrote to memory of 3080	5656	msedge.exe	87
PID 5656 wrote to memory of 3080	5656	msedge.exe	87
PID 5656 wrote to memory of 5252	5656	msedge.exe	89
PID 5656 wrote to memory of 5252	5656	msedge.exe	89
PID 5656 wrote to memory of 5252	5656	msedge.exe	89
PID 5656 wrote to memory of 2548	5656	msedge.exe	90
PID 5656 wrote to memory of 2548	5656	msedge.exe	90
PID 5656 wrote to memory of 2548	5656	msedge.exe	90
PID 5656 wrote to memory of 2416	5656	msedge.exe	93
PID 5656 wrote to memory of 5436	5656	msedge.exe	92
PID 5656 wrote to memory of 2416	5656	msedge.exe	93
PID 5656 wrote to memory of 5436	5656	msedge.exe	92
PID 5656 wrote to memory of 4484	5656	msedge.exe	94
PID 5656 wrote to memory of 5012	5656	msedge.exe	96
PID 4484 wrote to memory of 5156	4484	msedge.exe	97
PID 5656 wrote to memory of 4992	5656	msedge.exe	100
PID 5656 wrote to memory of 4944	5656	msedge.exe	101
PID 5656 wrote to memory of 5664	5656	msedge.exe	102
PID 5656 wrote to memory of 4888	5656	msedge.exe	103
PID 5656 wrote to memory of 4888	5656	msedge.exe	103
PID 5656 wrote to memory of 2444	5656	msedge.exe	104
PID 5656 wrote to memory of 2444	5656	msedge.exe	104
PID 5656 wrote to memory of 4780	5656	msedge.exe	105
PID 5656 wrote to memory of 4780	5656	msedge.exe	105
PID 5656 wrote to memory of 4808	5656	msedge.exe	108
PID 5656 wrote to memory of 4808	5656	msedge.exe	108
PID 5656 wrote to memory of 3220	5656	msedge.exe	109
PID 5656 wrote to memory of 3220	5656	msedge.exe	109

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CheatPractice1.0.4.1\System.ValueTuple.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CheatPractice1.0.4.1\System.ValueTuple.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/CheatPractice1.0.4.1/System.ValueTuple.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2b8,0x2f4,0x7ff8797dc188,0x7ff8797dc194,0x7ff8797dc1a0
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,4201369426146411754,12397645662396270139,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
      4⤵
      System Time Discovery
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,13772102371620974228,5894478501445645286,262144 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,11859499876400763643,3256821016778695725,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15279973915033504544,1768706773672231308,2097152 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3661628595061734718,7461097197697339636,2097152 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,2256499785261852179,13882815853587221104,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14650895844773109059,2173334198742417667,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7526296051514830071,15600151387985798389,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4734194226753178603,5463149525659298982,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4734194226753178603,5463149525659298982,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2595673324281380304,2441491554572754974,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8861098096353941957,16646071627538689644,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,18284824681393651578,13417714164816728727,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=732 /prefetch:14
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13223013931445865614,2133260871413405809,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,151121766012964317,11260971376066068097,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,12396272750907192826,3383765602800552525,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,3247273178309675914,7942248762961968643,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,6836812269107817257,12049819899394693578,524288 --field-trial-handle=2104,i,3318115561701514472,422664360908250762,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e0dd8a2-0480-401d-bbe5-105dc3bdcdb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e0dd8a2-0480-401d-bbe5-105dc3bdcdb8.tmp
Size 27KB
SHA256 bd157de07840dc09fca22c66d5ab8e7f4e54a34bee468a732a5ef309954b9ed7
MD5 815c5769e233df8f3e2312b873ad43ef
SHA1 69c33231cc65cd58ed76f4190684e36d4fcbdb13
SHA512 4d2a966c3fe6a3d8c37b1e76d2fc95ac8f7bcca0f07f4118bbee187d6a5e847ea99bcc81c731af1b78eb278f324befc11f210e3b43e195eb79147e3cfc842555
SSDEEP 384:nOiFjQkUSvC38NV8TUNTUlIRACC7wEELxzyfsBj94RpSUqv12IXgL/7Iz5IIl4:lFNC3ewg1CkxZVBWlI15hL6
TLSH
T157C24A36DC94DDA7D9EB8E95A71E7A83EEE00113D89C8AD8EAC55D1C00871DD230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

173304c8-6e11-433d-a1ea-d90263db2645.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\173304c8-6e11-433d-a1ea-d90263db2645.tmp
Size 27KB
SHA256 b523d6d8dfc8655f70847be0c7b8eba7d615cf996d5efe3ab3c535a57d8404db
MD5 3ba5651afb65358278e9450af22d60eb
SHA1 80ceaf728e726651d811d36c8d3ed472f378d7ec
SHA512 9387f34aa4b2f7e223f23d2b6fd5b3e4147e312ed3945e85851d8a452cd2546a8f25c1622947fe58a33db57a9b13b9ac86b0e8b9ca68aed687c04a9561318fdf
SSDEEP 384:nQiFjQkUSvz38NV8TUNTUlIRACC7wEELxzyfsBj94RpSUz/12IXgL/7Iz5IIl4:rFNz3ewg1CkxZVBWlj15hL6
TLSH
T101C24A35DC94DDA7D9EB8E95A71E7A83EEE00113D89C8AD8EAC95D1C00C71DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a385b5b-afc9-4ad2-804c-0bda86ef9de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a385b5b-afc9-4ad2-804c-0bda86ef9de7.tmp
Size 26KB
SHA256 9112e07df8ffa91e2fccf1d416b5af470f2ced6897866ea8565b0f411c631cd5
MD5 5300d3f834d93b44c6a08624ebb9237e
SHA1 47866b16edc9e2a3ad5d2735d61f1af799e60343
SHA512 39ebb00f420858385fdf79340631f3a2b910dfce7205c61ff2f645239d17678cf9784e9fd473e58f6fda5ad6ebc18cb718623a344b689a49f76393beaaeb9a9a
SSDEEP 384:nFiFzQkUSvY38NV8TUNTUlIRMCC7wKELxzyfsBj94RpSUyv12IXgL/7Iz5IIl4:MFdY3ewg1CkLZVBWlw15hL6
TLSH
T1FCC23A35D894DDA7DDEB9E95A70E7A83EEE01123D89C8AD8EAC55D1C00871DD230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8db84f0c-b05d-4b40-8fe0-871a580ea0ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8db84f0c-b05d-4b40-8fe0-871a580ea0ec.tmp
Size 26KB
SHA256 9cdf8fc6d4e80817810844d19eab2b3285388630f26e9b300eb862aa195e58a9
MD5 11a04015fd6e9105e80960ca2b9b52ba
SHA1 8c76556b269301d8e8d43d34d9b08571ea090983
SHA512 f9e2fea4e60d1e7111883cfa25e711b6419e6377923e0a5714c44b9cfe2a98cf98655b0ad52abeed26d1cf5c2877b415773c79ee237532bcfd8b68c5638734c6
SSDEEP 384:nfiFiZcI638Nh8TUNTUlIxBCC7tdoxzyfsBj94RpSUyv17O6R2FeokagL/7IzpoP:qFQ63uwgCCrSVBWlw17TR5s0
TLSH
T1E4C25B71DC94C9ABE9FB8FDAA70A7A43EEF00163949C85C4D9D85E2D008759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

0cb2fe08-b536-4fcc-b88d-28f69c29ba9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0cb2fe08-b536-4fcc-b88d-28f69c29ba9f.tmp
Size 12KB
SHA256 6adebe8f819404e5c23e44c2b658cd1942a9858a162368157aa9d08167a405dc
MD5 0a88ceb62c45a14add453eaede78d5cf
SHA1 2c306e269022c41c47bfab002258b34a6795a031
SHA512 6080fb28a8861122557c7ce41eec82e65df6c54022cd73f164ec118292ae332af9f75d13e101b42aed739e7d3988085b2579917d2d737ba9c81082f2e259b3ab
SSDEEP 192:sxZRRfck/fxsII1ZqMqO+/IZzodpEF/W6+WNGY0g7wS3uRfnIg5/eLJ:sxZRik/fxsF7q++/FI/bG5Qv4PJed
TLSH
T11842E755AD28A83B9CC7E619BB557F53E3FD103290801E48AAFCCA2C11EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1034086b-a4d1-40a4-9bf4-715a2f4e1e19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1034086b-a4d1-40a4-9bf4-715a2f4e1e19.tmp
Size 12KB
SHA256 93e5eec7fad0c8781268c6611ce63c6b623d42f43a84ae5891f8ac33fd10eadf
MD5 d46980ddb033e9aa02848ca982d8491a
SHA1 0c9687269482ebba53d81d4cb7f4db7d3210adeb
SHA512 ce730db44b0fffd2620e2fd5aa17b437af10dc9e2d6623386efd67fbafa1db09e8448bafb803007bbcafae2718a30ab882f1c4177249a9ce5480559b93884dad
SSDEEP 192:sxZRRfck/fxsHI1ZqMqO+/IZzodpEF/W6+WNGY0g7wl3uRfnIgjeLJ:sxZRik/fxso7q++/FI/bG5QA4Pjed
TLSH
T1B742E6556D28A83B9CC7E619BB557F53E3FD103290801E48AAFCCA2C11EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

208693eb-056c-40c6-a271-489a09205226.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\208693eb-056c-40c6-a271-489a09205226.tmp
Size 414B
SHA256 379b798e9b34c38fc199a61a298a97f39334da823c4813dc6f95270c3c6959dc
MD5 95f0fb989e605f6e2e8f081ef5260cf7
SHA1 fffd8e3a2aaffdeed2898f91424d9de9db8c84cb
SHA512 a02c6ba4bf6833e51cbc07bacc3807be1500799231aac03758b04ecd977266fd06eebbc5f465898b2c85b6489ac7c615ba99c8fadafaaa6a0a72f7122116c6c3
TLSH
T129E02BB9C822EC3B18F9171D7050074AEA5113572A50885B3A3CC1088FF263A8589C5C
MD5 SHA1 SHA512 TLSH

Submit Download

7dcc45ee-79aa-4f9c-88db-94433b1408a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7dcc45ee-79aa-4f9c-88db-94433b1408a9.tmp
Size 12KB
SHA256 68f4fed8b3bf04c673473ef285ba463e14a6e4300297f280dd7b7abead94eb66
MD5 9af1e982361977757cac6e644bb8eac6
SHA1 ba2a03821874a85946c218e027cfc1527e6e2388
SHA512 d123d9f27d1d0b79c8d14ae9fc961861644bb19594533ad3992be4149df21fbf0e36f736fada4d35f44d145d0e0602bb0fc05f0a79c33419304fe20a5a952f5a
SSDEEP 192:sxZRRfck/fxssI1ZqMqO+/IZzodpEF/W6+WNGY0g7RS3uRfnIg5x/NYJ:sxZRik/fxsZ7q++/FI/bG5Qe4PbN8
TLSH
T19852E755AE24A83B9CC7E619BB557F53E3FD503290801E48AAFCDA2C11EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a3c8792-ba85-4397-89c6-f54699eaba33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6a3c8792-ba85-4397-89c6-f54699eaba33.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

00a8924c-2628-4ab5-bda5-41509548fa29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00a8924c-2628-4ab5-bda5-41509548fa29.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

291f5c8d-1ffe-44f1-9a41-4d01ef839d2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\291f5c8d-1ffe-44f1-9a41-4d01ef839d2c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cd76ca7a-c839-4d89-9798-120e27e50f65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd76ca7a-c839-4d89-9798-120e27e50f65.tmp
Size 1KB
SHA256 1ef18a35b8b9e579d954a7e26b068eb9946b6d8573ff23dd3192285c74612d04
MD5 9d145c75f65f51f92262501132ee407a
SHA1 e1a1971b760194ae166a6e6c88ff0643578f033e
SHA512 c8cf9653dee3a39b8e94fede9872a6e82fb02ffd3a0611cd11db12beff5155aa9d1f37a80c19a31bb4adca003d95730213398c2ef1e19613627e5002ee17440a
TLSH
T15D417FF782E8856E890196F0A718BE2BCE1D0555432C7D9AC8E4AF2B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9834e7486cf6ac06bc141eaccf0d5a2517e37072990830eefbd6f5d957d4b9ee
MD5 5fb4723fd0b6a3af281c5635091d5bc0
SHA1 72985fca6ab24cc4d5d2d5a1f0de46ae0ce86522
SHA512 2feb8839129c8ba25646141960bd8edc08162d35bf948d807ed89a715217e76b1d460d561d1b32f0e0a22bd879023b4cc055832b663b2b2b02f02e1d2f0a2740
SSDEEP 384:oXNXznFfgFKVpIljflcpVzvL+vaxNRBJrO1V6z1pz:oXNXznFfgFKVpIljflcpVzvL+vaxNRBb
TLSH
T1E7B2451131BA12593CBE290890B59B2F528135B3715CE62B7FFD10A68E6BE481DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e123c7e0-7aff-4711-adb0-50deba4b52f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e123c7e0-7aff-4711-adb0-50deba4b52f4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fd91d398-0c99-4ecc-91e0-95050dfdb426.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd91d398-0c99-4ecc-91e0-95050dfdb426.tmp
Size 33KB
SHA256 55c708db90cd3b13af6845d115d0703236e8c4509e4d8985e01deef2406f77c6
MD5 f7ff410a7f221ebd3cef1e31435206b9
SHA1 3b18067f57414cc7b2552d95749845b8ec5e61a0
SHA512 0264208b0fd978cc4b06b4abc478ad24f76bc4d3848b0e8fb99b28f026c38bd835dcef3c8cf521eb4fd57c01728f12aeb932e316b10ef530a3ae236f8b78399e
SSDEEP 768:AvmgC8Ba2P67pLuLbdtWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32HRgLlI:AvmgC8Ba2PSEbdtWRmpbQPLu1jaK2HRn
TLSH
T144F20A7B680CCA7E4FC04E9DDD267F9A6DE802CB9A98C94047FA845C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

bded9d4c-ae84-48b3-97e8-64d26e65e90a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bded9d4c-ae84-48b3-97e8-64d26e65e90a.tmp
Size 27KB
SHA256 44cfbf9660dc713a15a37bff71520dfb48fde477d3dd0cec3dd5f857fcf73099
MD5 79cd8a1b7a7e52f46275401068eafcc0
SHA1 99bba3890515a420ca090f98707417f6de3ed39b
SHA512 a364dd0dd6f73c73a7865574eea7fc0c7c4fc056b4d07f5643a81663ab510a623887a93f391c8692ec71f727dfefcfb95b9a81b8882e872906669627c43e4821
SSDEEP 384:nFiFjQkUSvC38NV8TUNTUlIRACC7wEELxzyfsBj94RpSUqv12IXgL/7Iz5IIl4:MFNC3ewg1CkxZVBWlI15hL6
TLSH
T1C8C24A35DC95DDA7D9EB8E95A71E7A83EEE00123D89C8AD8EAC55D1C00871DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d91d1c4-cae7-4ead-9f7d-df62a1be5938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4d91d1c4-cae7-4ead-9f7d-df62a1be5938.tmp
Size 2KB
SHA256 48b3140f0219fb468efbe71fea879104b1e6219d59d157c18ae40ec1fd94e214
MD5 86f11f67029900961ec7c86a43152ff2
SHA1 959ab16f2a5a8bd5dc8ae790d898789b155116c6
SHA512 a1bd0a223c7fde58a7a9f527f5fb080553a36df8c3c24abe7591cc1a31b263556fa9c257099e6831537377d2c880662e30f51799ae575d1292f5d80b74b3566a
TLSH
T197511DD08C396AD5D1BD1E7EA49B35EC94E89312B4A038397868E998497E62D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

d7dad542-b1ca-4267-8fcd-bec6fb83a533.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d7dad542-b1ca-4267-8fcd-bec6fb83a533.tmp
Size 2KB
SHA256 13fb1c9ff17cea97761da0d7b76c21dd74477ecf9e0afa53caeb97bc6cdc8e40
MD5 eb55f455b1838dd6d8418f940743e762
SHA1 194845aa95620cdd021e15fefbf5e482e0277e75
SHA512 18630dcd0e21bacae1fbdd481306a67bccc50d4b052e71bf760f857daf034f9d1d71f2e03da8963164e5cfb6c4900ae37835362377ed7924431ec32efcacbd24
TLSH
T1FC511DE05C796AD1D1BD1E7EA49735FC94E89311B4A438393868ED584A7A61E308083F
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd366543-80c3-42e2-aca8-264caf47c13f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd366543-80c3-42e2-aca8-264caf47c13f.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f6ff6370-cda1-4e6b-8f15-f7d44d00cbdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6ff6370-cda1-4e6b-8f15-f7d44d00cbdb.tmp
Size 25KB
SHA256 debf8129aea27cd54c5261c299aeb179cfff1b05e3a10e612f67abf7c4f68f20
MD5 6f7c569711241c47f48fbeb06935f307
SHA1 4ddeab95d5639303d9c182908bdd6f880603eca5
SHA512 0ffe9e2f0c93124774b4921ea117db3299b227124a38ba359deb4d984e00ddcf238eef1b9a60e313caa5cc16f0b69aa7fca2d290684851242506b4feae710964
SSDEEP 384:nhiFiZcI638Nu8TUNTUlIxBCC7JPzcxzyfsBj94RpSUqQq7O6R2FeokagL/7Izp0:IFQ63lwgCC1zWVBWlrq7TR5s0
TLSH
T136C24A31DCA4C9ABE9FB8FD9AB0A7A03EEF00163949C99C4D9D85D2D008759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c241e8f6-07da-4bfa-a605-d81034a8567e.tmp

Path C:\Users\Admin\AppData\Local\Temp\c241e8f6-07da-4bfa-a605-d81034a8567e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5656_1715749302\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_107650594\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_1902168546\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5656_1902168546\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1400-4-0x00007FF898CE4000-0x00007FF898CE5000-memory.dmp

Download

memory/1400-9-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-1-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-7-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-0-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-3-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-6-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-8-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-11-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-10-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-5-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-12-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-13-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-15-0x00007FF898C40000-0x00007FF898E49000-memory.dmp

Download

memory/1400-2-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/1400-14-0x00007FF858CD0000-0x00007FF858CE0000-memory.dmp

Download

memory/5012-168-0x0000022F2B8E0000-0x0000022F2C8E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads