147b12adda76b0e3cef6bc4cdb6cb85dbfea785b6a2699caccaa4eb4cba0ae83

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Compiled Program/PharmacyIS.exe
Size 152KB
Sample261027-eellbsbs6m
SHA256 147b12adda76b0e3cef6bc4cdb6cb85dbfea785b6a2699caccaa4eb4cba0ae83
MD5 31375082ad4d4a1f98e72984bf5d45f3
SHA1 3de95bdc40ad4385e93a1b24337fb5b78093db10
SHA512 ed9590bea7d3e83a8b4de642b50ba7b022d9a300c59641cb63e22b5d7fca1a5f36589141b521d9253978b09100770fc67527b998c5090b2c5bd9a931b59d3bd2
SSDEEP 3072:x9G2U1qr+L6n2dIrOaWkwI1RcCtZKek7GVs58h:xMCgIrOa1bvDtR7
TLSH
T10EE33A07A6A850FEE1B7D679C9924941FB7238594BB1A6CF03504EB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
75	1228	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_1773062483\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_675526087\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_675526087\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_1773062483\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1824_345212785\_locales\fa\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{DEC20D54-D31B-4F87-B4C6-C41B1D893623}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 1824	5804	PharmacyIS.exe	91
PID 1824 wrote to memory of 4324	1824	msedge.exe	92
PID 1824 wrote to memory of 1228	1824	msedge.exe	94
PID 1824 wrote to memory of 2188	1824	msedge.exe	95
PID 1824 wrote to memory of 2188	1824	msedge.exe	95
PID 1824 wrote to memory of 2188	1824	msedge.exe	95
PID 1824 wrote to memory of 4672	1824	msedge.exe	97
PID 1824 wrote to memory of 4672	1824	msedge.exe	97
PID 1824 wrote to memory of 4012	1824	msedge.exe	98
PID 1824 wrote to memory of 4012	1824	msedge.exe	98
PID 1824 wrote to memory of 4012	1824	msedge.exe	98
PID 1824 wrote to memory of 4920	1824	msedge.exe	99
PID 1824 wrote to memory of 4920	1824	msedge.exe	99
PID 1824 wrote to memory of 4920	1824	msedge.exe	99
PID 1824 wrote to memory of 4396	1824	msedge.exe	102
PID 1824 wrote to memory of 4396	1824	msedge.exe	102
PID 1824 wrote to memory of 4396	1824	msedge.exe	102
PID 1824 wrote to memory of 3456	1824	msedge.exe	103
PID 1824 wrote to memory of 1340	1824	msedge.exe	104
PID 1824 wrote to memory of 3456	1824	msedge.exe	103
PID 1824 wrote to memory of 1340	1824	msedge.exe	104
PID 1824 wrote to memory of 1340	1824	msedge.exe	104
PID 1824 wrote to memory of 3792	1824	msedge.exe	105
PID 1824 wrote to memory of 2172	1824	msedge.exe	106
PID 1824 wrote to memory of 3792	1824	msedge.exe	105
PID 1824 wrote to memory of 2172	1824	msedge.exe	106
PID 1824 wrote to memory of 1216	1824	msedge.exe	109
PID 1824 wrote to memory of 5740	1824	msedge.exe	111
PID 1824 wrote to memory of 2432	1824	msedge.exe	116
PID 1824 wrote to memory of 2716	1824	msedge.exe	117
PID 1824 wrote to memory of 4996	1824	msedge.exe	118
PID 1824 wrote to memory of 5964	1824	msedge.exe	119
PID 1824 wrote to memory of 5964	1824	msedge.exe	119
PID 1824 wrote to memory of 3376	1824	msedge.exe	120
PID 1824 wrote to memory of 3376	1824	msedge.exe	120
PID 1824 wrote to memory of 3500	1824	msedge.exe	121
PID 1824 wrote to memory of 3500	1824	msedge.exe	121
PID 1824 wrote to memory of 5248	1824	msedge.exe	122
PID 1824 wrote to memory of 5248	1824	msedge.exe	122
PID 1824 wrote to memory of 5908	1824	msedge.exe	125
PID 1824 wrote to memory of 5908	1824	msedge.exe	125
PID 1824 wrote to memory of 1628	1824	msedge.exe	126
PID 1824 wrote to memory of 1628	1824	msedge.exe	126
PID 1824 wrote to memory of 4376	1824	msedge.exe	127
PID 1824 wrote to memory of 4376	1824	msedge.exe	127
PID 1824 wrote to memory of 4132	1824	msedge.exe	128
PID 1824 wrote to memory of 1576	1824	msedge.exe	129
PID 1824 wrote to memory of 1576	1824	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Compiled Program\PharmacyIS.exe
"C:\Users\Admin\AppData\Local\Temp\Compiled Program\PharmacyIS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff8adf7c188,0x7ff8adf7c194,0x7ff8adf7c1a0
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15159324470619812154,13702670122443535305,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,13151606285667711781,14428079721808136277,262144 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,131664274832942340,9201481480288377563,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,170716259618599716,2450195399565213841,2097152 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3686833406496476980,8897744257518946176,2097152 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,3552353063721333639,13712685439623495723,2097152 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,290299944904217498,3565328126458932900,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,559377382671982540,16487691837561585928,2097152 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,3374265729384308589,18399312843263741433,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,8742343954534514653,17320209561927951741,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,12721750722439021245,8863622438588020179,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,12721750722439021245,8863622438588020179,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,4681557453148512615,9150816432809614686,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10489697020818200605,10825272407021193047,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,4116395925173147730,14446391904175885402,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,9867570342668887047,8552085234397763593,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,7431270369137938127,10536016682058903644,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1776230221284745789,6497082483298641345,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,14096254994292749185,18163205661150675674,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,14199473581961663722,465204682889952207,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,3834970243776894629,4122193903271209885,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4526804343656990738,17647265693073473853,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,3828571912943892747,18130413022309279287,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6624,i,13138988440289886986,14946994862042584316,262144 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,14545179570519734042,498126061787161015,524288 --field-trial-handle=2284,i,2419723930713972785,11097933870768663969,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
    3⤵
    PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_1773062483\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_1773062483\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\deny_etld1_domains.list
Size 7KB
SHA256 1c999530d7fed6e4346d8cfb3933a044055544eea970efc00b114505b9cd3a86
MD5 f3249a6b4b36c4907803ec372e4d2b14
SHA1 c8ef9da8682dc8bba70ffebee0ab4d47fcd89136
SHA512 4b7860cf50fb58c32f136e578d284f9a66dc48c9335e2e45de323f8b1429ff70115032d5c7d0555f46db2ab349f8bfd8b9e24e60d9a867055518a5f4cd7ec360
SSDEEP 192:E9KyU8bqzeC/m4XqLWPgETdT/n+DEDYZHNnd:EQy8eC/m4pzpmDZZH5d
TLSH
T19FE1B0D537C7E2D2C03580B32203ABDEAA51BD40A78A3FE5FF461AC15F55AC7511E118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_217137902\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1824_675526087\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d5bc440-ff89-41fd-b718-770789a23bb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d5bc440-ff89-41fd-b718-770789a23bb7.tmp
Size 26KB
SHA256 fbc7580603e8433e13a2cfdf80b63be3d01ed66e73e95a0b6e917a74796e1e9d
MD5 a4c451c171c5d0d3c0ef863a9de82e67
SHA1 933f89a17bfed2281c4dacdaafc3206047391d64
SHA512 26c11d093141476ea22cf944b136d405810ca273098a19a6b68972e1af1970d1fc43bd740375bbf803bdfdfcd62c80e0f988542482ce483b881929fcb2ffce1d
SSDEEP 384:n+iFiZcI63sNF8TUNTUlIm2aKMS0ow2fLBCc8ibqRKQl/sqctiivsa+VYsTgL/7W:VFQ63cwgc5YBCcX8KQl/nzivhgNr
TLSH
T13AC24B32EC98DDABECEB4BD5A74A3613DEF411A3998C9AC4D9D81D1C00C719D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

397b34ae-7a58-457c-8133-54839aafeca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\397b34ae-7a58-457c-8133-54839aafeca1.tmp
Size 32KB
SHA256 6f9b8484d5f8c5b0c11a17840fb5493bc96bf5d6e774d23b7eb47236aa045c85
MD5 dc37067b0d688e86b2a80ef65063bb5e
SHA1 0f282772bd7dad28713952cdae36713607273bd5
SHA512 cea1ad40bc39148bd1ab956b8734674d1b76db634b5863bdc3865a680876d28f8b2f2ed222df4d2b2b5a300ff364bda16f9aebfa761e749d55334de818c3df8f
SSDEEP 384:nziFzQkUSvR53sN58TUNTUlI4waKMicLw2fLBCc8ibqRKQl/sqctCmvvaTZclgLl:eFdj3MwgIVBBCcX8KQl/n7mvvaTZcZLO
TLSH
T18AE29FF198D79977D9AE4B97A33D2E4299BCD153B8884A84F7C90C1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fd3bffa-8c5e-4592-ba9b-b80d1d290e4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fd3bffa-8c5e-4592-ba9b-b80d1d290e4b.tmp
Size 25KB
SHA256 9cc335b681fa61601f3d31f01924fce33e099f9a313169f85f606b530576181a
MD5 ba093f0e896d8811d735fc8876442cab
SHA1 91471cc9fa6663243c1815c4113accf3bf234d7d
SHA512 4fcef8a49d40ad900036ebb019a69b08c8de8649f6eeeba27e3c9774b1997a5f656a5e5404e2877119ecd51d8932cdc21d13201296ab1dad5ffce573cfaf6cc2
SSDEEP 384:n8iFiZcI63sNk8TUNTUlIm2aKMiq4w2fLBCc8ibqRKQl/XFasa+VYsTgL/7Iz3o4:nFQ635wgcPoBCcX8KQl/XFahgNr
TLSH
T1F9C25B32EC98DAABE8FB4FD6A74A7613DEF40263959C96C4CAD81D1C10D719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

1719f04f-5258-4080-a71c-1a704935148c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1719f04f-5258-4080-a71c-1a704935148c.tmp
Size 13KB
SHA256 3000e50d8978ff2ffde57e1db9812dbc031ae08cad7bfa15a658b10cdc982cc1
MD5 2041c40fc49187fb6e0e868f23126a9b
SHA1 5c2e50c4524e90f4ed5c453a81a2ca194811fc9d
SHA512 e54432ccff4747ce897913c028a29a6b9efbfea613667f327ab131b15be8bd6ef77f3e04aba33757290ffb51e73ca2c21e3bfd9f724dd3036d29ab803b37b674
SSDEEP 192:sxZSRMmF/fnsVQZLjT8/zodp6PHW6+WNr0i/YoD6kPSEkIg5veNtsJ:sxZSnF/fnsVOPYU0HbV/bSdoNtQ
TLSH
T11A52E755AD38A93B8CCBD319BB19BF53E3F9503290810E84AAFC8A1C14E76DD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a07f25a-0a30-445a-be0e-d63d75bb9096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a07f25a-0a30-445a-be0e-d63d75bb9096.tmp
Size 12KB
SHA256 df4be702d130ffeddd357e961848d78938cb09dcbfda5cafb71eca8f1255ee79
MD5 6a02852b9a88eb0f58353175e394a23d
SHA1 2847408f8ba95643d5afe733b1390a8fe22043ba
SHA512 e2934bda49274e722aa687a205f660c2bf47803f908ba3bdd9e8a718b810b7945f60bb32539377808d914522d2d2db81840f09e53c9f26fb75c6b4708b3d9f24
SSDEEP 192:sxZSRMzF/fnsFaQZLjT8/zodp6PHW6+WNr0i/YoMPSEkIgjtWJ:sxZSmF/fns4OPYU0HbV/wSdjti
TLSH
T15D42D755AD38A93B9CCBE219BB157F53E3F95033A4810E44AAFC8A1C14E76DD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36fbb2d4-5425-4aaf-bed0-cefe7ed5c118.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36fbb2d4-5425-4aaf-bed0-cefe7ed5c118.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6da46f84-66bd-4e0c-a030-5f85ca72b38b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6da46f84-66bd-4e0c-a030-5f85ca72b38b.tmp
Size 414B
SHA256 a590c747a580dcbaa18f4c8b97ad69585f3f83d9e3598a64a618677bed9bf1b0
MD5 567cdd4756ddf427bbe2a1d150f7df9a
SHA1 7f09bf956232ae959f21b6258432dc4e9cae1609
SHA512 cea1f2eb9a9858a2fd260e827ecf8cbcb3c4d24327638154d6121182fad43bb910c66519dc28b1758c61181f29fe865c4177db38263c961c8a80f325bca34a63
TLSH
T1E0E022AACD21EC3B08FD0B7C60940685FB05233B2B41988B3B3E90088FB0A3641C6D6C
MD5 SHA1 SHA512 TLSH

Submit Download

9d541811-088d-4328-904f-844c62fcafb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d541811-088d-4328-904f-844c62fcafb7.tmp
Size 32KB
SHA256 2de6945903a63f76423ce58c8f591c515e7010d5e7f40edcf2904f7cf7327f9b
MD5 228274938497b8e32d551131d02b040c
SHA1 c724750e70179f3df3b12066fc6001f0a4c4b561
SHA512 34a36c741b01bcba9e5469e448abede10f09ec6e1e547c06baa401e7bf1fd5d9515d870d7f1fd278b26fcf21d5b3fe2a70720b349672ed083d7c5b2f81124cbf
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP1qpLlvVajYroD:Px6r8s2EbG+WviyUKu1jau1qpLd4jjoK
TLSH
T10DE2F97B780CCE7E4FC04A9DDD1A7F8B6DA802CB9698C95087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f9078e7ca6cbe7b9116e182a504e90d0a33f685f52ba3ba9f7a62caea3e251bc
MD5 37dd398693ac4ed369a05951aa361c7f
SHA1 8d4d00f005eab22c02cc003544a5b8dbd77af427
SHA512 7b27752749ba300d3ca976cbd554ac6e0c396c842477d382defed831685cec5fa6d7b9424b877ff5c159e59d9a6b7d040af1b009da04c96616f077d9f454990c
TLSH
T165E07D8604E8C22FB288648B4178470CA3A2379BDBC06D9E5708CD8C78C7440FFE279D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2ce5e4613c107182fc37db415926939b66cc739880076971cfbc4c1a22ad10b3
MD5 d2ea8ccd9bd71c22c16488e0952b6003
SHA1 fa80547411f03ba976a42d8d13e67eeb1402b9a2
SHA512 e20947b45ee6799fb676501300bb56b51cca8018ba90d30a7f86ecf9fc9177f8716ffe47c71a35581190fc82f9f5317123be3dcd0e7ab3d1d2b44143d4df39ba
TLSH
T1C2E07DD904D9C26FA20C64874178430CD3AF3A1BDBD0699E5704CD8D7087440FFC2798
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 dc68136c60b35db7d5a35c6f2afad65f1d239a2f61e64925ce39eee1ee81b377
MD5 9b38b88b8366f0e133a43c076ff3b665
SHA1 bb5dc915f2d7e89eaeb26736c04d112496e8271b
SHA512 83a3a3e0c3e2443c33aa2111baf0fd0fdfa161fe7d5c8e5e62f56be42ded77ebd25475f55a179262eeae7d6988439b9d6016e07ff79b4f701c2716e0b33a89f4
TLSH
T14561C7449AACD352D7E9EFB08DE116C33634F67266A35E138BA8C5B85FA37497303048
MD5 SHA1 SHA512 TLSH

Submit Download

0fc63d3f-6b16-4d40-9b93-240e6784c991.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0fc63d3f-6b16-4d40-9b93-240e6784c991.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

444e0aa1-74f0-4404-a5fb-59dd4d9200fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\444e0aa1-74f0-4404-a5fb-59dd4d9200fd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

507d126d-9c5f-42f0-b724-0062f686ed08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\507d126d-9c5f-42f0-b724-0062f686ed08.tmp
Size 3KB
SHA256 8de879c5bbafc03997df5db2badd9e2eaa9b0b6d9ba33c5d0e1522c7e7e63300
MD5 e140c87c9c10a6b140a58f73ce4cf605
SHA1 690581edf4a923f6443e71fca480cf4ca93d97f3
SHA512 ab5fc660a91d22d15d17022fb98ae9d6fc0b41cf0d2a6a91d4ad2e6dfc19206a4527ab7e96fcf9b7de9f3f1d968f37a88b1d8b0455c7c8d716c1ce83f2c1a0aa
TLSH
T1B3619CF787B4856EDA0196F09A18EE2FDF2D0615431C7C6989D4EE27D3E3472E00269B
MD5 SHA1 SHA512 TLSH

Submit Download

f6a316a0-0320-4281-a6f6-e6b0451c9de2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6a316a0-0320-4281-a6f6-e6b0451c9de2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 6cabce43fe592dcce6bf6137067155a3aa7dc80471070146fe36da606607daa0
MD5 4d70594017e11eb729bbdf92fe2f1455
SHA1 911e43e5f1c3081ad163bdf3a568563aad29b813
SHA512 384516da6f96badcffec6ac6b0561cecdc17f37f3379eb418c0e6ac1719bdfc47d35e4015dd895ca371ee64d737e5663aff9dba346eb8cfcc3103e275ad7c31b
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgu:ST/2dXOJhJlpfnpp3tNXVrN3gT19HXx
TLSH
T1D5C2001571BB421039FE390892B5976E068231733119E66B7FBD40B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9b5bbb0-0552-45dd-b026-388ec79ad65c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9b5bbb0-0552-45dd-b026-388ec79ad65c.tmp
Size 12KB
SHA256 f71586e58253ba8bfda98a5dddedba3bfabff28dcc1b90c322a7a881839b88e9
MD5 ded9e0085b944c1c305d5688f95cb59f
SHA1 792e50240e675b35a9f5c5dc2ae5c1a46f289491
SHA512 8432767522bf3681ec9c6bfda225363b7fd8c5a70702e6af319eec46fbd779491d417b5c3fd104338370dec66af9f6d7085d501a1af972fe2b9242bada32cf3d
SSDEEP 192:sxZSRMmF/fnsoaQZLjT8/zodp6PHW6+WNr0i/Yox6kPSEkIg59tWJ:sxZSnF/fnshOPYU0HbV/9SdPti
TLSH
T19352E755AD38A93B9CCBD219BB157F53E3F95033A0811E44AAFC8A1C14E76DD620341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5aada2db9ce9b99afc85e461043e6f6f513a0334993d38f00547ebd058aaae86
MD5 49b9e17e4f1d944d75b5946ef8e528c1
SHA1 236b2fddb3461eba9de40ac46f024b056b5afe1c
SHA512 923d9d10e73fffed491cb23cefd1686ea7739a35a3e0458fd73becc87da1856de54edc5f64059aac7ba62dbd54de6317eddb4544b040e09400878d14c64813b9
SSDEEP 384:nciFzQkUSv13sN58TUNTUlI46aKMEyLw2fLBCc8ibqRKQl/sqctnivvaTZclgL/t:HFd13MwgUBBBCcX8KQl/nEivvaTZcZLO
TLSH
T140C25B32E899DDABEDEB4B95A30E3643DEE01263D98C8AD4D9D90D2C00C71DD274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.158\manifest.json
Size 177B
SHA256 976e13362933c4e9d37530c32a043728f47136ff030f249ade8210d4d1300df6
MD5 27f9a23b87cd0575e13bfd00ea13e3e1
SHA1 998b5c16a3c10772059819448dca88be1af7b84a
SHA512 3a1517e7d3f68d944fa540d52885c2e16d679358c8683997a407720cd6b4b194829017d07b451e58a78879e68cef66ac9e5a1cca3582034a70699709c6ad7f88
TLSH
T144C012DFDC509DB115EB4332156D43C4D733CF0B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

a717a2b4-2c4d-42d4-94ff-e898d44e9791.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a717a2b4-2c4d-42d4-94ff-e898d44e9791.tmp
Size 26KB
SHA256 c6f2144d910a1b83dc8944e361b3dc707fb5873ae858283b85aa921204096901
MD5 9acb84512a06ff24e75b96ab16f61bb8
SHA1 3e866f13e0c70c3c89ff5c5b369779e3f8b3fa2b
SHA512 f73dea2c41853a795430ebff8c7e472a988f5db0ad6156140d9a054324c3bc8bccad3278551dfec7a1cfdf2725057223613e4d4922f5b76f46c6545310d049fb
SSDEEP 384:nyiFzQkUSvY3sN58TUNTUlI4waKMiyLw2fLBCc8ibqRKQl/sqctnivvaTZclgL/t:5FdY3MwgI3BBCcX8KQl/nEivvaTZcZLO
TLSH
T19EC25B32E899DDA7EDEB4B95A30E3643EEE05263D98C4AD4D9D90D2C00C71DD274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

444ff816-f807-4962-b8de-f9244d074b5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\444ff816-f807-4962-b8de-f9244d074b5d.tmp
Size 2KB
SHA256 772dcf43b8091e2f5976a221e26447379b7b173bd07d54a6d5b2b7fa06041919
MD5 3aad83ca557983b2b4d674060da7b3c3
SHA1 03c4cded2d5a4710ecfe33bf83562192aa7001fa
SHA512 393af2b40b8a02c32c8f55306d6fa8921fe727a5519420b1b9f45c95ddf4a355fbd6801a005a43c7436a90a2ba1c99af23c689925e41f219a672d1b435c05812
TLSH
T1BF5121D04C3D5AD1D5BD0E7EB09B39EC91E8D661B490343A7858D99C497E61D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

7ec281b1-5f07-4bea-b609-252ef8d646ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7ec281b1-5f07-4bea-b609-252ef8d646ee.tmp
Size 2KB
SHA256 300a365f8a3216feb41574f17cbe53ed6cc6fec36e536687a20a0eb48e0916a7
MD5 31c3419806b41a8160fd0af8990c0f57
SHA1 6783095dc5fbf6e2551aa45da97b111978552387
SHA512 93eb7b7cfd7afb7e2f8258378bb390bcf96601c6c2c6efe38a3d70a185f628ea3c7f0a1a9afc42a2eaf44677e429870888a7054b8c8b196df834d8f93ad6e64e
TLSH
T167511ED04C3C5AD1D5BD0E7EB49B39EC90E8D661B490383A7858E9984A7E61D7184C3F
MD5 SHA1 SHA512 TLSH

Submit Download

b6e42f37-f67d-4eb7-a58f-6c7a8067ba31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b6e42f37-f67d-4eb7-a58f-6c7a8067ba31.tmp
Size 2KB
SHA256 5952982a8efe7dbe2e79a7bab9936874087d18400fa29d9c58ae4e008b68aabb
MD5 418b05271a24648e2ef3afa036685651
SHA1 e3ff351b9a8284d38d3d9eaaa67867cfccb63b21
SHA512 6921da1130855150d54a5f10f2ce38474dbd469bcc5a38a187302bf113e4be5cc47fd272f971b6e2e9863fb1e1aa91390c693fcbe1e046846d1d9e7409bd1688
TLSH
T10C51FEE0583C5AD1D4BD0E7EE49B39EC90EC8621B494387E7858ED985A7A61D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

04ac981f-9979-44b4-95db-2b1eed551a13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04ac981f-9979-44b4-95db-2b1eed551a13.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32439b2d49aa9bff7f0727717f91fd5b51168ba6a1fa201337cfed50d002af2d
MD5 08684fd429522dfa97985ec7ef96fde2
SHA1 32c7a6fa179bb8d2f730519decdbad86160ad287
SHA512 383f6ec98e872c52b0db2e8ae77498ffb915fe0be3479e09740cd7562970e4088ff96fafe6f3ea98dd3d9323830d55012a9bb0668f6550024a9aa95c447ddc64
TLSH
T1F1412D58A6F91148B3B37F4AAFF6B96D547EB9373E06D4AE00110E4E0622B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

9475ea7f-5de6-40d4-ba3a-e6efcf482970.tmp

Path C:\Users\Admin\AppData\Local\Temp\9475ea7f-5de6-40d4-ba3a-e6efcf482970.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1824_1208489249\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

8b7fba25-2f00-4bf0-8b15-ae79d6c32879.tmp

Path C:\Users\Admin\Downloads\8b7fba25-2f00-4bf0-8b15-ae79d6c32879.tmp
Size 15KB
SHA256 9c94544ab9f8872b74da6d857d2d965b768d57f246e5742074ed6fdf1017aaf3
MD5 61b0f84c34fbff35cd97943721683728
SHA1 f2bfba03df33a5405ed74676b746b1f063c47888
SHA512 c473c6e63667eb0f80e5cca7fc61bf44412c0a98c90415875986cea1e8c0e6899460c6b91eb84c3534f3c14382b847273d0f7f6d89114eca4c7fbd225dd8eda8
SSDEEP 384:sLDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:FMX7EounBj3VwZTFPb0f
TLSH
T14062F622B98995FBDBD20331CF2D393573A8823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download