7ca86aed322bdea7c2bbc76cb6f16b67cf4bfbf5e45578a867b7313417b5be37

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
urn:aaid:sc:VA6C2:5d4d3a5f-1d41-4e96-91c0-9aacc361a0b5.html
Size 708KB
Sample260424-xrt3caav5n
SHA256 7ca86aed322bdea7c2bbc76cb6f16b67cf4bfbf5e45578a867b7313417b5be37
MD5 81ce9f56f7f676e0accdc2ab1a7f2ef6
SHA1 85c259188fb1c9c43b87718c2d6cbe71f0c6e3d3
SHA512 66d3d5510da89c82191d0ee58b66feff14af46e00b25ec25f9c4332eb7a78b1fd9cfb358e5c6989aa35f86d90380553e8abfe86499f47111e7e24d03841cff86
SSDEEP 6144:FTv/vpx3Aj36naiG4lP+e7txYyHTVzoMPsu93JbdrvNRUxDH:Bv/vpx3plBlP+exZVzoMPfRrvMxDH
TLSH
T1DFF4B4E6F4708C7229362C7DD5DA592D522899CA588843D7B28FDCF036C5BDACF1620B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215311821498207"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{A82C9751-2EC6-4519-9F4F-A9FF4CC30484}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4904	1176	msedge.exe	79
PID 1176 wrote to memory of 3068	1176	msedge.exe	80
PID 1176 wrote to memory of 2092	1176	msedge.exe	81
PID 1176 wrote to memory of 3068	1176	msedge.exe	80
PID 1176 wrote to memory of 3068	1176	msedge.exe	80
PID 1176 wrote to memory of 4524	1176	msedge.exe	82
PID 1176 wrote to memory of 4524	1176	msedge.exe	82
PID 1176 wrote to memory of 320	1176	msedge.exe	84
PID 1176 wrote to memory of 320	1176	msedge.exe	84
PID 1176 wrote to memory of 320	1176	msedge.exe	84
PID 1176 wrote to memory of 2208	1176	msedge.exe	85
PID 1176 wrote to memory of 2208	1176	msedge.exe	85
PID 1176 wrote to memory of 2208	1176	msedge.exe	85
PID 1176 wrote to memory of 3808	1176	msedge.exe	87
PID 1176 wrote to memory of 2784	1176	msedge.exe	88
PID 1176 wrote to memory of 3808	1176	msedge.exe	87
PID 1176 wrote to memory of 3808	1176	msedge.exe	87
PID 1176 wrote to memory of 2004	1176	msedge.exe	89
PID 1176 wrote to memory of 2784	1176	msedge.exe	88
PID 1176 wrote to memory of 2784	1176	msedge.exe	88
PID 1176 wrote to memory of 2004	1176	msedge.exe	89
PID 1176 wrote to memory of 2004	1176	msedge.exe	89
PID 1176 wrote to memory of 3440	1176	msedge.exe	90
PID 1176 wrote to memory of 3440	1176	msedge.exe	90
PID 1176 wrote to memory of 3440	1176	msedge.exe	90
PID 1176 wrote to memory of 128	1176	msedge.exe	91
PID 1176 wrote to memory of 128	1176	msedge.exe	91
PID 1176 wrote to memory of 992	1176	msedge.exe	93
PID 1176 wrote to memory of 992	1176	msedge.exe	93
PID 1176 wrote to memory of 992	1176	msedge.exe	93
PID 1176 wrote to memory of 840	1176	msedge.exe	94
PID 1176 wrote to memory of 4236	1176	msedge.exe	95
PID 1176 wrote to memory of 840	1176	msedge.exe	94
PID 1176 wrote to memory of 840	1176	msedge.exe	94
PID 1176 wrote to memory of 4236	1176	msedge.exe	95
PID 1176 wrote to memory of 484	1176	msedge.exe	96
PID 1176 wrote to memory of 484	1176	msedge.exe	96
PID 1176 wrote to memory of 1116	1176	msedge.exe	97
PID 1176 wrote to memory of 4956	1176	msedge.exe	99
PID 1176 wrote to memory of 1116	1176	msedge.exe	97
PID 1176 wrote to memory of 1116	1176	msedge.exe	97
PID 1176 wrote to memory of 2532	1176	msedge.exe	100
PID 1176 wrote to memory of 3772	1176	msedge.exe	101
PID 1176 wrote to memory of 3772	1176	msedge.exe	101
PID 1176 wrote to memory of 2748	1176	msedge.exe	102
PID 1176 wrote to memory of 2748	1176	msedge.exe	102
PID 2532 wrote to memory of 3408	2532	msedge.exe	103
PID 1176 wrote to memory of 4592	1176	msedge.exe	104
PID 1176 wrote to memory of 2040	1176	msedge.exe	105
PID 1176 wrote to memory of 4592	1176	msedge.exe	104
PID 1176 wrote to memory of 2040	1176	msedge.exe	105
PID 1176 wrote to memory of 2620	1176	msedge.exe	106
PID 1176 wrote to memory of 2620	1176	msedge.exe	106
PID 1176 wrote to memory of 660	1176	msedge.exe	107
PID 1176 wrote to memory of 4516	1176	msedge.exe	108
PID 1176 wrote to memory of 1292	1176	msedge.exe	109
PID 1176 wrote to memory of 4708	1176	msedge.exe	110
PID 1176 wrote to memory of 4708	1176	msedge.exe	110
PID 1176 wrote to memory of 4648	1176	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\urn_aaid_sc_VA6C2_5d4d3a5f-1d41-4e96-91c0-9aacc361a0b5.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffe8ce6c188,0x7ffe8ce6c194,0x7ffe8ce6c1a0
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1514837491208320171,18251187068087152570,262144 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,8354716883032100641,6257097823604745336,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,11846353543718843458,15678851760217489478,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:13
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11720180585208877078,17492391763324565152,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1887430236140283584,5087173301940497068,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,12119511958085921951,10064477120126430727,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,17977363893547153118,14846632162708458693,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,1220221976607760313,4060182997765105671,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4244,i,7008440801504355219,5993945551948992335,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,9395869895816647745,7928206971416247598,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3476,i,3472213736400663259,1647690731314471707,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4964,i,1375323449187375111,13170607606596173398,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,5730920291680711227,6572092820592959392,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,16593248689701003579,6195625442933204039,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6228,i,18157452672173016219,1297406862533275836,2097152 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,2991871086919353959,8573927736348219735,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,2991871086919353959,8573927736348219735,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,16749253334208980715,1037493523215715160,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,2854889381801544036,3165137487909243680,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,6098417982194147054,16626700917412603865,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,8382824030528260683,8054535389518926958,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,15543811324836198089,1898210560508788176,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,14680325829500571028,17661073454197692421,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,3544980629966555073,13984523398540541781,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,8056662325793061719,13153876181893512119,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,15464550339230206702,5721753913647058023,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6278639355358732479,1399660850103811578,524288 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3480,i,6901531346810216880,3152526506558001775,262144 --field-trial-handle=2248,i,11579077229810534033,1525965082483642246,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

8be90225-57a2-46f0-88b8-0a46412080ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8be90225-57a2-46f0-88b8-0a46412080ea.tmp
Size 13KB
SHA256 ddc9f34cf5474091a443e3050d22170fefa05f5b0effc87dfab81c2544eecda3
MD5 59779d3d6324fbe3621c05477127923f
SHA1 bf083f021c1c29ad1deb45a6ee345e2d84a05983
SHA512 4d291cee57e953f01e6fc87a5c52a8382876a185f14972bed8971a5dd09f7423340d76134557f67fad2f57daa6c89e714cec817c126fc091001464a4d96237a9
SSDEEP 192:sxZnRryM//K1Ml8MFm/fosDcjLaJlIdpyPW/W6+WNGvOZ0FNewIIg4J:sxZnNdm/fosDcjRf/bGFEc
TLSH
T11952F8166A34997BCCDBD219F941BF53D6F5157292940E48AEFCCA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2404a246808deeca4d0ca0feb5d79cbe45aa7cf25f16e99bbe88c2e53ce5470
MD5 fc327316bc6a1e1c876ec134ef7b312f
SHA1 fad6165e8956301e2673bffd4bcdb8bf1582d4d0
SHA512 e612597f69f77fd06b470e2f8f1bf190e6e4c90ec64b8adfa5b3a3f2b6cb234388f209871dc06795b3cfa407511cc8235f6f52de67427da5618fef02f24f68b1
TLSH
T1EB71F81DE0B187EAE7E817B84AE6D36132F54E4831872ECF06E4847D8D1EBA251BCC04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586de8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586de8.TMP
Size 3KB
SHA256 9e438e82e3b0e99dcc7d40ba8db73d0c19616b5efe1ef7645dd466d5e32d1466
MD5 25a86b95c44e3a0b51a16377ee6fd511
SHA1 30bc753b63b428270fdf23e350390a6979a83d14
SHA512 c917aca368d321cc7980e8d4fc0901bddc8ad11560855b053a68c89592502e9c8f6682c97f7332577aac374f16cf94c455713fe65c9f4a91543b5edf675f4a83
TLSH
T17671D61DE0B687DAEBE853B446E6D76132F24E4430872ECF06E4817D9D1EBA290BDC04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 411d674c8fe77e9ff7f1aacc215e6b4e89f5070159523caf0a3828c0593f1e4c
MD5 1e4cef84fb5a6a98b2255ddbaaca58bc
SHA1 e553f99a5f161e95da830f9d3c10c6a2e0d7e9c6
SHA512 6b17f34d4678147ce03bb68b84487ff171ec8fedb7507c87088f922f2b6d6ff4adb0f20ea55fb30283acd82d5a7303fb68698184b37a8bb834a42c5f02e5ea6a
SSDEEP 96:DFOcsFzBKdBakGZlEdg+R50wBsU1j6VDBRa3mBKl:DIcsF1KdBakGZlEdg+R50ks2j6VFRa3l
TLSH
T14AA17EF783B8862D8A1291F0AB18EE1FCE5D0515836CBD6AC9E05E5793E34B1E101B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d5dc1906de0bcf9dd30ca329b95c53cd1da3b4f6a0685457aa69a160ea8c5d9
MD5 f3dfd4c388ba075a67215543b0227fda
SHA1 fb5664c0523ac0cb79d3fc69ef51ace687fd4aca
SHA512 8eba419b6b5aac10bdb407aad5d3e4d0d8871852c15385a68834e8faf191fa55b99603950b63937604222f9db1afcd3a1daa704b3fb45bbc4ac52626dd120e53
SSDEEP 192:sxZnRryM//K1Ml8UQ1Fm/fosB0cJOLaJlIdpEPW/W6+WNGvOZ0FQuvIIg5sJ:sxZnNqTm/fosB0cJORp/bGFCa
TLSH
T1B2620A1AA634597BCCDBD219F981BF53D6F4147292540E48AEFCCA1C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 f53ae6a3e5eaa6d25dfdeac85664641449244dbdfb633c2562cdf2ca427906f7
MD5 b727ec10c20bb87b31a994bf0d78b55e
SHA1 e29f7a9e5443a4c35a5cb1b631c10e35600f5c69
SHA512 3e1ecfbcf38b516d6ad1ed60c5f0a05904c7c6809b69895fcdd951f48f783a05761e1f7a657a7fff8350a689243751f9ee7af3e524b5809dc133d24c8081fa47
SSDEEP 768:XuP7x8t12wX7pLuLno0WRmoMQpA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV39MizLln:XuP7x8t12wREno0WRmoMQpAu1jaK9Mid
TLSH
T14E030C3B680CCB7A4F804E9CDC26BE9A6DE801CF96A8895447FA484C03C67EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b005a679cda6758bcd43326c4b76f97d74bb808776f401cc52fb9d35f4aec4a8
MD5 fe824bdd5048bf055f7afb4d147b4f50
SHA1 0765b81788a9d5464598c392c4342b025a782df9
SHA512 302454e0e821b01a0944af86bceb4dcf34142e3b48f6fb8b0e4b59669935f4c5dd7c22090b8bacb8893e91af283d3529176d5b448ae2a5f7c3cebbd5bf7348ad
SSDEEP 96:K84YKhq+ub+KgUyuFuK2gRjWKUQWGpuKCoh4RWygU:y7xN1PVVA4RWygU
TLSH
T15BE1F151F17A53813A7D699A85E0B47E02C334633028A47B7BBA41A60F67E10CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bab22393-6ffa-4d09-9b89-100692d35c2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bab22393-6ffa-4d09-9b89-100692d35c2a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bc434973ec0d90ec5c1025f6a2438c804489bbf6700df88dd4a6cef57ce5511f
MD5 1e9ef6f967473ab971e1cd453baa08e0
SHA1 f3ed36923ef2edf5366885f56b47b826ed9e2314
SHA512 0c6b810b3df88a00c8a271688978ddce9c64bc3a4dbc4b8cdf2943aa638f384abbaae0537e742d219f60c4854ba395c19e195804e0dc13e41bfe509d61ffb75b
SSDEEP 384:nfiFtjccCs+Bt0S3m8N08TUNTUlIlUmckQQ0HqDfQP/Fk8cqJmTV5fPDOf31:qFtccQGRwgxcxpP/FkfumD61
TLSH
T110D2A3F598E3893BE9AE4B93A73D6E429EBCC05775985994BBC41D0CCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 679694c9d4489c7eadfc86e186b47db6b008274e29044453c686f68c6c074679
MD5 eac20562f4d92b83e0488b7b5646826c
SHA1 c49f6e55b6bffeda7a8109e73aaed005c764ba40
SHA512 bb8d31e548908f86636cfef37ecac76ab055d3bb64c5eb3f07dfe2b084e53e9af88455f3913a0a1cef6051e5d7d1ec8ac8608643dca170ae90def38f446653b8
SSDEEP 384:nfjccCs+Bt0S3d8N8BmckQQbHY/Fk88qJmTV5fPDOf31:rccQ9gcu4/FkpumD61
TLSH
T143826C3928B42D7B9AE38D25F48A7B035FB450ABA6E42F64DEC91F1D05C75DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 39e53e5e4afe51051a43d0b24feb4dd9618cac3efa98fb80fff22face9933d7f
MD5 f445f0b643acae46649ae88fb0ee3a6d
SHA1 fb786ce0e8d761411b76cb0917c876b32562d6a0
SHA512 a9ddb629d710d4f266f84e84f69dbb605fc9c9dd1591952ec5df975a2303f07ab85c66124cc4c403e6f9e6102cb993f1ffb758f0525badeef21d5cbf42008782
SSDEEP 384:nrjccCs+Bt0S3d8N8FmckQQbHY/Fk88qJmTV5fPDOf31:HccQ9ccu4/FkpumD61
TLSH
T18D826C3928B42D7B9AE38D25F48A7B035FB450ABA6E42F64DEC91F1D01C75DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0184f6c10b789bf4a229350fd7b1e8cd7020e5b79bcbfb7369002f43847bcd96
MD5 0a91dfe5d84878157d69f437dbf4a2bd
SHA1 f62fcecb96b1ba58d38150f2968588f5828b4f32
SHA512 7c8b80b24da5d615e926d8c926a962a8def99d8fc1912464792d8965d03aeef594fbad32a0aa064438e0b494e3faff566d569f603dc13f2a0e316793db421047
SSDEEP 192:ZGNG6Pt3QmiUyfcnqB/Fl8V3t7rmJC5U6:ZGNG6FZU8qB/FkV0C5U6
TLSH
T1DA020B3868B86C7B9EE39E55B487B7175FA4206BDAA45F94DAE41F1D00D768C2303823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eeeaf885f440ef7f7d1b856b5ad9f3dea5bc6475f93139ea97ed670c51ac1223
MD5 45d9d146b97fddf8dfded83d4a289115
SHA1 784a5630ecbf8255ce5d92ed9abfe1784026adcf
SHA512 2e8d31e3313e46dbd79ec77b47f82090c3fbc54192857035f3231b3d26146b81cceef6d0d0e91f52931ce751cea8716cacf2f5240e71470330026596d1b44afa
SSDEEP 192:DGNd6PtXQmiUyBnn1B/Fl8V38Pn4Gq2JU6:DGNd6F5sn1B/Fk8gqJU6
TLSH
T144121A3978787CBB9EE39D65B087B7135FA4106BDA945F94DAD81B1D00CB69C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5889dca26923daca15b09f0b504b388d90c5cbed9233f4ea28730f42733db617
MD5 98d8ff3b734ba774c0e099efafb1d425
SHA1 c95e3ca886b6cad3f61c9fae3fbdad92790bd956
SHA512 8beedc742394f7c4eda8cfe436085f4b1e78fc67ffd6034e69b894f5638e4786c83a97f9c8ec570b8695fd296e93009085b8e86b74d66d17fd5084e3adcb1299
SSDEEP 384:nEjccCs+Bt0S3d8N8UmckQQbHY/Fk88qJmTV5fPDOf31:SccQ9Pcu4/FkpumD61
TLSH
T11D826C3928B42D7B9AE38D25F48A77035FB050ABA6E42F64DED81F1E01C75DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a279170-5d53-4666-9242-530c83f0f534.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a279170-5d53-4666-9242-530c83f0f534.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bb327a67-1843-42f2-addd-70d22bc74cb6.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb327a67-1843-42f2-addd-70d22bc74cb6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d34f0c5c-5ecb-423d-abfa-9ac516db8e90.tmp

Path C:\Users\Admin\AppData\Local\Temp\d34f0c5c-5ecb-423d-abfa-9ac516db8e90.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54e18738-fa35-42ff-bbd9-c69a38eb6337.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1176_764760965\54e18738-fa35-42ff-bbd9-c69a38eb6337.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1176_764760965\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4956-585-0x000001308C800000-0x000001308CB78000-memory.dmp

Download

memory/4956-586-0x000001308C800000-0x000001308CB78000-memory.dmp

Download