873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

max time kernel
299s
max time network
291s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
06/05/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260506-qbppcsfx3q
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4568	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_425948327\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\offscreendocument_main.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_75987064\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_759001971\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4568_1766305713\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_725704309\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_540450102\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_540450102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_956956449\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_425948327\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_759001971\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_741023514\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4568_198870820\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2328	msedge.exe
4568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225463884282765"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{49C5DF42-F66A-4818-B2DE-25C47C979FF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4568	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4568	2680	Velocity.exe	80
PID 4568 wrote to memory of 4732	4568	msedge.exe	81
PID 4568 wrote to memory of 2328	4568	msedge.exe	82
PID 4568 wrote to memory of 5668	4568	msedge.exe	83
PID 4568 wrote to memory of 5668	4568	msedge.exe	83
PID 4568 wrote to memory of 5668	4568	msedge.exe	83
PID 4568 wrote to memory of 5956	4568	msedge.exe	84
PID 4568 wrote to memory of 5956	4568	msedge.exe	84
PID 4568 wrote to memory of 2640	4568	msedge.exe	86
PID 4568 wrote to memory of 2640	4568	msedge.exe	86
PID 4568 wrote to memory of 2640	4568	msedge.exe	86
PID 4568 wrote to memory of 1336	4568	msedge.exe	87
PID 4568 wrote to memory of 1336	4568	msedge.exe	87
PID 4568 wrote to memory of 1336	4568	msedge.exe	87
PID 4568 wrote to memory of 5252	4568	msedge.exe	90
PID 4568 wrote to memory of 5252	4568	msedge.exe	90
PID 4568 wrote to memory of 5252	4568	msedge.exe	90
PID 4568 wrote to memory of 700	4568	msedge.exe	93
PID 4568 wrote to memory of 700	4568	msedge.exe	93
PID 4568 wrote to memory of 5400	4568	msedge.exe	94
PID 4568 wrote to memory of 5400	4568	msedge.exe	94
PID 4568 wrote to memory of 60	4568	msedge.exe	97
PID 4568 wrote to memory of 1476	4568	msedge.exe	102
PID 4568 wrote to memory of 5044	4568	msedge.exe	103
PID 4568 wrote to memory of 3316	4568	msedge.exe	104
PID 4568 wrote to memory of 3200	4568	msedge.exe	105
PID 4568 wrote to memory of 3200	4568	msedge.exe	105
PID 4568 wrote to memory of 4816	4568	msedge.exe	106
PID 4568 wrote to memory of 4816	4568	msedge.exe	106
PID 4568 wrote to memory of 5508	4568	msedge.exe	112
PID 4568 wrote to memory of 5508	4568	msedge.exe	112
PID 4568 wrote to memory of 1628	4568	msedge.exe	114
PID 4568 wrote to memory of 1628	4568	msedge.exe	114
PID 4568 wrote to memory of 4628	4568	msedge.exe	115
PID 4568 wrote to memory of 4628	4568	msedge.exe	115
PID 4568 wrote to memory of 5636	4568	msedge.exe	116
PID 4568 wrote to memory of 5636	4568	msedge.exe	116
PID 4568 wrote to memory of 3440	4568	msedge.exe	117
PID 4568 wrote to memory of 1680	4568	msedge.exe	118
PID 4568 wrote to memory of 1680	4568	msedge.exe	118
PID 4568 wrote to memory of 1156	4568	msedge.exe	119
PID 4568 wrote to memory of 1156	4568	msedge.exe	119
PID 4568 wrote to memory of 5324	4568	msedge.exe	120
PID 4568 wrote to memory of 5324	4568	msedge.exe	120
PID 4568 wrote to memory of 1808	4568	msedge.exe	121
PID 4568 wrote to memory of 1808	4568	msedge.exe	121
PID 4568 wrote to memory of 3432	4568	msedge.exe	122
PID 4568 wrote to memory of 3432	4568	msedge.exe	122
PID 4568 wrote to memory of 4164	4568	msedge.exe	123
PID 4568 wrote to memory of 4164	4568	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Time Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffd1b97c188,0x7ffd1b97c194,0x7ffd1b97c1a0
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2930739453266574370,11588288630938703876,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,7694280091739312430,11189844065341288506,262144 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,15932237954224857762,14884356130615486223,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4477353750404562171,8443091145168489222,2097152 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10105937478921178512,17729117697161917409,2097152 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,1975810423113256294,7363750575777169120,2097152 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,11685775518949311656,1988172975848763821,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,14252091860877812548,13659556958975547518,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15545116459156479110,14277786016440219894,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15545116459156479110,14277786016440219894,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,11497149545687147137,12433558819803725766,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,1437832092841591705,2718703602046588370,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,544107256721900160,7798960007274737692,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9117165652399640560,15504859734513027834,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4072740334795834846,9022052183131870547,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,1753570956996317621,16311755181803668036,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,10171781869395475623,12143407101400709739,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16422492425677558032,13149773146963689488,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,16041352915067636210,1784832249796309179,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:8
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,5578789851097064632,12488673339639678870,262144 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,18136951206300452432,14205344084717993716,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,6251721032459807781,4942541502851588238,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,8931804905642172700,7699074639706032057,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,13027881221303441715,17401171390519937899,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17691532067703203349,6781477228159060320,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9789129428588017564,645317214461108770,524288 --field-trial-handle=2328,i,17421087671723136745,3545818464506145375,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3bdd57139d99fb171187e241d0c03cde224f9c176dac9c20c60f28f29e64d27d
MD5 45635e74a1cb997ad7b0c65562e1854b
SHA1 410a8995e5f0ab9af3d7133e347ff08392ea8653
SHA512 239eff3e5a6810ecf550fe74b8292209366c145d90efbf4293b3f4e3842c2b505baa3cc749e27b80454fe4c792925cdb299145af908b40e927282f7899be7372
TLSH
T1DBD0803C52B57C74C86EE57424157B0B7519D87756535F15187315FC0C4314015974EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61c9f908475582ec0a8eb3b5cf00399511c5e42d8f5f9e1bd10dee6c3382278
MD5 00930effb53150b1c15782f203b6b229
SHA1 f2d3a801df3b68ee8a225ab8aebfafbc557fe47c
SHA512 baf5ecdc128b0737fee0d6a21544bc1de0f07159bd0b831936ace2f6b71df216792cbd6f9346d50bcb17ca955a247d1d414d019e9f3233553a84f8ae7ace1c7f
TLSH
T138D0C03812B13C34C85EE47024043B0B3619C47306534F1418B314FC0C4314008970EB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 43a8d87688e3c03b278b09b395cbe310c1852d37a6ce9ba301e3b0ba4f413946
MD5 1e8cbe21246070acf30c40dc8959bc2d
SHA1 57837eb63ab0b1dcd6ed165a17aa79aa6dda2cce
SHA512 1010602576dcf5275a15cf8f462340c2aaea3921e541e3b96519b61213e790e9e638749b09f1dac86c2119a99022bcf3392358fa6d6347518c93186b86985321
TLSH
T101E02BE6C820ED3B18FD5B18A050074AEB01030B3E518C0F3A3D81088FB92360985D5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c89732e2213700500a62cb7e982b34f49a22dba9d4e27e81904f28d803f2f1f
MD5 9051bd567f76e87c2c53d21f959dd9b6
SHA1 59b14f2d4c09615e3380601e2f39831c9c76136c
SHA512 2decb160a3495464de5cf12cbfe30785a2007985d95a2900d140f37180f360444b96c9bd258df7a535beb26fed8b2d97628dab878785b19eb40da0cda1715359
TLSH
T16B416CF3C3E4856E8A1156F0AB287E2FCE2D0614432C7D5A89E4AF1BD3E3471E14195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c8ffe5f7f3b0b64210c6ab12a105f7181454805f9cde06a56c8a1ea87a66ee92
MD5 9272b6d5f4c5e637727b04e716b15e4a
SHA1 c213e6aa5f8b84d5ff3708ef937a27d5ff47311f
SHA512 1f90a730e9f51248ad3f059311ac7739f87238f3c5262513a4b29b43db8a3ff781858de52fe8220c496c433ff1d36047a634ce8e8d52b366b14ee6b329aae03d
SSDEEP 192:sxZgRsyMqZ/K1Ml8UQ24gz/f7sA1gNxii1gzodp66HW6+WNrSp/Y3fOwxkIg5dtN:sxZgRq+z/f7sA12Yi1D5HbA/ftN
TLSH
T14272F956AB38997BCCD7D618F6457F93DAF9416391900E44A9FCCE0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06108e0f1afbacda94af08531fe170b6f0c32f8ebd18adfa04ab942177d7a59e
MD5 78582ec94e321efdb80b74cac2391a3d
SHA1 e17d372262033ce6da43626339a7215b6a7638a8
SHA512 108f483c13f7cc1eb96ac11b610ec64c5c202faa19afdbfa6a20ddc3178b7d3dcea61973947772fcb3356b7b5a404111f2ccee3a6f6b80d7c78e222f7bfa0787
SSDEEP 192:sxZgRsyMqZ/K1Ml8Mgz/f7st1oxii1gzodp66HW6+WNrSp/Y3yOHxkIgjuJ:sxZgRIz/f7st1oYi1D5HbA/Pj6
TLSH
T113721B466B38A97BCCDBD218F6457F93D6F5416391904E44A9FCCE0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8df52ca22a6e7d9c1e5c8d81975986b3c458eaf99f9c97ff5ad81d08fb2cf049
MD5 c0955f877d57a9c0490e072954cba727
SHA1 27a0b69111622a78b1a8fdd949bdfdf1bb36dd28
SHA512 18f6d481fcc7d61c9522b4e6a06984120227a8e273cd0a36985346ad9914768809382e12d9f88f310994e1547a0a7d717cdf61eade351fa5ecb7adfb95659f84
SSDEEP 768:FAsxA8P7pLuL/tpWvIMLA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKn4zLlusg5qroB:FAsxA8JE/tpWvIMLAu1jafn4zLUx5BKG
TLSH
T177F21B7B6C0CCB7E4F804E9CDD2ABE8A6DE802CB56D8895447FA940C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 f9e0e4b6ea9f77242b26cbe9929b119ec6e619da82e6beb9309f8d449b7c4504
MD5 759c837dde6314b2bf53bd2f35ac3607
SHA1 1356efe57cce95006f7e59342b0ffe1cde3a9de3
SHA512 a9a50497448cbfd5159a311045ddb0e4eb71a44dd383a3622ab9cd5ed73afbd2a9f2596544aa4a0e8f4595b2c921c14ba0fc70d84fe0ca2afeb5a864b6934192
SSDEEP 384:cnF65VzPbMf4xNR5BbslV4jFC8VOaUWWpC/WSY8B0Hs0XiXN2B+7lI3MoemWZmdV:cOhfN2B+7vnPtk3TJj
TLSH
T184A25C3471BEC2153A7D3AC89199BC26434230A23458F57B7FE940A60F67E181DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 15b92f6517c08f317a35dbc71e354c6207267bdf144da7e36766ab4752e946d8
MD5 4533091d82c601c748a31438e383ff43
SHA1 6e28afcaa879ab41a0f31a3883fbfafd2a8f2595
SHA512 7efbb3d8d2218df5bb2474e9a20fcbbb83d47d8cee528df14b0f3a8153bd874064bad7781475838e52e02a38edd09c0591b6eb9c7d64510ea99d730ee1c4c375
SSDEEP 384:nMiFrcXqn43sNY8TUNTUlI4kBgEq1/IMa9rfzYDlshVhvS2EuYZoUxcWbLNPk+5A:3Fz43vwgNgJCYDlgVBS2EZ/x3o
TLSH
T14CC25B75E8A8DE6BECEA4BC9F34A3A53AEE011A3898C4ED4D9D85D1C00875DD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cfd6ccd2d797d80e2952579aa41a401082a7ecd3b30f25621100407d3e12295f
MD5 e076a4e4658d49c4315e8f1b239a71a0
SHA1 e2800ead1c0a82beb664ee46306c59928576bd9f
SHA512 a14f4481027a171859c5c503d2f3e8922e0620bc7138f0f3486da4eeb6063b698a4d014e54eeca85975a8d5618d95929463a4567e2282f6bd773b87cf90a01f9
SSDEEP 384:nLiFavqMg3sN98TUNTUlImkrq1/IWd9rfzYDlshVhvScPkX+VWi94hQRPLNPk+5V:mFayv32wgoTYDlgVBScPMy4uRBN
TLSH
T1BFC25C35EC98DAA7EDE68FD9E74A7B13DEF001A3958C4AD4D9D81D0D109B19E130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d0071322c52078b05039877a8bc42d7096b55381d6f69c681f35d4e15ab31ae6
MD5 bfd04dfafc9c8b236470f9a209bcb201
SHA1 43f106a5282fd65b66e7070a8a2eebbac887e76c
SHA512 7789d25cc45df9ce221b88eb8f73ac179fa4b4367ee7e3b66a42f26ceda81c3e52a0529e0aed1f08882435d8a04c12c3b2f4c1a8a3dca9532024ca837c16e53b
SSDEEP 384:nOiFavqMb3sNY8TUNTUlI4kBpKq1/FMa9rfzYDlshVhvS2EuYZoUJn10LNPk+5vn:lFayg3vwgNp0CYDlgVBS2EZ/J1qX
TLSH
T1F7C23971D868DE67ECEA9FD9A74A3A53EEE011A3898C4ED4D5D85E0D008B19E130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7d5cd76ea50a17d9b6fd065f64a5aad28a0e15942de7a0e304eb803853726357
MD5 3a63381ede1258616f4644594f7149a0
SHA1 681d073040dd4faf3cb6fc6633f35e244f2e41aa
SHA512 6e7ef1defdfa70d4a62925c3d0ec433f6039f350da2be2600cb4045cdc3f74779dc884865eb56cd9182bdf1683cb30f9e52b8a05a02f9e3db4cfa543fb8dea1e
SSDEEP 384:nNiFavqMg3sNc8TUNTUlImkrq1/9479rfzYDlshVhvS2EuY+oUkX+VWi94hQRPLP:EFayv3/wgRRYDlgVBS2E+/My4uRBN
TLSH
T147C25B71D898DAA7ECEA9FD9E74A3A13EEE001A3858C4FD4D9D85D0D109B19E170FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 dfe9871781c4ca16ecc1c06503e2235ab1b6f8f7e06f769803b14347914cf708
MD5 c8b58fbcddeb239951340e93f5164dbe
SHA1 c79befdf06763a822d031aabb46142b4c2b299e1
SHA512 f1894ca2efba0868e97fb55c8aeafb6ff5261f7a85d3799066ff36963780a0057f66af8da3a3d73842ca1d494811b8c8431ddb0b06edfad9e2958462b499ef56
SSDEEP 384:nbiFrcXqnO3sNY8TUNTUlI4kBgEq1/IVa9rfzYDlshVhvS2EuY7oUxcWbLNPk+5A:2FzO3vwgNgQCYDlgVBS2E7/x3o
TLSH
T188E2B2F198D7897AE8DE4B87A37D2E429EFCC163B5884A84B7844D1CCC461BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a56fb8b9f075bf8b800d6ab6ea9ea61a71cde6585ab531d688fcf4b3043fbda5
MD5 a534ad850302c576c8107935aa65407d
SHA1 a72060bb2d879bc332a7372abe2546e5b22b7069
SHA512 888a7489b6e31994d02d2019fe462de2646d901d1577aa0680a4756d5a92e71d1d02c63db10f6b3f8a3ae77735be5bded4b1e49762fb373250913dff88d27485
SSDEEP 384:nOiFrcXqn43sNY8TUNTUlI4kBgEq1/IMa9rfzYDlshVhvS2EuYZoUxcWbLNPk+5A:lFz43vwgNgJCYDlgVBS2EZ/x3o
TLSH
T1DEC24B75E8A8DE6BECEB4BC9F34A3A53AEE011A3898C4ED4D9D85D1C008759D170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 39e3eae3712cf27181c359527687103b3cfa55b4a1be886ac0e772beefe89ed0
MD5 d3c543c2f31820c52241622a859d6ec6
SHA1 716809391aaf63d4b5ae6fc0e90fa77d0c211305
SHA512 ff1bffdb2966d2a6cac050dbd3775373c2722d60816cef560e006008cd1dc8c4841d69bd0cb85a01ed4a234a253adf901796e63eb51f21260f2c121cb61d86d6
TLSH
T123416FE04C3C2AD1D0BD0A7E708B34FC82DCC726F4A0347D6C58EA990ABA25D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 43b2da1c5174b3b155b6ff3942753d197183c7c30fa090af80e04ea9115b8172
MD5 7f8651d0c39434de8dfb353f45c63abd
SHA1 beba32b7a80175d5be24bed6cd1608c67048e7e0
SHA512 dc13ba94bb89e48a2d14aafdc7752f48e221849a97a1cbc0d5da6eb6ed670211d3b5ca60ce19377df710c91601c712a36a9881f0f2278cac0f2a7aa3e392bf6c
TLSH
T14A4141E04C3D26D1E0BD1A2FB05B74FC85DCC626F964353E6818EE88467A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 54506c49ce53d917b8273c62d2188d62c9412bf926883c9032fda2013c3d6c5c
MD5 761394715b79e14f0e55d2267036ec73
SHA1 b2edc67eeead8ca498fac0f7412c771a49ae4965
SHA512 e06ed51ef03a7f50580865441b65089f69b759cde69bc68c4fdc1e0b44f5ee7b8ac6c5506e61e791e52b2695ecb327ff35bdcb5501cea88c935636cbe61ca6c8
TLSH
T186413CE08C382AD1D0BD0A6FB08B34EC85ECD726F494343D6C58EA984A7A64D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aae92d68dfda303ff90ff9c88131bc6689f64408336bd31e6cd8b7ea34bfa1a9
MD5 e5faced8a0d5a453c927c32fb125199e
SHA1 23db5aa85754df6308db92969d6ec7c575939976
SHA512 d0f19f5999b040a9dc3e4262ea7af144f3e68e4f44724b435dd01f26db1e8c577ebbc9e0c125144d58662e5639a3363938ccadd12acb2e063d42a3b9efc0dd9a
TLSH
T1CA4172E04C3D2AD1D0BD1A3FB08B74FC85DCC626F460343E6818EE88467A50E648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0d008606c21ba4e5f581ac89ff24e7210a07fa0eb611b401af7c53de405729d3
MD5 4b0a9c3bd3e0fb78aeb2e2aa326d5850
SHA1 5cb556a9ecbc11a5c0865efc0d3d0c39306be518
SHA512 676db7d4080be7b31a09290094d1adba7d4c9799d36ad3b30abb0152754e4393e19c19f5a2f5a3cc0c979727f3ccc57cf23446850fd7a82bdb8e721dc828edfa
TLSH
T13B4163E04C3C2AD1D4BD0A6FB44B34FC81ECC726F850343D6818EE88567A61D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 844bc25756b8a815284d33ee1bbe097b8b2fffeee67f26c6daa6e9a3c1f84369
MD5 7c92206dc1ba56a72310a055c678cb91
SHA1 d271eeceedb1e5c311ba730daeb9e05f329da027
SHA512 5a8df7a23ed188609a4d0f0c7d9c4c0e62efce682453d95a623de1ab7bc8aaca90251a8d2f3156803b95cd98f8dcac94a695c2f6acf6e097272e41867a44f2c6
TLSH
T1CA4131E08C382AD1D5BD1A6FB44B34FC85DCD725F464383D6858EE98467A64D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 648b97559231ed06b048ac97ed67b3fa70711af82a5571820a065ca8f621056d
MD5 89c4c850fc1a0e92439d7a90195fbba9
SHA1 f3b6552c754ad53d6342d78d90e93b482343e077
SHA512 7f3b1a80c5b539f88e915d8bb8b9c7ae9d02d5942e376aabf77cb7dc8e0104a7f23b3329240b0bc70200c97cff182be0afceca4fe5f0507f9e600cffc51b62ef
TLSH
T122413EE04C382AD1D0BD0A6F748B34EC86E8D726F5A0353D6858EA984A7A64D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5d5cae63a62aa49eaa6023b9b34b8c02d3514e997523b308fd4cb1b8ba6dfc8f
MD5 17e58452cba86127e6cb7d37a746eb5c
SHA1 a4f58ebad142681d58991e38f7f8cc0895b34462
SHA512 6698ce9ae2d910afec861bcb2b788027b6024121f198c974f13ecf4e46e99874797a7b95e823cdde51a29fd015a9e3f5870c9e531283b060fe6bb9eea2239e1e
TLSH
T1B14140E08C3D26E1D4BD1E2EB04B74FC85DCC626F464357E6858EE88467A51E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

910bdd43-b5fb-4906-9021-be509c5569b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\910bdd43-b5fb-4906-9021-be509c5569b1.tmp
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d6c8fcae0ab14a9f434742947dd608a9c1e2165e7e8c5fcec0f38fa5ed32d9d
MD5 faac29f0dc9a30a87db283de5e2924bc
SHA1 55d5ea0df18d50cfb4d79fa286daae81dd147c78
SHA512 482693e3d67f2ea14087677ae0e5337802e5e5b8cf9c398af206f371d1e1db8aad3b22c1308d225ccbb82e04aa896a2bca4dd6852d07000bd4ba9a64a1c3c679
TLSH
T15B41EB587AE91148B3B76E5AABF6A86E487FBC776F07D55D10110E4E0662F00CCA2733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2680-0-0x0000000001420000-0x0000000001498000-memory.dmp

Download