3fa6bbe7c11c627e423fdc7ff52fbaad3acf976ca6f61ecd0755aaeb911fc6e4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
themes/astra/assets/fonts/astra.svg
Size 7KB
Sample260517-ajx3psev9j
SHA256 3fa6bbe7c11c627e423fdc7ff52fbaad3acf976ca6f61ecd0755aaeb911fc6e4
MD5 418f1832babfeb3713d55521c5c790e0
SHA1 7e2e5a9f65264ec2181b9a10aca33f7b35f8ad92
SHA512 1bc269595443fbd8e1dad5f23daa547643c88549396ffd642b485fcb1f2e95b3ed74e0f79924341a50c5f806e4392a7f2fc1522fb05e724964032535e7a7fd28
SSDEEP 96:cnsdr/NyfmUY1r0D/1eCS47zW+w3Mex7pmh+8FBwMKWUwrsLwLjRA7pv3m3sqb4p:csdr/kmU1DYCS4Sp7Qg8zHh2Wo9Io
TLSH
T105F1BA9DF32E3BB0BD4A07A0EB7E9D5D021D421DE06AEEA7E93447614DA3D0835544CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2054540616"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31254645"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237311533919221"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{0689B0C3-5714-4663-9517-F860B432752E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2376	656	iexplore.exe	80
PID 2376 wrote to memory of 2384	2376	msedge.exe	81
PID 2376 wrote to memory of 3436	2376	msedge.exe	82
PID 2376 wrote to memory of 4568	2376	msedge.exe	83
PID 2376 wrote to memory of 4568	2376	msedge.exe	83
PID 2376 wrote to memory of 4568	2376	msedge.exe	83
PID 2376 wrote to memory of 4976	2376	msedge.exe	84
PID 2376 wrote to memory of 4976	2376	msedge.exe	84
PID 2376 wrote to memory of 2312	2376	msedge.exe	86
PID 2376 wrote to memory of 2312	2376	msedge.exe	86
PID 2376 wrote to memory of 2312	2376	msedge.exe	86
PID 2376 wrote to memory of 4456	2376	msedge.exe	85
PID 2376 wrote to memory of 4456	2376	msedge.exe	85
PID 2376 wrote to memory of 4456	2376	msedge.exe	85
PID 2376 wrote to memory of 1752	2376	msedge.exe	89
PID 2376 wrote to memory of 1752	2376	msedge.exe	89
PID 2376 wrote to memory of 1752	2376	msedge.exe	89
PID 2376 wrote to memory of 3196	2376	msedge.exe	90
PID 2376 wrote to memory of 2260	2376	msedge.exe	91
PID 2376 wrote to memory of 2228	2376	msedge.exe	92
PID 2376 wrote to memory of 3196	2376	msedge.exe	90
PID 2376 wrote to memory of 3196	2376	msedge.exe	90
PID 2376 wrote to memory of 2260	2376	msedge.exe	91
PID 2376 wrote to memory of 2260	2376	msedge.exe	91
PID 2376 wrote to memory of 2228	2376	msedge.exe	92
PID 2376 wrote to memory of 2228	2376	msedge.exe	92
PID 2376 wrote to memory of 956	2376	msedge.exe	93
PID 2376 wrote to memory of 956	2376	msedge.exe	93
PID 2376 wrote to memory of 2936	2376	msedge.exe	95
PID 2376 wrote to memory of 2936	2376	msedge.exe	95
PID 2376 wrote to memory of 3444	2376	msedge.exe	96
PID 2376 wrote to memory of 2520	2376	msedge.exe	97
PID 2376 wrote to memory of 3444	2376	msedge.exe	96
PID 2376 wrote to memory of 2520	2376	msedge.exe	97
PID 2376 wrote to memory of 4812	2376	msedge.exe	98
PID 2376 wrote to memory of 1124	2376	msedge.exe	100
PID 4812 wrote to memory of 4052	4812	msedge.exe	101
PID 2376 wrote to memory of 4388	2376	msedge.exe	102
PID 2376 wrote to memory of 4388	2376	msedge.exe	102
PID 2376 wrote to memory of 4984	2376	msedge.exe	103
PID 2376 wrote to memory of 4984	2376	msedge.exe	103
PID 2376 wrote to memory of 4840	2376	msedge.exe	104
PID 2376 wrote to memory of 4840	2376	msedge.exe	104
PID 2376 wrote to memory of 3304	2376	msedge.exe	105
PID 2376 wrote to memory of 3304	2376	msedge.exe	105
PID 2376 wrote to memory of 728	2376	msedge.exe	106
PID 2376 wrote to memory of 728	2376	msedge.exe	106
PID 2376 wrote to memory of 668	2376	msedge.exe	109
PID 2376 wrote to memory of 4556	2376	msedge.exe	110
PID 2376 wrote to memory of 756	2376	msedge.exe	111
PID 2376 wrote to memory of 3424	2376	msedge.exe	112
PID 2376 wrote to memory of 3424	2376	msedge.exe	112
PID 2376 wrote to memory of 864	2376	msedge.exe	116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\themes\astra\assets\fonts\astra.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/themes/astra/assets/fonts/astra.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8b77bc188,0x7ff8b77bc194,0x7ff8b77bc1a0
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,4210145133020350223,3206317782376001980,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,5350924268487351853,16927782478989195113,262144 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,16719654329245256527,17347025337758360113,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4840658185768607435,6454547703144057909,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,8974007276214780948,10131611188253779652,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1198297045038474716,16570464705174255817,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,15441371112702770589,13717194344272291828,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4308,i,152830330459339133,4786849732349505069,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,12955689829442490005,1501158722663347058,2097152 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,16137977250625319394,9268408543892442634,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9428919567662904793,13131346571647308455,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,13647494324416334882,9728951548515983545,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,17087916427564472283,5417198974958889592,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2725837980074939267,17000750936779050109,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15776553762592267535,8983303436484406939,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15776553762592267535,8983303436484406939,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1723112626591581592,9335428216598191022,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,13662258488160101055,6643028707685779316,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,6737827290566183886,5725484828662679809,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14018830718153906648,15664828903328747137,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,18102906056671125026,14283827211232159768,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17494111377063799818,943980285012495643,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,6997399103869585575,9112234606267613097,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,15313180237060559598,16458917669661587717,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,4247916080219329065,1383115480556213094,524288 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,8332881886855659190,12812061848271887603,262144 --field-trial-handle=2256,i,17480170902886482697,14105895041774462257,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1240854d02a699b4cdcb73e874459050726e68cf7b2acfec992a2d0036c875b3
MD5 fefea6e0a566aa892db74e6fdfe9dcd0
SHA1 31b9d55fd77d53202300d664f3cbcf0309e9ac6f
SHA512 177849886b98ec914e442f5f68fce7d798bbd5a890b720b353e792d154f55b96e5069c5a78285195c59f173ef6b1881b882838809c0676394851fd0b22de653d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7a:fwUQC5VwBIiElEd2K57P7a
TLSH
T1EDB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0192dc8d31d75e03c9c66435c5274a0a38de4174a7d9529f6740942aab5e0b8a
MD5 cf258aeeab3c586f915faea3f265e163
SHA1 4320265948039c14152065a13b80fd66730a08ac
SHA512 ee4f5f239b3cd81b564ed3bf7dfbbcf391131b75112265093c9d275f28119c36a1f053c7bc68074a2864f0fe37b1335cc74ceb98deee372058d1a47190be7e09
TLSH
T1B071F73D3E66E353FFAC7679B0D20E043071B5ED8A870E18B2225976552B726C3E5E18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587932.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587932.TMP
Size 3KB
SHA256 dae801e088c4d3d92d9784b80f29c6e0a568bf1f1a715cb58acc311f6f0daaf1
MD5 97e2d4d04c2cfb25c7649587646ff445
SHA1 d4d4fcc15de6181d9ceeaa0a1aed050d3159e3ec
SHA512 49bc997fd9217f9db6b49075961fcfa8b1a666484848e418cec697ca238208ae518ce367e3536181d0d34cddf8a86c797a230aa98eb4b54b477eac53cf4f71af
TLSH
T15F71083D3E66E353FFAC7679B0D20E043071B5ED8A870E18B22249765527726C3E5E58
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 65f12db7f09cc8412a0d3d3e9756fd86d54b9d51aa03212d6bcb9b711ec576ff
MD5 46c04363d926447526ae7f288344a89f
SHA1 b80f80f212b725029b266f1daadb6130cbfa434f
SHA512 fceda89b25e20962f41d4c0ffb1fc3feaaefceae80e6b9b8b3adc140bfc949b71eaa4bee15f3bb3a444c5aefbfd0ae9e52c49473a58ddae4673b0a72608a062c
TLSH
T11041CFF3C2E8856D890156F0B728BE1BCE2D0914532C3D5AC4E4EF5B93E3871E14155E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9fd5f173869c3692d98db068795482ff62bd2d33ff683f82a0a1ffc4a2f10bee
MD5 d5dbdcf7dedd971a1d14112b71817fa3
SHA1 7dee21d7dddf2232ffca7a1b481d66eef0d93c28
SHA512 94b362407201f4ee3e85be684b4f65b81100cbf7792d499399c009609f8c2c30ac359948c5b0a3b988dd3fd680935057af264a8f70953c19aee493b56bffa77e
SSDEEP 192:sxZLRqyM/jK1Ml8McX/fYszvqqIdpy+/W6+WNGY0oA4FoIg4J:sxZL40X/fYszvwZ/bG5Rc
TLSH
T19952E7166B385977CCDBD21DFA51BF53D6F9156392900E44AAFCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 03d8af2b32bc3db45ef075bfc11cda15ac82f54557b53b80ae6c725b31d75728
MD5 61297f67c562f3797433df7487d59346
SHA1 14a6c2489678663b64ce9e0f6d621d8df032afcc
SHA512 723f79fc2b2013e04c5f83c0e3f3ec4990cd79044461b973aebcbaebe10c4c8d4f1eb3398c3c70aa5ddd1242edbebdbf8d7fb480537b980859de5568c7aaf5f4
SSDEEP 192:sxZLRqyM/jK1Ml8UQEcX/fYsURqqIdpE+/W6+WNGY0oAtMKFoIg5EJ:sxZL4qDX/fYsURwv/bG5sS
TLSH
T1BA52D856AA385977CCDBE21DF9517F53D7F9146392900E44AAFCCA0C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1427fbc88e297c56a9330b562eb6eacbd1098bd93a03a38484853e2285caee09
MD5 213cda08f1ae70817ca62a635411b45f
SHA1 3cbe9d83581431711c296557585244a663f16f73
SHA512 3b4446bc536012c16177e1eb503967995c3b31e852d718adaab8b87be7c9cd7789ed54a83f99343448ee0af5e2d44f2fbbea804c4719d1bd9003aa0c8c07fba6
SSDEEP 768:5fc0s8Ww2417pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Ky6OLlO:5fc0s8Ww24DEX/fWRm/JQg1u1jaKKy6v
TLSH
T1F8030A3B6C4CCB7E4F844E9CED26AE8A6EE8018B6698895447FE444C03C76EB15174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1fcecf72136aec25aa10aadd54e84214ad98a7c329879fe576be0d36608891f8
MD5 ec3995406169ff72724cc6313a6b0708
SHA1 733550d9ba97681e00a00daceefa330a245116aa
SHA512 c32ea538543b48bc9e2d5d9cf9d7a92de4308103c99bb1ef8079819b8d2a51d15bcdc027ce14e1bc5e689bda743fa605b74552f2893760f56d47cd8c21e37fb1
SSDEEP 96:KYBOKKQyWn2KYo+GfK20QcEMQtvKeEKihK8EuW2N0WZFBmTPprO:kBFlhl
TLSH
T15D917141F1F723533C7E2908A358AAA605427463702DA52B3B9844B25E2BE14BDFD7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86c7f3d5-b390-497d-b286-0d7865e455ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\86c7f3d5-b390-497d-b286-0d7865e455ad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d5bef8417b14ff15830deb0a72e6fc2e6b20409d32753dd8927fe14d75a0af91
MD5 a78d929682e9afade9cb147f8a560071
SHA1 7900457c6a63722294dab42b150e8034aa02b77d
SHA512 1b1ae0d6c2db52c4c821b91c218b7921e159f485b90c088d7d01610bc866640eb2c97356aba17eed84ff0ded5e234385611ec180f75bd911cc83672d844a1565
SSDEEP 384:nyGiFJCcmyWCa8NE8TUNTUlIlembpSC7+PqDf4/u8YkVvxJCddblI4H+Hwj5n:ytFQcpaFwgkAIFB/CYxJCfH+Qj5n
TLSH
T197E2C4F198D78936E8AE5787A73E3D469EBCC063B5844985B7941E0CCC871BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9bcfd7fcba0a9da875ed1adb03131cc624488241e1b3312314673dc26c9bc53d
MD5 b718b61e47481ea33f664541335e217d
SHA1 6a2b7d1e6f7a3ed20c55adbd77b18109263eef69
SHA512 2073699625459d71778ed3a695f1eb072f70db85a7b71f4d03e66f491ed3976c94a8325f2b56cda01b6d97c6128c09097fae9bacefe3167f6312665b93a1a283
SSDEEP 384:n5CcmyWCi8NMlmbpSC7WPUu8YkVAJCddblI4H+Hwj5n:AcpipAIVMCfJCfH+Qj5n
TLSH
T13F927C719CBD5C779CA67219F44B36679FB428BB99800F5AC6E95B0D008F2C8270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 74a66bd150b09aa945d21e8728ae19063c7bac400e972e517c4131842eb6d0a3
MD5 9a038b36526966fa1ec5c04c83dfdf58
SHA1 956ffe127debdfa311c64a8c2fac8f223d01d0dc
SHA512 307b073d060076c1f7778ff1a958e08ccef5cf3950b98be82f5fe6ebb34a488052908a43099436a4c33ed3a9cba7eb970fa7cfe4af4490db6f20495520839d88
SSDEEP 384:n2CcmyWCi8NMembpSC7WPUu8YkVAJCddblI4H+Hwj5n:1cpiqAIVMCfJCfH+Qj5n
TLSH
T152927CB19CBD5C779CA67219F44B36679FB424BB99800F5AC6E95B0D008F2C8270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9f874b9fb996d2185fca942dffdeca3aefd8936d9664b83065637ef2d263e985
MD5 f109393041331c2b79523c026dfe1b61
SHA1 293702ac46957b58355dea555cb817519532f7d1
SHA512 459dd6b7ccee23f68b6acf293fd4b841e73d0040d20c60fe257507a76b2508693ad8d463e330f44f829db15f9ba72b86026b2a6e5383480a6cabd7e0d3e8a004
SSDEEP 384:ntCcmyWC58NMhmbpSCLWPUu8YkVYJCddblI4H+Hwj5n:Mcp51AIhMC9JCfH+Qj5n
TLSH
T157927C719CBC5C779CA67219F44B3A679FB424BB99800F5AD6E95B0C008F2C8270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61d2b400389baf54ec871039acc8630894c6163d21509e89ec607526ba36d250
MD5 1db3d8d6a075248bc3311b720d05afc9
SHA1 d7e50626cefc76c5d13fa8e0731cb93004ac567e
SHA512 89f1bbc96c1ca3e6c89322097688ddc456c1df65d2d6ccd02e5ef4001b6cf8dc81906e9a95bf039278225c53266346dc1f412f3a02de4c135304a1fc585841d2
SSDEEP 192:XGNO6jCQmiUyfIaf4SufoPxzYkJSnYffRU6:XGNO6qEZfju8YkSqfRU6
TLSH
T15302E874AC687C7B9EA3AE45F58737136FA4212BD9952F44DAF82F0C00E764C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9c39a17ddd647470f5c78d11ed79569cb54eda2691ecffd4feb42c061e3ae7d
MD5 83eae7335f51ceb0acb331c9174a6e40
SHA1 04b389ee8e0612c24881e7f5eb1eefefa9ffa6e2
SHA512 345a9217c82791a74171ca7160f0a9318ec134cf10303cc03cc2bf55b4382a2ff8be9a4bdc1df324172d03e759b98906f84ccd6536d12fc1e82e26d87f7a01c5
SSDEEP 192:XGNF6jQQmiUyGaN4SufoPxzYkV2hOMSr/KrU6:XGNF6s+Nju8YkVEJU6
TLSH
T190120970ACACFC27AD97B554F58736539FA42077DD856F44D6E81B0C00EB68C270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9ede4c9-7a10-4139-a5ef-56a57a0eed69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b9ede4c9-7a10-4139-a5ef-56a57a0eed69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7ef84c66-759a-4bd7-99e6-a5e56f8f8cf5.tmp

Path C:\Users\Admin\AppData\Local\Temp\7ef84c66-759a-4bd7-99e6-a5e56f8f8cf5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

827a329d-18b6-434e-a54c-b3fce5b153a4.tmp

Path C:\Users\Admin\AppData\Local\Temp\827a329d-18b6-434e-a54c-b3fce5b153a4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2376_1672699274\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe1b6e55-7b92-4987-9d6c-886bcfd64d7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2376_704994598\fe1b6e55-7b92-4987-9d6c-886bcfd64d7d.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download