4cac75ec27ac79df8dc1eff55faff48d9a0efe6333aa680630bcec17d6baa4cd

Resubmissions

29/06/2026, 04:51

260629-fgxxtaew8p8

29/06/2026, 04:42

260629-fbw4bsds9s8

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
League_Account_Manager.exe
Size 10.4MB
Sample260629-fbw4bsds9s
SHA256 4cac75ec27ac79df8dc1eff55faff48d9a0efe6333aa680630bcec17d6baa4cd
MD5 9b10e242ba3b6fe18c30c7663a298115
SHA1 cc4611f95645b74af63831b451b770c9e847a248
SHA512 d50777d81d72352cca3a3d9a546aed8d1f190d0b8b1d8822c278437e650eb3999dd1744a46ed6701968596dd2a90c058ee4ed254f3a0c4766d30267b9b40df8e
SSDEEP 98304:x77kzRUkFE2V3qTIc/1VUW9xe/+FOvSmaRf+UcDN9NppBLxAHDfyLrZlW:x77kzRUkF5ctVz9xz8N9Npps
TLSH
T1C0B68D5E77ED4E32C3AF873D9CB073211A7559165292EB4B4F4A9A2C08663C0CDE139B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	4860	msedge.exe

Loads dropped DLL 1 IoCs

pid	Process
2228	msedge.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1135696667\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1440468665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1440468665\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1135696667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1440468665\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_1440468665\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Sigma\Fingerprinting	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4860	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271817867666832"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3730367222-316663987-825798519-1000\{78A37A67-0378-47B5-89A0-6B6A9CA2FEDD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 2228	5228	League_Account_Manager.exe	90
PID 2228 wrote to memory of 1324	2228	msedge.exe	91
PID 2228 wrote to memory of 7024	2228	msedge.exe	93
PID 2228 wrote to memory of 4860	2228	msedge.exe	94
PID 2228 wrote to memory of 7024	2228	msedge.exe	93
PID 2228 wrote to memory of 7024	2228	msedge.exe	93
PID 2228 wrote to memory of 2476	2228	msedge.exe	95
PID 2228 wrote to memory of 2476	2228	msedge.exe	95
PID 2228 wrote to memory of 2644	2228	msedge.exe	96
PID 2228 wrote to memory of 1076	2228	msedge.exe	97
PID 2228 wrote to memory of 2644	2228	msedge.exe	96
PID 2228 wrote to memory of 2644	2228	msedge.exe	96
PID 2228 wrote to memory of 1076	2228	msedge.exe	97
PID 2228 wrote to memory of 1076	2228	msedge.exe	97
PID 2228 wrote to memory of 6700	2228	msedge.exe	98
PID 2228 wrote to memory of 6700	2228	msedge.exe	98
PID 2228 wrote to memory of 6700	2228	msedge.exe	98
PID 2228 wrote to memory of 7068	2228	msedge.exe	99
PID 2228 wrote to memory of 7068	2228	msedge.exe	99
PID 2228 wrote to memory of 5668	2228	msedge.exe	100
PID 2228 wrote to memory of 5668	2228	msedge.exe	100
PID 2228 wrote to memory of 5668	2228	msedge.exe	100
PID 2228 wrote to memory of 720	2228	msedge.exe	101
PID 2228 wrote to memory of 2592	2228	msedge.exe	102
PID 2228 wrote to memory of 720	2228	msedge.exe	101
PID 2228 wrote to memory of 2592	2228	msedge.exe	102
PID 2228 wrote to memory of 1656	2228	msedge.exe	103
PID 2228 wrote to memory of 1840	2228	msedge.exe	106
PID 2228 wrote to memory of 3668	2228	msedge.exe	109
PID 2228 wrote to memory of 5180	2228	msedge.exe	110
PID 2228 wrote to memory of 3876	2228	msedge.exe	111
PID 2228 wrote to memory of 6012	2228	msedge.exe	112
PID 2228 wrote to memory of 6012	2228	msedge.exe	112
PID 2228 wrote to memory of 5024	2228	msedge.exe	115
PID 2228 wrote to memory of 5024	2228	msedge.exe	115
PID 2228 wrote to memory of 3392	2228	msedge.exe	116
PID 2228 wrote to memory of 3392	2228	msedge.exe	116
PID 2228 wrote to memory of 2972	2228	msedge.exe	117
PID 2228 wrote to memory of 6620	2228	msedge.exe	118
PID 2228 wrote to memory of 6620	2228	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\League_Account_Manager.exe
"C:\Users\Admin\AppData\Local\Temp\League_Account_Manager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff91452c188,0x7ff91452c194,0x7ff91452c1a0
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8158597177420525769,10068765273220467747,262144 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,515104399435661056,14326680771068833401,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,15614237095366696348,16028721291537798643,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,9043369528741955398,17945755213223771245,2097152 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,109694272479282004,10810061726373859193,2097152 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,13863853368220031821,15096383659565520110,2097152 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,2661830981842797293,12813972209885366373,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,12420311451650718545,729023934398215450,2097152 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,966264124743127962,2876892959598431264,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13941808742870763382,11543670971227934239,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,15349339422324133620,10139790314920439339,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16646286168910055449,17205483061931708725,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16646286168910055449,17205483061931708725,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,5428707460025188043,3153596804513260403,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,16767876782711476551,17626118297919518204,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,14438258200903500391,1448104979336342627,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,896248871196965833,2152165028427462716,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,1835986654749094574,17893391144704038476,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,1754174882177700004,3118039954642358387,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,9521399683940205444,6036375304460496191,262144 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,15990082850909750197,5755213704775439559,524288 --field-trial-handle=2504,i,16295914555149520265,13949007635400296262,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
    3⤵
    PID:6620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fbfdc6639449912c7c98b931d8190c5dc58f3c2a0bf5687e437a1f10d8fb4d03
MD5 0648a8cda5509f4d21f145a8d2e85107
SHA1 0098998314a76ff86c61b0ea846ab42ba2d245f1
SHA512 d12c9f38e4b1be9f515149cbec2d53104d76f99eb87ea993bf787c888cea28fbc81e79244b64386a0c5a5111415c57c4251ad0e5528252f3302570bd3971bd56
TLSH
T1C1D0C0513B2DB402C1241370841343706D09C503E333C10639BDA40CDC9A4C4F3C1543
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7250e4ddb51fa53ec8c4b9199831864f7ff3c5cca1fbf2e4e5086ae0576d31e1
MD5 d67d9caab78f31b2ab2ae61fc88b12e8
SHA1 c439af9d2a4c79b1936d0b654cdf2b2a6da22a5c
SHA512 f8e3ffb5bbcb1740ce2b25ded24b3be72c6285c98433cf97d12acea2ff455dd8da18d81f9348060457962fde88e3e33b5654dc94e329100848cdec215f571788
TLSH
T1C3D0C0513B2DB402C1241330882343706D09C503E332C10635BD140CDCDA4C4A3C1547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fceb2f4faf51c1e78f89ca904517b35450a37b2d4cd3d87d081d24a66ac836d6
MD5 2b9f772899b7d63c05e4f44cbd96b4a9
SHA1 69e4b586b692bd8afe52f50f1455eba516dda2fc
SHA512 45e102630bd1c08f83bc82051dd8416d109d24a53edb2bc0ea126e1d26b5a3460cd2cc2ddf5aa340e960808f2dd13ae0bb9808ea8d8bad189b6d448c91103e73
TLSH
T155F028FAD831AC3B2CFC1B2C60A4074BEB51135B2B50885F3A3D860D8FB567B458682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e60ab851cb16e5330267e3c47412390a26376130ff5b0447cf2405646aadb29
MD5 1dc3dec56517847f119f0dc0fd43f198
SHA1 e5825d4baef48fdf81453d38a881b0bf90ceaab8
SHA512 6808184b88e1f86932959a3cf28d3ccf00bf80cb7e1989393b60b2f262987ecdf85e9d7f4dca665203bc4045030c9e12ab10ac0e8a5375d7ae00e1ac8aaf05a6
TLSH
T18571C5921466396FDF2342F46BED28B977F400DB020B2F2244902DB6BCCF354949D3A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f9bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f9bd.TMP
Size 3KB
SHA256 24cd667ad5499bc330675afcf79ad9430cc153499a3eff5bca2745122aade0ff
MD5 2f6306995b21b35b445b26dc53ca6e22
SHA1 2aec5270faad6be42f0935bdc8a0662ce944fe82
SHA512 35977057a74bf48f3724c0aada1c919282a07093ecc5c02e63b2c6dd81dedc1cb75ecc0be3ebc051c14464be00c135bdc986a1d567cfa563bb30a244f5399f7f
TLSH
T11771D4521522396FDF2342F563EE24B933F410EB020B2F6255A06CB5BCCF714889E368
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9825ac9c1764265d2aec8fa04f59bba29d3a6fd120fc2cc643a642e5734b4e23
MD5 4f4ac7b20c070a3550f271e41d94f43e
SHA1 96c9b3e967994b4f72ceae1e2f68dfa11670b2f5
SHA512 9887e45a86b9b8d89f09e36b096c702c173a518716d0de8053d3ce13d5851c258d97f800c4afb5a16f55055aa89c7ad7113979916209e1e03e2d19156eac7f48
TLSH
T13C71DDF787B4856ECA0196F0A618AE2FDF2C0515432C7C6989E0AE27D3E3472E14265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ac65a853ed0890523b38b288fb8dbbe5b643e8722d664ee9ae4bdf413ce24f60
MD5 3bd6b0dfae04f93ee267739c00fd4478
SHA1 52ca01d745b74b626fd77f4d81ab398628c24142
SHA512 4f8beef871117ff728f78fed229470556f2ac2d9cf44a499146bc31d57e4209994c18fe9ffd285eaeb7d7ada3cd52202a1fa6c19f535cbf097cdf4c6c6a92f4c
SSDEEP 384:sxRrdqik/fasmEz7QHHcjlS/5T/5TDfpWyAHK:sXsik/f0EMcw/5r5HfQE
TLSH
T1EB72D816A934597BCDDBD219FA457F63D2F81563A2905E44AAFC8F0C00E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 00e2d1436e0ae3dbd4a7b441382f32eb7f92be188dde620c96eae5cc889ecb1e
MD5 f30307bbdabfb9e4db55d81b719a0604
SHA1 20b2c647011ddad710366e3e49bed0eba64eb830
SHA512 54e46fb566aea26a6334656c8810a5ee557b077861816d2e4769e9d2823168342b13018fa791222a288c280e6ce3f87c72ee348845585516cc1d58bb1dc55624
SSDEEP 384:sxRrdTk/fasmsz7QHHcjlS/5T/ATDfpWytHq:sX1k/f0sMcw/5rAHfQR
TLSH
T11872C71AA934597BCDDBD219FA857F63D6F81563A2905E44EAFC8B0C00E76DC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8cdcf8e4a479d786f0769a1385196f339894a0973ef672a2ed9c13f370bbbfbf
MD5 b83f523c6a8ff08948fee0e66b500cae
SHA1 d26e2392dad069611eb71abc5dabf5573ecd5c72
SHA512 3c451821d0c43636bb35d7cee9063790c2d5be7af6fb40af1bba8d67eae6ce5aee21f1a4ba0825341db3613088704904dbe2f1fa7d3abb53283486f736d82c56
SSDEEP 384:sxRjdTk/fasnsz7QHHcjlS/5T/ATDfpWgjHq:sf1k/fpsMcw/5rAHfQ/
TLSH
T16E72D70AA934593BCDDBD219FA857F63D6F91563E2905E44AAFC8B0C00E76DC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 69bb78c7bda2789a34cdbbd898e9f8941be74f810a6e39fc71e3446bd1b28fc5
MD5 ab301e2112850e60dd65e0e7c3b869ad
SHA1 a3e24900790900e6325b5ff1f662d0256bee7578
SHA512 3c8933e2a9c2140f7e527abd7e718289a9c315e325db966e092620de1eb4b2422aa820843ea4f3fc2d2e16bf3498587b45313201f837cf639483c14c9064109a
SSDEEP 768:hDiNNidNi/Jt7pLuL70DiEWg5Niuf+Xi08F1+UoAYDCx9Tuqh0VfUC9xbog/OVS4:hDiNNidNi/JbE70DiEWg5Niuf+Xi0u13
TLSH
T186E2FC3B680CC77E4F844E9CED29BA9A6DE801CB96DCCD9447EA440C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 6454e970601ea1ed35b29335759169216722a2a05b569d173083272e0b71c188
MD5 b685f9e25bccdaf19ff0fd2b72b89b54
SHA1 ae1d39dccbfd8811ab4b41af9b102d9947ea404f
SHA512 3b8793af39e04b7ad1ddd040b5dc6aea71ae8faac822980f42494850d278fc3af94ed021362a3b0508cc2d98ecceea5e33db6acbf9c72cb24be7e84e9ee5588a
SSDEEP 768:TFUxVXrvC7WZd5J5PClV2Hlftp113RFJlbDNOzNL9jF:qVtp113RFJlbDNOzNL9jF
TLSH
T17CC255117A7E224138BE690CE1A5955F274230B3701AA93B3B7D60E60EA7E005FFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 59aa16bab3161163de794cb4733d76c4bbf34e738778aaefd52ee87f23aeb96e
MD5 a9fe4ec78debcdbd9fa2bdb934b62be1
SHA1 7d1040cf6f3c0c485b690cb416dba39bd7fd30c7
SHA512 e2c0e58b4f47d1545784ce3323edc3960423e6b1a6d190ecaeb92224f97e5b026867f2bf0afa49d6d0376def3d6f3f4035f04951a7ee5d79a195f643efd97cd3
SSDEEP 384:nviF1tNn/s3n9Sd8Nk8TUNTUlIRBu644jRXfLF1zjVs0aITGT0I18Lk1IzAx9j:6F1j+9YlwgiKT1XVBai+0Kvj
TLSH
T152C22A76D864DAABADF69FD9B7097646AEE001A3C0D86DC4D9D81D4D00C71ED034BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8005a21d4df8d35a2ec4ff0544327759f1d470a08e59d7508cc99fd22618c017
MD5 02b579562ee776de5505f67ab39b8261
SHA1 cf59f4a31cb2ffb96a4d1ab548bb5ee9332a7f26
SHA512 35f945c0a1472f0b1ef72de4255a361b033216cd8968bcece3732f7e6722d25cecd1ebf7a1f9f3ea4d1c21b5aea51db33a0c34d537c4edabd1e9dfa26d5a38a2
SSDEEP 384:n8iF1tNn/s3n9Sd8NO8TUNTUlIR5u6RqJ8RXfLF1zjVsOXYOZxmn15wbAjEJq8Ll:nF1j+9YvwgifJ01XVHLxmn12bfJ/
TLSH
T1FEC25A36E865CE77ACE79BC9B70A7646AEE001A3C5D85ED8D6D84E4C00C72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ccf1e05c6a03349cd0382cf2b60bc577b1878207bb2d07d1b28100ffb9531dc8
MD5 8cc58558f32202e3204e75698b0d16d5
SHA1 fe47966a8bc1ac6115582d06f492cb1e6bed264b
SHA512 605697cfb0b8d123b0bc6ce89c3b9bff69acb0920352647bfd8548c1801a4b83d97d71c7867730edcd0909e85042c20bb0dd01a7f79262b467b0ac72cec4bc32
SSDEEP 384:nQiF1tNn/s3n9So8NO8TUNTUlIRWu6RqJ8RXfLF1zjVsOXYOT8xmn15wbAjEJq8x:rF1j+91vwgDfJ01XVH58xmn12bfJ/
TLSH
T102D25A36E865CE77ACE79BC9B70A7646AEE001A3C4D85DD8D6D84E4D00C72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1fdeaa8adc764768faa6ea9416127cad835d1c148c2ac2a34eb12f9fc62fc71d
MD5 96f50530af51ed4c0a0290e88838c30f
SHA1 9157e70252c5c5b805aac0fc184cd073199c5c07
SHA512 95edafe0bebbc4f1d0b2bdd1c3634a7caebe7e884fe5bae5937f65be3beac255317f1a8bd59a374c1cf513b31848f4dc8d10553bdafc1b4e3f9b2dd570640f77
SSDEEP 384:nWiF1tNn/s3n9Sd8NO8TUNTUlIRWu6RqJ8RXfLF1zjVsOXYOZxmn15wbAjEJq8Ll:9F1j+9YvwgDfJ01XVHLxmn12bfJ/
TLSH
T18FC25B36E864CE77ACE79BC9B70A7646AEE001A3C5D85ED8D6D84E4C00C72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 70dd6524218bf3d3ba7c8bbd1bdcbb65e2b2027a1023d39a58c42c70c71f3716
MD5 07f18cefa317de1c22a36d8b5affb7db
SHA1 cee5b3766f1501cc43d4f9e6581dabc2e67ec6f7
SHA512 2168da36066717b771dffd9576c571ed10b5a202a30af4e61713dfa9d2cae457b5456377132008e66e7c77f1088bfce4eaaf33dce5e3310fc226dada0e873db9
TLSH
T1032140E1583C1EC2D47E0CEFA05B29EC94E8C226F5A4343D2C98EC98563D65E268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 200cb5e659ed59622a8f8b57594e80e1bea4c75ab1b93885b1615da12092430e
MD5 1e7e60ceaf8e7b28af7f83fc4a48b9db
SHA1 b2b499b0465cfec49a916eb29c6efe9364fb1dba
SHA512 88ea9bcfcbccf5db3d365610a9fc7e3a78724929fb1a1f65016fcea042452531db4f10e726935872494ae06b747ac7817f40cd54c086d1bc6bf91e974539c1f2
TLSH
T1872141E1582D1EC2D47E0CEFA09B29EC90E8C215F59430392898FC94563D61D2580C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8f3f529ddcc30acdfcfae833343bdc0b63ed422f30e1e6277347faaaab6631d3
MD5 9bafb2ddffbf8758e8372efaf16ca836
SHA1 6848c227df7af60869b3332a92b22d7be63b3a55
SHA512 3dc125ed4c0da71e42265770ee65296052eb2bd7940aefef2759ac9f3a03c2fe61f3dd6c3d8e601422175d7b1170512666465ff7e0884988ad4d02946b1b723c
TLSH
T1E03141E1583C1EC2C4BE0DAFA09B39FC94D8C326F5A470392898ED58523D65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2228_2076099322\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download