c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260718-2cscesg19v
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
113	2196	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_183290314\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_183290314\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1600396645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1069100509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1953402655\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1600396645\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1069100509\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_183290314\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_183290314\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288872665590276"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{6BE9AFC5-4B3D-40EF-80F9-B3A0E135D418}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4284	4880	VelocityLite.exe	82
PID 4284 wrote to memory of 4596	4284	msedge.exe	83
PID 4284 wrote to memory of 1216	4284	msedge.exe	85
PID 4284 wrote to memory of 2196	4284	msedge.exe	84
PID 4284 wrote to memory of 1216	4284	msedge.exe	85
PID 4284 wrote to memory of 1216	4284	msedge.exe	85
PID 4284 wrote to memory of 980	4284	msedge.exe	86
PID 4284 wrote to memory of 980	4284	msedge.exe	86
PID 4284 wrote to memory of 2288	4284	msedge.exe	87
PID 4284 wrote to memory of 2288	4284	msedge.exe	87
PID 4284 wrote to memory of 3692	4284	msedge.exe	88
PID 4284 wrote to memory of 2288	4284	msedge.exe	87
PID 4284 wrote to memory of 3692	4284	msedge.exe	88
PID 4284 wrote to memory of 3692	4284	msedge.exe	88
PID 4284 wrote to memory of 3684	4284	msedge.exe	91
PID 4284 wrote to memory of 3684	4284	msedge.exe	91
PID 4284 wrote to memory of 3684	4284	msedge.exe	91
PID 4284 wrote to memory of 2072	4284	msedge.exe	90
PID 4284 wrote to memory of 2072	4284	msedge.exe	90
PID 4284 wrote to memory of 2072	4284	msedge.exe	90
PID 4284 wrote to memory of 3892	4284	msedge.exe	94
PID 4284 wrote to memory of 3892	4284	msedge.exe	94
PID 4284 wrote to memory of 2164	4284	msedge.exe	98
PID 4284 wrote to memory of 2164	4284	msedge.exe	98
PID 4284 wrote to memory of 1724	4284	msedge.exe	99
PID 4284 wrote to memory of 1724	4284	msedge.exe	99
PID 4284 wrote to memory of 2152	4284	msedge.exe	100
PID 4284 wrote to memory of 2152	4284	msedge.exe	100
PID 4284 wrote to memory of 3708	4284	msedge.exe	101
PID 4284 wrote to memory of 3708	4284	msedge.exe	101
PID 4284 wrote to memory of 3708	4284	msedge.exe	101
PID 4284 wrote to memory of 1860	4284	msedge.exe	103
PID 4284 wrote to memory of 3164	4284	msedge.exe	104
PID 4284 wrote to memory of 3164	4284	msedge.exe	104
PID 4284 wrote to memory of 1656	4284	msedge.exe	105
PID 4284 wrote to memory of 1656	4284	msedge.exe	105
PID 4284 wrote to memory of 3028	4284	msedge.exe	106
PID 4284 wrote to memory of 3028	4284	msedge.exe	106
PID 4284 wrote to memory of 2728	4284	msedge.exe	107
PID 4284 wrote to memory of 2728	4284	msedge.exe	107
PID 4284 wrote to memory of 2776	4284	msedge.exe	108
PID 4284 wrote to memory of 2776	4284	msedge.exe	108
PID 4284 wrote to memory of 3520	4284	msedge.exe	116
PID 4284 wrote to memory of 3520	4284	msedge.exe	116
PID 4284 wrote to memory of 212	4284	msedge.exe	117
PID 4284 wrote to memory of 212	4284	msedge.exe	117
PID 4284 wrote to memory of 212	4284	msedge.exe	117
PID 4284 wrote to memory of 3164	4284	msedge.exe	118
PID 4284 wrote to memory of 2736	4284	msedge.exe	119
PID 4284 wrote to memory of 4504	4284	msedge.exe	120
PID 4284 wrote to memory of 4568	4284	msedge.exe	121
PID 4284 wrote to memory of 4124	4284	msedge.exe	122
PID 4284 wrote to memory of 4124	4284	msedge.exe	122
PID 4284 wrote to memory of 3584	4284	msedge.exe	126
PID 4284 wrote to memory of 3584	4284	msedge.exe	126
PID 4284 wrote to memory of 4872	4284	msedge.exe	127
PID 4284 wrote to memory of 4872	4284	msedge.exe	127
PID 4284 wrote to memory of 2476	4284	msedge.exe	128
PID 4284 wrote to memory of 2476	4284	msedge.exe	128
PID 4284 wrote to memory of 2736	4284	msedge.exe	129
PID 4284 wrote to memory of 2736	4284	msedge.exe	129
PID 4284 wrote to memory of 2436	4284	msedge.exe	130
PID 4284 wrote to memory of 1380	4284	msedge.exe	131
PID 4284 wrote to memory of 1380	4284	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffc2997c188,0x7ffc2997c194,0x7ffc2997c1a0
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4387115703588067458,2204523052797972839,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,10346734514481944739,14330379207183782977,262144 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,6500758319612250191,3257286211446396090,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,13222787968675911428,11298897775903317651,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,17877034946535910770,5528036124934083266,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7692414396634681986,13923093151262389925,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2407243673705100412,5777926904689370831,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,18234829841331407110,279706497432067746,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,13426051904966551502,2455175736589163824,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,18223825986617495961,12614220230685338771,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,3033126903006981100,8920920208193015685,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5744,i,11551083278592605923,5988653976803693764,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,16397327177900010023,7041221212816376727,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,16397327177900010023,7041221212816376727,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9902303281525600841,680815296286647813,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1558874105801254221,6441317486435966941,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7493228486777898044,16803960559801379752,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6760210506188946711,11782053923421387591,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,3723020592411407459,4874980347927063876,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,11235685818988186189,11923498375192066112,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6764,i,7470334898602170497,10663559482521458738,2097152 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,9033449311176784483,15050248704852717206,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,15163694685119742833,11299930542923020916,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,284660980214569641,4191184406876026601,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,940356046081907314,9753215417921729794,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10020291236364813819,11920429141321170811,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,4018363289139683220,14295857974455396476,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:8
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10108975680502812740,10623056659270875063,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,295223885104502283,10966919221532599793,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11380344321157945193,12996957178110213377,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5532,i,3751543791155825364,13510910820141897990,262144 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8214645570369804090,11310328205848734170,524288 --field-trial-handle=2896,i,7137480026602774739,9560468933792292065,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6ce74f490dd52b11b04d1c5ca49c5fad8f8efd369860c5f32a32e394a1bd899
MD5 1f008af937d3a25203f85cfacfe8b281
SHA1 b5e3b59191733b0a96991ed60114217ef02e9815
SHA512 347270a01a9cb151bd1dfd3bbf4f81e4dfec1f2d9ed62fb17744ecf54526e2378101825cea56e63d68fedb77507467f18dde5ec26fce57ce00c3aeec1d5e4563
TLSH
T186714C35054262D1EB00CDF1B4D1E28079FECFB64903EED629D464F836AB7A792806CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bae29c4d6140463fb5b36be391eedb58aa8336949cc51b4f2c753dbbe5f2d543
MD5 cd14c2c8c266e05c4e9f6db4a436944e
SHA1 4cf33ee39274e1fc9748969231d653772cb0e4cc
SHA512 5702c625afbd569a56833b03ac0936dacbf4ee225b2e9b29b3807eb46ae9426c7343ab6b13513a322afa83b033a76fdfbab168bd8ccdcf5ae4e44475a861359f
TLSH
T1EA815E31050262D1EB40CDF1B4D1E180B9FECFB94903EED52AD454F83A9B7A78680ACD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a062.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a062.TMP
Size 3KB
SHA256 6eccdfd42aa54615741b22dc7bd3013cd6bf86fa9fd862a674ce172b125a2275
MD5 59309a76e11e0febe80fcf2808f266bc
SHA1 1c8cfe642000b61f46391815541cb44140c21f08
SHA512 2979730b70cf198b3a0d03f0cc06c922297cdc4c7adb3a4fc8d554cb49b729e2421915b0c1793b46ee8fd86487ba8d7ef4781ed03e5823da50e195b8fcfdf711
TLSH
T1AF715D35050156D1EB10CDF1B0D2E24079FDCFB64903EED529D464F836AA76742C11CC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2eb8a36c4494558aa9dfe675308a9dda65ca0f55c68aeb321eb9ecccf8202545
MD5 10ee8f7be5d7b3a40f3900f46483785a
SHA1 52dd9cd7de76c539946cae6d9f38c0318c405bb0
SHA512 3492c473dcab285c7667df8b06446d79e2095cad558f662320a553399a830651030c23ade6ffd0aef734581a037a67e7b4f71258d3a4fb936bb9871b911f9285
TLSH
T11D519FF787E4856E8911A6F0AA24AE2FCF2D0615431C3C5989E4FE2BD3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 76543c2537137064056f4bd6a02e7a1739cb1c81761b956a864ecb1b0a092bca
MD5 68e5b74680d976a3232d60cc91cc4e40
SHA1 6c93a9ba25eece34af01494602181d9797af93fc
SHA512 cb9334964099ee11f7462edb43db7a9ca3ba37f2ecc41cae4acb4707fa46fbfb5c05027512271253c00b244a55d812b2101b52dbe527c5b67d52332be9526017
SSDEEP 192:sxZORIyM/jK1Ml8Mi9/flsJr2FuIgcqjwIdpwTHW6+WNrGt/AwcD6SBmIg4J:sxZOKq9/flsR2F7SFqHbg/zc
TLSH
T1FC52D8126A349D77CCDBE209B9557B53DBF91572D3900E44AAFCDA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 49e906b587f3d1182c3eb7898e74932436740637af5152618fbb280c990a0de2
MD5 12c53e78ca26063bd6cb7d52a3027cb2
SHA1 2192f194d0a49f977efee6249809c3440e7c2645
SHA512 f3ff3824c5073fc238fd28e0fbe200bdf3566cdc41461b266e3eb1661c0e0a4ff21d65b484b219e52dd420c74cf32cb27d3928dccce243a801e9f9a81375e62b
SSDEEP 192:sxZORIyM/jK1Ml8UQLz9/flsIVr2+uIgcq5ZwIdp6THW6+WNrGt/AwcDDF9mIg5I:sxZOKqP9/flsId2+7SxgHbg/hS
TLSH
T16C62C752AA345D77DCDBE209B9457B53DBF55472D2900E44AAFCDA0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 651927ba6526c58de29924d997dad187dd300a0f557b5c04bbfc0be356aaf71c
MD5 5f1b329c2a7bc36417c52c4773a3926e
SHA1 04d27c22c75b317cbc130f6c2d1de3a131f6fa51
SHA512 947617456d3608d27c5807a9fcfceb8e3d0e4fb04ec2988645f8c501d7354c0c6c7db462110b266281ab8808fa14a0b37258b7c601534e52725186c11fa93ee7
SSDEEP 192:sxZORIyM/jK1Ml8Mz9/flsIVr2+uIgcq5ZwIdpwTHW6+WNrGt/AwcDoSBmIg5EJ:sxZOKL9/flsId2+7SxqHbg/xS
TLSH
T18152C612AA345D77CCDBE209B9457B53DBF56562D3900E44AAFCDA0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7147630a82d04a036f407b87572380bd6a8b9dd3c997a13b3a8e311c99234c39
MD5 a5ca55af67c76fa0c5d7227de5a7600f
SHA1 05799b789d105e1842fcb128410933ac90138d66
SHA512 ab5c7191cb857e4edaec02fc6491691cfb6b1e6c50418bb53a328b9fac06c7c2212f7c1dff0f43e92abd142ac61f73ec34e21107536bc4e9a2b3954b2569eb6c
SSDEEP 768:FuiM4RkJq7pLuLfsUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLdWTLlLBERil:FuiM4RkJCEfsUWvssLgu1jamdWTLBWR8
TLSH
T19FF20C7B2C0CCB7E4F845E9CEC2ABE9A6EE8018F9798895447F9440C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 cff9a0a6781a8f387a717cdf8b0ffb8a6d9da37a8b63a60e56ba782f79f8801c
MD5 a9f84d60cd0022310c40f07a3260104a
SHA1 3fef1f7d9969943ce2cc2206670f99188ada5180
SHA512 cfb7507f568d60d1b00f4a77dca6284ba730822c67fc9f8feac0122a213907e3e9a858451b8a30e985ec0fa97c6025fd232df2fb0544cf51b5860eec94182940
SSDEEP 96:KUQwKl2COvCK84C6AQKFqeLSKgY6iogKZmCm:yLt5nQBDI
TLSH
T133E12482757A02C239BD15099296873B5D417173711CEAEF7BA831760E6AE210CFF9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b222813b-1f8b-4bae-94e4-b8a3c2d3d742.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b222813b-1f8b-4bae-94e4-b8a3c2d3d742.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 909cb3cbdaefb9b4c3f58a42a9c48d20fdd453b0e0647487be214e98942d0e76
MD5 1625b86f48da3d246c1dbebd5cbe377c
SHA1 237249d4325eb05df3961921644ce252ada8fe14
SHA512 c4e4803d8b5e2152a7472d930b829390b40b295157d7c316d0385bebda5a68891b1461c979c86ba21d2a666a4a34ed7877cb33d826938fc1fd059acaf1f6c8c8
SSDEEP 192:tONk6JpDQmiUyXgRcQ4sw270jzo/ybXbenshsQqmsU6:tONk69nRcQ4sw27kcybXY7zU6
TLSH
T13C120A35A879AC2B1EF3B405B4873763AFA41177DA84AF14E6E85F1C00DB64C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b65e9e95a270ca0613b45ca14bb6e301d2ace01321dea20991a00ce955713230
MD5 bb331cb0ff61b570f4f7de7b605cac68
SHA1 f834d049708dfef3e390cb4a9639dceddc125aa4
SHA512 682db42d2ee04ea2bff33f4ad3ed7cb3615c6ab3b6afdd797d95fbf38b32ba249cc70486d1e4ba6bbe82621dc5aa40738aed3e55c98f88e4e93a9681ad54a258
SSDEEP 192:lONW6JpdQmiUyaggcQ4sw270jzo/ssFHWZj+U6:lONW6jsgcQ4sw27kcsk6j+U6
TLSH
T12302D835AD797C7B8EF3AD45B5472B236FA41137E6946B04DAE85E0C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e65301b0976fbed683b47594e943eb77fac584a174aeb6e3f0546222ffc2ba6
MD5 f4872c81a4d7e2434f597ebe04cc0c2d
SHA1 706727f12a1ec541120c2d93875f51ca744f066d
SHA512 26034b68e22b0e8e5d6ffa97cb757ec790a4c9c2a6eccfd1db96fa2fedfffade28381c6ca73dc78625052fcf003644b98ddba9bde49e30bc3d6edef12334feeb
SSDEEP 384:nQtNn/s3n9SfsNxksP2D5GkDdQ4sw27kcybXonzOObjI9G6w7iJ:Qj+9UVpYFyTonz29MiJ
TLSH
T1D0928E359C399D7759A3A555F58B3A27EFF8207797C02F04E6E8AF0C00CB69C170691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f807e3a3624d52c7495b694549aaaed802f26f77915db80fc83f483df12d1e5
MD5 d11de0df90b204e12b5d1d7473203895
SHA1 8b8789a1f7b9eac0aa6fd77ebc9799e06c726737
SHA512 520b2e15478189737824821c8b8063aebb6d5ae04f7ac812b41798a4117c5f0175cfdcfe66d48b173ea94744c6674ed10ec506e76953d01d368774bb34a5a03f
SSDEEP 384:nutNn/s3n9SfsNxktP2D5GkDdQ4sw27kcybXonzOObjI9G6w7iJ:uj+9UupYFyTonz29MiJ
TLSH
T1B9928D359C399D3759A3A555F58B3A27EFF8207797C42F04E6E8AF0C00CB69C170691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 38b1614b32812dc60c706a4fe12579c3943c529d91fe63c41b0dbf47af71b623
MD5 df5800984f69e47eab1294345d5c658e
SHA1 52e1ce956ccee4f6911cd08eea0af8e4bcf1f40d
SHA512 b18b1f489b7f1b838c290f6d53d3556de20d85ad4ab87e1c13f61d70e0a70b2f4d62aade24c0ffeac3a855a2269b356e3c2036b5360c1300fdd0e76cbbde0c3a
SSDEEP 384:nfiF1tNn/s3n9SkzsND8TUNTUlIlktP2D5GCDmDfYeQ4sw27kcybXGzzOObjI9G2:qF1j+9HKwgPReYFyTGzz29MiJ
TLSH
T157D2C5F598E78936E9AE4783A77E3D569EBCD063B5845A80F7C45E0CCC861BFC206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 99f73753e5f84e614848629749b53fcee0d3da22f488e079bc0a90c863259e14
MD5 70f321796884d9c59bfca5037ec121a1
SHA1 b3700d1e8c6b8493014e062b3f206dc94dca521b
SHA512 1b932ad97ab4e2425c6f3657ba25a08280dd962666893ef74285546f3d733f3f3adea0a45666290af5ca26e4473772cecd2f7a6eeccf96b325fed518c0aef7cd
TLSH
T11141F95CB6F91148B3776E5A9BF6A96D487BB8772E06D49D00110D4F0666E00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

e848342d-fb4d-4f02-a37c-45a994bd2811.tmp

Path C:\Users\Admin\AppData\Local\Temp\e848342d-fb4d-4f02-a37c-45a994bd2811.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4284_129680129\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download