3ccd1b7a893ca5b1ac893b7662e9704d262e989a49944259afcf39310a791b15

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.cms/img/icon.default.svg
Size 1KB
Sample260720-cjrl2act2m
SHA256 3ccd1b7a893ca5b1ac893b7662e9704d262e989a49944259afcf39310a791b15
MD5 81a465b6c2a9e43757279cb37c24ed08
SHA1 e8498d1e14230a50bc2f0e87149a79243da21a63
SHA512 8f8746d5a0228ef7782323beac0870adfb38cce06633708968ee424bcaa21939b596f0acfaa74190056f7c7767a0ccd30b942259da35009fa2814a2e787420df
TLSH
T1C631E077939117B229C407100AC1622C393B151632F0C3EC5FEAD6AABD165F704BC8A6
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_247647600\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_247647600\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1446043664\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1446043664\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1360682972\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1360682972\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1393213293\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1393213293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1393213293\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1393213293\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1446043664\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1446043664\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1364_1320807750\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289868177066482"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{B6E76382-963E-4F25-AB50-AFCAF23FD62B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1364	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1364	4832	iexplore.exe	90
PID 1364 wrote to memory of 5472	1364	msedge.exe	91
PID 1364 wrote to memory of 4564	1364	msedge.exe	92
PID 1364 wrote to memory of 5680	1364	msedge.exe	93
PID 1364 wrote to memory of 5680	1364	msedge.exe	93
PID 1364 wrote to memory of 4676	1364	msedge.exe	94
PID 1364 wrote to memory of 4676	1364	msedge.exe	94
PID 1364 wrote to memory of 4676	1364	msedge.exe	94
PID 1364 wrote to memory of 3840	1364	msedge.exe	96
PID 1364 wrote to memory of 3840	1364	msedge.exe	96
PID 1364 wrote to memory of 3840	1364	msedge.exe	96
PID 1364 wrote to memory of 6088	1364	msedge.exe	97
PID 1364 wrote to memory of 6088	1364	msedge.exe	97
PID 1364 wrote to memory of 6088	1364	msedge.exe	97
PID 1364 wrote to memory of 2032	1364	msedge.exe	98
PID 1364 wrote to memory of 2032	1364	msedge.exe	98
PID 1364 wrote to memory of 2032	1364	msedge.exe	98
PID 1364 wrote to memory of 4848	1364	msedge.exe	99
PID 1364 wrote to memory of 4848	1364	msedge.exe	99
PID 1364 wrote to memory of 4848	1364	msedge.exe	99
PID 1364 wrote to memory of 3708	1364	msedge.exe	100
PID 1364 wrote to memory of 3708	1364	msedge.exe	100
PID 1364 wrote to memory of 1816	1364	msedge.exe	102
PID 1364 wrote to memory of 1568	1364	msedge.exe	103
PID 1364 wrote to memory of 1816	1364	msedge.exe	102
PID 1364 wrote to memory of 1568	1364	msedge.exe	103
PID 1364 wrote to memory of 1140	1364	msedge.exe	105
PID 1364 wrote to memory of 3288	1364	msedge.exe	108
PID 1364 wrote to memory of 3288	1364	msedge.exe	108
PID 1364 wrote to memory of 4868	1364	msedge.exe	109
PID 1364 wrote to memory of 4868	1364	msedge.exe	109
PID 1364 wrote to memory of 5896	1364	msedge.exe	111
PID 1364 wrote to memory of 4768	1364	msedge.exe	112
PID 1364 wrote to memory of 5676	1364	msedge.exe	113
PID 1364 wrote to memory of 5248	1364	msedge.exe	114
PID 1364 wrote to memory of 5248	1364	msedge.exe	114
PID 1364 wrote to memory of 5288	1364	msedge.exe	118
PID 1364 wrote to memory of 5288	1364	msedge.exe	118
PID 1364 wrote to memory of 1792	1364	msedge.exe	119
PID 1364 wrote to memory of 1792	1364	msedge.exe	119
PID 1364 wrote to memory of 4504	1364	msedge.exe	120
PID 1364 wrote to memory of 4504	1364	msedge.exe	120
PID 1364 wrote to memory of 1252	1364	msedge.exe	121
PID 1364 wrote to memory of 1336	1364	msedge.exe	122
PID 1364 wrote to memory of 1336	1364	msedge.exe	122
PID 1364 wrote to memory of 3580	1364	msedge.exe	123
PID 1364 wrote to memory of 3580	1364	msedge.exe	123

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.cms\img\icon.default.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/.cms/img/icon.default.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7fffaadfc188,0x7fffaadfc194,0x7fffaadfc1a0
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,7205460188471670885,17111795956372682616,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,11523002984751527244,2293916845141264500,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,8255783942566256499,8971397802266125071,262144 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,5747456416520346344,125526293311404419,2097152 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,7611447967649731844,2968011295946554000,2097152 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,8672456152444306151,7705655102572063045,2097152 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,12811438173867373367,16540890144243149158,2097152 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,5532056672394818420,17178235360485152246,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9532026402200513284,11367955207403721925,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,4369667876445358477,11981510428509851594,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,105304074944918018,11917887935868544143,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,105304074944918018,11917887935868544143,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6828630207853288193,11151825317897633050,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6879105170373007641,1689264989247924313,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,17976627456895364919,8094697587583226385,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,1345731149100349953,10113950688646962632,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13722286016878972405,1163859505253917171,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3228,i,14048752940856269574,5902000369974326571,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:14
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9243806948407547781,15663176707529235920,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3185524858148216867,1747364148957106271,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,13896990783352373466,10319751947248227427,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2996,i,3855782626982738560,10050431908016413638,262144 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,11792270533651850936,14476199724138387709,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,4838601601010567118,18120323349008428841,524288 --field-trial-handle=2616,i,12536887914505162621,15261335845637265882,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:14
    3⤵
    PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a9d158a44dd98c02291f82dc35f7fceaab2c66e6bef911a1acc46a2a1980f9f6
MD5 5c7fdf213b12df9d3d930fa3c0a3cf7d
SHA1 06e71549fc9a6539ac388a585b95aee6aef9e25a
SHA512 55195ee72c3e63e9cca6d180a6035b6d4896a762739e3afca0cd671a3ce2022aa17355e9cf13133b9486a82c770a2c56d7f66ed5948853ed101ff9f6d6a5dd4c
TLSH
T151519B5047769DDDCB6A9EFD53DC0D4B72F8A43B06279F0B044A6E7819EA344570089F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bdb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bdb8.TMP
Size 2KB
SHA256 b1028eec553a0dae4e967fea7d85298caeb0575d6fabd302ac41cf826b571ed5
MD5 04b4ecf16914de87b87c4a2bfe063617
SHA1 3febd7478564c6214fa810aa2d50ceea4d1de67e
SHA512 424757df84ad4a6cba889a5bff3d2d1a7bc085489787d44b2cfc5824a3bf3e025d626bd6a7bc9909e1fdb58b1929e50b9f4e7f2ff9b1cf6cfe930ae61c203992
TLSH
T1EC519B5047329DDDCB6A8EFD53EC0D4B72F8A43B06279F0B044A6E7819EA344570089F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0217335fa82c4c7a2779bae66d74602441aff2811c28f0c9e5242e59beb69f60
MD5 64ec6e941cf770f8799111b7875ad669
SHA1 0ce8eb6481fc7c479d19cde67a59519e8b875a50
SHA512 07fe7efa8d4be6dfc9f8de6ca3f4aefc06329f842d219acc806fa9eedbb88925d36c5f0400443385fcaa6c4b7ff7d8f0cc0c7a8d6e4911b7cba287e0878c4488
TLSH
T1F6418DF3C3F8856E8A1152F4BB186E1BCE1D0955832C3D9AC8E4AE1BA3E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a164664a3ad0e4e86aa67348f288e38619281060467badf92bc4e5a6cea3f703
MD5 83900739d0f68705ab34503aaafc0b88
SHA1 e38bc7d2463c312802708563e0b7d46e2a02f38a
SHA512 16d864a3208c7850111a924cf93657350680af65e18e7c77b37657f7fa674d389d986e5fa5f540a69a1977721b4ea92a346acdc57910dd03d36508f8bcd76af3
SSDEEP 192:sxRnrCo/fksGwGbZzMaqzoA8p4q/g6+WNIYZ7PKsiGV85IgVLJ:sxRneo/fksGwGVAanH/5I6f8Fz
TLSH
T18432A6166E28993B9CCBD21DBB557F53E2F95033A1D41E48ABFC8A1C05E76DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 80d353669f0dffda84476a0567bf0aae30e646a2887961d7f2adbb831436e9a9
MD5 85e0060f36d527a53b7b2111344222d5
SHA1 5eb5ca870224f76ab93f1d40faebdc4ad6cc574c
SHA512 bc932d959941d968d84f75fcead8c6d7542dd532a0c2434225818a6f31ce2992747e4e16939d5f92d8ecf10bb15b3b1df933da85c7433acc61cc5573af9bbd58
SSDEEP 192:sxRcrCo/fks3wy+bZzMaqzoA8p4q/g6+WNIYZ7PBsiGV85IgDFLJ:sxRceo/fks3wy+VAanH/5Izf8FP
TLSH
T13542A6166E28997B9CCBD219BB557F53E2F95033A1D01E48ABFC8B0C05E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8f3d0d826e464f47b35526cb983e2660f8b8ee1e20b82ab4828640d8ad2f0d75
MD5 3ec3c821b44a2f8a87183f5cfdc88f55
SHA1 7b89eb97eebb0cc04743fe48e73bf32c8c14f053
SHA512 7a2755a5e28fbe9d4c88bcad65066176a1f1eac320d0777091ecef8ab77ef385faf2154488ce2ecd06b8b00bb0c081fe18afc4ac0f72fb714005b0bd0ec9e0a4
SSDEEP 192:sxRcrCo/fks3wGbZzMaqzoA8p4q/g6+WNIYZ7PKsiGV85IgDHLJ:sxRceo/fks3wGVAanH/5I6f8F5
TLSH
T1063295166E28993B9CCBD21DBB557F53E2F95033A1D41E48ABFC8A1C05E76DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 69791f868e2b55db8920ced1c9e3c9f2ab16e1add47c357a13887372074d5763
MD5 4f04e651449294d0c1e9b1e2eba81534
SHA1 0cb45d06984b488d96f1320afb0547ee99f863c6
SHA512 6e2fabb0bcb8486a9e7b7d0f620b6b19fe26afc5cef1e50fcb4a71de732d80f8ed1f2453a3356ce9811c517a396855029a29e93ea04c0e3e62abff10e7acdae1
SSDEEP 768:ky2SiS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx/uSV4Hrof+9:ky2SiqE7evWgd5f/bu1jam/uU4UW9
TLSH
T1E5D2DA7B640CCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

069a72b1-ce91-4289-943d-b18ba63c4c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\069a72b1-ce91-4289-943d-b18ba63c4c04.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2544289411e4ebefbbd21b3ebc47e3bbb83df954b8448485b8ef8825b635a5ee
MD5 f40452e7b8f1df52a11435906666b961
SHA1 981f72929a91a5d4c79204e4b53bacbfa2c10207
SHA512 d4d6173be9f76fde061ea6f9e39adb6cbd2880a4c0e595ba55b010822b74fb52660e6912a131aeabb501f2592e9c467404eaeec205ddbd5bc0eccb9995e3c09f
SSDEEP 768:oj+9a3DFqgLfLL7Aam6aQMGdjWca4Ghf9jeP:39a3HtmaME6pj4
TLSH
T150D28E3158A9DD639CA79695F72B27C7BEF011B348C80E84D9D9AF0D06D328E2707D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 566d0b9ad2fd276b5a61dd8b9f88c2a3465816dca86886dc23d03e5e9bde9222
MD5 2ff8cdcd43247ad7ccb3095206ec837d
SHA1 1c6d124783d98201338e9fb2c8ae2561febd1dd7
SHA512 62206fa6db0c6dfb1d209cefa1f8ff795b5e91fa27fb36008009b7d9cf417cf088b0746690b1745f276359f608fc94c3a769e99924d70cd4e023816fb1d1494a
SSDEEP 768:frv+4UNbdE3IFqgLfLLsAam6aQMGdjWca4Ghf9jvwC:fbsbO3uemaME6pj/
TLSH
T140F2AE31A86CD9739CB7A295F21B66C7BEF021A388C80E84D9D95F0D469709E330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 777bf1b89205eae40b5845fa4bb906de29579698103dae4bcc4a2abaa21b292e
MD5 b9ca3f2da4c3c7fdcab1844f7fee6380
SHA1 ee6c15bc265434c9a6bac8726584fae2f6839d33
SHA512 3c12c9daa596eb778adae61d8a4c933ddd281a6a659fe96746fb621526d2c0b6f9ff46953411567a01ef8140d9084c4a7eca19a337dc355ad62c17427bc53867
SSDEEP 768:/rv+4UNbdq3a8qgL2AAam6aQMGdjWca4GhfBKPeU/:/bsbc3qKmaME6pCH
TLSH
T1F7F2BE31A86C9573DDB79A89F21B6787BFF021A389D40E84D9D95B0D839308E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 55bc9c7535525a6a9246b33b9b91b84eba82e4653c50efb77fc233b3a56e65ee
MD5 f9d875531a2657992aa7229ac7d0f286
SHA1 31723a1f6a6eef8f8b86b4103be3b2ccbfb40c1a
SHA512 9a2f3166aebdbd7a5f793fcaf7586ac9956b329b82ad43109f6b6969ac66640aa82beb41058708a8676450f9bf77651f672dcfb064abfb57622e5996583f0857
SSDEEP 768:QF1j+9V3Rwgd0KLfLwAam6aQMGdjWca4Ghf9jeP:99V3cmaME6pj4
TLSH
T158F26C3298A4CE67ACE79BC6F71A7687EEF011A388C85DC4DAD95E0D01D318E130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 97075d103ab7fa7b706d93e94b2756ac81f93caf1a4d4c79da243b2323f919d2
MD5 25cadc83626594441159d71d280d1662
SHA1 de5e8495d3c8ed89ee33518cbb664b27e9866d28
SHA512 50bb8d1bb5952815dc4dded60ae3a80dd8e29bd09d4f274520cc17f98dab849a294b3e4a11537776b8b405aba74371817336d9d6b8adacbd9697ef537c8c7c44
TLSH
T15551296626B287BF8E652EB6EF04A6607DD8DEB416579040C2221A914DDB1770C073FD
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe59eaa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe59eaa4.TMP
Size 585B
SHA256 58891dae028f3558494c3e15d6129fbf999af317b58d788b0c5427307114549b
MD5 75512538b53581658f678a9a22df9290
SHA1 8eea3c603667500bef5fc3b4382df04bc329e4a5
SHA512 39e219ef3193f08f53ffda2ec2361cbdde4ae179643f1c9a35610495973b57df87108163eacf3caf64a484c36ede6a60f1353f1947b2b2d069a4dabcad8ddef2
TLSH
T15CF096779EB21831D16A02F2589F2E5840C86912080049D195C0FB3781FFC3BD5008B9
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

bf2ef7ec-7dc6-4444-8738-526fa852c330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf2ef7ec-7dc6-4444-8738-526fa852c330.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1364_578367071\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-193-0x0000023652B70000-0x0000023652DB1000-memory.dmp

Download