c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m1-eL.svg
Size 3KB
Sample260801-ay379stgrf
SHA256 c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31
MD5 2226f49d0e59c46b4a18649eb679ae54
SHA1 c969dfea4218c1fab67060e9393a7fc24cc5547a
SHA512 a155996290a9d678506c7112a083decaa035069718b565052611fd751a1fb9378bb55dbdb09a8fabc2a0f5caa91dfbc2eb1e106fb2f9cba9c2f00608c0720af7
TLSH
T1C771368876F87EDBD7D802570D41D4B84B2F906BD822978DD3CBA0E8792826C735E5B0
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3096_881883113\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_117031234\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6064	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300182999882070"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{D7D592D9-913D-4D6A-AC0E-B1014E9CADDB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3096	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3096	4224	iexplore.exe	89
PID 3096 wrote to memory of 4388	3096	msedge.exe	90
PID 3096 wrote to memory of 3660	3096	msedge.exe	91
PID 3096 wrote to memory of 6064	3096	msedge.exe	93
PID 3096 wrote to memory of 3660	3096	msedge.exe	91
PID 3096 wrote to memory of 3660	3096	msedge.exe	91
PID 3096 wrote to memory of 1368	3096	msedge.exe	94
PID 3096 wrote to memory of 1368	3096	msedge.exe	94
PID 3096 wrote to memory of 4144	3096	msedge.exe	95
PID 3096 wrote to memory of 4144	3096	msedge.exe	95
PID 3096 wrote to memory of 4144	3096	msedge.exe	95
PID 3096 wrote to memory of 1596	3096	msedge.exe	96
PID 3096 wrote to memory of 1596	3096	msedge.exe	96
PID 3096 wrote to memory of 1596	3096	msedge.exe	96
PID 3096 wrote to memory of 4944	3096	msedge.exe	97
PID 3096 wrote to memory of 2268	3096	msedge.exe	98
PID 3096 wrote to memory of 4944	3096	msedge.exe	97
PID 3096 wrote to memory of 4944	3096	msedge.exe	97
PID 3096 wrote to memory of 2268	3096	msedge.exe	98
PID 3096 wrote to memory of 2268	3096	msedge.exe	98
PID 3096 wrote to memory of 5904	3096	msedge.exe	99
PID 3096 wrote to memory of 5904	3096	msedge.exe	99
PID 3096 wrote to memory of 5796	3096	msedge.exe	101
PID 3096 wrote to memory of 5796	3096	msedge.exe	101
PID 3096 wrote to memory of 4532	3096	msedge.exe	102
PID 3096 wrote to memory of 4532	3096	msedge.exe	102
PID 3096 wrote to memory of 1404	3096	msedge.exe	104
PID 3096 wrote to memory of 3848	3096	msedge.exe	105
PID 3096 wrote to memory of 3848	3096	msedge.exe	105
PID 3096 wrote to memory of 4892	3096	msedge.exe	106
PID 3096 wrote to memory of 4892	3096	msedge.exe	106
PID 3096 wrote to memory of 2712	3096	msedge.exe	109
PID 3096 wrote to memory of 2712	3096	msedge.exe	109
PID 3096 wrote to memory of 3488	3096	msedge.exe	110
PID 3096 wrote to memory of 3488	3096	msedge.exe	110
PID 3096 wrote to memory of 1616	3096	msedge.exe	112
PID 3096 wrote to memory of 3928	3096	msedge.exe	113
PID 3096 wrote to memory of 1620	3096	msedge.exe	114
PID 3096 wrote to memory of 5220	3096	msedge.exe	115
PID 3096 wrote to memory of 5220	3096	msedge.exe	115
PID 3096 wrote to memory of 1044	3096	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff89fbbc188,0x7ff89fbbc194,0x7ff89fbbc1a0
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8250898350491726384,18130899359214046546,262144 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,1964068114789206443,11142333952764462278,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,9712257933947170586,8594788380578913432,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,17882671721208515699,3037803172519320844,2097152 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,17416073114099641365,14821229730721453889,2097152 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10302650355840683951,14723408924115322895,2097152 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:9
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10678341374855961820,10748963856138473032,2097152 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,510486500990590479,10130653637987057717,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,3464578740154625065,12591741022045132114,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,6147483526290498322,7702077625425566153,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8282295676372098249,17333017274138785042,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8282295676372098249,17333017274138785042,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,15959527384726368903,3529018960098970075,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,9740536049620325732,12924314885710485530,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,10581327283675731132,3264507942838672950,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17655810393599671054,10682142886487483404,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14269848956879664763,3249814596175363895,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,1080796149164058274,162310821172485218,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,6822092606877668445,8760021485339869078,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,9939894910541702125,15998466303457342584,524288 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,14444437619363357720,12056083567588322032,262144 --field-trial-handle=2392,i,15857617051825731805,7347806673722845809,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8493722fbe07c3d652355e2829955ab2a543ed80a158d9aa9575dff7dd76242c
MD5 448d9dc7a314d3281da4a4d522ebe143
SHA1 8c2029e965d705dfe5b8923df92121e497498340
SHA512 a3773a7b58c9b16118235d5a52bbf59b4d07fcc5b40f799b0cb2d3dfe50a3e556cb0f28bba1c21964561ed5e9561002ed443e1ff94c94ef304bd249bff57a2de
TLSH
T1C66150D5231A2B92EF208EB1DDE2764D35F3C754090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ad6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ad6d.TMP
Size 3KB
SHA256 6dd563a3977f12da44f68abdbd6fcdb837719215381cb81662f3263c29200f2a
MD5 947e6e0b9c2382df9a47d7e756e30a7f
SHA1 26fa2e2d89211aa3ada11be357f8819adf8fe3a9
SHA512 0d80f7c421ee170406b0aaa119d2a23fd7eadd4a140055dadc582b1ca9582a0bb5fa96a8ce023e8ca900191ac1e71fc671f4dfa901dea46b88d3df9b3a8b0012
TLSH
T1A16150E5271A6B92EF204EB1DDE2764D35F3C754090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95949ea996b191bf464b9aa732dc14e4bfcc83add18899f557addb4b1e679f8e
MD5 f9b53d3871fbc30cc1b3d11098f8f0ac
SHA1 a762d53cba827e256d63a9e2edce87666a81a458
SHA512 aba6bf4c37f0fc0aab83e496ece06fa9f6dec9f27b00f2c75336dd72210ae95346dfd9b33d07f1dc3f3171ebedbe9a6499cb00995bb3b6b882114c8f8f3c61ce
TLSH
T18751AEF7C7E8866D890156F0EB187E1BCE2D0964432C3D5AC8E4EF5BA3E2472D14165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aaf77cf07081ac4d301b1bb0d090ad7c7f108ee86b551acd27795114337eef0c
MD5 89cc4428b271c6ea4ee167277d1ac616
SHA1 b1240ec9f5e57543e19d728f3902a81d4f84f550
SHA512 4e2306ed75471bc0acc438388de7e1cb9dda941d6500b2eafe48b9714649793735d6c41338271f0eb38ee78eb1c078f75fd9506978ee4c15cbdd2ba42adefda1
SSDEEP 192:sxRyRNCR/fmsNrDeZ9WrDqzoA8p4i/g6+WNIYD9L6SQGIfIgDCNtyJ:sxRyWR/fmsNrDY9WrzL/5IbS4r
TLSH
T15742C759AE28693B4CCBD61DBB557F53D6F9603260D01A58EBFC9A1C00EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec4d772932178e170afc813f1f0df7d5694fefcca5ad74365b7e35e1013271f5
MD5 66071bac54da3291259f039f74b0bf2a
SHA1 6f3e884cee881caeef7f1149ec06edd564333b66
SHA512 5e97fc9c244c72ded4dd397d35886d7106ed902bdd5d8784e021e024db522a1a6ea8452eabeecd74b5f83a6ba36ed1137954f8082c59580734453c32decbd38c
SSDEEP 192:sxRlRNCR/fmsgrfeZ9WrDqzoA8p4i/g6+WNIYD986SQGIfIgVNtyJ:sxRlWR/fmsgrfY9WrzL/5ISS4M
TLSH
T19632B715AE28A93B4CCBD21DBB557F53D6F9603261D01A58EBFC9A1C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec2f9515c4dff6b772e6513104b5e2dec4b2fc767b6179077b346401625736c6
MD5 84c0d23733829f0af5be495ffae4f0d3
SHA1 658af7c47bbda1b07691c27319efabc953762a26
SHA512 78a92fff56bce02c4e2130d389928f4730205f75d5fa1e426b0cc9e05890d388568e0a4e6a94ce9c6dac93ef041beacb81ab62e6e33c5fb15f43abf99f9b606c
SSDEEP 192:sxRyRNCR/fmsNrfeZ9WrDqzoA8p4i/g6+WNIYD986SQGIfIgDwNtyJ:sxRyWR/fmsNrfY9WrzL/5ISS4N
TLSH
T11442B815AE28693B4CCBD21DBB557F53D6F9603261D01E58EBFC9A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2407378b3c66caba351347d32df032fafeb8402fc600d3e7e98e8d5bd17d5c67
MD5 0083f48e8b03e46e97e1cc95fb006396
SHA1 075507aae48d77b19df217050467cba409704e46
SHA512 22167f9749859defa64e00fa9afef3e56a78defe66b75b7aa49a78005879a915fe8e6a1b2cbe7b168b4b67dca1a7ca41de2d6dca8c48b4140ed95aa0ee539128
SSDEEP 768:azfWOI7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EYc167ropq4FL:azfWO0Ef30Wg/XfHfu1ja4EYy6Ipf9
TLSH
T1ADD2EA7B640CCA7F4F800ADDAD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e2056b9854a87dcd77d90aaf1eb482c6a8dbd9883b0b66dfd733aba28d1effe
MD5 7514d39d577a9b3f4ea5163a31a66374
SHA1 0b1bd1531a23bc720a7e67ca6d4bec3e9d0d5c1d
SHA512 02e231f1d99d4c9c6906558cd1ba611c3033ad327324247fc926060f82e4ae9a06cacad48bcbb4485fae32649132779a1b7abf0137095af71fed7d5b54a7e1f9
SSDEEP 96:KRE/iE/nE/OE/iE/UE/0E/kE/iWE/sE/5E/RgE/SE/iK4E/HgE/IE/icE/yE/6E/:CE/iE/nE/OE/iE/UE/0E/kE/dE/sE/59
TLSH
T145915141727B1250393F6A0CC5B4A82B52827463745CF56BBFE911A60F6EE125CFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0a868c5a6c482569e032d674a9ea59a6f9d2e4e56cdc8143430069a8c107e980
MD5 5c6b31c2bf4d7be08d9f483689fe6440
SHA1 91ce39282d4c277f6cb28cce8f70f1dfa62dabb3
SHA512 eb512a5abb1521f8a465d74d5115b962568cd1f82f9d5f3aba1a9e355c8dcd2c3aa8f39132486d8dca5e78a37ac9785604258d8b0eaa138318a0d0f351286997
SSDEEP 384:n9ZcIH38NCPaGfUPIdLWZlf8hyEG6f77h7F+ay2rEoajo4cdR8eHhVODjYPNDUMT:lH3rwi0QW6rEnjN3Gac1Fc2ewBKZOv
TLSH
T14DF2BF7468789DB38CEFE745B54377439EE0566394D40AA8DADEBB0C14836E8270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a2d95775429a0e437d4738301af23fadbc295846c7ec951f315e88af922ab514
MD5 412d36be3c6daf834b3b9e9425a7ce48
SHA1 7f3178cf824895e73d7f2cd636109c10adc4aee9
SHA512 366bbdb8ac2e6cd356183147a234e08fca7ecfab4b020b755374c089236352073164058022e983abf7237b1f0f481f2d5946dacd9479b7ad25d358353661a8f1
SSDEEP 384:nEZcIH38NCkaGfUPIdLWZlf8hyEG6f77h7F+ay2rEoajo4cdR8eHhVODjYPNDUMT:iH3Iwi0QW6rEnjN3Gac1Fc2ewBKZOv
TLSH
T167F2BF7468789DB38CEFE745B5437743AEE0566394D40AA8DADEBB0C14836D8270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 077eeb9b41d8c273b500ad7ab43667487f71c7de390ee467b32af71fe8c6e782
MD5 6950a0c70d603d4d31c92384d2e79bcd
SHA1 1eab0d751f78a13112367c82914bbf7f9d431863
SHA512 02862bc4b75a4860ec0b744f9bd3479cf500917950b194caef57ff12d2b6657c0871ebcbda2c92014337dbd9a140c4d05d5891e60145a81e930256e51caa9bbb
SSDEEP 768:cFQS3NwgufsQWbrEnjN3Gac1Fc2ewBKZOv:PS3HXbQnjMaf2evZY
TLSH
T141038E799864DE779DEBD785B6467B43DEE012A3C4D859E4DAC9AD0C10C32DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ec2571860826c40d1a82d3d566502a24e41ce3a52b0316a02a2a2799e9e4e276
MD5 bbff2be9c8ac2c85246927f7094a7ff8
SHA1 9614de96378eb45163ef5e6014c7744aa169f1f8
SHA512 48b7ca251044e15cd977bf886a968e84e229aa0f1868d2f6e3bbce99d6e6cda1e8d31cfda788901a22f800aee74030753088d5b3361f5579cdde15d8922306a7
SSDEEP 768:Prv+4UNbdg3Nwi0QWOrEnjN3Gac1Fc2ewBKZOX:PbsbS3kXOQnjMaf2evZE
TLSH
T13713C034692C9DB38DEBE245B54776437FB4169384C50BA8DACA6B0C15876E8230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ddaf8411860ca62d62a97920461f75cb2e4cb8ef4a4bf556414a51175cb6feb2
MD5 70810847257d60d3ef2b75b29252ade0
SHA1 5a4d7a4ba761be68a71494d29453c77939be9fb6
SHA512 55e09d22560bcf878f6646ca5bfd4e822c7761a72d7f4ea9db993399b84a84dcc6e33168b67e1aadbbecf057ced54ca2947028d8761f363288e929e2cdd4b7b2
SSDEEP 768:rrv+4UNbdS3gmi0QyrEnjN3Gac1ZPeVH1SCz:rbsbg3X7QnjMaIEH1V
TLSH
T14203CF3169A89A738CE7E38571877A037FB4525385C40BE0CADD2B0D02DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26daff1f-8c9e-42a1-af10-e973f5c3455d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26daff1f-8c9e-42a1-af10-e973f5c3455d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe598469.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe598469.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

73c51e82-1be9-45cd-a20a-74513e60b35e.tmp

Path C:\Users\Admin\AppData\Local\Temp\73c51e82-1be9-45cd-a20a-74513e60b35e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3096_994309865\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download