61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260804-1bcd5shb78
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2080338928\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3036_666962896\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_286096093\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2080338928\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_385134504\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2080338928\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_385134504\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_2136204456\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6768	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303599598230150"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{75CB4ACE-FAE7-4C8C-B4AC-D6640C286B03}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6956	msedge.exe
6956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3036	2428	iexplore.exe	90
PID 3036 wrote to memory of 1412	3036	msedge.exe	91
PID 3036 wrote to memory of 4400	3036	msedge.exe	92
PID 3036 wrote to memory of 6768	3036	msedge.exe	93
PID 3036 wrote to memory of 4400	3036	msedge.exe	92
PID 3036 wrote to memory of 4400	3036	msedge.exe	92
PID 3036 wrote to memory of 5132	3036	msedge.exe	94
PID 3036 wrote to memory of 5132	3036	msedge.exe	94
PID 3036 wrote to memory of 3732	3036	msedge.exe	96
PID 3036 wrote to memory of 3732	3036	msedge.exe	96
PID 3036 wrote to memory of 4412	3036	msedge.exe	97
PID 3036 wrote to memory of 3732	3036	msedge.exe	96
PID 3036 wrote to memory of 4412	3036	msedge.exe	97
PID 3036 wrote to memory of 4412	3036	msedge.exe	97
PID 3036 wrote to memory of 5580	3036	msedge.exe	99
PID 3036 wrote to memory of 5728	3036	msedge.exe	98
PID 3036 wrote to memory of 5580	3036	msedge.exe	99
PID 3036 wrote to memory of 5728	3036	msedge.exe	98
PID 3036 wrote to memory of 2844	3036	msedge.exe	101
PID 3036 wrote to memory of 3540	3036	msedge.exe	105
PID 3036 wrote to memory of 1296	3036	msedge.exe	106
PID 3036 wrote to memory of 5436	3036	msedge.exe	107
PID 3036 wrote to memory of 2352	3036	msedge.exe	108
PID 3036 wrote to memory of 2352	3036	msedge.exe	108
PID 3036 wrote to memory of 4716	3036	msedge.exe	109
PID 3036 wrote to memory of 4716	3036	msedge.exe	109
PID 3036 wrote to memory of 236	3036	msedge.exe	110
PID 3036 wrote to memory of 236	3036	msedge.exe	110
PID 3036 wrote to memory of 6172	3036	msedge.exe	113
PID 3036 wrote to memory of 6172	3036	msedge.exe	113
PID 3036 wrote to memory of 4064	3036	msedge.exe	114
PID 3036 wrote to memory of 4064	3036	msedge.exe	114
PID 3036 wrote to memory of 5844	3036	msedge.exe	115
PID 3036 wrote to memory of 5844	3036	msedge.exe	115
PID 3036 wrote to memory of 6956	3036	msedge.exe	116
PID 3036 wrote to memory of 4444	3036	msedge.exe	117
PID 3036 wrote to memory of 4444	3036	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8eafec188,0x7ff8eafec194,0x7ff8eafec1a0
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,5746208422241641408,7349497596668827191,262144 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3416595759431418256,18055053965285611066,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,18430944531364227720,1685723343686638532,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,7596107479491786684,9996731078276799968,2097152 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,17935644960142839407,9203346422040390597,2097152 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14934028682226787439,15330400828709385030,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,6597274519034764218,10872153654474973024,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,3595887721795685119,1346054033845612796,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,3595887721795685119,1346054033845612796,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7388309767587097773,2096010436386096266,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,12936458352187264342,2004730751752383985,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,8687043866389899377,11355697805815513100,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,8966017476057438528,2827636118486109707,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13007930463025709025,10790356942288514062,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9902458058702388148,17318271674944447813,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,3355904327513993897,2292681771202663421,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17742260749430732253,16719091337049799957,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4569633905230422529,3628134340635647583,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,4609070116321845546,609899567708214959,262144 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,14523040756702598494,9718570382485505828,524288 --field-trial-handle=2292,i,17337150618924094433,2789173830962770147,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
    3⤵
    PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

4bb32a6a-e73d-441b-ab09-887a5f487080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bb32a6a-e73d-441b-ab09-887a5f487080.tmp
Size 649B
SHA256 e92942d922aa98e516cac9e3d99de1b97b8bc7441ec047669192fd38a03a6e8a
MD5 98bfbfe57ed9437e1292b6a3106aa40e
SHA1 587d3f02d4a82b26bf3cb1087493cbe91b71a64b
SHA512 0f9d8fde87f0a441061be6cc61fb61f0a2c22adfbb27cc322197994454a2e7bcf7f6798286f7199828e0a4701434e348c22be070908c6db48789ea76edc0d5cb
TLSH
T119F028A6C821BC3729FD1B1860A85B47EB51136B3B81985F3B3C925C4FF563B8686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bfe060973e92b0fbf77d96f1d9152064176b6f62ccdf1b84083e3a4456cacc8b
MD5 b224262b3d9c1db0959bb15ba6755f50
SHA1 aaabd641711bcf7165b4028ccc16ea99cfef6d03
SHA512 b2d2d73d8903d883a96dcea57f4a3bb47d3db66944ee9d462892eef0efbc9e219d84a373d4cee383a3a4cd61817d1577e8f2c8650722790b8f8459b4a5781b99
TLSH
T1D151BEF783E8866DC90196F0EB187E2BCE2D0915432C3D5AC9E4AE5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eb1e241aacc07b7999c6db3f49ce815e9e3f6206baf570f28e451812ec473805
MD5 5055fa26af6b265d1fbcf9242978f59b
SHA1 1226055d40a3e2ab7cc9bbefd999394ca3dd3294
SHA512 68f860475cc20d67326505dd431cab3d402278a0b1a84ac8ae23a4e99ffa23bdccdc374be8996facf345b7f8eccad9b98a325534e64764a2175fe423cea18629
SSDEEP 192:sxRKR6yMqZjK1Ml8wCE/ffsZLNRZRI7SzoD8peU/g6+WNIYcC4CUsGQdGTIgjRJ:sxRKn8E/ffsZLN/RI7Oz/5IW4TsGQMjb
TLSH
T1B272F9056A389D778DDBD209FA957F53D6F82133A1905E44AAFCCA0C04E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0635e66deec96be4fc6c42cfc47eda352ccd4d0bb341d11ef0d8f7856c4cf3e1
MD5 cf73e391cfc2a3d15028f17fbaa88a5e
SHA1 3a87be1fcafaa63c06b906485ab2cd246d835752
SHA512 f53a7356ec2bce9a5e9d381d529ec75659d3bf92f3f511c898668b9d3898843c37541ea2886800af433cc0096b72dd7764a162336b302b67392198ca0726321e
SSDEEP 384:sxRKnqPE/ffsSDN/RI7Oz/5IW4BsGQMK8:sWqPE/fDJWa/5IW4BsGQo
TLSH
T17F72F915AA349D778CDBD219FA957F93D2F96123A1901E44AAFCCA0C00E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3f72ef00d891cf57eea8758cedf5b5949a8cd2c16dea13ea9f22375f012f061b
MD5 38c373e4caa4b9c2537111d80b8bd578
SHA1 fde826190649831536d0f9bfb3e58dde65ab1f3d
SHA512 6eb9bb11301f2bb3a46079158270f7b72e6a21af10531a30d496c965038cabeeecb4ded317c87236b23f9df25f7f914bce216f1b0da97c2f66670360975ca3c4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoobbDwzro/4i:Ob4YZnE7yTWg1NfwBu1jaPobHwAwi
TLSH
T164E2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF56D88D5447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 66e140e3c416a247df1f59662bf41092ae7197f6639f1d4893c4a3b0d13d1608
MD5 0f0a8b43848d2964f6eb1722d9309044
SHA1 e20e23108c637eaca4a55fe80c66869ff18da626
SHA512 0bcf4a43eb21e32cd31a6ca93c80f68f0666bd3889c6333dbd0ecbeaacaaefd105780cb294c27591663a3b28af2105fbfdf4a3f00a067668f2f95b374a422ede
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9fFL:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR8
TLSH
T1F6B24C11713F4680387EA90C91B8D81F96C2B4A37519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ca0245938fb24deee27929d70cfa6372fb464570e2196c5621ca2066c5626eac
MD5 392f2e50a4a1086ac54b11d227970630
SHA1 e7556b3b462d13116d3ed49d98431d282c40d105
SHA512 d1ad9b74869ca6a5761c5a06fbdb4bbfa9edf634c04c8c958c428777e4009d534ecfd62640b99f72aa21555813adbd1b4ed82845627a5fe5b85fe6350d113f6b
SSDEEP 768:OFQNQGwgMurAG3yYEMDV7TjKgqmUHhOGx:lNQlu9yvu7igRUH8Gx
TLSH
T171D25C71D8A5CAB7ECEB5EC5A64A3646DEE06163C8CC9AD8E6D85D0D00871DE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 70a2964068b19bac2976b40bf9c5a5ab44d64e0320e29a4c2fa6f177bb595080
MD5 9016426fe4caf28ec94dd4de191f771d
SHA1 6caeb1df683b2b01d4d8f05416f27655bdabed72
SHA512 bb105704b46ac4b1c529d7335b811dbe8b8c82379ffd7affbea10ea997255a5f712e8574d698bb21fcf93b875f876bbb772cd9668d354e6a9c00357228d21470
SSDEEP 384:nmiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTu1REqfbzG3+3YEeLYOObjI9G6w7ZV8p:NF1j+9SXswgUuSXG3yYE8Y29MW
TLSH
T1B3C25B36E859CAB7EDE64FD9B70E7A46EEE0516384D85AD8DAC85E0C00C71DD4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7955b8e120926a91e18509f2bff65b61dff995ee2151736139670f464100c889
MD5 c8e4a84d179f63fce74c330f41152b48
SHA1 7ab9b60f3d5ff6081a26ea4a97a1e7c86ff03840
SHA512 6aefb990a25cec4c9b4c4b98a4a070a30283e946b9bb94203c944a6af4cc64f2706e16cbae7f0e254bb8e86f50bd1d0c9d33015d584ba197e7401bd29a839ad8
SSDEEP 768:SFQtQGwgMurAG3yYEMQV7TjKgqmUHhOGx:ptQlu9yv37igRUH8Gx
TLSH
T19CD25C71D8A5CAB7ECEB5EC5A64A3646DEF06163C8CC8AD8E6D85D0D00871DE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bf63c2e2e8aebe49fc516abd6faf71cc5dbb55220f362c320726351d0c781111
MD5 97ac42b938cb1225669ce4e904fbbd19
SHA1 619fd910efbc78f1fbfb5f12239c604cf7bf67e8
SHA512 001da69ef5034c348d984d0034a09c7a5d932769cf9cc882eb775b6f9e74f74010e5eb7fd49b9b83d00512486675e7622c75ed71a6167a27d86e5da06732eced
SSDEEP 768:8FQNQGwgMujAG3yYEMDV7TjKgqmUHhOGx:vNQluVyvu7igRUH8Gx
TLSH
T125D25B31D8A5CAB7ECEB5EC5A64A3646DEE06163C8CC9AD8E6D85D0D00871DE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8cff74c43fa7f1f0b2daff8f636aebd2c3d4c40d52491eda840f8eebeb107909
MD5 3895f41cafb4e7f8e1735dc10b4616c5
SHA1 7c3d96029078baff4f0108642d47b4930cd6f859
SHA512 14324c06eed8d4d36fd3373df324a51dd535263ef9f86c9f1ee663e9f4c82b1d468761b329d9503c7007a4cc1cfd53d536f9bfd36d9232fce198969ca88e8b72
TLSH
T1595120E04C3C1AD1D5FD0E7EB48B79FC86E89722F49434386868EA58597A31D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3b86e16b2fc642218a4304de32d39e6a1b182250db279e9c22a0938903e18ea4
MD5 da6e11e37d442ebba477ecbe787165df
SHA1 1a013db59ada94d87ccefe5648fbbf1af01fd01c
SHA512 6321e71395d963d5d9bc3cc44b5ba26ed37184d4342039204b5641039d9e02ae57e0dd7739165e7af2142fa6a8c335aa2d754eeeaeb4b65f8326cecf2d24997e
TLSH
T1395121E04C3C1AD1D5FD0E7EB48738EC86EC9726F89434386868EA58597A21D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download