c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m1-eL.svg
Size 3KB
Sample260806-ml5lsayfpd
SHA256 c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31
MD5 2226f49d0e59c46b4a18649eb679ae54
SHA1 c969dfea4218c1fab67060e9393a7fc24cc5547a
SHA512 a155996290a9d678506c7112a083decaa035069718b565052611fd751a1fb9378bb55dbdb09a8fabc2a0f5caa91dfbc2eb1e106fb2f9cba9c2f00608c0720af7
TLSH
T1C771368876F87EDBD7D802570D41D4B84B2F906BD822978DD3CBA0E8792826C735E5B0
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1490470355\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1472110195\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1490470355\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1481397212\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1472110195\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping52_1517967435\_locales\de\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304860595523487"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{15CF934A-B2CB-41CD-A91A-61A0B8151D13}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
52	msedge.exe
52	msedge.exe
52	msedge.exe
52	msedge.exe
52	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
52	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 52	4084	iexplore.exe	89
PID 52 wrote to memory of 256	52	msedge.exe	90
PID 52 wrote to memory of 1944	52	msedge.exe	92
PID 52 wrote to memory of 4460	52	msedge.exe	91
PID 52 wrote to memory of 1944	52	msedge.exe	92
PID 52 wrote to memory of 1944	52	msedge.exe	92
PID 52 wrote to memory of 4564	52	msedge.exe	93
PID 52 wrote to memory of 4564	52	msedge.exe	93
PID 52 wrote to memory of 2412	52	msedge.exe	95
PID 52 wrote to memory of 2412	52	msedge.exe	95
PID 52 wrote to memory of 2412	52	msedge.exe	95
PID 52 wrote to memory of 5448	52	msedge.exe	96
PID 52 wrote to memory of 5448	52	msedge.exe	96
PID 52 wrote to memory of 5448	52	msedge.exe	96
PID 52 wrote to memory of 3916	52	msedge.exe	97
PID 52 wrote to memory of 3916	52	msedge.exe	97
PID 52 wrote to memory of 3916	52	msedge.exe	97
PID 52 wrote to memory of 944	52	msedge.exe	98
PID 52 wrote to memory of 944	52	msedge.exe	98
PID 52 wrote to memory of 944	52	msedge.exe	98
PID 52 wrote to memory of 5784	52	msedge.exe	99
PID 52 wrote to memory of 5784	52	msedge.exe	99
PID 52 wrote to memory of 3684	52	msedge.exe	101
PID 52 wrote to memory of 6140	52	msedge.exe	102
PID 52 wrote to memory of 3684	52	msedge.exe	101
PID 52 wrote to memory of 6140	52	msedge.exe	102
PID 52 wrote to memory of 4236	52	msedge.exe	104
PID 52 wrote to memory of 1180	52	msedge.exe	107
PID 52 wrote to memory of 1180	52	msedge.exe	107
PID 52 wrote to memory of 4044	52	msedge.exe	108
PID 52 wrote to memory of 4044	52	msedge.exe	108
PID 52 wrote to memory of 2088	52	msedge.exe	109
PID 52 wrote to memory of 2088	52	msedge.exe	109
PID 52 wrote to memory of 4252	52	msedge.exe	110
PID 52 wrote to memory of 4252	52	msedge.exe	110
PID 52 wrote to memory of 1800	52	msedge.exe	112
PID 52 wrote to memory of 2456	52	msedge.exe	113
PID 52 wrote to memory of 1972	52	msedge.exe	114
PID 52 wrote to memory of 2696	52	msedge.exe	115
PID 52 wrote to memory of 2696	52	msedge.exe	115
PID 52 wrote to memory of 5312	52	msedge.exe	119
PID 52 wrote to memory of 5312	52	msedge.exe	119
PID 52 wrote to memory of 5760	52	msedge.exe	120
PID 52 wrote to memory of 5760	52	msedge.exe	120
PID 52 wrote to memory of 4668	52	msedge.exe	121
PID 52 wrote to memory of 4668	52	msedge.exe	121
PID 52 wrote to memory of 4400	52	msedge.exe	122
PID 52 wrote to memory of 2280	52	msedge.exe	123
PID 52 wrote to memory of 2280	52	msedge.exe	123

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a0
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6226946471893583331,13398328368934723104,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,8365098310874238282,5910689671635073651,262144 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,10893833541297875038,6865679715309056899,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,18194306872947998802,5823021384968660340,2097152 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,4079392797021947166,8435529884372423350,2097152 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,6715906813277576013,8036750453963688900,2097152 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,3543126071301428810,16070371611579483179,2097152 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,18220318760773109786,1157151714260727147,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5905643313266336404,907048146542160142,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15783695999389222455,11539376261380006405,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17538060246147473117,7212174802881484861,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17538060246147473117,7212174802881484861,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,2118835378786695976,13249216113571246842,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,883821847154431991,12990227132847561311,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,17185062272812443120,10292906397712730671,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,13718916903300437291,11171993185091891070,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11156716448637403124,16739243202056443767,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1693275974925188557,14750165832552537037,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,9523009704163445945,14251244050002618169,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,6398916839082545167,18146852510560829852,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,7820131631663951781,1293996839399313758,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,9029626316379086653,13945512642558990774,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,7983314828376934757,13452627938869611544,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,11962972172223096345,1587787226392339421,262144 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,8383166652778229990,6933304247210432422,524288 --field-trial-handle=2328,i,615390052307456893,3556876570383487044,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:14
    3⤵
    PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

4a2d5531-fd81-4fe3-884c-30e2224a43bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a2d5531-fd81-4fe3-884c-30e2224a43bd.tmp
Size 11KB
SHA256 eb6a04b9f76b5647eadacf6e2464bb11341e537edfa0c25c83568bf7590cce2a
MD5 deb07c0432337ec3dc1603f5a73c0f91
SHA1 8b1026041e25a32487239dca05a3c9178e4d5e69
SHA512 267589f18aa00f55553a74ea2808b7396687d43cb69e73e225887185930d68f9363d0857870d942b7c35c258091eff499dae43c1453fbc7d5f8a2f3188f87143
SSDEEP 192:sxR9RbCo/f+skP9gpZ5BRDOQzoD8p4q/g6+WNIYCyuOYGbIgDbrPTJ:sxR9ko/f+skP6n5BJ7/5IQPB
TLSH
T1D942D7156E28AD3B8CC7D21DBB65BF53D2F95032A1901E58A7FC9A1C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f640edb3561c9302ec3fa7745aacc2da245ac2ddde063af44ad0d3c93741a421
MD5 8cd4769dc7a5ea8c46a459058b387a4f
SHA1 ef5b0fdeb7585e9a878c8fc19cb5a00902b62d2c
SHA512 b532a24040b3df9e436fcd03cac81df3c7ef64931336e683f065c1101d2fec3cd4afd0b1561eb89e5a4f3ddbfacb6aa712a61aa6743ca5f59ad6ccfe5d60463c
TLSH
T12E41FAD40BE90AC2DBFC8EF520E16ADD33F0C49E41176E8064422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c0f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c0f5.TMP
Size 2KB
SHA256 86ccc1f853db3e60eec9dffd8aec31e68bd7d372d5fa8a58df9f6f6e974f7896
MD5 b02fe55b4b6476a6523e59851e65e40d
SHA1 18c1b82b4698b2051053976d8917f5dc5743ef7f
SHA512 f191582ff755577a4e524f9d4eefd288bf45ca555eadc1bf933b960834935a7c78deadf78de73f6b4c4e3f52f994fc320cfea10c21e7ce5e8c8979aca7db2f66
TLSH
T1A241F8D41BE90AC2DBFC8EF560E16ADD33F0C4AE0017AE8164462E701B0AF9791D2873
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 47e736ac9248091b53cf26d28f3742d0e19b715b2fb40401184ccfab24cac6c9
MD5 dc993910e0a05e930608f501190885a6
SHA1 c96439c06ddaaf66e9b082a324cef6faa9abd8e2
SHA512 9605bb0efbb0df4bcfb7b81db0b9caad48ad6ac83917dc42f0b70bcf3344d4fcc0f1d88d14630161d2cfc6d35abd1d46ce982e5227ff7fba30b79ff8c0a3119b
TLSH
T1E351A0F7C6E8863DCA4196F0A7147E2BCE2D0914432C3D5AC9E4AF2B97E2471D14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d680c232305553434b4c433231e6d8dec1097e03987451a26f8bba60a48d558d
MD5 1c0ca5d2ea8b2113ca32bf9f71fe08f8
SHA1 310d9d135ef94983e1bbd77017c52c2fbc10e457
SHA512 54b72f244138794dfdbda67bab2a7f9af8f3cb98c643c158724b615d4b8c8bf7d34bbbc4ce0f7592e83041dce19f17a222f73ad3983db36587a0bd891b317fcd
SSDEEP 192:sxR9RbCo/f+skm9gpZ5BRDOQzoD8p4q/g6+WNIYCnuOYGbIgDprPTJ:sxR9ko/f+skm6n5BJ7/5IvPr
TLSH
T1DD42B6156A28AD3B9CCBD21DBB55BF53D2F95132A1901A58A7FC9B1C00EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5af030b8a777f2c45e86b96e29d7a02a28d870785367e22f33e762a0930af34c
MD5 469ee4505d2166ebca2adca14b0b2c9e
SHA1 a80707a7f7d0375f9715d6c1dbc132269d6645a5
SHA512 3a46f1c4a3e0550808ca77ee3dbaac6c704aa23569771603d9222067d64598c659c761bd710ab7b454f04b6965be7d34fa0b433d965ea9963f4b153779f964be
SSDEEP 768:jC+vEo7pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcv0QqcfroZH:jC+vEUEfDQWgQ+f4+u1jaXv0VcMV
TLSH
T1D3D2FA7B640DCB7F4F804ADDEC197E9A6DA802CB9698CD4047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 918da66144d68ce88c0a243e1a8439a5c82abc1a4a09eeaeae98795ee8cea295
MD5 ef332860eaab5dc497ecbf7a081a9ffc
SHA1 30db2b1845843c51da7ea8386bda36d75c9f6c98
SHA512 62728265aeaf88dfb85912c40aa91e883fc61c59b3c94091d344c3a50791155e4fb2ec3cbae691256fab7987d2b2dff8f7c8479255bbb327691d5e3690a75d7d
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lsYwKVyKCz:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPX
TLSH
T1FA918419717F4240383E651C81BC8C2B468730B2345AE56B7BA915E61FAEE525EFDCC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2c03807-0248-4cd2-bdba-13c3eb6479c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2c03807-0248-4cd2-bdba-13c3eb6479c2.tmp
Size 11KB
SHA256 b3d1936cf5d0ce7b853c519d08e621a721bf3761f4a4422255207ec071fc951f
MD5 d645a53b5760f514ac09f4c4b848e889
SHA1 3840fe9a28afc9623f3954bcc8cbdecbe8fa4a20
SHA512 7a2fa50db4d363c19c15863c4d0b71be1c5b05b54a0bf14f06c38de64468556f087c593306a0de9bffb08e958b3b7ac07223d941cc0b4ec50ee8fb3029aeee73
SSDEEP 192:sxRuRbCo/f+sPP9gpZ5BRDOQzoD8p4q/g6+WNIYCyuOYGbIgVrPTJ:sxRuko/f+sPP6n5BJ7/5IQPD
TLSH
T1E232C7156E28A93B8CC7D21DBB25BF53D6F95132A1901A58A6FC9A1C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5f86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5f86.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cb8407c86366eaa702536354feba3f1d60c15a31429c65a05c3514f61b246ba1
MD5 a0369a6f7e2ccfba80077baf264aa368
SHA1 15c59b7250172cf310e461a7d4c1688b2c709baf
SHA512 051da4605c4ab8784920424bb9e18a4f7eb70adbc357ea3b254c3ac534da870d0020fd3723e12ac1930a20befa11af8a4bbfa9d885c2f2b7e3cb7cfe25dd61aa
SSDEEP 768:A53hKQViQp8+p3bd66j+4BRv86aLIWyUXERPbQEixlWBuU:A53Ku8+p3Z6n4yUzRPbQ1mBJ
TLSH
T17EF2AFB1E87A9D639CF5D348B24A7B436EF451B3A5C05E94D8D86B0D005326D2B0BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb4fd5ae9818144b837ae7daf9379e59b505bc76ac6695cc846d0404183cc132
MD5 b217193c0131fde7029c4e742ee31bf6
SHA1 e403aac8709d3449bcf9b30c4cc979c15018a7c3
SHA512 7314e320c347650e99182b1fef9caf8f362580f8742a73a79bff0b29d78d948c644e117f62898db069676ed10b42038244c136beea09cd10ec410423ccc2767d
SSDEEP 768:Y1FQt38wgWhRVSp8+p3bd66j+4BRv86aLIWyUXERPbQEixlWBuU:YUt3m8+p3Z6n4yUzRPbQ1mBJ
TLSH
T133038E72D865DE67ACF6C785B34A7B43AEF411B385C49DD4E9C86E4D00831AE170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9090dcb9c30c083c2f093130df070b7f898c6bc396e37deffe7c863559cda677
MD5 2224141fc2b26edbdb603a1609b0a039
SHA1 867ae166e4985302b8a5e4fe717f8d136430cf83
SHA512 cb85f6730654c379e8aac815b4c985c35c59fb3c0ce2faa566e458f392c222b2824d5571f5f42b142929cd6a9dff68cb40e366aa80f441fab141594143ad55dc
SSDEEP 768:3rv+4UNbdm3xKQViTp8+p3bd66j+4BRv86aLIWyl:3bsbc3al8+p3Z6n4yUl
TLSH
T10A03BF71E8699D339CF6C644B2877B837FB811A395C00EA4E4D86B4D41971AE270F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 50e51a4d090f04417de28e23ae89a4749363420056cb54cdef9931cf870db7b4
MD5 4a30f2c82a7449569b883b316aab356a
SHA1 237c65d9e722663c5a2eea00e497691057d16589
SHA512 0851adf3c5610986b858d3a1304af4759dbcbb564656039a672a3f1305b16abf26f91861b6761e434e55847a42d7bad091a0cd1e1b6d10377cc137e6a48bb65f
SSDEEP 768:p53YKQViQp8+p3bd66j+4BRv86aLIWyUXERPbQEixlWBuU:p53Zu8+p3Z6n4yUzRPbQ1mBJ
TLSH
T1D8F2AFB1E87A9D739CF5D244B28A7B436EF451B3A6C05E94D8D86B0D045326D2B0BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c33c5e4dc594b7cfa63c752b68d2ac3fe0ac4b4a0a5504c601f1d8e3e03ebb25
MD5 513b73f79103460a7e34ac656b3fab4d
SHA1 2dda1cae467e63c5d30817312532fe38bb93096f
SHA512 cb99cc6777ec249b658399350cdaec32dfa4490b9d5f8feb36f4906e43a4b6dc5f0096a00e8a96162239318b198b37625f0fe6ffc5460e5a32e4ae8df3521c02
SSDEEP 768:Irv+4UNbdD3KcQVTNp8+p3bd66j+4BRv86aLIiB2bwCl1:Ibsbp3QL8+p3Z6n4y30ww
TLSH
T19E03BE33E8A899739CF6C648B2467B433FF851A396C10AD4D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

ddcea1fd-8bea-4a6c-bc8e-70ce12f9b8e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\ddcea1fd-8bea-4a6c-bc8e-70ce12f9b8e4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir52_1809702595\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download