d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v10J-m4-eM.svg
Size 24KB
Sample260808-raz95sssfw
SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
MD5 8c786d4da80ac1948a137a727a12fd7e
SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
TLSH
T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_836022095\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5736	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306712201462146"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2230F7FB-60F4-49A7-8954-83B07B59CE3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4608	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4608	4876	iexplore.exe	89
PID 4608 wrote to memory of 4408	4608	msedge.exe	90
PID 4608 wrote to memory of 3128	4608	msedge.exe	91
PID 4608 wrote to memory of 5736	4608	msedge.exe	92
PID 4608 wrote to memory of 3128	4608	msedge.exe	91
PID 4608 wrote to memory of 3128	4608	msedge.exe	91
PID 4608 wrote to memory of 1584	4608	msedge.exe	93
PID 4608 wrote to memory of 1584	4608	msedge.exe	93
PID 4608 wrote to memory of 2588	4608	msedge.exe	95
PID 4608 wrote to memory of 1972	4608	msedge.exe	96
PID 4608 wrote to memory of 2588	4608	msedge.exe	95
PID 4608 wrote to memory of 2588	4608	msedge.exe	95
PID 4608 wrote to memory of 1972	4608	msedge.exe	96
PID 4608 wrote to memory of 1972	4608	msedge.exe	96
PID 4608 wrote to memory of 4188	4608	msedge.exe	97
PID 4608 wrote to memory of 2208	4608	msedge.exe	98
PID 4608 wrote to memory of 4188	4608	msedge.exe	97
PID 4608 wrote to memory of 4188	4608	msedge.exe	97
PID 4608 wrote to memory of 2208	4608	msedge.exe	98
PID 4608 wrote to memory of 2208	4608	msedge.exe	98
PID 4608 wrote to memory of 2752	4608	msedge.exe	100
PID 4608 wrote to memory of 2752	4608	msedge.exe	100
PID 4608 wrote to memory of 4292	4608	msedge.exe	101
PID 4608 wrote to memory of 4292	4608	msedge.exe	101
PID 4608 wrote to memory of 4784	4608	msedge.exe	102
PID 4608 wrote to memory of 4784	4608	msedge.exe	102
PID 4608 wrote to memory of 2992	4608	msedge.exe	104
PID 4608 wrote to memory of 4588	4608	msedge.exe	105
PID 4608 wrote to memory of 4588	4608	msedge.exe	105
PID 4608 wrote to memory of 2524	4608	msedge.exe	106
PID 4608 wrote to memory of 2524	4608	msedge.exe	106
PID 4608 wrote to memory of 3276	4608	msedge.exe	109
PID 4608 wrote to memory of 3276	4608	msedge.exe	109
PID 4608 wrote to memory of 4440	4608	msedge.exe	110
PID 4608 wrote to memory of 4440	4608	msedge.exe	110
PID 4608 wrote to memory of 5272	4608	msedge.exe	112
PID 4608 wrote to memory of 2836	4608	msedge.exe	113
PID 4608 wrote to memory of 4936	4608	msedge.exe	114
PID 4608 wrote to memory of 3436	4608	msedge.exe	115
PID 4608 wrote to memory of 3436	4608	msedge.exe	115
PID 4608 wrote to memory of 1976	4608	msedge.exe	117
PID 4608 wrote to memory of 1976	4608	msedge.exe	117
PID 4608 wrote to memory of 1492	4608	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v10J-m4-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa944ac188,0x7ffa944ac194,0x7ffa944ac1a0
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,13147328796336741392,11945837616680087669,262144 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15974478864759350780,17365835386008649273,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,8706439497762259531,11566838936220469897,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,1349601488166025351,10355923563528946286,2097152 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,8523345885529270617,9659979617182863715,2097152 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,6622416666604179657,9753530320525165509,2097152 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,4038326939322098659,16450180131795302683,2097152 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5866663628307736706,13484595916615260596,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13955699691543859474,8724240002558119572,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,12808592312435649756,13014533314456431689,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13155025994025853445,16588326107008263974,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13155025994025853445,16588326107008263974,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,15376733401082498620,3810372199773191143,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,2545061367101889358,16160718088288545334,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,17949041053837191147,16362404279333911581,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,5658522141619273831,16445558584880814175,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,13831584932960790137,5246907010227552511,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,7991509334503867298,773180404542496948,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,12780174285470031811,12746008019184960411,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,10500752053354237813,16394186747686393237,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4820804660234491109,5350521282747682081,524288 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,1178937246186608662,14799055965966762884,262144 --field-trial-handle=2212,i,4760199060450918268,14470667837656321737,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

04a953ba-9a26-486a-9545-7e1efa4b88d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04a953ba-9a26-486a-9545-7e1efa4b88d1.tmp
Size 11KB
SHA256 f980cb4b0c46776571274143ef895ab2c4bed2cb45607f2518d07b3fcf2ecdf1
MD5 43ea25cffa6fa18443b87ed060eadd5c
SHA1 d17ae38e9b3beddec9303cbec4555d878cd7adef
SHA512 b5a42333364b558cd7d412dcad04ae5aaf9d63f218b841d2d0b3b5644fa56890636d3d30937059638d669742297214bb96da42db2520f1c58366ed2ada1f8d95
SSDEEP 192:sxRtRrCF/fdsF2r6ZnlzoA8p4N/g6+WNIYn83hzGYIgVlJ:sxRtkF/fdsF2rsnIU/5ITRx9
TLSH
T1F232A6166E28A83B8CCBD21DFA557F53D6F95032A1D42E58B6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 745172d5b4384e1f36148cf0511c0f4164f5318b57c5092b5d1be9519ab8b3f2
MD5 2d2fc37aded7562417261964b0fa2f87
SHA1 bffb51e25b82bc0ab4492e20899d844f66615837
SHA512 632912ce98d4440ba006799989fbd064fc44e0af90e19dd03bfc8d35307d5d75742715cb7afc43f73567d2e93c26c09d8adf2dee0bb59c9ddb8ed021689e9437
TLSH
T17261D65623634DD1DF7745BD52E96898FAF4A495093B2EC06054BEBC48C6F4BC1C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599bd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599bd9.TMP
Size 3KB
SHA256 56b3930a8442369507a7990f86453036e6e6d6a1156f86f123596870e140e250
MD5 2bcab8a09215d069357a0c8f5ce33341
SHA1 3e42d7636f00837d478aa111562c77436c196706
SHA512 edb503dfc2c46252872b8814afef656c26a5ad1589d2b9eb98e95c03c571dd8477b6e2e51f1c537e827070c496d7826fe76d2914ce5a92612c4043d3f999a2ee
TLSH
T14161C45623634ED1DF7744BD52E96898FAF4A895093B2EC06054BEBC48C6F1BC1C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9ce54d3e019ef17b9e7a4b22a99baa10c567b18846f1a9819771118e8a633a4b
MD5 98ee87836d7d2b23239c0730cdb1e4f9
SHA1 40f402dbebf805e8bec23a8bde0dbadf7674ebfb
SHA512 046730c1e8ddf2fb8f1fc9702940dd14f05b1f854ba73cd88d13adba24b8ad7fb3eb91e581b28ad97f2d2d22bc7762e3df8843f783be32317678402ead55302b
TLSH
T1C851AFF3C2E8866DC90156F0AB18BE1BCE2D0954532C3D5AC9E4AF6B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c8cb68707a9a4fe1e10aff65879c2b7549d4b4ec6415a24eb76ba229c0aa4ba0
MD5 5370d95012893c9a73dc3c4530102fce
SHA1 f9f813ec6eaab7e67f9d0ef59b2e826b4fed7c8d
SHA512 278c73bb9af50d33156a79a8785df19ae7585a61df7f2a36f0f00748710c723797c603cf186ec6a7dd182514bc1b5c4ac17c497338fe64166cddd9ae21a1d147
SSDEEP 192:sxR2RrCF/fds8206ZnlzoA8p4N/g6+WNIYn8ChzGYIgD9lVnJ:sxR2kF/fds820snIU/5ITAxH
TLSH
T18C42B615AE68A83B8CCBE21DFB557F53D2F95032A0941E58B6FC9A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 611227f202337dc968dfd2e3934f4bf892f10fdba328b15c150a02ad026576d8
MD5 a5f38855ce8072349667db5b563f5892
SHA1 9d7f22f18004978d2d782b923e3a618e10ba51a6
SHA512 25a964a3a79aad8f92f6f2ce6fa87d2a05b76576696c1fe24b987fdc581967edaa84b956f9ccebac4b8297967c66b5536e1f8852a4636520a85ee467b3101145
SSDEEP 192:sxR2RrCF/fds82r6ZnlzoA8p4N/g6+WNIYn83hzGYIgDvlJ:sxR2kF/fds82rsnIU/5ITRxj
TLSH
T15532B615AE68A83B8CCBD21DFA557F53D6F91032A0D42E58B6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2b0d9baef9c2be2e66adcf66c96baf1c7656b1ffa24a0dc51aa9d2b18f3f5800
MD5 9d4a4be00f1f42186cc6a88efa0d93b9
SHA1 479a835f410682889f7ec6f380ca933d26b40257
SHA512 a2e17ee149930bc9d6ad7e15e29e68aa8231ae84164241045c2a7c559b03eabf7938c92710fd8b17c8c4c63819d8f925102ae98a334262ed910c97082f57fa1d
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVT9Amu467rohM72:wb8dpsE7r6Wgouf6Mu1jaYGmV6Iq2
TLSH
T193D2E97B740DCB7E4F800ADDAC19BE9F6DA802CB96D8C94047FA951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d998b4d899ac445da97b3b07f4bf14b8ed29c07b6b47d17e7be101df036cf67
MD5 5a087ca1bded6b2afa251b6176b4adee
SHA1 59ad2deebc15713ce650b21f0fc0d91ca9653815
SHA512 801dcac8869f7828f3dbae9a9af7109a2a0322482014284aa3df6a78b37a4267c1b982b750902bcef36689845632f71dfaac2edc4a5bf7f639233ea2db86ec18
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbDaDo9Rr11E:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZf
TLSH
T1E4915A43767F02803D7EA54C95A98C1BA28278733118AD2F77E951B60F67E064CFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6d7c23b4a70af8d30e7d28cb077fe40fc1874f433fc3c89ff004c8688c5b9fb1
MD5 5a2e3647805e09f26cb73f18f4195fc5
SHA1 972836f8f99b25337b0fdec3d2dc5f4d32bfcd31
SHA512 13d3754b4bc3d5efc811b7ed51be72c4772eabe1a8dfb65093091589ad8f5134a0d9fd7624600f97660032f86e8df46e09a8f9ac5e4aa1204d47da672152c9e8
SSDEEP 768:3rv+4UNbdoC3fXGDZIO0ZQRIWsKNzc4ReyIsPP2ewBKZO0:3bsb/3f+IWsKtc44bsH2evZn
TLSH
T11913BE31A82CDDB3ECEAA249F1073293BEF4216B84C41A98D6DE5F4C46472DD275B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e5e984fab0ca7dc5a60ec42180ee8a01d1832ecbadb1bfe7afe64905085e85f6
MD5 7a912511f5a181b0d0964bb7cdb39865
SHA1 792392b56f293c8debd3dde8cc8b2a7403d20cf4
SHA512 0772fcbf97afa2253ab60f40f09ac0d2cf81f05cb2cc766fba68ca6f117a7344558aba32f232dbf872f5d81647b0acca8a3dec1fbaf38615e4c6176354292017
SSDEEP 768:EJC3jtGDZLDVO0ZQRIWshNzc4ReyIsPP2ewBKZO5:EM3jVIWshtc44bsH2evZ2
TLSH
T149F2BF31EC29DD73ECEAA249F6073292AEF45167C0C41E58D6EE5F0C0A4369D1B5B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 68810b0461c9a195d064761c018385b5fddcc90f423ebb8d798d55fde93cb25e
MD5 67d4c124834b4650a65e691915289878
SHA1 d28d4a1382f2a4a7667b3084b6fcaf082d7a6a8b
SHA512 d10f539734803f60abd6342a9f586d82f943228228380b9be469d4fe7498cf0994187a2e95ac92dbc13b645154636fe0702ab711afd385cd6167a5c710fb2e99
SSDEEP 768:7XC3jtGDZIO0ZQRIWsKNzc4ReyIsPP2ewBKZO5:7S3jUIWsKtc44bsH2evZ2
TLSH
T133F2BF31AC29DD73ECEAA249F6073293AEF45167C0C82E58D6EE9F0C054369D1B5B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6bd968afea7101dbc1bfc177426412b8f0ec3173b49c813588225d347d72728e
MD5 faad3731a7fcf0d9bbbd1bc950e99f18
SHA1 94ee16705671b73dbac424d95841b9ca77980b52
SHA512 b626a63565c9fc6c4ea3c92a4a34fc8baf2f5afcbb09ed699468bec22e253fa222e2b7fea4fc240499aa5edd5df7dd291e8a548acc47a42644fa375179da4f0f
SSDEEP 768:6rv+4UNbds3wODZIO0ZQRONzc4ReyIsXzeVH1S5D:6bsbS3pOtc44bsjEH1Y
TLSH
T13703DF32A8788A77ECF69686B14776537EF8512BC2D81E94C4DE1F0C464B5DD130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f46792f7-03e6-42de-a2a7-7930759fd1b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f46792f7-03e6-42de-a2a7-7930759fd1b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

6f50bc4a-d365-40f2-8e67-0b71c6bfe3d3.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f50bc4a-d365-40f2-8e67-0b71c6bfe3d3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_1228024106\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download