42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v19S-m5-eL.svg
Size 63KB
Sample260809-zq2rxadn7x
SHA256 42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62
MD5 f18d08462e03abffd185eb85868309f3
SHA1 dd183829fc35212fa44c1eaed674ab5a4eec0528
SHA512 976524dfac99df9110a4e493d412b20f4a979b4ef3762a94a3b0285d66506b35d53e8da757a0bf5469830a5f9f99e84a2b77b7731d6efc5f845d5e01b183a4c8
SSDEEP 384:ciIVpu6WpeE5gyDnGCeTSC9wbhJaSFMczb4KlBHYwMdfq/ahUfLFjIcCcvGjIqaV:c5pZW7isuIqIx
TLSH
T18653C26637F4BC9B8BCD034F5D02EC6C85AF94B784A86ACC97C790E89548368B7EC550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_148006109\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_439890266\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1900455679\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_439890266\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1900455679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1292549022\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1292549022\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_439890266\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4176_123885653\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_2039057493\_locales\ne\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307825807984253"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{7A161862-12CE-4235-9665-4050A9A56CD1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4176	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4176	3480	iexplore.exe	89
PID 4176 wrote to memory of 3120	4176	msedge.exe	90
PID 4176 wrote to memory of 2388	4176	msedge.exe	91
PID 4176 wrote to memory of 5764	4176	msedge.exe	92
PID 4176 wrote to memory of 2388	4176	msedge.exe	91
PID 4176 wrote to memory of 2388	4176	msedge.exe	91
PID 4176 wrote to memory of 1764	4176	msedge.exe	93
PID 4176 wrote to memory of 1764	4176	msedge.exe	93
PID 4176 wrote to memory of 5916	4176	msedge.exe	95
PID 4176 wrote to memory of 5916	4176	msedge.exe	95
PID 4176 wrote to memory of 5916	4176	msedge.exe	95
PID 4176 wrote to memory of 5528	4176	msedge.exe	96
PID 4176 wrote to memory of 5528	4176	msedge.exe	96
PID 4176 wrote to memory of 5528	4176	msedge.exe	96
PID 4176 wrote to memory of 5156	4176	msedge.exe	97
PID 4176 wrote to memory of 5156	4176	msedge.exe	97
PID 4176 wrote to memory of 5156	4176	msedge.exe	97
PID 4176 wrote to memory of 1600	4176	msedge.exe	98
PID 4176 wrote to memory of 1600	4176	msedge.exe	98
PID 4176 wrote to memory of 1600	4176	msedge.exe	98
PID 4176 wrote to memory of 612	4176	msedge.exe	99
PID 4176 wrote to memory of 612	4176	msedge.exe	99
PID 4176 wrote to memory of 2456	4176	msedge.exe	101
PID 4176 wrote to memory of 4908	4176	msedge.exe	102
PID 4176 wrote to memory of 2456	4176	msedge.exe	101
PID 4176 wrote to memory of 4908	4176	msedge.exe	102
PID 4176 wrote to memory of 2604	4176	msedge.exe	104
PID 4176 wrote to memory of 1308	4176	msedge.exe	107
PID 4176 wrote to memory of 1308	4176	msedge.exe	107
PID 4176 wrote to memory of 2408	4176	msedge.exe	108
PID 4176 wrote to memory of 2408	4176	msedge.exe	108
PID 4176 wrote to memory of 2244	4176	msedge.exe	109
PID 4176 wrote to memory of 2244	4176	msedge.exe	109
PID 4176 wrote to memory of 3364	4176	msedge.exe	110
PID 4176 wrote to memory of 3364	4176	msedge.exe	110
PID 4176 wrote to memory of 4256	4176	msedge.exe	112
PID 4176 wrote to memory of 5436	4176	msedge.exe	113
PID 4176 wrote to memory of 4536	4176	msedge.exe	114
PID 4176 wrote to memory of 5460	4176	msedge.exe	115
PID 4176 wrote to memory of 5460	4176	msedge.exe	115
PID 4176 wrote to memory of 4116	4176	msedge.exe	119
PID 4176 wrote to memory of 4116	4176	msedge.exe	119
PID 4176 wrote to memory of 3332	4176	msedge.exe	120
PID 4176 wrote to memory of 3332	4176	msedge.exe	120
PID 4176 wrote to memory of 1744	4176	msedge.exe	121
PID 4176 wrote to memory of 1744	4176	msedge.exe	121
PID 4176 wrote to memory of 2324	4176	msedge.exe	122
PID 4176 wrote to memory of 3444	4176	msedge.exe	123
PID 4176 wrote to memory of 3444	4176	msedge.exe	123
PID 4176 wrote to memory of 3344	4176	msedge.exe	124
PID 4176 wrote to memory of 3344	4176	msedge.exe	124

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v19S-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v19S-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffb17d7c188,0x7ffb17d7c194,0x7ffb17d7c1a0
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,12385477371215471709,7132353559787085480,262144 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,7889645668795385640,17103013746407230586,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,3630895256336183054,795190058509094933,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,3908276464801673088,3304324966972728812,2097152 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,1430333917739062636,2061019270639921336,2097152 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10545571141144380434,12405438806487916743,2097152 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:9
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,14136023490365887908,8669928273265888200,2097152 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,13239797010559289191,15346340597643760903,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,8364223251930119834,14974453534127643894,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14083628552355184135,11802338719194150016,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3983209673416724624,17624400253396552182,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3983209673416724624,17624400253396552182,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,14881598369346817912,13629115240927554219,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5501581764832474748,16922701935955383886,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,2819946293153377271,18014210377400255626,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,8290072219237371055,12175369091272062234,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,16806548760761882897,9710073446325918239,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,8164831691087137077,4548228570997772694,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,15225627735937415611,8191959561549056677,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,13502502259501028460,2109699893963768503,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,1744023199896244739,15915421739096970288,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,2470834470638255500,12610164272704027450,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6880179424670006387,9441259081240991742,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,961022489533778022,11866071418452287811,262144 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,9246432648327266727,6560129809549838136,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9189485790336454239,9666551302381979015,524288 --field-trial-handle=2324,i,8422398754217539585,6252026306623788343,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 97afdfebde9e7dc7043dc0a92afb637af2e89fc9a2ddde63363101c183b2966a
MD5 fcd2f9c162f83e509b76b99d62015294
SHA1 e5ac355b16555b7a8bd8778bb675627b124b2a14
SHA512 f8ec0c5fee3f4a2991d2395277f579bdb5241e8203f21d0c501b4ef431a2fa8c551cd6e961c3a74b80b876e6ac3c7a289643488d755acc67369627342a2adffd
TLSH
T1F261124A235D04E9D36A4A7251D9774436F086704D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592d21.TMP
Size 3KB
SHA256 3b0837e3fab50803ad590434a57a60ccefae049786532cde9c7453f65fe19fae
MD5 ac6b0d618195d59994044bdf5c90fa77
SHA1 0b5b8441970e5ae36674a61ae714d1f864dd7a2e
SHA512 c042da2ddc9d01cb835e604770c019ef83fbad2b55879cd4ba0359c7f876a5ad96a73561d3423c9a01fb4eb2bdcf8b89305cfeb9af9006925851b9ab7898a716
TLSH
T13A61214A235E04E9D36A4A7254D9774436F086704D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 be549b2e6f9467b64deb094541bb63c77a9083ef5264befbde00eb7aa9c6517e
MD5 63b5e3480c0b18fc2eb3640655fa1d4c
SHA1 f54ed35d64ccb9c85ca21bb82f7d48aa6ea09c66
SHA512 b258f1988efc4c92a206bdef027df97a9a1ce24a8dc82061ca5f8f8157dba0d5bf8ce77bdb235a83bceb515bf5f6af000e23f9238ca44b3b48362d07e0c75e75
TLSH
T1DA417EF3C3F4856E890196F4AB14AE1FCE1D0915432C7D5AC9E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9c82545c3fa5e363f1c6c07a768f73a8d0c8dadec48d5450f2b029f474ea6ee0
MD5 5b57f4b6f45aac12e00ceaa500814688
SHA1 a4092878dc17823e47628fbb0a08459b0176f965
SHA512 81c622304bcf5d415021223409fac5b851c9a5a13b30894d3a9333bc6d174ccd202195bb88bd3cb678e2688e9d30717e2979b1bf9304c05b3deaadc56964f39a
SSDEEP 192:sxRWRgC81/fEsKyMZ1h/KzoA8p4a/g6+WNIYn8w9hVGHLIgDTlViJ:sxRWV81/fEsKyy1ZHL/5ITMsm
TLSH
T13D42B7166E28A93B5CDBE21DFB15BF53D6F91032A1D01E58E6FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0a5ed6baeed334397181646ae7e6b46aa055bfd8e088937c70576f9f01b7f97a
MD5 25b2e2d56e74373bc666d8f3ec8c59e6
SHA1 2268be60c9547eedb412d4f92cd89b1d99c40cc2
SHA512 2a57b8eb6069ac319ab6014faa7f814deaec911b73f376b8af2e44c0ec689e96d5c68787701b652f0b60e8ead44a35dca22e1b73bb197541daa89db21322c3ba
SSDEEP 192:sxRWRgC81/fEsKWMZ1h/KzoA8p4a/g6+WNIYn8UthVGHLIgD5lViJ:sxRWV81/fEsKWy1ZHL/5ITGsw
TLSH
T1F842C8166E28A93B4CDBE21DFB55BF53D6F91032A1D01E58E6FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 89cb87e6356872b57c170d2c2d8fbdef0773cdec2b9127306a530aa473502bd3
MD5 cd5629659ef0b1bc71a09a4cc7ca2d64
SHA1 da03f93a3e1fb6f14ef48403ae25aa13ea5b661c
SHA512 eef34ad5df12a0a4386b8c881074064bfc05cf848e69ebdaf2053cdacece022490b3d672335a7e23799810c347baa1764d25de09afdd9d92c3222044b65178ce
SSDEEP 192:sxRxRgC81/fEs+WMZ1h/KzoA8p4a/g6+WNIYn8UthVGHLIgVlViJ:sxRxV81/fEs+Wy1ZHL/5ITGsw
TLSH
T17C32B8166E28A93B4CCBE21DFA55BF53D6F91032A1D41E58E6FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d1b70239857587966c4a8abb26ab4a471277a5abb07c7bcdbf851bf5d2e4bc69
MD5 2da4745f694fa097a4e0f18fe8b0c4ef
SHA1 fcc0ed050c89ecb090c145fb53b5b13f4902186a
SHA512 f49c6d454b30c9c23a2448f4eed3be7054cf0ebc8eea0533ad52fd3f0041b89acd7c8293662f506389bba89ca34aeaf46087253794cd06e3ef319ced6f707daa
SSDEEP 768:wb8dfh7pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOVmu46srohU151:wb8dfXEfR6Wgouf6Mu1ja1VmV63Mn
TLSH
T125D2DA7B740DCA7E4F800ADDEC19BE9F6DA802CB96D8CD4447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 14f7ccdf7707305ec4fbe924020bb739cacc6dca263675e531c2ddd0bd9b10c6
MD5 90a8143c71e76054b1492ac68b281d83
SHA1 1e25d186ae852ee7139eadcb36f257212c46ecbc
SHA512 75e4c76ed98bdd3c0d9498483678bf6bd10c7e9a434bba8134033be22f9a07db737f18f20cc54401db0453305c8385392235cd37834c62b9e33d864f4af9cef3
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70HS3eyEkUyW8pBgiyK43gYyciKxQV4gKNWI:CtaTHd3LeTInPlOgxU1NAj70HS3eyEkS
TLSH
T177912555307A0240387EBA5CC46C982FD2C574727459A47BFBAD22B20FAAE134DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eae9db8-8ee6-43bc-908c-5abe6f8c2b02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4eae9db8-8ee6-43bc-908c-5abe6f8c2b02.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2cf986892033b95b4dda51daba07c4c0a848d52fcd32860214bf2e8207d28f48
MD5 b330a19ffdd600b2108eea5e12408dfd
SHA1 b3e902e77ae554bde0d53e57a28c383b14c92429
SHA512 b3b8ced0c100ebf991d2dbc368b8f2a4d7e296193055f7f11a1717d2c451c61fb4f20a20e31daebbc600a7a68de9ca0b229f0d0dbf368c1a5101063da45feee3
SSDEEP 768:yH3TK9DZIO0XcNzc4ReyIsPF2ewBKZOLWK:yH3Otc44bs92evZEz
TLSH
T131F2AE71AC399C67ACEAB245FA0B3253BEF4512391C41A98DADE9F0C044369D176FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 86d6db7299c1e8a5c3da8f036e70059663fc27e6bc00c7464cd0a306b80b8f42
MD5 174c7ff7a35c18a83bbb3953d6a32b66
SHA1 1ca679d03e9f9e41f7d5900f1bae0129ae6f7ed1
SHA512 f63785bd8b34d7fd28db547d1abb3d617df6626871ec80c60ce2a569f4ca5f6838e3b5ed5c63ef864c1bb39cf0baaca2129358c33178bb5960e19ab3a6b2687a
SSDEEP 768:5o3TKEZJ5O0XUNzc4ReyIsPF2ewBKZOLWK:5o32tc44bs92evZEz
TLSH
T1A7039D75EC39DD67ACE66386B7067647ADE4112382CC1ED8D9DD5F0C008369E171BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2da397d01ea98a7ec1f8a4f631ee35898dabedc629f37b73dac711c7681ca047
MD5 0b942b9df71ccdded3223311b4a8e8a6
SHA1 84741ae60ac5e4629c94c8ce4df2ec53d93a569f
SHA512 3a294fc028b2f21a0a99f9a4f8900d05f6b8580fbdbd2102921f0a76d42bb4ab2aa5e9aa082d2074f1c914db5d09e565b304b0c171081efe331fed659bf68a1c
SSDEEP 768:/FQo3BwggKEZi5O0XHNzc4ReyIsPF2ewBKZOLWK:Co3Rtc44bs92evZEz
TLSH
T155038D76EC28CD6BECE66786FB0A7257AEE41163C1D869D8DADD5E0C00832DD075BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e8a3b5e18d9bd3b5fd5d9cadf9583aad2b19c45e9fc4485641b2f0dd4092aeec
MD5 133d6af88004d73864f591ad95811c68
SHA1 2f230fb7e1430dcbe9dacc92cd63d8dd14d0adb9
SHA512 10a74991188120ce793618d20fb55a6eea0ca3aabdb67b143d92abd405014dad154f7748fc98aa410b51c0ec091ca468483299c7ef68e57ef232121c81d0e022
SSDEEP 768:grv+4UNbdY3wE9DZIO0XENzc4ReyIsPFE5:gbsb631tc44bs9E5
TLSH
T13203AE31F8389D77ACF6A245F60736537EF4202781C50AA8DADA5B4C05472DE272F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eb4ba04ce7113fca7b259b230cbf62745780bf17c473df14de033a8b4af8eddf
MD5 3a8d22a79137847d0a09fe58419888b6
SHA1 8dbc795602006b31478182da3295a41c0a7b8f01
SHA512 8d810abd4c2e4a24bd32196eb6b768a727b4311cb3c6d763a02cefe7d62ee904fddd1253d9e5855635e73a1b1edab11e28d37f2b5061ee7124ff1eeb45f665a4
SSDEEP 768:8H3wK9DZIO0XcNzc4ReyIsPF2ewBKZOLWK:8H3Htc44bs92evZEz
TLSH
T1CAF2AF71AC399C67ACEAB245FA0732537EF4512391C42A98DADE9F0C044369D176FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 27a0f800a21a97f277d25ced4d68e2d312e4955673d4b48dc10f2269394f68d3
MD5 27218fa561a77d16fd03b7f6fd968400
SHA1 43da6dc4ed2a965aba45e9367a564597e5cf0276
SHA512 c070d653a8b2426c7cbf1539a9933756b0d16126c33c882151837a53ebd7a02bb465edbe86f90f92f56092677bc66801fc6683666a5323ef50540e6a586f93d1
SSDEEP 768:6rv+4UNbds37BDZIO0sNzc4ReyIsX3eVH1S5D:6bsbS3ptc44bsnEH1Y
TLSH
T14203CF32A8788937ECF6A686B50B72137EF8611B82D81F94C5DE6F4C464B5DC131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 54eb8aa737c8ec1215d3d6b6d21882bfc12de57fb7bc29d23a218a8aa5c89478
MD5 2b41f0b4027b03ee848bd2ac718d1e69
SHA1 30e9474de00936ea1e0695e107ccddd474dc7f71
SHA512 02c1f8a2a42d8f937e7c617710a7a31a4503f494544bf66b261b51541334075f305f9e69a7f63f59258d8261f3dcf917380b27cc5675a7fb7dbe2057d293aa63
SSDEEP 768:mrv+4UNbds3AjDZIO0X5Nzc4ReyIs2FeVH1S5D:mbsbS3Xtc44bsuEH1Y
TLSH
T1F203CF32A878CD33ACFA6645B14B72537EF8212B82840F94C9DA5F4C4A471DD275F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b0cddeb2-538a-40e5-93c8-9407083cb29a.tmp

Path C:\Users\Admin\AppData\Local\Temp\b0cddeb2-538a-40e5-93c8-9407083cb29a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4176_47913719\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download