f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eM.svg
Size 3KB
Sample260814-2etchacd47
SHA256 f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab
MD5 40ed26c24cc55b701d2198147f4dd511
SHA1 be79a6dd7f18c178a4419eb98dd433ab090071d7
SHA512 6640d83ea0c3300598f061d3914e839c94e0dec416692dbed5dc1e857898e7467011e2e986cc39131cb59505b3705d679faa8e61cff117e12fc356edaceed39e
TLSH
T10271378876F87EEBC78802970E51D4B84B2F906BD822978DD3CB94D8792C2AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_2004815341\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_2004815341\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_124831417\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_247747408\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_247747408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_247747408\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_905155343\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_905155343\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1735982091\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_124831417\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_247747408\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_905155343\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_905155343\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6136	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312202185623643"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{357E98E4-97B9-4AA1-9C67-07A5F23161D8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 1776	5604	iexplore.exe	89
PID 1776 wrote to memory of 908	1776	msedge.exe	90
PID 1776 wrote to memory of 2612	1776	msedge.exe	92
PID 1776 wrote to memory of 6136	1776	msedge.exe	93
PID 1776 wrote to memory of 2612	1776	msedge.exe	92
PID 1776 wrote to memory of 2612	1776	msedge.exe	92
PID 1776 wrote to memory of 5852	1776	msedge.exe	94
PID 1776 wrote to memory of 5852	1776	msedge.exe	94
PID 1776 wrote to memory of 5740	1776	msedge.exe	95
PID 1776 wrote to memory of 5740	1776	msedge.exe	95
PID 1776 wrote to memory of 5740	1776	msedge.exe	95
PID 1776 wrote to memory of 2780	1776	msedge.exe	96
PID 1776 wrote to memory of 2780	1776	msedge.exe	96
PID 1776 wrote to memory of 2780	1776	msedge.exe	96
PID 1776 wrote to memory of 208	1776	msedge.exe	97
PID 1776 wrote to memory of 616	1776	msedge.exe	98
PID 1776 wrote to memory of 208	1776	msedge.exe	97
PID 1776 wrote to memory of 208	1776	msedge.exe	97
PID 1776 wrote to memory of 616	1776	msedge.exe	98
PID 1776 wrote to memory of 616	1776	msedge.exe	98
PID 1776 wrote to memory of 1092	1776	msedge.exe	99
PID 1776 wrote to memory of 1092	1776	msedge.exe	99
PID 1776 wrote to memory of 4284	1776	msedge.exe	101
PID 1776 wrote to memory of 1692	1776	msedge.exe	102
PID 1776 wrote to memory of 4284	1776	msedge.exe	101
PID 1776 wrote to memory of 1692	1776	msedge.exe	102
PID 1776 wrote to memory of 1732	1776	msedge.exe	104
PID 1776 wrote to memory of 2616	1776	msedge.exe	105
PID 1776 wrote to memory of 2616	1776	msedge.exe	105
PID 1776 wrote to memory of 5908	1776	msedge.exe	108
PID 1776 wrote to memory of 5908	1776	msedge.exe	108
PID 1776 wrote to memory of 2704	1776	msedge.exe	110
PID 1776 wrote to memory of 5252	1776	msedge.exe	111
PID 1776 wrote to memory of 2756	1776	msedge.exe	112
PID 1776 wrote to memory of 4232	1776	msedge.exe	113
PID 1776 wrote to memory of 4232	1776	msedge.exe	113
PID 1776 wrote to memory of 4308	1776	msedge.exe	117
PID 1776 wrote to memory of 4308	1776	msedge.exe	117
PID 1776 wrote to memory of 1500	1776	msedge.exe	118
PID 1776 wrote to memory of 1500	1776	msedge.exe	118
PID 1776 wrote to memory of 5132	1776	msedge.exe	119
PID 1776 wrote to memory of 5132	1776	msedge.exe	119
PID 1776 wrote to memory of 2520	1776	msedge.exe	120
PID 1776 wrote to memory of 5248	1776	msedge.exe	121
PID 1776 wrote to memory of 5248	1776	msedge.exe	121
PID 1776 wrote to memory of 2112	1776	msedge.exe	122
PID 1776 wrote to memory of 2112	1776	msedge.exe	122

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12098744576106927374,9552632550520665390,262144 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8181936393103510103,9033670102288048696,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,11842672896249899876,17318190992594638904,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3284,i,11367249676817445829,4116664159746875405,2097152 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3292,i,11250609573916988453,10488346174438473678,2097152 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,18263081864223014546,11534456428433154523,2097152 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,10485883333337786963,8094255635289094200,2097152 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,10396254862691732542,1140673460868298079,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10879052972589065812,12016951779349049292,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,17280404191299769263,582285900358257518,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3107712234811245734,7638443047393487621,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3107712234811245734,7638443047393487621,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6503235523801570310,8456549967668732651,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1418413061471205069,12362961816102299594,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13176143200950331277,13092356452635605976,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14717435581659857632,1694067065551064262,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,12814037153020898375,1084088600535935732,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2876,i,1338687310577450375,11910759339432951737,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1217989643852495599,17393304452288521396,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,3052537676386179711,11072538492579010930,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8057610030821407376,190708615254053700,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,12832187851129498095,184601627801011907,262144 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10031788689871440754,11679267649171323165,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,18188714701036345335,17575164700752009541,524288 --field-trial-handle=2180,i,17716222548608732695,3369474839491795805,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0bc6098c2195ea120fd2411f8b8c4fa0be6092da7b9834a6a10e2505ee8edd65
MD5 e447ec9ad40bf31349a90a2aadcb3ecc
SHA1 3d51a6fa9976a1d212dceb0da59f78b797929ecf
SHA512 a2349b92a39953e6bd700ee27581e208e0b6bc741fc0ef93e485053eeebb1733e6e591a854f76c310b6452cce50aa67eb5aba01e43244dc41591b76e7370460c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T145B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03aafe5626608030cbb61cbe17a9b1b2e7b30ef9decdd97a26fffb4d421270a8
MD5 d2fbb8a514c51f1cd9bc6e03e5e65486
SHA1 0d30a1d48346f8d88f80c2c90aec318c61d7cb82
SHA512 abeccb2d961c6d08ceb3274cade97537993581a6613d4762e8f77843c7889c44c614be9a164d8f59f460741870bacc1f1f3b2c5a0877bc371bb113ff633539a5
TLSH
T11A612DD2A3A10AE2E7358EBF84E1F45737F4CC5A81B32E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59110d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59110d.TMP
Size 3KB
SHA256 de72d056dd8080063c00426e7a593644711e436d5a7869e86895e0e0244b7473
MD5 0e172f258d8c85a715c7ac1182dddeae
SHA1 bbacfd744a02b5bef76948b58840fb68cfa10ef1
SHA512 5b94667dada8f03649c894502269d27b7ee88e05835bde63324040aaa5f17327b038be92bd619f07d75561f3f321334f457939fc449fa138ddbbd605f25c7c16
TLSH
T196612DD2A3A10AE2E7358EBA84E1F45B37F8CC5A81B31E0474835E746462FE4A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0e640f684d01e2d4bc6324c8661c4d3af88c77b8418766c265d9598be358005b
MD5 2a3c4d6fe0b66ce3226634b33d378176
SHA1 f6f1ff1ebb45f124829f5524c436057702124c3b
SHA512 e27e7e224ce9f0943294fb31932fae9aa138166ab6679455217486a117353bed96d5d30558f670d439da806883485c21ba07082c0ceb604142fc7df440180aef
TLSH
T1BA419EF383F4956E890196F0AB18AE1FCE1C0915432C7D5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca4cfc217fdee29b6cf0001e9e43ec579fc26fcd036836a0c9d4f26178818c8d
MD5 6cf47e85c899c30301dff6b9a60b01bc
SHA1 45aea108ff606f8d009451edfdcba5ed04349121
SHA512 d07062ba470618072519c937829611971746f37500ea651dad051b4f353eb330e4e23450728b8397615bb398632ed87957c809d2527427701ab637d3ecd4a245
SSDEEP 192:sxRURZyM/jK1Ml8wCo/fAstPBpyBZxUurOzoA8p43/g6+WNIYn8UohQGlIkIgVhD:sxRUX8o/fAstJAPx1z6/5ITXBIILD
TLSH
T10462D915AA246977CCDBD20DFA557F93D6F81573A1901E44AAFCCA1C00E6AEC6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 afbf5225d289338570a2fe0ea29ba5b326409a4f950268dd4408d38e105458ce
MD5 f55278cd04d6a9449d80f8b5534c3b7f
SHA1 d5723754b2f834617c7c4018a9a294ce92495584
SHA512 85f3ceedc0e5aad3fec02b0385f1ff90f1ae7ec3fcf0bbd3ee5e1e91bbc45212717663092916ce3c8391e62ab47c3a63cd9005d3d66765571cdceeff09d82cb8
SSDEEP 192:sxRjRZyM/jK1Ml8wCo/fAsePBpyBZxUurOzoA8p43/g6+WNIYn8UohQGlIkIgDNF:sxRjX8o/fAseJAPx1z6/5ITXBIInD
TLSH
T19262D815AA346977CCDBD20CFA557F93D6F81573A1901E44AAFCCA1C00E6AEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b82dc2d999eb9d1cc4123defe4d6d4912742537c0bab31ebf25f54aefa713287
MD5 6a0c699b53a9fe8095c02dbc69491149
SHA1 24764e1fec1a81dae6c97bb766cd42b847a905c6
SHA512 27286ce8beff5bbaf78c2d33972673cf268a1f8900ef57f8e0ae6f7a4f745d7f901aaf314a21bc5ba6bf336a494bd4df8256b72dacf470d68ead667d27a91739
SSDEEP 192:sxRjRZyM/jK1Ml8UQsCo/fAsePB7yBZxUurOzoA8pe3/g6+WNIYn8NyhQGlIkIgp:sxRjXqLo/fAseJWPx1zs/5ITmBIIVD
TLSH
T15762D915AA246977CCDBE20DFA557B93D6F85573A1901E44AAFCCB0C00E7AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e2fc3a33fc1079b654727e6da116a20c6fd1e45352a3e329a4ce43d2d33f7b8c
MD5 f313540d44ae84644b1f5c156884593a
SHA1 4fc51accf74925d9565962f2304f95ddec2d41e6
SHA512 98e9ef1ee1e03fe8080e7be97f2497f403bd0cb8049449cd66510262f19ee80ae9db2fe564c8e2e5a3d7372f8943a22459322b4603efc070e5a3d0d430882375
SSDEEP 768:wGedTg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5EOu4YnroSI8id:wGedTsE7X6WgoufDMu1jauEOVY0td
TLSH
T15DE2EB7B680CCB7E4F804EDCEC29BE9E6DA801CB5AD8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0bd3420df5667482b820814669427a23006dfb0d6d434638028b9b51fed92a77
MD5 c39d881ba955505719afe8ec7ed2d349
SHA1 1bc6db8d33a5438ba44c786ac35bdd7319f100f0
SHA512 fb50cf6acbf3a29ee52f0b53602f919f61c466ffbd09efe70249c1264dac5ca770117cde62e334414c2637f50656ecebf88694c88352b97455441fa6fdd6d793
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkVzWKoMH:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIl
TLSH
T19391FD0075BA12943C7F772981B8C95BCA9174733116E86A37A811A74FEBE424DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bd1f56d-8a15-402a-86c4-d85620478a2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8bd1f56d-8a15-402a-86c4-d85620478a2e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 96dedf70854e4f03ea7e2770e97ed5779136c6622be3e25d40fa25e10fde1a4e
MD5 d9f80b78d7ba716c5454f8df51cc7b5e
SHA1 0a1bc1d60869c730fa5176275f7bcdbdb3ef133f
SHA512 44dde7b2da151b7cb038b988fcb5c278271f0240eda41f2d9f54cfc7fd84fdac37a6ab100672f0a7ed3092350c2c72e15ec9ecdceb0f1231d00787cf2ee1879b
SSDEEP 768:zrv+4UNbds3FUDZIO00he6Nzc4ReyIs20eVH1S5D:zbsbS3Qdtc44bsvEH1Y
TLSH
T11203CF32A878DD33ACF6AA85B14736933EF8612B81840ED4D9EA5F4C4A471DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 adaa674b2468105e6f42e123d672527b7153c98a5a5d69c7f5a336494f3d4a7b
MD5 c31af41dc69f4065c0b469e93334e048
SHA1 4a534c710fac10d6860d80f355f1c7caa23400c6
SHA512 cd5ee5547fd5eda1a0ac0358a5b25b8eed19d7ea49fda90546e7df52e5179e37e85a58a6835bf78e479d0e358ac822e4e2e8e3b78cacef86ebe167dc4b233a82
SSDEEP 768:1FQb3gwglBzZR5O00hesNzc4ReyIsP0Pi9PzX:Ub3k+jtc44bs8Pk
TLSH
T19A039D72E864DD67FCF6AB82B7463687AEF41167C1D859D4EAD98E4C00831EE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b89414c9d684002bb01cda6e3e45fc1bcd2e24da551bb72e6d4004e1e9788728
MD5 7293d1f42cfc5afea459d6b401db9dd9
SHA1 98c0ec30817f0f8c78cb1b6bfe37bb202061ac06
SHA512 51e0d223df800081e973140737dc72c8f041e3c98aa84309367c90186ac7de866a5d5b29b36eb062f4cd129cac8e44a95449fc1d07f6572e481e5cdd8da4df41
SSDEEP 384:nsZcIT38NdrnrjcsKVJDZNfNoXOVSUUq3hei8ETRzcoXfK86sfxEZxxsIj4lB0Pk:6T36BKDZIO00heMNzc4ReyIsP0Pi9PzX
TLSH
T109F2BF71A868DC63ACFAE741B64636937EF42127D0D41E98D5ED8F0C09836AD172B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 939fd330a244b2dc680e6335aae799b76347d2ccf063cb798d2087dcdb21e77f
MD5 81668053ba0fddc8372e2913c20b84d5
SHA1 cb663fd398407975d7e8f3cbbda4504a4b7b589b
SHA512 eeca9014b3fe5ce60ed0c74b5add74073e96e8a0e6514f5faa5b0215d69c700eb134cd1d752874c671fbffd14f4b72df8d56a5800b0ade5058c99d9371bf0133
SSDEEP 768:6rv+4UNbds3EwDZIO0tNzc4ReyIsXHeVH1S5D:6bsbS3Ytc44bsXEH1Y
TLSH
T18103DF32AC789937ECF6A685B50B36533EF8512B82D81E94C5EE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1fd3a82e3dbdad47712b78d6e92a068e3c17c298cbab22b4146581ad903c083f
MD5 091fbbd9f08bf73bfcc0115787e80ead
SHA1 44a8e9d6ac5c18110d3cadd3130b1da0919f3ae0
SHA512 2511f1d7658d0ad75cf21a0621abb935f54cc7067b2cb529a50094666470a3297e42a6dedda81782f2107a0f53dc028f3c38b8e4387daba10e8105428fa27727
SSDEEP 384:zYZcIT38Ndknrj9sKVJDZNfNoXOVSUUq3hei9ETRzcoXfK86sfxEZxxsIj4lB0Pk:qT3bWKDZIO00hejNzc4ReyIsP0Pi9PzX
TLSH
T1EBF2BF71E868DC63ACFAE741B64636937EF42127D0D41E98D5ED9F0C05836AD1B2B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

40713821-bb9d-4866-b3d0-c753a6457cc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40713821-bb9d-4866-b3d0-c753a6457cc8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_188552158\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download