09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5

Analysis

max time kernel
149s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m3-eL.svg
Size 3KB
Sample260814-ewzjhsvbpg
SHA256 09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5
MD5 8a97a3e2ea7103a874e7c9a32e7ed545
SHA1 b450e9e2801ae7e10cb96224461aeddb11dc1ef7
SHA512 7303da25aa0029a146545b8d2046e553d7c07cc7ad7a6942065592fa27b645f0a9a88448251d474773f712b5eafff6d8b4ec09bfbd1a490865583802a57df4b7
TLSH
T12A61168876F87EEBC7D802530D51D8B84B2F946BD822978DD3CB94E875282AC735E570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_155056692\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_155056692\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_2051434833\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_2051434833\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_28507671\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_1758325904\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_155056692\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_2051434833\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_2051434833\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_1851071731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_28507671\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_1758325904\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_155056692\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311547053645532"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{6A8C6177-B1A0-465D-986C-2622109B4ABE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5400	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 5400	5056	iexplore.exe	90
PID 5400 wrote to memory of 6064	5400	msedge.exe	91
PID 5400 wrote to memory of 4620	5400	msedge.exe	93
PID 5400 wrote to memory of 4108	5400	msedge.exe	94
PID 5400 wrote to memory of 4620	5400	msedge.exe	93
PID 5400 wrote to memory of 4620	5400	msedge.exe	93
PID 5400 wrote to memory of 2180	5400	msedge.exe	95
PID 5400 wrote to memory of 2180	5400	msedge.exe	95
PID 5400 wrote to memory of 4504	5400	msedge.exe	96
PID 5400 wrote to memory of 4504	5400	msedge.exe	96
PID 5400 wrote to memory of 4504	5400	msedge.exe	96
PID 5400 wrote to memory of 5960	5400	msedge.exe	97
PID 5400 wrote to memory of 5960	5400	msedge.exe	97
PID 5400 wrote to memory of 5960	5400	msedge.exe	97
PID 5400 wrote to memory of 1224	5400	msedge.exe	98
PID 5400 wrote to memory of 1224	5400	msedge.exe	98
PID 5400 wrote to memory of 1224	5400	msedge.exe	98
PID 5400 wrote to memory of 4804	5400	msedge.exe	99
PID 5400 wrote to memory of 4804	5400	msedge.exe	99
PID 5400 wrote to memory of 4804	5400	msedge.exe	99
PID 5400 wrote to memory of 5048	5400	msedge.exe	101
PID 5400 wrote to memory of 5048	5400	msedge.exe	101
PID 5400 wrote to memory of 4572	5400	msedge.exe	102
PID 5400 wrote to memory of 4332	5400	msedge.exe	103
PID 5400 wrote to memory of 4572	5400	msedge.exe	102
PID 5400 wrote to memory of 4332	5400	msedge.exe	103
PID 5400 wrote to memory of 4780	5400	msedge.exe	105
PID 5400 wrote to memory of 3116	5400	msedge.exe	106
PID 5400 wrote to memory of 3116	5400	msedge.exe	106
PID 5400 wrote to memory of 1592	5400	msedge.exe	107
PID 5400 wrote to memory of 1592	5400	msedge.exe	107
PID 5400 wrote to memory of 5060	5400	msedge.exe	111
PID 5400 wrote to memory of 4752	5400	msedge.exe	112
PID 5400 wrote to memory of 5832	5400	msedge.exe	113
PID 5400 wrote to memory of 4308	5400	msedge.exe	114
PID 5400 wrote to memory of 4308	5400	msedge.exe	114
PID 5400 wrote to memory of 1476	5400	msedge.exe	115
PID 5400 wrote to memory of 1476	5400	msedge.exe	115
PID 5400 wrote to memory of 2436	5400	msedge.exe	119
PID 5400 wrote to memory of 2436	5400	msedge.exe	119
PID 5400 wrote to memory of 960	5400	msedge.exe	120
PID 5400 wrote to memory of 960	5400	msedge.exe	120
PID 5400 wrote to memory of 3704	5400	msedge.exe	121
PID 5400 wrote to memory of 3704	5400	msedge.exe	121
PID 5400 wrote to memory of 5016	5400	msedge.exe	122
PID 5400 wrote to memory of 4956	5400	msedge.exe	123
PID 5400 wrote to memory of 4956	5400	msedge.exe	123
PID 5400 wrote to memory of 2436	5400	msedge.exe	124
PID 5400 wrote to memory of 2436	5400	msedge.exe	124

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb0b46c188,0x7ffb0b46c194,0x7ffb0b46c1a0
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,4517959983008505759,11133279690142711397,262144 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,3711318710903621417,9746689772153884361,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,2440714082073566851,55593764137080142,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,15150790444935730657,15165032105854564464,2097152 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,1698561361809132032,3518717777298066442,2097152 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,9852846261246725581,11626706298150573890,2097152 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1099251421510376533,14593089835092861757,2097152 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,16652051749298271358,15579881629033985736,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,12213518472585589217,5310480882606983328,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,17229630632903644046,2013397678213210069,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,14525849558441424157,3933737730378603834,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,14525849558441424157,3933737730378603834,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,5639278036430217284,6085834747450194148,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16746565226074773523,18166259230346899343,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,6786302947303666183,7588220649211514435,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,478630621498898550,10718293540166047581,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,17277617369081278236,5395330227907962300,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7402847369944193320,15999168226063355309,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,17247139044265501695,6250326452243777497,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5221875373704908414,5350885949666063228,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,5144637091748259210,3269840946948482757,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,2724820082180078359,3802114282188761279,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4276,i,14470143950273548747,8577277562857068200,262144 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,17839048988337111282,14125231745126274250,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,13910668520046376229,2656560731521638249,524288 --field-trial-handle=2512,i,5981538888356986556,10895343890502820075,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d68177580774d0f63ab798eede236ad10d91a640f209a1efc601cdd58c094951
MD5 3c0c2265a0d77ee52bedfb01260db68d
SHA1 c5fa94100befe64a59f21ba71cd52e052cc6a492
SHA512 ab64fe40a2ca4992fdcbd581c917664f8aa16dfede6205f91445741859749f0c7d75b63df25633ffdb8aaf76e09af54b299b04974e5aec488dd751877d063df7
TLSH
T12B4195958F2E14DAC3A4E5B212F951993AF6C8693D072EC95471BE7C9B92F0C00DB223
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ac940902976a7737183b4f067e1f94a514dffacc99976e354a66a6d2a6572656
MD5 57032f67ab9aad40fdcde95fa966af84
SHA1 261c0ef7f3e650666fc3d47ef7871956721dd806
SHA512 9c867bb82d8a8a7a0ba1db77a4eb6575cdad4e78f0e44de9277f437af7a781119e954c15ec613bee326b47442996b3230f900d0db7744a4289d8e690cfa03f33
TLSH
T10241ADF383F4856E891196F0AA14AE1BCE2D0915432C7C5AC9E0AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 72d1990d85e7c75ca417a9980de5ab23244df34474f1cc537a0b320dcc7ef23c
MD5 7ec76dd74e4b8d63900548b7762f03c1
SHA1 956a086d6188dd34cea1bca84baca6ac61b8e003
SHA512 9e4f9a7cfba9cefc9afadc87657c95579a08560ecbeadb54c4e499e3a42cfec445e96c4c319893f6e4ac5a0dcf725e576abafb435539425aab53917261d75b97
SSDEEP 192:sxR/RVC5/fysTZWZozoA8p4Sw/g6+WNIYbCYi6y+G8IgV1J:sxR/q5/fysTZgxXw/5Ij6y+p
TLSH
T12D42B7156E38A93B4CCBE219BB557F53D2F91032A1D51E48BAFC961C04F7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 164ae00010a7f2280368904a0c59d37341c445fa1aaf2a57a9c19ddcd0a6bd50
MD5 8fbd69b71dd3c0251fc96e8368f7de6e
SHA1 0a6b198c47a37a5ea81e3fec95901c285b0c8c53
SHA512 12f357168782e780d1f0c8851d50789061ad800a5ec0c34bb2df3f7b8d06647f7bb95fdd7ed7d99fcc1d7034e69205b58081244f23ea34c5bc96c28a3a9efed1
SSDEEP 192:sxRwRVC5/fysg7WZozoA8p4Sw/g6+WNIYbNqi6y+G8IgDW1J:sxRwq5/fysg7gxXw/5IQ6y+I
TLSH
T11B42C715AA38A93B4CCBE219BB557F53D3F95032A0D51E48BAFC961C04F7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c14af0072797af1262132dda2f5ddec719e6cff51bd7203c3775b811a6dd2f0
MD5 c207a7b538a9f7c938d74e7369b40ec5
SHA1 851dc244c0a0ebd79022ba73a38131e7295dac74
SHA512 fc76ad85ef6ef3aacf1374597ca41f19cd0c8d8052ac1ee9e3bc709644a791b5052db0cacd5783958e34229f8cbadc2457e4e8d01990e4a9c8786992a93b920a
SSDEEP 192:sxRwRVC5/fysgZWZozoA8p4Sw/g6+WNIYbCYi6y+G8IgD01J:sxRwq5/fysgZgxXw/5Ij6y+6
TLSH
T15142B6156A38A93B4CCBE219BB557F53D6F91032A1D41E48BAFC961C04F76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 adb0aa1bb28278893f12c10e2744f32338b0dfb1787d134ab724788c0090ae3e
MD5 9f48e2d5aed5eb6d3c8b0a342bc456c7
SHA1 c47be54428f1118f5170025df75391715bc48083
SHA512 6c76b0f465c55724a0a6f721437943712c5bd243a16666d65c3d915d52759c5f1d71d60f171bceaa6e4d8a6224473d18a3febbe9f6a9dcf548697a79f824da47
SSDEEP 768:Fb1pPD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVcE2J8ICroSPamX:Fb1pP1E7otWgikfq4u1jaHE2yIZw
TLSH
T14CD2DA3B240DCA7F4F804ADDEC197E9E6DA802CB96D8CD8447FA951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b07c64801eab43af7db9ab453ff41e6b67c439d1e3e2f48cf85d8e3cbce142bc
MD5 f217ce1950177946cbd10c688a10557e
SHA1 686db0eca25ad6481bc1b835e53f46c42fb40405
SHA512 9cac129a4169e0cbe29d324ad9b3f5b04c98fffdb0020ff056790c4269dd7cc93803b56dcfc40220365cd8b4585ca8504f84fa37521c1c4f6c68b2f42ffaba28
SSDEEP 96:KRKvWK8c8qWEhZg6qK4fgAqcqCpYaDHVCbvlfjHWLQeg3HK4GgJHcNVIbm04Kh67:CKvWK8c8VEhq6SfgAxqCpYaDHVCbvlfQ
TLSH
T1BD911202377E42917C3E650D917A8D1E96A2B4A33068F43FB7E901755FAAE024DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4392.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4392.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7a1ca61ec6805730d290eacba8b0c1ac41632b42ecbed2f0f356c81da4f31f9c
MD5 4207421c01670856e6c33178acfde81a
SHA1 744d1b0d07b89d27c973cefd4e6625d6aac583b7
SHA512 6bf0f72b9314d1e103ecfd54caf19d2f6b9692e4d00e915cd18f97d6898c9f976197dbbbaa1189acfab71b158e4b5613fa3c5e9d98ccbb4e56dfd1ed4bb4651b
SSDEEP 768:2FQ53owgvb694vy/t2eNItZu4aWADIidy8LuC8pJ/rhy:953SUItZzaNsuVLJoJ/rhy
TLSH
T159038C7AE855CE7BACAA9785B7423A4BEEF450A3C4CC88D5D9DD5E4D00D31AD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0b616d18c615bb0b052c7c8b3337c321086d604960c1fe4a3eea34083da57578
MD5 72baf7fea0a13048e3a49aa8357a6f76
SHA1 0d3487c7e12cf8177fc19aa577bef583799c21d2
SHA512 0cedcf5d0bd70134d124d5ecc2dd12f8a3bedc2023d8ff64867d662042600daa1c7b020a9d5d1768d7c4a8704d41d86633ed64e9624a9a97d9b98ee70f92f3da
SSDEEP 768:Brv+4UNbdg3ib6OBqobGy/t2eNOtZu4aWADIidy8LuC8pJ/rhE:Bbsby3i1OtZzaNsuVLJoJ/rhE
TLSH
T13A13BF35B819DE738CBAA284B1833A47BEF850A3C4C906D5D9DD1B4E04D74AD131BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e69f763ed6f28f624d5a0105775d39845dcba3d7384e8fbb73c51d401bf8b2c3
MD5 b3cfad3e4a1c9d0bc727e875277e9c57
SHA1 6f8bb9398e6e421d2c86fababba0850210ad2b65
SHA512 3e79a47011bbe068e1d578148a05c8eacaf8ab661882ac525e17161f2cc08703265feb7d94a82eb85cba94e0f759c155ac0e1df37482fe9286bb1bc0ccfd97d9
SSDEEP 768:9rv+4UNbdC3FVfBqobGy/t2KFpZu4aWADIidy8Lq3eVH1S1C:9bsbw3xFpZzaNsuVL8EH1d
TLSH
T1F703C037AC59CA739CF79684B187760B7EF89163C6880AD488DD1B4E41DB4AD1307E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c61c741237bf6d7b18565a404fb2c7b3ab01f473732e7766d201d36121696519
MD5 6ff24bb0c23a46c96e49ab1ddd45929c
SHA1 22fbf0a40b1fb52c6febca3b2f4231f076ffb5bf
SHA512 ed744655fd7b43ce32dfcce56d250928ad37ff86d98c426a12368013562e89dfa4cc98d1c46b2141e3125142fc76e4056ea5d21b34b5441ebfdd4f7fed424e32
SSDEEP 768:Urv+4UNbdg3xb/OBqobGy/t2eNOtZu4aWADIidy8LuCeVH1S1C:Ubsby3xoOtZzaNsuVLJEH1h
TLSH
T17213C035B859CE739CFB9284B1873647BEF851B384880AD4D8DD1B4E059B49D131BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 034459b20558ebb57e47da656f996f9f80fc8f58006e98c07ce8913a1ab4a8e1
MD5 bd17ee59f022a7450b007760258c0428
SHA1 d721437a6ddb3609d4e8cd3bf4d54af4359d152d
SHA512 82ae28139712afae2fc3ec47e0e86033dec6eb8c891ff57307a588e1ec9e86fe924a07c0095269ac2b7d40053d0b291d550b094867385fe7e0a6707e6f796d7a
SSDEEP 768:9rv+4UNbdC3wVIBqobGy/t2eN4tZu4aWADIidy8LbCeVH1S1C:9bsbw3n4tZzaNsuVL2EH1d
TLSH
T10A03CF36B859CE739CF79284B187764BBEF861B385890AD0C8DD1B8E059749D130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

d249cf47-0cd6-4a85-8f90-2fd08eafd57e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d249cf47-0cd6-4a85-8f90-2fd08eafd57e.tmp
Size 36KB
SHA256 ec342614fb774712f7c1f589f1b9d5a60116b0df636c506eebf5dfe108804905
MD5 6b50174aa4e99043e1e70d3a69bdc79d
SHA1 7910de05dbf569df9c4f1a0c597d20b4ca4e08bd
SHA512 99fbd3b43aed7ff163cdfcc4cd841ffe2818ec79bfd887442ccaf04532482e95f27dab76221e2e5b4e0412663ae28a22acf637a485ded15f571aa8e9ec10a8fd
SSDEEP 768:3L3Ab6OBqobGy/t2eNOtZu4aWADIidy8LuC8pJ/rhy:3L3A1OtZzaNsuVLJoJ/rhy
TLSH
T16CF2BF79BC15DE739CBAA284F2822A47EEF890B3C4C849D599ED5B0E00D35AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68f52c25-ed71-4064-b47d-68bffa8d5d68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\68f52c25-ed71-4064-b47d-68bffa8d5d68.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5400_1084011485\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download