61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260815-e65hhsztft
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1019229889\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_585597477\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_585597477\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_585597477\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_585597477\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1667538132\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1667538132\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_370411238\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_370411238\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312420578078284"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{61797D8C-BF2E-4FB1-B9DF-05BDA9FEC7C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4032	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4032	3012	iexplore.exe	89
PID 4032 wrote to memory of 5804	4032	msedge.exe	90
PID 4032 wrote to memory of 4460	4032	msedge.exe	91
PID 4032 wrote to memory of 5872	4032	msedge.exe	92
PID 4032 wrote to memory of 5872	4032	msedge.exe	92
PID 4032 wrote to memory of 5872	4032	msedge.exe	92
PID 4032 wrote to memory of 4476	4032	msedge.exe	93
PID 4032 wrote to memory of 4476	4032	msedge.exe	93
PID 4032 wrote to memory of 4040	4032	msedge.exe	95
PID 4032 wrote to memory of 4040	4032	msedge.exe	95
PID 4032 wrote to memory of 4040	4032	msedge.exe	95
PID 4032 wrote to memory of 4048	4032	msedge.exe	96
PID 4032 wrote to memory of 4048	4032	msedge.exe	96
PID 4032 wrote to memory of 4048	4032	msedge.exe	96
PID 4032 wrote to memory of 3228	4032	msedge.exe	97
PID 4032 wrote to memory of 3228	4032	msedge.exe	97
PID 4032 wrote to memory of 3228	4032	msedge.exe	97
PID 4032 wrote to memory of 1516	4032	msedge.exe	98
PID 4032 wrote to memory of 1516	4032	msedge.exe	98
PID 4032 wrote to memory of 1516	4032	msedge.exe	98
PID 4032 wrote to memory of 5168	4032	msedge.exe	99
PID 4032 wrote to memory of 5168	4032	msedge.exe	99
PID 4032 wrote to memory of 3732	4032	msedge.exe	101
PID 4032 wrote to memory of 3732	4032	msedge.exe	101
PID 4032 wrote to memory of 5956	4032	msedge.exe	102
PID 4032 wrote to memory of 5956	4032	msedge.exe	102
PID 4032 wrote to memory of 5704	4032	msedge.exe	104
PID 4032 wrote to memory of 4628	4032	msedge.exe	105
PID 4032 wrote to memory of 4628	4032	msedge.exe	105
PID 4032 wrote to memory of 2208	4032	msedge.exe	106
PID 4032 wrote to memory of 2208	4032	msedge.exe	106
PID 4032 wrote to memory of 2932	4032	msedge.exe	110
PID 4032 wrote to memory of 2948	4032	msedge.exe	111
PID 4032 wrote to memory of 4324	4032	msedge.exe	112
PID 4032 wrote to memory of 5900	4032	msedge.exe	113
PID 4032 wrote to memory of 5900	4032	msedge.exe	113
PID 4032 wrote to memory of 3196	4032	msedge.exe	117
PID 4032 wrote to memory of 3196	4032	msedge.exe	117
PID 4032 wrote to memory of 1516	4032	msedge.exe	118
PID 4032 wrote to memory of 1516	4032	msedge.exe	118
PID 4032 wrote to memory of 1368	4032	msedge.exe	119
PID 4032 wrote to memory of 1368	4032	msedge.exe	119
PID 4032 wrote to memory of 1436	4032	msedge.exe	120
PID 4032 wrote to memory of 1436	4032	msedge.exe	120
PID 4032 wrote to memory of 4324	4032	msedge.exe	121
PID 4032 wrote to memory of 4104	4032	msedge.exe	122
PID 4032 wrote to memory of 4104	4032	msedge.exe	122

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,1719874229167444345,5872482796819485746,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16699150093107506196,9572776033094039478,262144 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,16961654088705074071,3467166441359409902,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,12816455048950796603,11514265749039058425,2097152 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,10422154190262002450,4755757373181835455,2097152 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,3531935547933846955,2649240636270665030,2097152 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,13713992951695660731,7797944650033371683,2097152 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14392688032572858195,6005038823987698054,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15490707350014054732,876312922250818394,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,491709924409751791,6491001256370249439,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4394502714102586497,14343270241217043420,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4394502714102586497,14343270241217043420,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3885879200377926005,7286837797517984829,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,13824090211608419474,6635381709672327097,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,5538269863590571994,16063994426099653574,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17118322472766174280,17606551548920297089,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17095342816526202257,4840767742027102943,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,5116233446079066856,11168344027736790674,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,5340715010917877523,5171395077733796701,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=884,i,12389327474095229878,18375080242594250036,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,6407857363080944534,14042799688778788161,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,11733982353179751902,7815487665654107052,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,14181412668940371415,11167355323439278687,262144 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,15068150787528262610,15286968713808969001,524288 --field-trial-handle=2372,i,10571642596474762832,2781939515935636613,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:52

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a8007805e866030ddef8c0bffd6eec19b553c477bee180584b20c9c94621d55
MD5 f5400134b7975827b28654b3dcb1bdd6
SHA1 7e8ece0707d714e927405149f6d79c09a5c4d741
SHA512 1a774a2d3347b177b206cdb44ef3d8dfa5dc050dc320a393142991f46902ad3f68a035ce5a4ceb798b1663a69be306b2e14c094ed33e586d5db67c58a873f12f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 49692fb9b901eeb2833f99373d43d607ba1a89868a02cd5184e69f71ce425c3e
MD5 5ea3727e1ac6e164de685dab35feb637
SHA1 8a45a2b4e476cf7c0bd5544293743ad8c81da295
SHA512 67756f7eb1720973ad28401263a2671100724f14f4aac147e135c3906e3c1cde964fb6c38baea49ecee41036aae4e7ecd9f32a693f19e88047b5ba39a46fd83d
TLSH
T172612ED2A3A10AE2E7354EBF44E1F45737F4CC5A82B31E0474835E746462FE4A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5910a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5910a0.TMP
Size 3KB
SHA256 2454cf9433012f9144e0046fd2c0d19fe878ba0ba9dc15e43fabc21f047f4955
MD5 30eca883a6f3924f91511c0203103c80
SHA1 4fdeaaeb60c82ebba018cfc9fe6292bb92b7bf8e
SHA512 05469758cd4f723ff8269117d2a0de4c46138b244108dffe3396b55f5f1f488e169f22445bba0d4dc5e1e8af0641efdaccc770c5d45cad683aaa8bcf92b97736
TLSH
T1DB612DD2A3A10AE2E7358EBB84E1F45737F8CC5A81B31E0474835E787462FE4A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b81c704a084f7341532ee3014012e864d3f9782f15afcf11dfc4c0e0196a77a1
MD5 be72d5695eea4cfd135d0220cbecaec8
SHA1 0ff2bae3b586e759a172c1f1ea86450a9d159e37
SHA512 80d1c6750bdbcdb4d04f76be5620e0d865425cf2265d060225b131564ce63cc9553700180b2059a228ad36b23a877de0932db6c69b904ec280ec671526166d4f
TLSH
T145319CF783F4857E8A0195F0AA186E1FCE2D0515432C7D9AC9E0AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 56507c47bf134f0915b40b0557822b84296509482f9fd0264e47190927147587
MD5 54c9bcbc9cd43dac3480963eb3720e49
SHA1 2d41961d121353db383fc47b4ab49aa865899bca
SHA512 cc8bbf5172699b6f1996c03b797b4140a9d09f6295aa5548a8bcc904d4419e358caff5534f0dbad6bbbfe0dbf9d69589b7db6fbcc89023e63facbf036d797e5c
SSDEEP 192:sxRJR6yM/jK1Ml8UQKCd/f3msVk0WBZqAmzoA8peJ/g6+WNIYn8rRhpGwIgDulJ:sxRJ0qtd/f3msVk0WPqAbS/5ITXPg
TLSH
T1CA62D815AA64A977CCDBE20DFA457F53D6F85573A1901E44AAFCCA0C00F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dad8cd2ec25925addc5d99b75babd3e22de4fb51adfa081462153f9be8165dc3
MD5 6c77ce19a69bea904870ac021bcce1ea
SHA1 bbb09a5829fa73b011ec14be9fae5d058ac0b6a9
SHA512 e1db14bf1f1ba33975cd82f29dbafdf596467c4994dec2fc2964bc450b6d922e6f0eaa7eb67168f549a714e429f3e71e807b7bfe6b2c7e9b36743fe3306dfd7d
SSDEEP 192:sxRJR6yM/jK1Ml8wCd/f3msVk06BZqAmzoA8p4J/g6+WNIYn8UphpGwIgD8lJ:sxRJ08d/f3msVk06PqAbc/5ITKP6
TLSH
T18A62D815AA74A977CCDBD20DFA557F53D6F81563A1901E44AAFCCA1C00EAAEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c1f89612ae174b40636799914bf4ed04e0045e46d3e54996295abd9b40dd323b
MD5 caaad79a468e79516ac00ea19d193882
SHA1 6eea5818c1f1920aeb6457af3d92956233a5c23c
SHA512 af630adfcfd0afd6e703b79b41645e0e4840d43946c9764ce675c535027b1d5596917bbe021a8250a6952ec4e1ae3f9220525219f9a5aa666a8978ce178fc071
SSDEEP 768:wGedLg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA1Ou4YaroSn8oz:wGedLsE7X6WgoufDMu1jaT1OVYR8z
TLSH
T125E2EB3B680CCB7E4F844EDCEC29BE9EADE801CB56D8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c858897ed37e3fd731682c155a7a7ee116bc18377e1647936b293774474df69e
MD5 ab34f56e0f4c89519f2040cb2daa5efc
SHA1 a404591238c6dfb0cf0891e58191e97cd6b44b0a
SHA512 8373bfc87cbd9c586e8dfc03e0a0df24a929b62004f7dce5a6822a5b659c143357af62198db2a834b9d8c4088980a4edcd066dfe9263426c462eb9a9c928f412
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkFHwzXRx:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIs
TLSH
T11F915200757A42443C7E7A1885AD996BC6827473311AE97B3BA811B30FEBE434DFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e48164ff-cd34-4063-a79e-ac6a7fb819a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e48164ff-cd34-4063-a79e-ac6a7fb819a9.tmp
Size 14KB
SHA256 08390ec7b8b73f52d4d201f3505795f07618a4889a38fdeb11c74cc0ef9ca706
MD5 b160be94263bcd8548cf04987d18d1aa
SHA1 77d3cc74ec2974b45f70e3014a4546a4972a5842
SHA512 68f76a6f0ded69fe8ffb572a07da8d4d0fae91f56291641e876db821f80ae43c4f45242e3bf10770e0a9140ee69a680b22329be0b2c17a13131ab33e1e28a5a6
SSDEEP 192:sxRuR6yM/jK1Ml8wCd/f3msBk06BZqAmzoA8p4J/g6+WNIYn8UphpGwIgVlJ:sxRu08d/f3msBk06PqAbc/5ITKP5
TLSH
T1C462E815AA64A977CCDBD20DFA557F53D6F81563A2901E44AAFCCA0C00E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f377fdee-241a-4cdb-947f-76a20f8f5f37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f377fdee-241a-4cdb-947f-76a20f8f5f37.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e927e9cf942b52246d74b4b057a534de00f98ade8ac1af780c60ae6239d3113
MD5 d8af2217a3ee7fe8ae1bb37baea40273
SHA1 7eb6cacb2806b624950deffa643f30525e470c88
SHA512 3abb5633b40d55183445d0c6919890bb6dfb63b93c6ba044a1a7893e640e1b6a06cb814bff5ed3755ddb1be365e5eb3201d2852de6bfc052e2477961392d0872
SSDEEP 768:CB3iHmDZIO00hepNzc4ReyIsPyPi9Pptw:CB3/Itc44bsKPitw
TLSH
T178F2BF70EC788C63ACFAEB86F55637827EF41167D0D41A98D6ED9B0C058729D071B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 26af5551b09bf5865d6775d65ed3a93679fe393ce6c035ec55e08d266d35e9e6
MD5 306f7ab3e28964b77c65c05e8e6ae8a1
SHA1 377bdc33195ada062e6d8a12a951e80a3e6809b1
SHA512 62bcc0ee7d9a950750c51aba15250812dff29142f7492799689db050e59f511493908f67eca0b782446e39201fecaa689e4d9d858d8bc0e0681a9c16d4e92d63
SSDEEP 768:FFQE3qwg4HnZR5O00heTNzc4ReyIsPyPi9Pptw:kE3m0tc44bsKPitw
TLSH
T1B0039D71ECA4C96BFCF6ABC2F6563682AEF41167C1D859D4DADD9E4C008719E070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c21cacd04745dbab0bec35efde5d573b981750b5c1e87a8e7ac6e605a4c36553
MD5 d90a73928ca481302b9e0bf455704e7d
SHA1 fe3bd6539d18c7f2000aa651efe761ebec74ee20
SHA512 f0eda1925f3c6f20e2fd09b810f98695ac87ca517097922dcdae2e9f961ae189976c7a576ea1e051e9e7459a48d4103b4c9a66ed6b5115c8c8d54e5594b95337
SSDEEP 768:6rv+4UNbds3nawDZIO0tNzc4ReyIsXZeVH1S5D:6bsbS3etc44bspEH1Y
TLSH
T1D703CF32A8789977ACF6A686B50B36533EF8511B82D81F94C5EE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e68a18262bf4e7ec1cd7774c443de4a234188932447eb4e2f5d191d2e3810f7f
MD5 bd0ae4ee7f27f5aed0c2713daaaabebd
SHA1 de730768dc9706dea4c4272051c866843bc13c93
SHA512 d2152a9f20a215cf12bdcdaff18154200b9a181b51c665c22350401e8bdb5325caa87fa8560e9e9a6cfc37e9718fa5ec2328f8014fb25b0cb329af3d1c7ee7af
SSDEEP 768:yrv+4UNbds3zawDZIO00he0Nzc4ReyIs2yeVH1S5D:ybsbS3Pztc44bsFEH1Y
TLSH
T19503CF32A878DD73ACF6A686F04736933EF8612B81840E94C9EA5F4C4A471DD174F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8767d89d1eeaf539517eb32a1e239ae93191e30336bb771ada9de4ebe07e8289
MD5 125fca71310c8c1668e06fb1daacc367
SHA1 7657f8a3c343a7a747796a681305cb9f5e9219ca
SHA512 103a651b6cd9d6b1174b808a9353ce9bba5765e48c095560bb4f5ec6cff18241805a3b4e653f74d33f252978517c6b6844df3178d87fe3c5f279717a9e40b092
SSDEEP 768:NB3PHmDZIO00hepNzc4ReyIsPyPi9Pptw:NB3YItc44bsKPitw
TLSH
T19AF2BF70EC788C63ACFAEB86F55637827EF41167D0C81A98D6ED9B0C098725D070B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4032_1396000297\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download