1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v13M-m7-eL.svg
Size 35KB
Sample260818-y152msgq4v
SHA256 1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388
MD5 bfd57f9c04b8bfc4e5434bae690e2203
SHA1 e7b3435c094295274f0af2f8397f5bb45ea184c1
SHA512 6758b4a12d192d174ef164e40e6e9404b61b978a9fb28913f7bf0882d22b005217c3f048344f661fc2e264b7060e3cbe73503e4b546688f5342e8ae0eff3613b
SSDEEP 384:chMBVd+SOAKzMf2qACRnJPB/nafePgDOx48FAIddEIRisu:c2VdxlZdIV
TLSH
T19EF2306537F43C9B8BCC03479D42FC6C46AF98B78098678D97D790E8A548368F7AC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_2033040961\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_2033040961\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_626458483\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_626458483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_626458483\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_626458483\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_36458637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_548179200\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_548179200\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315577804001384"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{01722CEF-CCC9-4FB0-9127-E2E0A5423061}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4436	4960	iexplore.exe	89
PID 4436 wrote to memory of 2316	4436	msedge.exe	90
PID 4436 wrote to memory of 3628	4436	msedge.exe	91
PID 4436 wrote to memory of 2012	4436	msedge.exe	92
PID 4436 wrote to memory of 3628	4436	msedge.exe	91
PID 4436 wrote to memory of 3628	4436	msedge.exe	91
PID 4436 wrote to memory of 5516	4436	msedge.exe	93
PID 4436 wrote to memory of 5516	4436	msedge.exe	93
PID 4436 wrote to memory of 780	4436	msedge.exe	95
PID 4436 wrote to memory of 780	4436	msedge.exe	95
PID 4436 wrote to memory of 780	4436	msedge.exe	95
PID 4436 wrote to memory of 5884	4436	msedge.exe	96
PID 4436 wrote to memory of 5884	4436	msedge.exe	96
PID 4436 wrote to memory of 5884	4436	msedge.exe	96
PID 4436 wrote to memory of 1076	4436	msedge.exe	97
PID 4436 wrote to memory of 5988	4436	msedge.exe	98
PID 4436 wrote to memory of 1076	4436	msedge.exe	97
PID 4436 wrote to memory of 1076	4436	msedge.exe	97
PID 4436 wrote to memory of 5988	4436	msedge.exe	98
PID 4436 wrote to memory of 5988	4436	msedge.exe	98
PID 4436 wrote to memory of 3956	4436	msedge.exe	100
PID 4436 wrote to memory of 3956	4436	msedge.exe	100
PID 4436 wrote to memory of 4520	4436	msedge.exe	101
PID 4436 wrote to memory of 4520	4436	msedge.exe	101
PID 4436 wrote to memory of 824	4436	msedge.exe	102
PID 4436 wrote to memory of 824	4436	msedge.exe	102
PID 4436 wrote to memory of 2456	4436	msedge.exe	104
PID 4436 wrote to memory of 752	4436	msedge.exe	107
PID 4436 wrote to memory of 752	4436	msedge.exe	107
PID 4436 wrote to memory of 3296	4436	msedge.exe	108
PID 4436 wrote to memory of 3296	4436	msedge.exe	108
PID 4436 wrote to memory of 2720	4436	msedge.exe	110
PID 4436 wrote to memory of 3432	4436	msedge.exe	111
PID 4436 wrote to memory of 2920	4436	msedge.exe	112
PID 4436 wrote to memory of 2844	4436	msedge.exe	113
PID 4436 wrote to memory of 2844	4436	msedge.exe	113
PID 4436 wrote to memory of 3972	4436	msedge.exe	117
PID 4436 wrote to memory of 3972	4436	msedge.exe	117
PID 4436 wrote to memory of 796	4436	msedge.exe	118
PID 4436 wrote to memory of 796	4436	msedge.exe	118
PID 4436 wrote to memory of 1220	4436	msedge.exe	119
PID 4436 wrote to memory of 1220	4436	msedge.exe	119
PID 4436 wrote to memory of 3928	4436	msedge.exe	120
PID 4436 wrote to memory of 3996	4436	msedge.exe	121
PID 4436 wrote to memory of 3996	4436	msedge.exe	121

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v13M-m7-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v13M-m7-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7ffb345dc188,0x7ffb345dc194,0x7ffb345dc1a0
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,6886545302734952977,16392815017628526473,262144 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,4356593795497291366,14644962539886977491,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,7370046619001499532,13287294084186562457,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1204956998402771019,14682655014182238251,2097152 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,10343798008064993387,6391416629114429712,2097152 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2369716066468625152,3937263444999391628,2097152 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,12563807782369106819,16929635109481987817,2097152 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2447121498734046236,17028113269970712036,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,9573223717528926639,16225091912751924505,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,464212759701558870,12882610879015107362,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,12476031754411613543,18135043529394241321,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,12476031754411613543,18135043529394241321,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10789849298943461903,18086057633531747706,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,8256042346332538117,17096371492625485384,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,3441005842032882510,2308700610154584607,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7298024994480145703,15590948449191483476,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,4448469815080871521,14792147033594671663,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,14011336934066168820,14264790559950849573,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,12693784162125217287,1365011087526487569,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,17949102482455481068,16679858284758647832,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,1915423176650798533,3086362858464411869,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6588,i,2763184135728023024,1774384698423520131,262144 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,2665754805705001406,11910353125323712730,524288 --field-trial-handle=2276,i,8538967461916642205,5168887381220472230,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:14
    3⤵
    PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67b1ed7a5e7b28dd4679f2e94dcd11ade1e7612ad271226247f9334de2debd3a
MD5 d1ec1ef0aef1070e747cca8448781ee4
SHA1 e9b9f49ce457b153ce317d94c0623adc63348c29
SHA512 9ae68d2e1e037b5e37e07c4c959a28025ca5175af5cc3ef30275282693640d4743b0d157d39f838d4a7c13910a5383cd6255e48923e9866dbf028e512a8bbd34
TLSH
T1FA611B8C432699B2EF7961B267E15F583DF9407D46032E95E056FF708846F806CED283
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5990dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5990dc.TMP
Size 3KB
SHA256 dd469259483f692664d978af3789b650d7d0b6bee61ecfb03b2bd73060fa94b0
MD5 4a907bd24c5aff99136cb76c9e3487cd
SHA1 1bd6648165dfb19839109a65b3cebd4a90614777
SHA512 9e566c366d57d91dad8973f1efa4f760f34afcddb9dde071660adeca94d8d2ef1af8a57ced22f5f216542f6037e5eae28eedb07d88508b193c1808995f83c8f2
TLSH
T1A6611B8C432699B2EF7961B267E15F583DFA907D46032E95E056FF709846F806CEC283
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 86bb53488d6acb3c19943347d5eea750ed093b8097856587dcd23791ac77d415
MD5 609655f55c26c1768c011ea36f3fe465
SHA1 f1656f63454a3fe8f46d7685e255b19734c1e63e
SHA512 388feb07ceef0713e3770d10830da8e7ad2573666aea7018cb9b42b3660a42c553304cf13facff4feac7c5915bbb3d3ebe62ea57a45a527a3d16e791bb80bb81
TLSH
T141418DF783F4856E891196F0AA186E1FCE1C0511832C7D5AC9E4AE2B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1065a0dcb540d8c75326b2bb4b90babb9bed75104791db0d2081e956d7d924e0
MD5 1db6e4f836432e25a6fc8facac3a85f0
SHA1 89cf31942ff1e38af81e6c91d80809e2a0832819
SHA512 10d9e7aee66405238e4efa4e7ee99e320c2d9711ec3de76230e88b16e58f24ea552aa0285303f6c320dd173f76d6729adfcbceb3bacc5a6022deddcca813309c
SSDEEP 192:sxRFRryM/jK1Ml8wCG/f5sbdYZnTWu0KzoD8p4j/g6+WNIY3B2quGcIgVuJ:sxRFV8G/f5sbdmyGi/5IAQ4
TLSH
T1DE62E815AA24597BCCDBD309FA51BF53D6F85533A1941E44AAFCDA1C00EAAED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e193977a813283a10f75becdf7a1acaa6b819513d0579f3682ceffbaa950105f
MD5 76845db68edf6f108e7c8231c25fe16e
SHA1 18abfbc8252e8f9ed7977edbba22b433d7bdc553
SHA512 dfebe732f428f3a85b6de63602219d903be87a0bc4b4038e1b73a1a601e86fc1fc963e5d26a2fc99e4ab81673b263335a9d298e71bfc17c5b5e5429d6d70c6c4
SSDEEP 192:sxRCRryM/jK1Ml8UQiCG/f5sDcYZnTWu0KzoD8pej/g6+WNIY3REEGcIgDCuJ:sxRCVqVG/f5sDcmyGw/5Igl
TLSH
T19662D615AA24597B8CDBE209FA51BF53D6F85473A1941E44AAFCDA1C00E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 23edbde8adf9bdd4530ce335069f91e20f49dad54e22d15b09c970adc4a66b5d
MD5 bca9db5038e9d52adf99b0fc77e84493
SHA1 e01744f076a5d8555aabd6fefe567acd2d207462
SHA512 22e4c7eec6614d09e7804a1a687b3758bc0062bd5ae65829844f0f0df2392095df842af5ee37b0e857f66e86c894f0582f4c55edf33cfc1b1857ad5e3c782310
SSDEEP 192:sxRCRryM/jK1Ml8wCG/f5sDdYZnTWu0KzoD8p4j/g6+WNIY3B2quGcIgDwuJ:sxRCV8G/f5sDdmyGi/5IAQ7
TLSH
T1C362F815AA24597BCCDBD309FA51BF53D7F85533A1941E44AAFC9A1C00EAAED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e5551e3e222b76d4f29f866cc43dfa09a99b53a1b5578cce84adfc1ff9bcf2fc
MD5 2a72e465f278dbd7ce0d56f5d1aebf2b
SHA1 99908e3a539aa3a7534ce90c899bc1015cbd4707
SHA512 88a6e2b8e22c5ad74c891d47655ce5788dffe4a10209f01e7322e2df66760248acaf2177225f40665c3e7ee896127f19e12e41dd18db3c44154f6fea932b3fde
SSDEEP 768:Giqbro7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqv8HMW67romHCG:GiqbrUE7hkWg0CfDsu1jal0HF6ImHFh
TLSH
T106E20C3B680CCB7E4F804A9CEC29BE9B6DA801CB56D8CD5447EA841C03C67FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b7cde4c89ded5e5f9716c1917577df43a693c861b07be19acfdcd2642700584
MD5 77525a63bf164274ec18a97ad8ce0a8d
SHA1 e104a9dd8964c10161a133dedbdc84370bdc1cc9
SHA512 6cdb5c5d972ba197ce109e3e990b827d1d83be76baba4e0584f4d5893506a09efd9540679091f7e4d4a50f5b53e02cfde39dcf3168b0b4c1ff6ef2ef6196be2e
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHMxMOMfM7MJMrMvMbWMfM8MqgMjMbK4Miw:C1i7PF/DWrwfX9mgpct1o7zsH8dIsGKd
TLSH
T1FB910455323A0280383E6D8C90F9A81ED5C178637058A52F7BFA15B61F26E178CFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2ed2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2ed2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fd509304292796dc5c2cd40fd284de27db797f1f148521a2144158b10aec88f9
MD5 38727754e036bc244d63525cbdc4854a
SHA1 e862828a67693009119680068516a6c55a01b34c
SHA512 c561786475f81b5d97676a4981d4a6ece2ab971a5c80f7bde0c0f9e75c38149fb71aebe7cafa80413f5e1bd1a7919ce1c466ce732346b385f3ed4a4da77e1b7a
SSDEEP 768:kFQO3owgN7aAtfZOOf3xf39vShCQRv0uTHyBu0:HO3AHftfhftvSr0cHyBR
TLSH
T181038D76DC609977EDE6978AB709BA07EED49163C1CC99C4DED85E0E00C35AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0c540ee005e733baac02ad6453ecb913d06bef5da22d31f807bb1dda5c004bef
MD5 8db000a7e70a55453f3a5be8269dfb24
SHA1 3477f6ef188235a410441a4d8927ccff6fed804a
SHA512 9802212e9d24c3a91a14cf6e84f133487415a8c32abe3295d5843e4faa8fe6a242a39efdd0ef84570c1890c94bd7583acd6fe97de9eb6dc6cd03ce77fd9424dd
SSDEEP 768:O03S7+c+wfZOOf3xf3evShCQRv0uTHyBu0:O03SIwftfhfOvSr0cHyBR
TLSH
T164F2BFB1AC706973D9E6A749B60A7B03BEE59137C1CD5A44CEDC5B0E01836AE131BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4a1b0138e4fd5fb6b635ff00f45d53e1a9ae1d6000ba0846fa676b9f430c2736
MD5 74fbf06eb29e552f8b9430bab9cada07
SHA1 f774cbefd57b2d999686584d75a2f707b60892d2
SHA512 7f843f83557cdb7452416f642d04ac848f3adc876b15adeb3faef74991e32b6d1bb1004ead76da53f29d51325736efd46388cecc4ec458d6ffec82748f218462
SSDEEP 768:X03P7+c+wfZOOf3xf3evShCQRv0uTHyBu0:X03PIwftfhfOvSr0cHyBR
TLSH
T119F2BFB1AD70687399E6A749B60A7B03BEE59137C1CD5A44CEDC5B0E01836AE131BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 325e56d98cec95081aac7dd643eb13ec3210147a22f6797230077e23cb8ec172
MD5 cc148e1e8d6141708a776e0d8e7be0fb
SHA1 756002e24462929f30019ba6d97ceed28baf3695
SHA512 bb6c372dc429b5e526bbfa67333c56f7bceca196afde4136748f743f09a4e37afe6da6316c1d10882e7ad730c46a200cb2ab3ebed10b3f16a8913bb3012199b2
SSDEEP 768:Rrv+4UNbd43Iqkc+wfZOOf3+vShCQtK2bwWV:RbsbO3IfwftfuvSm0wO
TLSH
T13103CF32E96899339DF692487646BB63BEB46173C8C54784DACC4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ebff8ed1348f5075ed11d8e161b00b29e8e8898b9fe83de93c9edbb13fb8efe2
MD5 c06358043f1aba66a34538258b44f66b
SHA1 92766ec6ffa334580144bf81e58d6c205fe12ad4
SHA512 cc4f12add38b5a89217fd92ca624579cd1b4192507a04287e5cb08192e35c967034c6d72fd995fd27677be3be936dcf4828fbca111df6b95412457bb833f59b9
SSDEEP 768:9rv+4UNbdj3uT+c+wfZOOf3xf3evShCQRvO:9bsb13ugwftfhfOvSrO
TLSH
T11D03BF71E97869738DF29749B206BB13BFA45023C4C90A54DEDD1B0D01876AE231BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2ea44442b7cc9fff48dd686bebc1e8336296e3ce5d70b43a47c8b788edcd96fe
MD5 591182fcf87bbe0faafaa5952fea3f3b
SHA1 4b126de558f2581d24dbeb987f5c1d5c0892fddc
SHA512 9a740b2a7f084183713c8d4629cd153d86a893d8abc5590c163dc5c6e33ab1ae02bf4fcb9c562046352808ea6a411f4d5c6871fbe299eecf1ccc4e0755a08348
SSDEEP 768:brv+4UNbd43Ygc+wfZOOf3xf3IvShCQsv2bwWV:bbsbO35wftfhf4vSg0wO
TLSH
T1BD03BF72E97869739EF39648760ABB23BFB59163C4C50744DADC1B0E018769E231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae8af644-53b9-48d1-9c75-269f3220a0ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ae8af644-53b9-48d1-9c75-269f3220a0ba.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

f21939ae-4300-484e-ba65-1cabe8e6287b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f21939ae-4300-484e-ba65-1cabe8e6287b.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

2f2dda8e-46fa-47a8-a478-100c7ed9cd14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f2dda8e-46fa-47a8-a478-100c7ed9cd14.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4436_2028786578\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download