4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-4.0-pannel-master/MEMZ-Clean.exe
Size 12KB
Sample260819-lph2hs1fre
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
TLSH
T13042E88BBAE05007F1F1C57A24B56738DB7DBB631FA58ECEECB11E429A90C466407352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316061750682109"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{38ADAF63-F47F-4AD7-962F-EE68EAA65EAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3460	1016	MEMZ-Clean.exe	87
PID 3460 wrote to memory of 2852	3460	msedge.exe	88
PID 3460 wrote to memory of 2032	3460	msedge.exe	89
PID 3460 wrote to memory of 1668	3460	msedge.exe	90
PID 3460 wrote to memory of 2032	3460	msedge.exe	89
PID 3460 wrote to memory of 2032	3460	msedge.exe	89
PID 3460 wrote to memory of 1092	3460	msedge.exe	92
PID 3460 wrote to memory of 1092	3460	msedge.exe	92
PID 3460 wrote to memory of 1560	3460	msedge.exe	93
PID 3460 wrote to memory of 3044	3460	msedge.exe	94
PID 3460 wrote to memory of 1560	3460	msedge.exe	93
PID 3460 wrote to memory of 1560	3460	msedge.exe	93
PID 3460 wrote to memory of 3044	3460	msedge.exe	94
PID 3460 wrote to memory of 3044	3460	msedge.exe	94
PID 3460 wrote to memory of 3476	3460	msedge.exe	96
PID 3460 wrote to memory of 3476	3460	msedge.exe	96
PID 3460 wrote to memory of 3476	3460	msedge.exe	96
PID 3460 wrote to memory of 4596	3460	msedge.exe	95
PID 3460 wrote to memory of 4596	3460	msedge.exe	95
PID 3460 wrote to memory of 4596	3460	msedge.exe	95
PID 3460 wrote to memory of 3148	3460	msedge.exe	99
PID 3460 wrote to memory of 3148	3460	msedge.exe	99
PID 3460 wrote to memory of 4960	3460	msedge.exe	101
PID 3460 wrote to memory of 4960	3460	msedge.exe	101
PID 3460 wrote to memory of 4960	3460	msedge.exe	101
PID 3460 wrote to memory of 3788	3460	msedge.exe	102
PID 3460 wrote to memory of 3788	3460	msedge.exe	102
PID 3460 wrote to memory of 4984	3460	msedge.exe	103
PID 3460 wrote to memory of 4984	3460	msedge.exe	103
PID 3460 wrote to memory of 4984	3460	msedge.exe	103
PID 3460 wrote to memory of 4364	3460	msedge.exe	104
PID 3460 wrote to memory of 4364	3460	msedge.exe	104
PID 3460 wrote to memory of 4268	3460	msedge.exe	105
PID 3460 wrote to memory of 4268	3460	msedge.exe	105
PID 3460 wrote to memory of 4692	3460	msedge.exe	107
PID 3460 wrote to memory of 3548	3460	msedge.exe	108
PID 3460 wrote to memory of 3548	3460	msedge.exe	108
PID 3460 wrote to memory of 4704	3460	msedge.exe	109
PID 3460 wrote to memory of 4704	3460	msedge.exe	109
PID 3460 wrote to memory of 4484	3460	msedge.exe	110
PID 3460 wrote to memory of 4484	3460	msedge.exe	110
PID 3460 wrote to memory of 4468	3460	msedge.exe	111
PID 3460 wrote to memory of 4468	3460	msedge.exe	111
PID 3460 wrote to memory of 744	3460	msedge.exe	112
PID 3460 wrote to memory of 744	3460	msedge.exe	112
PID 3460 wrote to memory of 3664	3460	msedge.exe	122
PID 3460 wrote to memory of 748	3460	msedge.exe	123
PID 3460 wrote to memory of 2880	3460	msedge.exe	124
PID 3460 wrote to memory of 3476	3460	msedge.exe	125
PID 3460 wrote to memory of 3476	3460	msedge.exe	125
PID 3460 wrote to memory of 2796	3460	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\MEMZ-4.0-pannel-master\MEMZ-Clean.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-4.0-pannel-master\MEMZ-Clean.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff95b26c188,0x7ff95b26c194,0x7ff95b26c1a0
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,5519702255306843159,14174705033764754821,262144 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,15149478261347557432,10929949302669337970,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,5312461759377135108,7096414370560158288,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14823573538604041743,14422040100900704547,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3422046271184244096,3940324802684425152,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1420808112437942234,6203928687744524816,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,3977609413033306813,10467980903347649847,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,913337897801038980,6395787184501857489,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3636,i,9317607319712202648,13203123380601153751,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,15059981502767535765,13850548103358233669,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3552,i,10508699062330510723,18423223021603633619,2097152 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17217122024012318704,11465173017515924658,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,809191692572612831,17792434285237316110,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3936752937602752178,2261491066989351868,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3936752937602752178,2261491066989351868,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,5293441380902973394,6649392182363619371,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,8619094507492076700,16055895709523970575,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16005383119916784858,7893567398809328744,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,11864166373637341969,11233000073558627039,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11661833737129954985,1764459473295935503,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,16462358510322151231,12559832701290069401,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,3892820855519189927,5383557872598851749,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,12767595509433138496,14207302650284708832,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,5160203311648437609,6943293239350305333,524288 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,3520153148737921269,3844710047360560237,262144 --field-trial-handle=2292,i,823454886862640273,3181427853362245530,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 db8427499dbd08b11fb0cf6a3e4620109f1a225b920f9670e3ad6f2c10edeb7e
MD5 219828efd38ffab468bfe22966dc99e0
SHA1 6051891a5bbec5710dbaa520f25c98fb2d982c65
SHA512 085013ff91a5fa48a1d49c5039fb8075851191c86b8c42b69e435c282b9b7ead4f170a60ed73214e877678bd8b28251b614d4f2ad7e7790c2026eb5df03ad662
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7/:fwUQC5VwBIiElEd2K57P7/
TLSH
T128B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d3f9d1ff7c412ac2ba09e665c8739e88b9fedf9567d2a97d2e3fd94a55aa8eba
MD5 835fd36142a0a8094fe80ff73aae4bf1
SHA1 a293033e464387084a538ccb5bb9fcac59e8d55e
SHA512 d90aeadc9ec5f21debff7935f18d93bd3cd519dffb7a11c3c9b802b7d72fa109efb4538db37972c02b6bdc6e6a1d5d0e85e8c407cdc229a93241b21b998d8bb8
TLSH
T1E8716C351D714F52EBD402BF64E3F210757A85D4FA131E79C960AB3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58abbc.TMP
Size 3KB
SHA256 8bf5a87eb31a536cd8c3c842cf38b42011f795cf9ac9efa995fe5584bdeb057b
MD5 c51991dbf0a27be7763fd08d964515de
SHA1 835200a17f2fb8188741f18df5d9665717cca627
SHA512 35404dfe57788c842f22b90d74496ec4e74dec65e3c38827190219f3c28d02847bcf337451c5e9fb6bbf784d4e6ef639eb6ac091b6188c15b3a29595d0dcc49a
TLSH
T110717B350D314F92EBD401BF64E3F210757A85D8FA131E79C9606B3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1a70e0d574173ee235d2cac83c100a5d1646ea86a423ac6e13a379fe54e5ee0a
MD5 87ebfde0d5eae022fbc9ee36d49b7b25
SHA1 8b09cd9b2f52eaa6c53d0d50d683877d8b7c19ee
SHA512 c4e7c9d677ee37d6182424a72afd915be54c4e3f809844e5fd921faee1bacc198dd7c6aa907166c406a1d8f71d92fc02bb963cba19861580c19104d3fe917829
TLSH
T10B51AEF7C7D8862EC94166F4A7296F2BCE2D0A14422C3D5BC8D8AF5B93E3871E10155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 963964542b59d44168bb615e0770f78f600287c71963b125c7ef8a241e535308
MD5 d3beb6db5a928c760611da8964402c80
SHA1 b3492be6af77653d662193a354b5a6ce2336f880
SHA512 dc2bc98ffa69d21b0a76131409d3b31f7a4d0404eb31128452d527a339a485973a24f3da1c4d098225ff8e87dfaa338d62d2ac230e5d5ab373ae7798abfa26e5
SSDEEP 192:sxZZRCyM/jK1Ml8MiM/fwsNDUELoIdpVwAWHW6+WN+neU/YC2YrkGIg4J:sxZZ8qM/fwsNDjLZUHbG/frc
TLSH
T15C52D812AA349977CCDBE20DF551BB53D7F8156396940D489EFC8A1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 50e1663bfa62565e03c87e588c7f00e3edc5c72ff2292bbcec875f7499542e6a
MD5 a4a5fc987aec28b4058ac9c2a422d2d0
SHA1 1deb8a6e19f0501aac3e73b444af9b7dee57065c
SHA512 403e5d4d89a320ff39c402acde7e428d132095c33489353a86fa579817df2d3cc588708d4ffab3336dd3840e4e89f3bd9740ab838765317165f62dd2f417069c
SSDEEP 192:sxZZRCyM/jK1Ml8UQfiM/fwsp3UELoIdpPwAWHW6+WN+neU/YCoBrkGIg5VJ:sxZZ8qqM/fwsp3jLZWHbG/crR
TLSH
T16862D722AA3459B7CCDBE20DF541BB53D7F4147396940E489EFC8A1C00E6BED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 38953d6a0a84262faec683e5383ff6b9c2eed6e7c04d44ff38ba03554a3f70a1
MD5 cf5117d48a5273d2b3f3f168a445b411
SHA1 c15d028c954b24a6c78b0c08205e3849f534bdff
SHA512 8311459e1d0fb3d8570f06cacbfd23e67df4b513fb127f807ad5f3e1f26e4b078bc993ae4486bfc10fa10b9b8d20d19ce75d17369aebe7d2fdd755b8d2198a48
SSDEEP 768:/A8bq41vq57pLuLza+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVmTCZLlRTKVH:/A8bq41vqPEza+WvSCt6u1jaXTCZLbW9
TLSH
T17CF2FB3B2C0CCB7E4F804E9CED2A6F9A6DE8028B56D8895447FA844C03C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 38c53fa9f7ce536b5f6896cbb242e28d3076f83618dd12032e99385136988c87
MD5 589dfc07c8b074e9fca29c052f15a066
SHA1 7a40ef186877c70249cef22400eb22e80040948f
SHA512 994c50109bd6213a82895d0dc74f5b55a90991eab316aeb261322889c7a72dcbab4cbf07449ad97920ad244ce0644dbd5ef226b5ff18e5192425f45ba07ee65e
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJen5:invrhZsLfZb7o/2Ln94E5OBJen5
TLSH
T167917602713B228138FE2908925796768E4672633808A47F7FF904A60E7AF515EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59479e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59479e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 67f54a4f5e432da8073ff125288f2de60839b9955172c0567aeb3235ea5bfca7
MD5 92567a4417e62dd8955aca36e5f9e4d4
SHA1 36015f188a28b6fe1036a7e0bad14df49d2566f0
SHA512 40f3736c3b3a8c0af2514bade27a8d66afeb4105813cfe028d6aac44685c4bf0e71e251f2d83a3d0ad48be3c9a2ed8c44fe7f4781da7d8d34b3649370ab66a7e
SSDEEP 192:uu5ILsNkgQYTbifGLQmiU139I4Ea+j9OmaftmHXFgEWampqJlrU8:ncsNkg3qKz3Ea+5OHfaXFjearU8
TLSH
T190321931797C9C7759E6A288F4873753AFA420B789896F98E6D85F0C04C769C230F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 02a6b4e4f4313f28d5c28e21e322c670531c3b84dd4d6d19451f0aab2c32a4e1
MD5 f7f9acb42f8b73674e6e3d880408d5bb
SHA1 23fe55a7def65c54980d34f95e9e885533d954de
SHA512 6af7090532c9ac4517819d1f866f492ce8f6629a975ba5aed92ccc7d385e955d2921e4701a1e954657ecc3967f862a5492de800bd2388f060e041d4cf3e4fa55
SSDEEP 384:nKiFiZcItsNs8TUNTUlIl+3qKB3aDf4xa+5OHfaXFjLarivO3g:BFQttwgqTpxaYOH89Lai2Q
TLSH
T1FED2E7F198E78937E9AE9783A77D2E469EBCC06375885984B7C45E0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b69eab4fde7a62ecd70828854c5eddefe3031e45438e2eeb831664db46c9db40
MD5 811f8ee7bfcacf0cf0f4ac95ffd18550
SHA1 af82db910da7a74863ea280cdd4de0459054a40d
SHA512 6c03d3c69f4b39e842b964bf95a1b8b42fdd424c40954650d6a25794d316841397008711bfd2ae5e90f735a9afdc9fafd0778b29e2170f2b586c2c131ccc98c7
SSDEEP 192:vONm6Db6QmiUyvXHBa+j9OmaftmH+Rg/6U6:vONm6u6HBa+5OHfalyU6
TLSH
T11602F93569786CB79EB2AE49F48B3B279F94106BDA562F84DAD81F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 99dd702110568fc9c0671d7392d7aec6dd3c5df798166baa9f86276d86a24f73
MD5 6f6207fcdddc30c688486aa58c85db04
SHA1 ae5255f26aebd2e7f5b30f69988ca77d37913e69
SHA512 bd0a32aab40be4ef7fe7dbf118b3dc968c850864f1da0b37b960cefb24aaa5de942315ebe9efceadb528f2dd8f6ce7af17defa9e4670e875e6e0864dd5e6ed1e
SSDEEP 384:nYZcIhsNk+3qKz3Ea+5OHfaXFjearivO3g:mhIB0aYOH89eai2Q
TLSH
T1BF829E706C789C3359E9E288F58637579FF860B796C96F98E5D89F1C00C669C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd7d815989b1b29b1b84720fb807c9225fff4a4907046685a42aebfc0dc8ae19
MD5 4e1530769c9748ffd1f143c90d52700e
SHA1 0fa289ce179a1cf87b625f0a873e0df238ccb270
SHA512 2e49b25ab044e0213ba3c4251f3232363f4e3562af262e39d22dffc2d6547eb89bd0f5519246a92150484f4403a2e843c7fc3d4e653de3ddcd0517916f7ac6f8
SSDEEP 192:jKONl6Db1bQmiUyiXFBa+j9OmaftmHXFgE8NzpqJlrU6:OONl6jxFBa+5OHfaXFj8arU6
TLSH
T11912F7317978AC635AA2A588F4C737579FA420B7D946AF85E6D41F0C00C769C270F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 19533c8773bd115c2a07b7c20a563b2b2d0d879759ed12c9d82f145affafea86
MD5 03a55f1762e6fe7fb56ef6617f0802fb
SHA1 63f8cd3568d5c5d79ebda2b4dcfa759662aa0a57
SHA512 ead129f1fd9bd5e6ba2db6f9d9327261b88d8a58b748d96f11e5f39473695b2e6adbe5034e7ca41145a0c4e09c6d10c0c2401cf8b533835b1cb89104385aae38
TLSH
T1F1412658BAF91108B3B77E169BF6A86D48BF79372F07955E10010E4E4663B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

a13a9c27-1bd0-43ef-8cf5-13db92c28b55.tmp

Path C:\Users\Admin\AppData\Local\Temp\a13a9c27-1bd0-43ef-8cf5-13db92c28b55.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7fe1b34-978b-40cf-b918-373974d69170.tmp

Path C:\Users\Admin\AppData\Local\Temp\c7fe1b34-978b-40cf-b918-373974d69170.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7ed2d0b6-4906-47cc-99aa-b5ddfe9a04f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3460_1627358006\7ed2d0b6-4906-47cc-99aa-b5ddfe9a04f8.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3460_1633306316\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download