6426e1ef770f7e4ff6e82c54ec5f11f3885adfd9da47e0ba003b0c8993fc8282

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
images/accept.svg
Size 1KB
Sample260905-pkwzcsvajf
SHA256 6426e1ef770f7e4ff6e82c54ec5f11f3885adfd9da47e0ba003b0c8993fc8282
MD5 c5c74dbb463bdfb293e4fec9b8b06d1a
SHA1 171a3796e0dc6739caa150b95dd016cbecb691a8
SHA512 3a076d38aa227b6ef81f190d5ea2831626471188f2c527e8dc09ff01c87539f86bd0e0003c7068a751f21d2dc0550e516cc77baa7454abb993484a479984671f
TLSH
T17A31BF89F1A758D6922C86502DE6A916C31AB0A3C2980D5ABDAC4470EF444C3F37E7DE
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_414151674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_414151674\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3440_1687646554\_locales\ur\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330846510496434"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{2CC4B73D-F02E-4FD3-919E-093B9C6137EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3440	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3440	4348	iexplore.exe	89
PID 3440 wrote to memory of 3432	3440	msedge.exe	90
PID 3440 wrote to memory of 1680	3440	msedge.exe	91
PID 3440 wrote to memory of 3708	3440	msedge.exe	92
PID 3440 wrote to memory of 3708	3440	msedge.exe	92
PID 3440 wrote to memory of 3708	3440	msedge.exe	92
PID 3440 wrote to memory of 2676	3440	msedge.exe	94
PID 3440 wrote to memory of 2676	3440	msedge.exe	94
PID 3440 wrote to memory of 6044	3440	msedge.exe	95
PID 3440 wrote to memory of 6044	3440	msedge.exe	95
PID 3440 wrote to memory of 6044	3440	msedge.exe	95
PID 3440 wrote to memory of 396	3440	msedge.exe	96
PID 3440 wrote to memory of 396	3440	msedge.exe	96
PID 3440 wrote to memory of 396	3440	msedge.exe	96
PID 3440 wrote to memory of 6124	3440	msedge.exe	97
PID 3440 wrote to memory of 5220	3440	msedge.exe	98
PID 3440 wrote to memory of 6124	3440	msedge.exe	97
PID 3440 wrote to memory of 6124	3440	msedge.exe	97
PID 3440 wrote to memory of 5220	3440	msedge.exe	98
PID 3440 wrote to memory of 5220	3440	msedge.exe	98
PID 3440 wrote to memory of 2224	3440	msedge.exe	99
PID 3440 wrote to memory of 2224	3440	msedge.exe	99
PID 3440 wrote to memory of 2356	3440	msedge.exe	101
PID 3440 wrote to memory of 3068	3440	msedge.exe	102
PID 3440 wrote to memory of 2356	3440	msedge.exe	101
PID 3440 wrote to memory of 3068	3440	msedge.exe	102
PID 3440 wrote to memory of 588	3440	msedge.exe	104
PID 3440 wrote to memory of 5624	3440	msedge.exe	105
PID 3440 wrote to memory of 5624	3440	msedge.exe	105
PID 3440 wrote to memory of 3184	3440	msedge.exe	106
PID 3440 wrote to memory of 3184	3440	msedge.exe	106
PID 3440 wrote to memory of 4784	3440	msedge.exe	109
PID 3440 wrote to memory of 4784	3440	msedge.exe	109
PID 3440 wrote to memory of 4508	3440	msedge.exe	110
PID 3440 wrote to memory of 4508	3440	msedge.exe	110
PID 3440 wrote to memory of 4168	3440	msedge.exe	112
PID 3440 wrote to memory of 5648	3440	msedge.exe	113
PID 3440 wrote to memory of 3436	3440	msedge.exe	114
PID 3440 wrote to memory of 2192	3440	msedge.exe	115
PID 3440 wrote to memory of 2192	3440	msedge.exe	115
PID 3440 wrote to memory of 3412	3440	msedge.exe	119
PID 3440 wrote to memory of 3412	3440	msedge.exe	119
PID 3440 wrote to memory of 4460	3440	msedge.exe	120
PID 3440 wrote to memory of 5644	3440	msedge.exe	121
PID 3440 wrote to memory of 5644	3440	msedge.exe	121

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\images\accept.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/images/accept.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x354,0x7ffb26f6c188,0x7ffb26f6c194,0x7ffb26f6c1a0
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,2800568645141104286,17816163445532320565,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,4653544515035070723,13439094529831228367,262144 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,12483955808032920880,13982920203172446020,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,10254942931476406877,9024557674058039916,2097152 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,13055925302491695760,10917358557343413093,2097152 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,309801314737038512,10888458147181106200,2097152 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,6762440473564901772,9319579137941258690,2097152 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,12853972723542226867,7315173294450233249,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15424547907499892358,136133052849424160,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,2655576235826953241,6080381879901237669,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10222089880533880090,2172262736240531464,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10222089880533880090,2172262736240531464,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9999043178395474606,178823491021116439,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,6027676044958081839,4167386482440502051,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17815690218766415234,7020976442483585534,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,6265274557456289225,10094704550667547865,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,12755346251049019449,4736637588811578117,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7629282148336337160,5451435047018078534,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,9046776885459640275,6713415016147591746,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,1517134790708651202,16199633998510367955,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11471711633445261479,12076836885039799267,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,16314385393479626866,6789222735938890201,262144 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,8068816060200467981,12400306121210152093,524288 --field-trial-handle=2352,i,11375439767491705496,5785289033693473622,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 668c40032cdc6c038f702fe1161344aad8ce08b6ea7f354d39d3550ca1d756c6
MD5 10e966fe78aa0d04a4468add428cd3b4
SHA1 d623fe3ed98dcc66c86e2c0bffc133be8e3339e0
SHA512 228dd7bdf220cd8bf36e8ddc257d72b03073efc5189671d75fd101bc081206f4ba94796102c09e8414781b17f98f6bb0fa36828df283ea5908068055a4a5a7a9
TLSH
T1E541212AC33EBDCED7A1577255E1625633B3D4992D0B6F188288BB7C4F45B067093322
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596008.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596008.TMP
Size 2KB
SHA256 f32e177f6cc92f9a0a81ef2b9f6a9a4008954f0ba409e2cf9a344e89b159e949
MD5 4fbd3a064ea819590b0b5540698e394c
SHA1 6bd2b3829ebf9dc5c5b1d6934a24dc039bd8f32f
SHA512 95fb8a4b96dcc5e86999db23e312b38d139a82546be22deec8b2a20a35b4640a5a72dbd95fe76a7c1fde5fcb938a9566f0491418d79ba0d9832a558c156e0d75
TLSH
T19041312AC33EBDCED7A1577255E0625632B3D0896C0B6F188288BB7C4F01B067093322
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5beface4-a4c5-4493-92af-5dd046124c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5beface4-a4c5-4493-92af-5dd046124c3d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 94f90713d34bd6a576587a616c57e1b6f0a7007b0cdd393d82cc1e71b356c2d8
MD5 f022b9d073767f451c0e92c8d5d2824e
SHA1 2cd3c827318757b25379d8d649a3c4f2851449b0
SHA512 dd59b566c76d75b090c88cee8bba6491304a7afecd90e542c68f80a2b8a0427eb48689300e4eef8f0877919098f8a0940d5d5cd2c60d14f9570bcba827332109
TLSH
T10541CFF7C7F4857DCA0186F4AA146E1FCE2C0915432C7D5A88E0AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f54d1515153cf427e6ef6dddbdb34d05e7b0e7480b677df9e65e18fe4a063ae1
MD5 ca2b4e049517cb9f475f43ec5488ad78
SHA1 ad815fd6d18beb4a7006243b39286f26edb0a06a
SHA512 f17c6d3de43e00b08875373b46614c395bb4a8cee1b270a866b87aad103b14117077784794331e6b444e9e823e0fcdc88f13d6d846ed0603359d5ef60b0072c5
SSDEEP 192:sxRlRLPyM/jK1Ml8UQplCv/fasKzpJFgZsc/uf6RzoA8per/g6+WNIYlFZIE+LGo:sxRlZrq+v/fasaJF+yyM8/5IS+ZRx
TLSH
T17A62E615AA349D77CCDBE209FA517F53D2F85173A1901E44AAFC8A1C04E7AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 355f72054550c16305d869a05b5ed96868f7c8557d6f09b2f75de2d752b69b71
MD5 a6783435828a2ec9ebc7f0d7c4814076
SHA1 c7f0edc8f2fe380dcaad687d493418e818f02a6c
SHA512 7d8d304dd26d08f5b505ff695d9fedd18886813a2cef58a95287a17b49ddfde62284eead56d480c2b0ee0eb2b597047a1525f120909b9070684047fac7cb8333
SSDEEP 192:sxRqRLPyM/jK1Ml8wCv/fasDzphFgZsc/uf6RzoA8p4r/g6+WNIYlzZ8q+LGYIgl:sxRqZr8v/fas5hF+yyMm/5Ik+Zzx
TLSH
T1D162F715AA34AD778CDBD209FA557F53D2F81533A1901E44AAFC8A1C04E6AED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e9c3fffa7866fc12f72bf10d8ed63266faf9bd75ba2f18e7c74534839facbde1
MD5 4bbbc165ac964db481a3a3bf050c4e25
SHA1 8e8cfc72839d2e00490f1fe887570c76d7c4bf0c
SHA512 e833b7f25d4f79e2c257d33488f07946ca6027516164e1b5a2e7d99c98197f1554058a32e1f6963ed213359980823582438940aa1f531fe50e6cd80a18235600
SSDEEP 192:sxRlRLPyM/jK1Ml8wCv/fasKzphFgZsc/uf6RzoA8p4r/g6+WNIYlzZ8q+LGYIgZ:sxRlZr8v/fasahF+yyMm/5Ik+Z/x
TLSH
T11962F815AA34AD77CCDBD20DFA557F53D2F81533A1901E44AAFC8A1C04E6AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2509bbbf618ae07fa3f4809ef9b7a8debdb6fb4cbb53a77d29265cb960708265
MD5 b5a1b28bb0ca1cdb54fb76774766ddb5
SHA1 0f7045d87d2032bc6ac48308d7ae42a6621d759d
SHA512 9f632ec27265ed05f6c56f749647493239a2cfe609120ad4f02eb25810cf9cff5dd826e0998485e65a1969ae6f1d88ec274244907be34652341b985f9d48a919
SSDEEP 768:dhRAkO7pLuLzmxWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQIa13flroPScN:dhRAkOEzmxWgg+fAJu1jaHIalfeKcN
TLSH
T129E2EC3B680CCB7E4F804ADCEC29BE9A6DA802CF56D8C95447EA481C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 befabae4e3ec4c21a4a3406e72666f18e7e9fa832e168d41471d23e4cc591eff
MD5 1a887344ea227883ebc61ef8f5192b3f
SHA1 446c94b22f99d1fafda64a1d6698c24c0615688a
SHA512 9d9c4344ca96f91bc8fa4c403ee6f6f4f3fc648c19c375517a5d15f4485ca6388dab94a41914a9946181faf0420f2f8f7edab1bd3bf9925e3b3f1689672bf03b
SSDEEP 96:KRN6zn9Xr/WzoWgv/K4ugR/cVtgDbUHZ2HDxTnjWXkSgLjK46gFjcpBc/H5WnjA6:CN6zn9Xr+zoHvFugR0VtgDbUHZ2HDxTy
TLSH
T12CB14749713A465139BEB60C917D8C1F82C1F8A37718E92B77A945A20F27E139DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fae1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1772060f26754e5ff300a1ae232040b0da7336f9429af1e9c139c865260d99ee
MD5 eb04b56b85bde964b3a0e1543dd52879
SHA1 ed72647e092db7a4504b785ad3459eab06bbfd23
SHA512 e67c196a0d612b0148880d5d76bea83ba09055763aa6901cf7c296bd5b937f18c56ece8a675e4d6c7556705776ed9d93371c2f24a03229865a443764530f1eec
SSDEEP 384:n9PZcIu38NbtL6OvtsKzRfY9bYVMWT8tQPlLJQXmIkdP9IimIMWEfMbc+HacO6RU:Ru3BmTiJsMQ8KNHXmTWTbc+HacTR8B
TLSH
T1E5F2AE71ACB69A339EFA9F89A50B7F06AFF500A380C81584CDDDAB0E058755D071783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2fc24434cbff92615131e352c86e3934ee1d1346d368ab97ae272f7d3b15201b
MD5 e4c709ef4aa883c1c0d287cc25df040f
SHA1 52c1babd53cbd38a4f2001daa17f88d2ea914446
SHA512 cf73318b4c1587c480e34ec9ba61e8b86000f15e5858184b235901eef0d572389878d5626fb120c49dcf47fab91349564f74bf6e7a0b6aedf3a56f95c5475808
SSDEEP 768:TFQx3ewgim6csMQ80NHXmTWTbc+HacTR8B:2x3vd8MeWn16cTR8B
TLSH
T181038D72DCA5DA3BADF68FC5A60A7A06EEE500A385CC58C4DEDD6E4D008759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3cb182733ae0474dd231056462b5854cdb6dcba101f205644c946f0346a281a8
MD5 dde17dcbc6343ee9bf9884226747d2ff
SHA1 0b655f5472bef179dca72d3c2d4544ff5f23e373
SHA512 cd50354a03b24e267df6a285b2ac84e00fb82c7186e671fb68c91c9a60079dafc5cd2429eea7fc2efc02eaa3e31dfbe381d38a2a4910e6b0bed5cc533a332536
SSDEEP 384:naPZcIu38NbkL6OvtsKzRfY9bYVMWT8tQPlLJQXmIkdP9IimIMWEfMbc+HacO6RU:au3emTiJsMQ8KNHXmTWTbc+HacTR8B
TLSH
T10AF2AE71ACB69A339EFA9B89650B7F06AFF500A381C81584CDDDAB0E058755D071783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 08ba283bd3a71f9952e82395eac7a743318de57cf63a62b0388150a2fd4ef053
MD5 272a79efaf82759a369ac5da52ba414e
SHA1 fc3cd3836539e2e413bdaba103cb3ade656ce72e
SHA512 b52109459fd6cc602b51019e4b0f8390df1b7b409091f5cb6e0e64363891f21cf4e216164995304204f0ab49a9afbd4a375870fd81267e88366f81834cc6fe4f
SSDEEP 768:Grv+4UNbd13eBTiJsMQ8KNHXmTWTbc+HacTRCh:GbsbX3e5d82eWn16cTRCh
TLSH
T1A003BF71E8B99A339EF69E88A40F7E077FF9109384C80694CDD96B8D068B45D171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ef7f3947d309dc82a7dcd69a517335b29c00061ed30e24712435f08928a3f05
MD5 fd13683f9ee3eef30a750d68722ed6f2
SHA1 ca78c2c6f71e9d888ea7345b6965e56447cd70b1
SHA512 74ffc88c10fa3653882616e7a93dae47aaee60d3fc64ddc90bfed8ff9a26151dadcec90202c2856d35decbb23a0d388390688a77f245af6339f0d89a42d08eb2
SSDEEP 768:arv+4UNbdM32b8iJsMcNHXmTWTbc+/9eVH1SvyZ:absb+3L5feWn1lEH1dZ
TLSH
T14C03CF329CBA9F37ADF79788744BBA477EB8106385C40684C9D96B4E028B44D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 693dbf9fb10d38973da62f566959c6d326b1c553d961acb8733baabf0c9251ab
MD5 45b7d3fac19fcc4415f2e608595145c1
SHA1 9a7f72255281e6f2fe5e217bb215dd443a3b8650
SHA512 edaeeaf8b7d268bda49c3873d1046f5b69efe91feeb0228a7322ef6c3ac357a22bcdd429205166b5f06696151f3eecbe0f99e1825b4f46ec5be9cde5c65ff445
SSDEEP 768:Trv+4UNbdM3WWdiJsMQ8tNHXmTWTbc+eaeVH1SvyZ:Tbsb+3f5d8beWn1lEH1dZ
TLSH
T18203BF7198B99A37AEF68F88B04BBA077FF8115385D80694CDD96B4D068B45D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d34ba3bc-d277-4aab-998f-e47b5063b195.tmp

Path C:\Users\Admin\AppData\Local\Temp\d34ba3bc-d277-4aab-998f-e47b5063b195.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3440_169383380\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download