385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m5-eL.svg
Size 3KB
Sample260906-3vls2avdkf
SHA256 385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04
MD5 6543ebf56ad638c15bd11060b03b1eeb
SHA1 1deceeb76ff2eff0c2c0e8d5b6ba97d08e6c9101
SHA512 8979dc038d83456b9f3a34b8a476c0823e3800b4c565f2522c420a3d8e2b81998746773fd3e7429db629a460ed20176871e96eaf4d5c0031540ae10b9a696c11
TLSH
T19A71278876F83EEBC7C802970D41D8B84B2F946BD822978DD3CB94D879282AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_458826936\page_embed_script.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2232	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332122211834126"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{971AA98E-8032-482A-AA76-70E4125008C2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4900	1080	iexplore.exe	89
PID 4900 wrote to memory of 1188	4900	msedge.exe	90
PID 4900 wrote to memory of 3476	4900	msedge.exe	91
PID 4900 wrote to memory of 2232	4900	msedge.exe	93
PID 4900 wrote to memory of 3476	4900	msedge.exe	91
PID 4900 wrote to memory of 3476	4900	msedge.exe	91
PID 4900 wrote to memory of 1752	4900	msedge.exe	94
PID 4900 wrote to memory of 1752	4900	msedge.exe	94
PID 4900 wrote to memory of 1304	4900	msedge.exe	95
PID 4900 wrote to memory of 5512	4900	msedge.exe	96
PID 4900 wrote to memory of 1304	4900	msedge.exe	95
PID 4900 wrote to memory of 1304	4900	msedge.exe	95
PID 4900 wrote to memory of 5512	4900	msedge.exe	96
PID 4900 wrote to memory of 5512	4900	msedge.exe	96
PID 4900 wrote to memory of 2088	4900	msedge.exe	97
PID 4900 wrote to memory of 5468	4900	msedge.exe	98
PID 4900 wrote to memory of 2088	4900	msedge.exe	97
PID 4900 wrote to memory of 2088	4900	msedge.exe	97
PID 4900 wrote to memory of 5468	4900	msedge.exe	98
PID 4900 wrote to memory of 5468	4900	msedge.exe	98
PID 4900 wrote to memory of 4556	4900	msedge.exe	100
PID 4900 wrote to memory of 4556	4900	msedge.exe	100
PID 4900 wrote to memory of 1680	4900	msedge.exe	101
PID 4900 wrote to memory of 6024	4900	msedge.exe	102
PID 4900 wrote to memory of 1680	4900	msedge.exe	101
PID 4900 wrote to memory of 6024	4900	msedge.exe	102
PID 4900 wrote to memory of 5200	4900	msedge.exe	104
PID 4900 wrote to memory of 4696	4900	msedge.exe	105
PID 4900 wrote to memory of 4696	4900	msedge.exe	105
PID 4900 wrote to memory of 5060	4900	msedge.exe	108
PID 4900 wrote to memory of 5060	4900	msedge.exe	108
PID 4900 wrote to memory of 4376	4900	msedge.exe	109
PID 4900 wrote to memory of 4376	4900	msedge.exe	109
PID 4900 wrote to memory of 4380	4900	msedge.exe	110
PID 4900 wrote to memory of 4380	4900	msedge.exe	110
PID 4900 wrote to memory of 2056	4900	msedge.exe	113
PID 4900 wrote to memory of 4812	4900	msedge.exe	114
PID 4900 wrote to memory of 5656	4900	msedge.exe	115
PID 4900 wrote to memory of 5868	4900	msedge.exe	116
PID 4900 wrote to memory of 5868	4900	msedge.exe	116
PID 4900 wrote to memory of 5336	4900	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x348,0x7ffb1129c188,0x7ffb1129c194,0x7ffb1129c1a0
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8542949964481833559,9620345057507537166,262144 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,8983400906683437232,17935937538259114067,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10094412310853905095,2783821927510928511,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,8137127519595547072,10463183137000892260,2097152 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,17685627721780094146,10048029892716975803,2097152 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,17366064588163100238,13996408470841819017,2097152 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,7751375186848514066,7917881692925774514,2097152 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,6831628745632685821,18368697933345857820,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,9339304979571554603,3941937747127875619,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,17602318355926023276,14609353274976199215,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,8850056977508668614,3423395012361061715,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,8850056977508668614,3423395012361061715,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,17514094001612289342,4257977794761602752,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,17101832534612922072,14761531765244819507,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,17402777580833464385,3249795089120900104,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,4747926793925450927,6737980292547929771,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,17827020561567706263,12015655436405424189,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3100492967058041771,11677264608370705726,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17006392211193839569,2714932068575851408,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17470140986146360333,16814347227450068884,524288 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:14
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=944,i,8314720642384917520,16704395846368528613,262144 --field-trial-handle=2952,i,10835038366463218092,8020466454237748531,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b2802848c283955aa26fa05ae046df2b1613269d904daedefa5aa256a4a2bce6
MD5 291208c930b3dc6a3299aff280a69ec4
SHA1 00dea29e9dba878a33c69946a2472bc3c8dde29e
SHA512 dbc6cd8b7b5fdaa5724612ddcd3bc890f44c9e4bc2b21d449742a137d8c1f7365e70025fdab6438d5217ea47b0e7016e5af0db439599f2863cae7a5cd970522e
TLSH
T1C861316513210591EB286FBBB1A294B433FA849B792B7A2150419F764CC7FF151D0363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c951.TMP
Size 3KB
SHA256 bdd051fe2cbc5e88bd09a166c6ee015bb5efcd5435b0bd54f3830f5f76518c39
MD5 4124d0c4593985d42909708846f1ee3c
SHA1 48d3de7b55d961e91095e4f88414261e16228e83
SHA512 7b50d4556fc7b98cb76852376a73307994efb6c13ea607c15c91b599d95b3ab9b3cd45ca8d58c6c417e8aa366e17fa6022954cefe797f70fb81b292e73d7f875
TLSH
T19E613065132105D1EB286FBBB1A294B833FA849B792B7E2150419F7A4CC7FF161E0363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fedf5feaf43ffe9583b84274facc9c0313f70112f1b25149485e2fc98490b7b
MD5 1cfc8b7921a35126405590e4cfc9cbc8
SHA1 046661f96037977e4b2bb7f3082f36bfbb21dc61
SHA512 ad06e18890e0b83e5d18f75f86397eeee96da951324b6bbf68b1270fc6fb6da78e12155b63ae6f399d9d7770c6ac33b2c026573f9b4d16850abcb65128594c12
TLSH
T164417DF3C7E8857E8D0196F0AA146E2BCE1D0A15432C7D5AC9E4EE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9179c5fcb3e8953079ac141ddab3b7db506b908c73dc345e6e8d6937ed51a7a0
MD5 dcac7f03ffee269e95556ba08b2558b0
SHA1 6a0a98b8ba9b453b7e68c800766f73ff9f2f5cc8
SHA512 75630636346caf08a9f0f8fc0e6e61973da7aa244687f098a4221b6f14ac864d4580e283fa6d4ec65f09e3f24d7e549a1f9b632713d8d27813f6e7e34d9a43da
SSDEEP 192:sxRuR3CY/fwslfSiOZ7upkzoA8p4n/g6+WNIYn8gjhQGMGIgDrDDOJ:sxRuwY/fwslfFo6fC/5ITeg+S
TLSH
T1BC42C815AE68AD3B5CCBE25DBB55BF53D2F9503290D01E48A7FC861C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cef5d548d4c76db27a7aec2010282ea5062e38810e76dd4f5f5e4dd24519c500
MD5 e45b2fce3f80ed515503ec636316c4c8
SHA1 f4fc2fd0056fafc4752e2412b90e86aa71fb8036
SHA512 35ff712076f75e1f4100ff62aef690d9185cc44f5d6ac3a06cbb2dc65fb9de63338a72e61c9493de4109bb54b91e9f74c9beadc753ce009227465b1a87287768
SSDEEP 192:sxRhR3CY/fwsyfSNOZ7upkzoA8p4n/g6+WNIYn8UHhQGMGIgVDDOJ:sxRhwY/fwsyfOo6fC/5ITMg+Q
TLSH
T1F232B7156E68A93B8CCBE25DBB55BF53D2F95022A0D01E58E7FC861C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ce166c0a51e6fcf1ad4711171b5c1008c589c00fb8cc1c4880d30157036f3504
MD5 d042f99a66771d1e45afaa318e531e9d
SHA1 b8a439643b657597a55bfd049a3d390e30f701dc
SHA512 4501d355ec0e5e32393d7fd5e89cd9f397973dffccb52ec2cf379e600a88dba45b97f805ac4ce30e680a84c878674e327798fd0018383f707b3f2a7c643a0303
SSDEEP 192:sxRuR3CY/fwslfSNOZ7upkzoA8p4n/g6+WNIYn8UHhQGMGIgDBDDOJ:sxRuwY/fwslfOo6fC/5ITMg+Y
TLSH
T11742B715AE68A93B4CCBD25DBB55BF93D2F95022A0D01E58A7FC8A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3bb15b9ff5c85f9b1d29612a85c2875eb742848fb19626ffebff24ec7fffafac
MD5 e4944e6cc3bb88b0e55d04b214848ccc
SHA1 1bc15194b995b435243ee50e23f626e3428b15a4
SHA512 5c3d9fe5d84e655b56c97f760d59a99fc70df924c4f3193e4cb3be4818d1979432af364d30cbcebee969f981d438083eeba2ff9198700b1f169db7f1a4f1574f
SSDEEP 768:wb8d+M7pLuLzR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWomu46trohep5Q:wb8d+wEzR6Wgouf6Mu1jaNomV6G2S
TLSH
T1E6D2DA7B640DCB7E4F800ADDEC19BE9F6DA802CB96D8C94447FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 62f5c0987381e6b977a9f9687ab1d260b4a298addeeee1d35863e2ee290d6777
MD5 1abf509106b1fda4c77d37f9892c0aa4
SHA1 247447f9e94c793ddf4aa0caa52be993acd2f19c
SHA512 0b887fcf0548badab674305218eba69a81c3f89a30c8f111c9d8dfae097f2666dd6eea3a0c22cab3e7769801b4fffd283b5d47cb0cc488d29dfe9def680eb192
SSDEEP 768:eVS39bMC4DZIO0m0Nzc4ReyIsPKxcTR5c3:eVS39bFtc44bsCxcTR5c3
TLSH
T1C3F2BE71EC65DC63ACFAA286B6077692BDF4506BC1C81E94D6DE9F0C084379D1B1B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 23dee848a008398679ab098edbcb50c46a840c7ca8a4a819c42b563f6603eeb7
MD5 7aff1353b7026f5009885ffb0a91c9e7
SHA1 fc4dc55b0f3878d111b17057273862d0a923be2f
SHA512 9abe61cbee4258483bacad5ef34fdb6cd83e87df91eff55519c9984c5d9df3697655ddf52f891372bb7d8c7c8599010be491062e3f115a9b07ac1453d7e5293f
SSDEEP 768:m1FQK3fwg9bMCBZQ5O0mINzc4ReyIsPKxcTR5c3:mUK3Lb6tc44bsCxcTR5c3
TLSH
T14D038C72D865CE67ACFAA786B706B696ADF41067C1CC9DD4DADA5E0C04832DE070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3937df13de2967e839d0584085e65066089f6313225206e64386d48e95029517
MD5 32ecfce4b0f06476dffcf1f6316c1de6
SHA1 c29220334fd345e600cf85ca083b15146518bc58
SHA512 312f2b607fbe56665cf23275791e7a9de23e2ac510878bf3c7444bc5dda13d551271970d2fe58348a3aaffcf01e8cb87082cd38f4a9d620dabd11b92966fc0cc
SSDEEP 768:HS3abMC4DZIO0m0Nzc4ReyIsPKxcTR5c3:HS3abFtc44bsCxcTR5c3
TLSH
T150F2BE71EC65DC63ACFAA286B6077692BDF45067C1C81E94D6DE9F0C084369D171B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 96f6a8db6479d7e741a883cf820890267059445caf84fea6f603ecdc20ff16c4
MD5 c7411ef6f754deca8b8af27c72158ec6
SHA1 49649b3c6077297b9b71c7c99934ba8f8e26b8ab
SHA512 4527f1f326650c8d282627e726b77f8b421a4764a2b06dd51fc3d3e30abbe91578a0503f3f069aab44ccca735152c438f4239fc2177ecaaa63369ee93f92b623
SSDEEP 768:Rrv+4UNbd13abM64DZIO0mTNzc4ReyIsPKxcTR54:Rbsbr3abatc44bsCxcTR54
TLSH
T16503CF31F869DD73ACFAA286B10B76937EF8106B81C80E94D6DA5F4C094769D270F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb8eb26d2b8506f0a5908508e5dca348dbe0afbb4e4e814ccfb4c29dc6678968
MD5 a0441b6b863938d7f8742c5136028fb5
SHA1 521ef32b7ac2ae91052ad9da0f7a123cf9cadd0c
SHA512 8f662b0480e9d87a2ba6446e3f41d1f2c463eb6d5f76fed87d8ea13337f577e07d752ea084ba035a6f78de4f0c1fd07b1b0c354b5f434ff8f6cc0dcbc045a51c
SSDEEP 768:6rv+4UNbds32tDZIO0ENzc4ReyIsXQeVH1S5D:6bsbS3utc44bsgEH1Y
TLSH
T12903CF32E8688A77ACF66686B14776537EF8912BC2D81E94C5DE2F0C464B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c2a228f6124dc4d441ee5636a9e3ba88b5f9df29d653fb973e4e30564628ceff
MD5 595c7f8c961d15543477003e775ca6ca
SHA1 bedba030b05fccd392b3e17606b212ddba2b3400
SHA512 5f381a3e9131df0644407e2b4c0345bf81125ce2682e6704ada7d9d500f670853eedb5f6669606d8928b06e656fcd54e28cec59e703497745c2441e0dff83c8d
SSDEEP 768:grv+4UNbds34iDZIO0mwNzc4ReyIs2KxeVH1S5D:gbsbS34tc44bs3xEH1Y
TLSH
T14203CF32E869DD33ACF6A686B147B6937EF8616B81C80E94C5DA5F0C0A471DD170F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28b8f480-d354-4f17-a538-8dbca7dd54b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28b8f480-d354-4f17-a538-8dbca7dd54b1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59a01e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59a01e.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

88a94489-1eff-40c7-8efd-9f9fd09ac15b.tmp

Path C:\Users\Admin\AppData\Local\Temp\88a94489-1eff-40c7-8efd-9f9fd09ac15b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4900_2130660378\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download