42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v19S-m5-eL.svg
Size 63KB
Sample260907-rrwchsbm41
SHA256 42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62
MD5 f18d08462e03abffd185eb85868309f3
SHA1 dd183829fc35212fa44c1eaed674ab5a4eec0528
SHA512 976524dfac99df9110a4e493d412b20f4a979b4ef3762a94a3b0285d66506b35d53e8da757a0bf5469830a5f9f99e84a2b77b7731d6efc5f845d5e01b183a4c8
SSDEEP 384:ciIVpu6WpeE5gyDnGCeTSC9wbhJaSFMczb4KlBHYwMdfq/ahUfLFjIcCcvGjIqaV:c5pZW7isuIqIx
TLSH
T18653C26637F4BC9B8BCD034F5D02EC6C85AF94B784A86ACC97C790E89548368B7EC550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1968_192869582\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1968_773693258\_locales\zh_CN\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5860	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332647800454552"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{B4E82365-37EB-4505-99E5-1CA359E86B9D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
672	msedge.exe
672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1968	3496	iexplore.exe	89
PID 1968 wrote to memory of 3044	1968	msedge.exe	90
PID 1968 wrote to memory of 5860	1968	msedge.exe	91
PID 1968 wrote to memory of 2996	1968	msedge.exe	92
PID 1968 wrote to memory of 2996	1968	msedge.exe	92
PID 1968 wrote to memory of 2996	1968	msedge.exe	92
PID 1968 wrote to memory of 3360	1968	msedge.exe	93
PID 1968 wrote to memory of 3360	1968	msedge.exe	93
PID 1968 wrote to memory of 3492	1968	msedge.exe	95
PID 1968 wrote to memory of 4920	1968	msedge.exe	96
PID 1968 wrote to memory of 3492	1968	msedge.exe	95
PID 1968 wrote to memory of 3492	1968	msedge.exe	95
PID 1968 wrote to memory of 4920	1968	msedge.exe	96
PID 1968 wrote to memory of 4920	1968	msedge.exe	96
PID 1968 wrote to memory of 5788	1968	msedge.exe	97
PID 1968 wrote to memory of 4720	1968	msedge.exe	98
PID 1968 wrote to memory of 5788	1968	msedge.exe	97
PID 1968 wrote to memory of 5788	1968	msedge.exe	97
PID 1968 wrote to memory of 4720	1968	msedge.exe	98
PID 1968 wrote to memory of 4720	1968	msedge.exe	98
PID 1968 wrote to memory of 3280	1968	msedge.exe	99
PID 1968 wrote to memory of 3280	1968	msedge.exe	99
PID 1968 wrote to memory of 4272	1968	msedge.exe	101
PID 1968 wrote to memory of 3372	1968	msedge.exe	102
PID 1968 wrote to memory of 4272	1968	msedge.exe	101
PID 1968 wrote to memory of 3372	1968	msedge.exe	102
PID 1968 wrote to memory of 1632	1968	msedge.exe	104
PID 1968 wrote to memory of 756	1968	msedge.exe	105
PID 1968 wrote to memory of 756	1968	msedge.exe	105
PID 1968 wrote to memory of 4292	1968	msedge.exe	106
PID 1968 wrote to memory of 4292	1968	msedge.exe	106
PID 1968 wrote to memory of 5016	1968	msedge.exe	109
PID 1968 wrote to memory of 5016	1968	msedge.exe	109
PID 1968 wrote to memory of 3904	1968	msedge.exe	110
PID 1968 wrote to memory of 3904	1968	msedge.exe	110
PID 1968 wrote to memory of 5432	1968	msedge.exe	112
PID 1968 wrote to memory of 852	1968	msedge.exe	113
PID 1968 wrote to memory of 2204	1968	msedge.exe	114
PID 1968 wrote to memory of 1492	1968	msedge.exe	115
PID 1968 wrote to memory of 1492	1968	msedge.exe	115
PID 1968 wrote to memory of 672	1968	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v19S-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v19S-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7fffdbd1c188,0x7fffdbd1c194,0x7fffdbd1c1a0
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14730531393287703101,355101178514637772,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,12513374141003049854,47813038339007485,262144 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,14716957854254245524,8825901823077626118,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,16226062984805833350,5103208178438592170,2097152 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,11914907177882088631,13625081056949884474,2097152 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5488322844077053858,9262415823058748643,2097152 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,6812490227467541289,14411926032224720491,2097152 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,9226074298604177843,4022085930302180709,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,577629429092278917,7149272180742490936,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,5118205408062884653,10998717488170441635,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,4216508262499884820,348094311774859479,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,4216508262499884820,348094311774859479,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6981259843201588821,15867719885390501619,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,9969539416928679692,5347840314781645930,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,6974921668658071116,17978233983649023379,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,1207719765015848464,3150045184246293385,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,8828192838096377655,1319048380303430190,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,13588226116059131755,9196611939842013741,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,17900373855880017825,9919051073745727298,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8457979218485458297,4132344685602788260,524288 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,15371735493257548806,9668766532060084639,262144 --field-trial-handle=2272,i,7253497861087514763,528004181725436631,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

81cb895f-f042-4d0f-9d16-972882edbbd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81cb895f-f042-4d0f-9d16-972882edbbd7.tmp
Size 12KB
SHA256 fc5eccdda31525eed3b9e4d08febc871eba468e20a5f094ad052a6ade70ce5ce
MD5 874ca6a48b6a42d68355b31b896aca07
SHA1 47248d41a1863d198badca44a8ec39540fb98087
SHA512 42390215c440dced88b3080b1fdf27f00b815da11423b58d44a1cb9d69821a10212e55018a21c7ac041e0778a981a1bd93e6be95ab475ead3d815a6e3dfc39eb
SSDEEP 192:sxRYRsCb/fksoIEZA9klzoD8p4t/g6+WNIYGXGkvGjIgDvUotJ:sxRYdb/fksoI6KkRY/5IpCb
TLSH
T17542C716AE68693B9CCBE21CFB55BF53D6FD503261941E48A7FC8A1C00E7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 366fea30d8b96b2d7324a8e28a6982b0a7f517fc2a37b6bd7f4fe8dc1ab11642
MD5 d3e3760b7b3ff13691d1810a89d30ae9
SHA1 0e5fa214d2dda9ac2c8a14f9ce4289a66287f2dd
SHA512 44377d3afb59e2c0c9e110708b90115173b7f9c387c6b41cc48ecc91900a4070eb71cf2a1f5da59c45a73b5e535d70c01df9384d677e731fbba11749bb4017ef
TLSH
T1A65129A74332ABD2DB6388B263E19C183AF4CB6589039F51804CAF348B06F1C00D973B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5956a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5956a2.TMP
Size 2KB
SHA256 3874845fa3d9c17976a8a5b62e9bb1fbc5dbabe35a092d5841011982b904d3c3
MD5 73b20e50461d0386aa371df658936864
SHA1 138f7eeea9dab9501a1aef5830d460ccf3b52d99
SHA512 ef3353221692003da3de989a9f7ade1e194127dbf208e5164da88a2055a74fd8a983b92f26fc68e8a1c9b262048ee059eac569e74bda9f38a79eb42881bb8f76
TLSH
T1DF511AA75732ABD1DB6388B263E19C583AF4CB6589039F55804CAF348B46F1C50D573B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a591ab9ba6f80b7a6eb8a32a6f67b26758fece6193a4233154e2d45b39ce9a9d
MD5 1c4e525eebc9fd97b5f70807ab51635f
SHA1 04b5617b5d1dde58f74c14055c83be21c3512152
SHA512 a84364532163940debb6a547cbd33fb82f49c06fda4c185a0292fada01f4e433e0414840b2d3fc37abd21908323d8774bfef4288874378bb8b7db034e83d6ff5
TLSH
T18D41CEF3C7F8896D890156F0AB146E1BCE2C0911432C7D5AC9E4EE2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 35e1bc9ab85ced4e17bf6df65e06dbd8482dc62e2bcfd0e5516303dd10a8b578
MD5 99bcaec7adaba00c63992cbf22474ade
SHA1 2e962953f3b7cab75b3f186d0c8f5db1b4ec4df8
SHA512 d7506eab702e84dfbc3af57aecd67624d716716628428bdbe7c8645d20cb1958001a67cf8226dc1e1711a508575145951e2ee9ab90f296b83a54ed36d1a57ccc
SSDEEP 192:sxRHRsCb/fksHYEZA9klzoD8p4t/g6+WNIYGlb2kvGjIgVUotJ:sxRHdb/fksHY6KkRY/5I7Cp
TLSH
T16032E9156E68693B9CCBE21CFB65BF53D6FD503260941E48A7FC8A0C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d43375ab24168d69b5711e474b9c8838736a37dc94dba9ea408c1ddc5d07300d
MD5 bf7e822ee640490ddc32817352e65a89
SHA1 53cc39f0f8560e270210a3e13aa309d193d83f78
SHA512 2ba09d406fac0fc8bd9cbda17ab546892818655bf8375e2a2f27ac8c3d3ea8c57e0efa53ba20176eb59e5f83305e767c0f7930a2d708e17fa9ce8ca911f36771
SSDEEP 192:sxRYRsCb/fksoYEZA9klzoD8p4t/g6+WNIYGlb2kvGjIgDVUotJ:sxRYdb/fksoY6KkRY/5I7Ct
TLSH
T16542D815AE68693B9CCBD21CFB55BF53D6FD503260941E48A6FC8A1C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1cb027f933c31a9e0eff94de3cf6c15cdca1f622a6f4b1f407c1214312d4b16a
MD5 c1dc9ddf515c58567cfeed40628ecbfb
SHA1 c958da7b251d4a9db883255c1c796db936065841
SHA512 881e649f597cc4f268d98ec1db4d01105fafedda15a68236a2a3058ec86573fb2310ce14ad2f7daf98e2b3888e0d31b500b48836ff7da4332ce59d1c523bbfdc
SSDEEP 768:UQYik27pLuLzONWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwJ5pNKxrox:UQYikWEzONWgv7fxJu1jaXJ5fKKx
TLSH
T178D2DB7B740CCB7E4F804A9DD9297E9F6DA802CB9698CD8047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 25092f7c0c2f9ae471b552b206784b5aa021882b0f12865120d992b090326bc6
MD5 b22f78ee727197bdbacf1e3013475b83
SHA1 536454ae95cd1a8ada45fecce5a0b1a7ff758b52
SHA512 3af69d87da815290b0658a7ba47a326feabe8e2cb248a9e25032108344852df3226d57bdecc220d60b95ac811316e36364927e921837a3c5903cb1cb5c6c3251
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlktaTHd3LfWTI2gPfK4OuggKdyCi6sKbal:Cm7KmgIIJ4tWGm7g09OGlktaTHd3LeTQ
TLSH
T1DF912085713B4680387E69048DEDC92F528275A73118E56F7FA861B21F6BE034DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 00bf0475ba129b321c7b68c169664796be1d74124df7b5ee9712b5cf1ee096d9
MD5 cdb362bfa2673809e572d94c89875f64
SHA1 f2f14751e30c9a603aee46bb7efffe47025ec588
SHA512 a035c78072efa24397d3f1e2686f9ce0fe6230e560910123922fbad68d1753444c9a22bfaaf3d8d3aea85bf46fe40bce811725a6c1478ad7270308b45e39986b
SSDEEP 768:Zw3cJlYyhY7Hucys6BRvi82oP4/z6himo6McTRnB:Zw3u3imOz6ImoHcTRnB
TLSH
T13FF2AF70A8558D72DCEBC299B5467B826EF0522349CC5D84E9DEAF0E0587B9E071B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 20f45b4444f2c78baa27ac7372ae3af98a1cec26990d71bc0004691b019f3769
MD5 e848c666b4036740a0f45963a5639af4
SHA1 cebcfe55d307615d1e234ebb686db435154a24ed
SHA512 a3841004813e18427e0d01240f9fe99962c76946f3734e101e44414eac714176aa28da1876cb74398c8df4446248269618cfab93a0c23deb2bc31dce4c9a1ee9
SSDEEP 768:Rw35JlYyhY7Hucys6BRvi82oP4/z6himo6McTRnB:Rw3n3imOz6ImoHcTRnB
TLSH
T168F2AF70A8558D72DCEBD2D9B5467B827EF0522349CC5D84E9EEAF0E0587B5E070B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 38f86d3b79fdafe61c4f8eb0ad4b65f334825dbefb9d10ea75cce6e879809ef5
MD5 c815ed80832892e6afb2a690a7d1925c
SHA1 4ccd21e5cdf543736f928388476772ca88aa2b2d
SHA512 eef7e3e8ecf0683edfeac9f4e52d20e900b44bf9183577708b58e923915932c88122dc93fcf064a1c3d00518306866c6371b9708ddf0dbcd897e0c00513e4ad6
SSDEEP 768:Ks35JNMECPO7Hucys6BRvi82oP4/z6himo6McTRnB:Ks3U3imOz6ImoHcTRnB
TLSH
T1CCF2AF70E8958D73DCEBD2D9B5467B826EF0522345CC5984D9DEAF0E0583B9E071B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ae383de687c99f250f59ab70fde601c0664ff5448c92130ccc8900f330d90b0
MD5 553c00ba0ea7c219fd588a75d347845b
SHA1 4420f50946486fb18e504413fcae3f3aba19dd6b
SHA512 2596a63ac3e0e05656b198ffbd118ae4bab90c151500d39929fca0795d42fc38ce45d9ce1a5dacd8daa539b5e817c79ed6241e494723edb83f3e1082deb8875a
SSDEEP 768:jrv+4UNbdL3sJlYyhB7Hucys6BRvi82oP4/z6himo6MIJ:jbsbd3t3imOz6ImoHY
TLSH
T1C403AF30E8558E73DCFB9298B0477A937FE4212348C85D94E5DA9B0E0587A9E171F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9985562d5abfc6d17c743de67c81758041626ad9b4a16ff60f489c0862b5cb8d
MD5 147c8e8f7f25d24313d8df13f97fd576
SHA1 e4ae49c7e6a32212bef4a0501fe75df4c91d53e7
SHA512 e97810bf69d3b73210e55cb9496d50b5c04e4284ad2bbc834f0fa03d1059b0638ab225b0998402415b50915dbe98328117fc80027d12c2cd9dc67d5c308927f3
SSDEEP 768:xGrv+4UNbdS3+5hlYyhk7Hucys6BRvi82oP4/z6himo+X2bwn+h:xGbsbw3+f3imOz6Imoo0w+
TLSH
T19503BF36E4548D73DDE7C288B046BA977FF4522385C91AD0E6DE5B0E029BA5E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ed69e4c9b1a17d710607221b9e67bdf34e86051679f0592fbdd686a8ad7f892d
MD5 b73c59e32fcbf4b36d1b7745ac720953
SHA1 505feae8dc176b15cd2a3a0e7f748c5ddebfae6e
SHA512 bc4a94806a3f2c3ad6e2f537b3fcaee63b13a35734d6b480c4701e71f6b03fd8d9115e5c295ddea445ed7f00cb0071d0d0ff2bfddbc9ca6a54abaf7d1e023470
SSDEEP 768:Yrv+4UNbdS3WvlYyh37Hucys6BRvi82oP4/z6himofM2bwn+h:Ybsbw3B3imOz6ImoE0w+
TLSH
T12F03BF31E4158D33EDEBC184B446BB977FF4626389C95A80E6DA9B4E0187A5E130F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

493c9fed-df21-42dd-9df2-6c1055251aad.tmp

Path C:\Users\Admin\AppData\Local\Temp\493c9fed-df21-42dd-9df2-6c1055251aad.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1968_755601826\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download