hxxps://cdn[.]discordapp[.]com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme[.]rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/11/2026, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme.rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&
Sample261106-gkc79aah88

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{DB927393-13E6-4330-B292-23CE5852082F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Aljaheem Theme.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4952	4976	msedge.exe	81
PID 4976 wrote to memory of 4372	4976	msedge.exe	82
PID 4976 wrote to memory of 4440	4976	msedge.exe	83
PID 4976 wrote to memory of 4372	4976	msedge.exe	82
PID 4976 wrote to memory of 4372	4976	msedge.exe	82
PID 4976 wrote to memory of 836	4976	msedge.exe	84
PID 4976 wrote to memory of 836	4976	msedge.exe	84
PID 4976 wrote to memory of 2548	4976	msedge.exe	85
PID 4976 wrote to memory of 1320	4976	msedge.exe	86
PID 4976 wrote to memory of 2548	4976	msedge.exe	85
PID 4976 wrote to memory of 2548	4976	msedge.exe	85
PID 4976 wrote to memory of 1320	4976	msedge.exe	86
PID 4976 wrote to memory of 1320	4976	msedge.exe	86
PID 4976 wrote to memory of 2052	4976	msedge.exe	87
PID 4976 wrote to memory of 5152	4976	msedge.exe	88
PID 4976 wrote to memory of 2052	4976	msedge.exe	87
PID 4976 wrote to memory of 2052	4976	msedge.exe	87
PID 4976 wrote to memory of 5144	4976	msedge.exe	89
PID 4976 wrote to memory of 5152	4976	msedge.exe	88
PID 4976 wrote to memory of 5152	4976	msedge.exe	88
PID 4976 wrote to memory of 5144	4976	msedge.exe	89
PID 4976 wrote to memory of 5144	4976	msedge.exe	89
PID 4976 wrote to memory of 5148	4976	msedge.exe	90
PID 4976 wrote to memory of 5148	4976	msedge.exe	90
PID 4976 wrote to memory of 5148	4976	msedge.exe	90
PID 4976 wrote to memory of 1128	4976	msedge.exe	93
PID 4976 wrote to memory of 1128	4976	msedge.exe	93
PID 4976 wrote to memory of 5320	4976	msedge.exe	94
PID 4976 wrote to memory of 5320	4976	msedge.exe	94
PID 4976 wrote to memory of 568	4976	msedge.exe	95
PID 4976 wrote to memory of 5408	4976	msedge.exe	96
PID 4976 wrote to memory of 568	4976	msedge.exe	95
PID 4976 wrote to memory of 5408	4976	msedge.exe	96
PID 4976 wrote to memory of 5408	4976	msedge.exe	96
PID 4976 wrote to memory of 5424	4976	msedge.exe	97
PID 4976 wrote to memory of 5616	4976	msedge.exe	98
PID 5616 wrote to memory of 4540	5616	msedge.exe	100
PID 4976 wrote to memory of 2568	4976	msedge.exe	102
PID 4976 wrote to memory of 4556	4976	msedge.exe	103
PID 4976 wrote to memory of 4680	4976	msedge.exe	104
PID 4976 wrote to memory of 2064	4976	msedge.exe	105
PID 4976 wrote to memory of 5936	4976	msedge.exe	106
PID 4976 wrote to memory of 5936	4976	msedge.exe	106
PID 4976 wrote to memory of 1456	4976	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme.rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffca983c188,0x7ffca983c194,0x7ffca983c1a0
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,11108317954557291276,7363585983053199573,262144 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,1448495407841288417,9791321267877987616,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1629080556389216697,11291398556074089924,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,7132322076136957296,16895105388785980362,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3380,i,10506306983658632817,4153963797116682024,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,14238942617268715509,3912250603446839970,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,17382497884352298383,1990656972033099133,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,3890332146427180412,10914110413164185843,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,82646445844872399,11071793716735492896,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,16708345766046833064,6557854253592032687,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,4144373766595440596,8975050809826564057,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1030775293477445392,18220112666960483248,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6016,i,13444438421974336277,16268507373871906240,2097152 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,17719620868629604082,5185449924035962833,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,989349198703624584,8089097273913607671,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,6527722056133805442,17230027139495226746,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,6527722056133805442,17230027139495226746,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,4522728978278817902,17000131323326855488,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,2060511746770539526,15089838732715647060,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,2505063219586711787,229793405218959433,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3116846312127246257,7102986252610571268,524288 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6332,i,5863170614644332119,5631375253019682436,262144 --field-trial-handle=2136,i,15217327829129252488,1916550906164695060,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38e22198-71f0-4fe9-af0e-aa76830159f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38e22198-71f0-4fe9-af0e-aa76830159f5.tmp
Size 8KB
SHA256 ec8149d477f54bf3b08de668007c3f5dc73c3d5b6a52a40977ae7a552ccf2ab4
MD5 4547f368866be127a942ae9302c3d8ff
SHA1 424bbb41ccce41f55715bb6e42675dc68a4d62ab
SHA512 54227e6e8781ad6cd9e2dd99719566df1bfbf5791c79f4d3e392afbfcd10e7f66d2282587eadae48166472d720723df4197b813f6c243b4bd357a673599f356a
SSDEEP 192:1GNC6KsE7uFQmiUyHXIxupZU+KCk562x4qlU6:1GNC6LEqjgIxupa+KCkTx7U6
TLSH
T19F121932AC386C7B5EE3A891F48735279EA54227EA847B80D5DC1A0C01EF65C134A962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61d18a19-35bd-437d-9b80-0fd1ae885308.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61d18a19-35bd-437d-9b80-0fd1ae885308.tmp
Size 18KB
SHA256 7dac8d28a5550ad477795453b24124eac53dcbb2670f1d5fbabf8c9921437364
MD5 269bb99965d72ea86856b7e96ff2508c
SHA1 79360a316e0db1c7c4e75adc0e9f9c0b8c8c6704
SHA512 a29f6b561fd8f6f2cf6d23734671febc38ee0d69aaddb51d9784b869966184dcc0772c9111b53a7d0d52ecd28a055c9155a07e299357a13ee6eff6be7957fc8d
SSDEEP 384:2QkUSva8N/IP2Eqeyi4Gupa+KCkxx7H7vBEDX8IIlk:Waxqo1Ua3CUx7H75EDMLy
TLSH
T162827D71AC786C7B1EF39550F24B3923EEB49167EAC42B40D5DD5B1C01DB68C234BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77362695-da5f-48ff-9fd8-3b7d97e85f5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77362695-da5f-48ff-9fd8-3b7d97e85f5a.tmp
Size 8KB
SHA256 8b69584d10a085c43e38c62f7a98f3a2e4098213ab978a8adf4fdf8e2b69713f
MD5 3b19e98a9da6131a85005852d66c01a1
SHA1 528ebe7250aebcda2b63c76f8df98d20bf003b3a
SHA512 6b92f46725dcd457c969fb3a48abbfd2854f8adff23ad0068646566208a420f5c81e9786894e521bcd663b7f6416936eb505473952c2d420241416eec04cefe3
SSDEEP 192:DGNU6KsE7uxQmiUynUXgxupZU+Kgu9xcAU6:DGNU6LEqP4Egxupa+K7xFU6
TLSH
T19A02D735AC786CBB9EF3AD55F5877A235FA5112BE9942F84D6E81E0C40D728C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8385ffd3-0550-4d87-8c3e-33499a39ef50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8385ffd3-0550-4d87-8c3e-33499a39ef50.tmp
Size 18KB
SHA256 ca388873009e013fc2ce30ec0914bd12cc6101b11bd4671352eb75cbc6cc3443
MD5 84d761c461b5bda9697b2254062bbb83
SHA1 a0aedc629d5f13a543b8ae31ba65d350226237a1
SHA512 2d64f5c110fb084425a9e4ace7e0314547bd771c934ec9035e634ebbe58511d2b1ad442fada08f1322f644e8f38370276c4fd0553d2c2f2089404b0ca5c6617a
SSDEEP 384:rQkUSva8N/bP2Eqeyi4Gupa+KCkxx7H7vBEDX8IIlk:lakqo1Ua3CUx7H75EDMLy
TLSH
T12F827D71AC786C7B1EF39550E24B3923EEB49167EAD42B40D4DD5B1C01DB68C234BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e15da6e5-4e17-4b90-9c9a-a376e7debe3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e15da6e5-4e17-4b90-9c9a-a376e7debe3c.tmp
Size 105KB
SHA256 62fab88cb5198530e2dfdb8339f170da8e3c8d0fff4167dc4bfcb08cc18fd750
MD5 06eaff39e7d820178762d31fbdadca1c
SHA1 4ed51eb65450f98c797ac2e1af69c955dc014f1b
SHA512 703e50475751e268f8f48b744f5f09e24bf5a9df4dbd989adac78e251f5ca548631a44b92ae65f955e635d39fa1b190cd88a18556d3638c2658e63aaedcbe8b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T18FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1f6c4b137cf090c223f598118775b10d154be67456bf38a42ba1bb747522307
MD5 208cd2028de536f1eebd85494d0f5255
SHA1 9d2d0041979da71db635ceefa3fa6317dd57e198
SHA512 c40982abd1b1451db2e704b05ef6ee872d40348c91bfe1108ca9713f9faf2315fe291999266c5847de730d134c5fa291e71f02b8b42a23a33fd6d932fac0da4a
TLSH
T14BD02B80EBDC4670E033383743A28213314DA0904402244584D203CE2E0230200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2919d80dfd6d85559fba9643d47674e2117f9df47486cab2b277d4be08d7f573
MD5 df4820d8a4af5e2a30e051bc6b17890b
SHA1 71c71e6c4861a6746045802c49b9b40e854305aa
SHA512 1e68daef0c4ac9151d4231114e5afe348c06a3f326e718c027aadf385c9d9583a707dd81bd0085d2728242904ef42d27b43b0be21ee08803b068b3878dad5e55
TLSH
T1E1D02B80EBDC4A70E433383743A18213314DA0904402654684D203CE1E0334200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

4e4d1366-9dd1-4916-bf03-d3061940b87e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e4d1366-9dd1-4916-bf03-d3061940b87e.tmp
Size 9KB
SHA256 415c760acd330851fc3eb05b4824d9c44e1f9d1e29e38693bcdc97ab04ff9e3f
MD5 fd1f465755c82c6ffabc1ca48d6af8b4
SHA1 657461ea0ee9f6230d951e239e69f373ce4c91d7
SHA512 0e8a9007f57f2e5b913251214710b61a80b8d58fecc17e94ea840fbf64bca233f572990acd1aea875dffaf13ea032f220db29fc04b9572f3f086ea981a27827e
SSDEEP 192:sxZ8RHOs/f5sqeAIdpM/W6+WNGY0gocZAIgrJ:sxZ80s/f5sqCM/bG5z9
TLSH
T17E22C7126E24B93B8CCBD20DBB257F53E5F9543291951E48EAFC861C05F66CD220B50F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

679c2178-799c-4904-8cf9-ec952c450a61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\679c2178-799c-4904-8cf9-ec952c450a61.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91ff0ae4-5a75-4b09-928b-6ef0de122d1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91ff0ae4-5a75-4b09-928b-6ef0de122d1a.tmp
Size 10KB
SHA256 c5f3e7a42fb3936c24852b426109f1fa6015e70f0e0797f056a417072acb039c
MD5 265a737306681bf79a9f24b6b96676f6
SHA1 72ffc592bfdc9ccad597a7c655e187d40685e9e3
SHA512 da12a24e44c3dde4f3622551bc5e97f79a9c0a474dccfb83046293704ac5bfaee0f7df5dc5df9615ba28587cdf092f4502a2e367b7cc9d0e182af033b75cf0ed
SSDEEP 192:sxZ8RHOs/f5sIeAIdpM/W6+WNGY0gmUZAIg5gJ:sxZ80s/f5sICM/bG5VC
TLSH
T1A122C6526E28793B9CCBE20DBB257F53E6F95032A1911E48AAFC861C05F76CD220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 03cc7c33b3cbd5723b83d91ec1aa2b8fe78276f8c7ec54e225fd977c9d90d4c4
MD5 6cdf41031e80aeeec9730e50fb743e06
SHA1 63dcab53ca6c4dfbacebd26a1d7ab8a1cfb3e863
SHA512 4a1d1c3f00b1510c4c95a1b247c7e159ff6acc0110e45d745fc6f801234ed8d269c515cd609239cd0cd9170024c67967c7a3e9abf3d32e37f81e4c9e19898da0
TLSH
T19061556080630A98D714B2B4A5D32A8336B779B17543AF371DE8E3B5F48EBD91942092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b88afc2b37dcb7de4fec9e4cd2189d9f50500599af835bb35b7ac7fba77830bc
MD5 c930d2301aef0db0b0ab8d0624b256d5
SHA1 625b24c4b9031365edb0802a80af1cafe470b796
SHA512 8bf9645aad0cd294bf18185cdc13a042d99fbf711e75ab1bcaca248e20c22e25507ae7c8456284d86182b141cd6141eaeb1379474f0bcff8d63db7d98d0b67bf
TLSH
T13961556085A30AD8D714B270A5D22A8336B779B17543AF371CECE3B5F48EBD91942092
MD5 SHA1 SHA512 TLSH

Submit Download

637f6bd3-25b8-45d0-8f1f-582ddcdce91b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\637f6bd3-25b8-45d0-8f1f-582ddcdce91b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

46127c56-766c-483b-acde-32aad34a3fab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\46127c56-766c-483b-acde-32aad34a3fab.tmp
Size 1KB
SHA256 25c26a29a552defa2ea311f7dc9850f579860808b6c07a4d1fc7d71c4e4a7ca3
MD5 05e7088d42e8199c736d5d28aa99cdb5
SHA1 1516fe0056f24cc1ccd3ae594f0fbbfed64a39cf
SHA512 9463ec06ca76195f174cec67d1495314ddce9ba321e90b6fde365d713cd9dc5cb76726f529ac597a89ccabd2e3c5162327196b3c63b5e707759b1e2ab7b824cd
TLSH
T1EA2197F3C2D48A6E890116F46B146E2BCE2D0914436C3D1A89D4EF6BD7E3466E04094F
MD5 SHA1 SHA512 TLSH

Submit Download

9382d308-4816-484a-a44d-927a0e1554a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9382d308-4816-484a-a44d-927a0e1554a4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fc89a503-78a4-4185-9b7b-dc2df499db1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc89a503-78a4-4185-9b7b-dc2df499db1a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7c686134177d2c18ab26cdc28b46e059c4beb5dc274932d6eb0e20cfa764a2cd
MD5 402c31c2baac24cbca15a4cfe73cc682
SHA1 d84ec2500614b9cabee386067bd1f5270c77ce6c
SHA512 e9b01d23da60753572da7d65d2953841830f183af389bd45ce1911104b1761053f5bec02edac6d63d7dda6bead54e00f3483555e6d841227d11c722fd6f87e63
SSDEEP 96:KQL6KUEWe3WKwomsnSLXJFxkBF0PrfkKDBrRkP3XUJk:kx1FLu
TLSH
T1D591064135BA0280B8BE251D80BD975B128172B33018EA2F3FBD52E68D7BE145EFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c06a3df9-ede7-47a7-895e-152c8c790594.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c06a3df9-ede7-47a7-895e-152c8c790594.tmp
Size 28KB
SHA256 9078ef3de2753a6057486c87d444dad4d0eed0672c6c35bdadcf9c1e3186bcfe
MD5 5c5b7e39e1fa2db6399a1b8fdd9dd20d
SHA1 d67d6b497ab99f49e71196d3ea1b2f931c32ff9f
SHA512 14ca8fd9830645cc47616a5a19a903c29d662a2662e0181a518d684ee7f19fa51f73428e82cfb071bc422ba43952513a1e06f600643314b87efc43cdcbc6d9f1
SSDEEP 768:ganh588N24sWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CrLl/Ii09Fvroed:ganh588N24sWRmUUQ6Iu1jaKCrLpI79l
TLSH
T135D20B3B344CCB7E4FC01E9DED566F966EA802C766688D4047FA894C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc7cf4e9-d187-4405-a542-e9b10325ee70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc7cf4e9-d187-4405-a542-e9b10325ee70.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e44f5ae4-4e28-4b08-8319-f7f13427a1e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e44f5ae4-4e28-4b08-8319-f7f13427a1e3.tmp
Size 10KB
SHA256 1fe7d45e76fbb453708f6ca8c6606b1eef016e2f3386e3ded39e2f6082a20418
MD5 4b95e6e6e714c4b18d74e65e9f9faf91
SHA1 ede45cbb674e3dbc8fd2406710e3456d9abf753b
SHA512 1bc6cb33d744d791cd4f95544349afcad36d9b5a4bf5c69f82a66d737ca05141642200d7d1166140c41f38447d74c478a37b6c692927ea3c0c82fa7a7bfd55d7
SSDEEP 192:sxZ8RHOs/f5s+eAIdpM/W6+WNGY0go2ZAIg5KJ:sxZ80s/f5s+CM/bG5hY
TLSH
T10C22C6126E24B93B8CCBD20DBB257F53E6F95032A1911E48E6FC861C09F66DD220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe47d31d-d946-4fdc-8740-96915f2da316.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe47d31d-d946-4fdc-8740-96915f2da316.tmp
Size 10KB
SHA256 afc183e14bb82732f53d11fed01b86507c9a1c47f0a1692ee290718831507796
MD5 bfa1ce528f8cb5dc400a3e3e3df42e40
SHA1 4e9ad83bb8976098a16e964bb67a4297ff3facf5
SHA512 cc2c032b9fe5c4d5761dbfe32aa26d0c1e6f81ec5a509f3ea86dfeb7b60549d132b33785b1d587e5d45a11bc7c3580f97c42355ac416583d4f4fd1d318c45dab
SSDEEP 192:sxZ8RHOs/f5sIeAIdpW/W6+WNGY0g4pz2AIg5gJ:sxZ80s/f5sICW/bG5lJC
TLSH
T18722D7526E24793B9CCBE21DBB157F53E6F95032A1911E48AAFC861C05F76CE220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7888b20-25ac-47ab-acd6-26e874bfabed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7888b20-25ac-47ab-acd6-26e874bfabed.tmp
Size 21KB
SHA256 08a75c03bdd85136d327b1b047692a35d701d3ae06f3c778fa3442e7b235794d
MD5 4766715926289e06ece8a8d9ffd7d904
SHA1 8fd4ee71720fdbc46a57dae987128b89e1db68dd
SHA512 54ac00328184ad7838120cbbc8426074b17b2c0ff34e03477a20bec99af7e65973af9c876faf72c871781cd3d47afb77ffb596a9727a1b3e11bdde136b4104b1
SSDEEP 384:oiF5QkUSv08Nh8TUNTUlIlIP2Eqeyi4Gupa+KCk6x7H7vBEDX8IIlk:zFb0Iwgkqo1Ua3C9x7H75EDMLy
TLSH
T151A26C739C68A97B6EF39A50E64A3513DEB04167D9D46B90E6DD4A1C00EB1CC238BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9d67410-9bac-4d0f-9653-346e280c1a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9d67410-9bac-4d0f-9653-346e280c1a4d.tmp
Size 18KB
SHA256 710dfcfc6ae1f19f4494595e9b20b28791ae74918bd442b9104815dd64620265
MD5 21b1caa2cb229c2736e8364fd76d4269
SHA1 8a261e3e2269ac5b3575699661c83103f4e0493e
SHA512 f8c9ddcac8e0f01dc813000c7f8ab56615f97f0adaa8ed7d415612be85c317bcc7afabaea9270b41109421023acac1b6a49302f2c7f1a86903e90b0e175fe56b
SSDEEP 384:BQkUSva8N/PP2Eqeyi4Gupa+KCkxx7H7vBEDX8IIlk:zaoqo1Ua3CUx7H75EDMLy
TLSH
T1D2827D71AC786C7B1EF39550E24B3923EEB49167EAD42B80D4DD5B1C01DB68C234BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26e0d1a5-d108-42f1-9786-43de639ce4dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26e0d1a5-d108-42f1-9786-43de639ce4dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

753c856f-71c0-43b4-9503-c7d8a86c7bb6.tmp

Path C:\Users\Admin\Downloads\753c856f-71c0-43b4-9503-c7d8a86c7bb6.tmp
Size 14KB
SHA256 34837cccfc957cd6404e30e321266ee8c201aa8a98fd7aa815da4bab8d804133
MD5 ca141e7d8b65cd3564532b2758387702
SHA1 9b00285852d4a37e4f697c8cfcf39c46893b8601
SHA512 39eaa7b273520ed88cae4238caee11c2ed6149137e027fc69501d1991ee5218c5bf653f34f426592ca56e8434e489dbc4b1d3d7f80408ad604468fb8f7064ca4
SSDEEP 384:FgU8vMSrAkgdgRyXm//41bBN0L5Sowd/4GWWeBXTw:eUkMSedVXm//ebAlDWs8
TLSH
T1C562D0A6A45101F78D772FB07C262A5B4487C767E48D0F40CD476F568BFDA1292E314E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aljaheem Theme.rar.crdownload

Path C:\Users\Admin\Downloads\Aljaheem Theme.rar.crdownload
Size 6.7MB
SHA256 c2faa32f93874b30e1f051f184f2c7ded3fb1167cdf6cb017830a01fae21ae9a
MD5 b8c4ee0ff12b989bc4c5f0774ac0d7a3
SHA1 991bbba350965de0e5f88bb3f982585b0e0dc212
SHA512 d9e006fc6186bff675b8011e2f2035dad97fb6f97dff33fe2790676871b0ffdba58a2e308b224edf2119af3bcbcaf1615948d0ec257c2164cbcd2d749c1065e2
SSDEEP 196608:r226HG9rEOKDihpijvFS77HtRV27ftLIszOulj8EK/Lgo:d6m9x/ijNS77HLVo1FXoEuko
TLSH
T1A0663335EE950D69F73C2592509E1F11085EF33D8844929EEF7B1BE0EA82AC54BBF490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aljaheem Theme.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Aljaheem Theme.rar:Zone.Identifier
Size 226B
SHA256 399d57cab17c40c2d8c2da1507b8142a3bd966b1e5a3d72a7d9d385424748ea2
MD5 f8f1152bf479c3d0d8743854b3b1062f
SHA1 0cf4eb3c70b51059d7cf8a6efa4daac45eae6662
SHA512 335ff4e1c6d834597d71d54ef43029c008380f7245cc541d92a4f69130ee242d567fae7d3534df933480dc6fc5b8d99c4a4368bad47deec4758e045603c4c88a
TLSH
T1D9D023D24529403055DF95FC1F844454947EA7DC855315408454D19598415DE71F2C7B
MD5 SHA1 SHA512 TLSH

Submit Download