bde6548522b38205d24a5caf1ae12bddbfe7d31c5f4ae71e441b1688e4a42946

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
img/04 Honeycomb Foundation_pictogram_Medium._Mobile64.svg
Size 6KB
Sample260603-ag29msgx4p
SHA256 bde6548522b38205d24a5caf1ae12bddbfe7d31c5f4ae71e441b1688e4a42946
MD5 544d488b12bf86b04eef3617976d74ff
SHA1 dfda5d740ca875fe435ad5c66ea2e94e23ac36a4
SHA512 3ede8cecb81a9724e97c61a5b4debbfb707b9e7a96aee498575fd7101d0d05ca228ca1b70ead185758b1431c4c6353c9873ff34a42eee4ee3b904e9cf44c7c19
SSDEEP 192:pEGJsowHhEGdVfn4ga5XOUZnYq27Zb0qy92hgRvF19:tsowJta5XOUOq21bcz9
TLSH
T1B3D1331925F605614663F07E2BEF7444303E80973A0EDDA4B98DC7B4AF1641E4AB7BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1736500011\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_782441501\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1736500011\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\gl\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_782441501\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_2027571185\service_worker_bin_prod.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "474325957"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257352"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249191189649312"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{40DA9156-6158-4453-9ACB-70DD4F02A364}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3312	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3312	4188	iexplore.exe	79
PID 3312 wrote to memory of 4800	3312	msedge.exe	80
PID 3312 wrote to memory of 4940	3312	msedge.exe	81
PID 3312 wrote to memory of 3376	3312	msedge.exe	82
PID 3312 wrote to memory of 3376	3312	msedge.exe	82
PID 3312 wrote to memory of 3376	3312	msedge.exe	82
PID 3312 wrote to memory of 3644	3312	msedge.exe	83
PID 3312 wrote to memory of 3644	3312	msedge.exe	83
PID 3312 wrote to memory of 5304	3312	msedge.exe	85
PID 3312 wrote to memory of 5304	3312	msedge.exe	85
PID 3312 wrote to memory of 5304	3312	msedge.exe	85
PID 3312 wrote to memory of 1048	3312	msedge.exe	86
PID 3312 wrote to memory of 1048	3312	msedge.exe	86
PID 3312 wrote to memory of 1048	3312	msedge.exe	86
PID 3312 wrote to memory of 5288	3312	msedge.exe	88
PID 3312 wrote to memory of 5884	3312	msedge.exe	89
PID 3312 wrote to memory of 5288	3312	msedge.exe	88
PID 3312 wrote to memory of 5884	3312	msedge.exe	89
PID 3312 wrote to memory of 4768	3312	msedge.exe	91
PID 3312 wrote to memory of 3232	3312	msedge.exe	92
PID 3232 wrote to memory of 1972	3232	msedge.exe	93
PID 3312 wrote to memory of 5644	3312	msedge.exe	96
PID 3312 wrote to memory of 2096	3312	msedge.exe	97
PID 3312 wrote to memory of 2796	3312	msedge.exe	98
PID 3312 wrote to memory of 5620	3312	msedge.exe	99
PID 3312 wrote to memory of 5620	3312	msedge.exe	99
PID 3312 wrote to memory of 2564	3312	msedge.exe	100
PID 3312 wrote to memory of 2564	3312	msedge.exe	100
PID 3312 wrote to memory of 6008	3312	msedge.exe	101
PID 3312 wrote to memory of 6008	3312	msedge.exe	101
PID 3312 wrote to memory of 4348	3312	msedge.exe	104
PID 3312 wrote to memory of 4348	3312	msedge.exe	104
PID 3312 wrote to memory of 2096	3312	msedge.exe	105
PID 3312 wrote to memory of 2096	3312	msedge.exe	105
PID 3312 wrote to memory of 4516	3312	msedge.exe	106
PID 3312 wrote to memory of 2560	3312	msedge.exe	107
PID 3312 wrote to memory of 2560	3312	msedge.exe	107

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\img\04 Honeycomb Foundation_pictogram_Medium._Mobile64.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/img/04%20Honeycomb%20Foundation_pictogram_Medium._Mobile64.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x100,0x7ffaa930c188,0x7ffaa930c194,0x7ffaa930c1a0
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,4445271722921674502,7709748672386396297,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,10065575951600679016,12570493685790702129,262144 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,2834896498591780363,7900786688742365034,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15856206481587891909,5103371810508607621,2097152 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3335238307810817007,5338505609893272432,2097152 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5687513384768502945,18388229956236585620,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9513473852982684339,10753230384435381902,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,8201475672415074625,15397633163401524439,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,8201475672415074625,15397633163401524439,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1329600576983821657,7479683680202568871,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13383469777928981081,15695088659485776983,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4191169759134701777,6252379128510407490,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,210210442735264882,4151798722975045310,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12361297084952666909,346380582800999978,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,8542348949032888726,9960201972142140676,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,14796925895772038026,13752134282820236898,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5348489870596040253,4957285890246154520,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14294437688371723046,3962668741541077731,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,3460323753341505591,7529839390789630784,262144 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,10876787851880441436,12319967834458987116,524288 --field-trial-handle=2440,i,1690584926358840688,8673493821660594680,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8f2eccc18bc35e9080806adce1774c6c3309d40fc23c3244d1d537e5d74a76ee
MD5 c02199bf4fb6d17dddc3793ee9ae04ca
SHA1 7eea91aad25d04cf8d372f6c7e61d012f070c734
SHA512 35d724d0c9c9a6831fc0b037abcfbdbaf43e3947179dbf4195953f3cfe660243a71343777e55f24ec6b856e4bb4b33f7069c2395284625dfd9fd983c24303b30
TLSH
T134F0F9AAC920AC3714FD0B29B0A5474AE75513672780885F3B3D960C4FB567B469681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ce8f531575feba115276298c2663218ab194ecb9c16ab5a4af0ea858d2b500f0
MD5 f370b2aba5027f8facfa376e525428de
SHA1 cb4ceba3f7be1fd43ffe0473d213e50e617a52ff
SHA512 e73ee9ce0e14f5182829ad9a8e5d435c822d966ba5dead3881db8d6f3714059db6d667214966ff4ca8e38358397fe7d16bc3ef0dfc796a1d62ee898d7a074390
TLSH
T180419FF7C2E8856D890195F0AA187E1FCE2D0954432C3D5AC4E4AF5B93E2471E18165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 38bd5dbacde9a96074224f4f43be3c545aefd62b8298dbf71ec29bd607d345d5
MD5 8a0fd148a07caada35588debb25f9bb4
SHA1 b83945ee55a6f0b3eabb7e867c8561075215a214
SHA512 3841f5fe5076a4c6f6968432acbb6fb64f83b1f7bd745cd184e1c32e07a9c64020218063207d34c023bab8319f2de8ac6543b4b1270f3eca6f9b2d9a1ea50e92
SSDEEP 192:sxZ0R0yMqZjK1Ml8McV/fNs8PuxE0CXUyynDJzodpE3/W6+WNGY0dg0MWIgjJJ:sxZ090V/fNs8Pu60Ly8im/bG57vjz
TLSH
T1FE62F816AA38597B8CDBD319FA457F53D3F9152292505E44AAFCCB1C04E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2eb981253b5392508b92cd2fe16f672997fd6b541fde6bf0158224cbc2ea614
MD5 7dea1a4a0fbb01fd23051e2fbc7fa1ed
SHA1 b4d573984defbaf5db5a1f7e586fcaa653e0cb3f
SHA512 2ad0adedd4271eb7f20c7ad9ba63efcc446dc043fed2eef11c502b7c20bdb1b7491ffd42ed619969516fafa20bbffa4d9f6f3dbcc2e9b2c4e0eb0c74740cf544
SSDEEP 192:sxZ0R0yMqZjK1Ml8UQbcV/fNsIFE0CXUyynDJzodpE3/W6+WNGY0dQ0MWIg5BupJ:sxZ09qAV/fNsI20Ly8im/bG5Tv+T
TLSH
T18172F816AA38597B8CDBD219F645BF53D3F8152292504E44AAFCDF1C04E66EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 14bcb38d728318ccb34e0254afd57e1dc61702d6ad651a6e9f9bdaf3bcbc7785
MD5 8b5b63c39e3c79796e84df43a9e9a9bb
SHA1 f51c3b2e262835f34b84050a92a9d7f92caea683
SHA512 37401c08f470be689967bc1f61912564f1f71cb406c3e378dfd6a58a32a064f8021d2b4920043c815d93e08b3739345ea1cb15ad5365ac76d6660601110bc456
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3N3pQLlY:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKN3pn
TLSH
T12A031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 457fdb22d62541a6dad0726fc5c6de8cbe45e2d751718a7d16d045f7f654a1cf
MD5 f459990e87a439b9c1e888597700c121
SHA1 fdd6f9d70fd1e1b2c80e827953b468e51aefc3cf
SHA512 46af323dfd41fcea37d3dc540eee2c68a14771fdf78e8116bec10c9bb407af471172c2103d02b97cfde40f14df57a25aac23e5f4d5b046d6faeac8265af61993
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7aPt:AFBHhTofhno2mB21q3Llbfe3sLDdeEpy
TLSH
T18FB29E56717B12423C3E291CA6929B370E8272A3345CA57F77B800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 588ad619f05eeed60d9318fcf7338fd29e881535e621345a6878cc29349f73d5
MD5 07b18f6204eb2d345850881220938f54
SHA1 ae5db2a10e13b29eb74c4f0736443bbfa226875a
SHA512 a814296e8eefb4676e163f53679d8d842531766d25afd1c1427928b4e496f4d10a0d0332988877098fe4ebdd6a553714333d5ba8c304c788951d971cbe760316
SSDEEP 384:yMiFKtNnNnb9t38NQ8TUNTUlIRfy3I0jjf+8ogBlVH8jZALEntAXVjHy/7Igzf:eFKjZbr3bwgVGogBbH6eVQf
TLSH
T16DD25C32DCA5CDB7ECE64E99F34A7647AEE401A3898C5AD4DAC89E4D00C729D170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c492db01765bd4edb6898a2a29830cf418ea3d8046286bd6db14112d3d5f659b
MD5 130e70a36d11136585f1146bc66184fa
SHA1 8945df9c98acefce4a6ccba65993ec0e4addd2ca
SHA512 74c72e5eaf627a54980b9b068ad7f6473ec758951f65795436d4696d9e35101522b3e9d45c4cc07caae7e63e5851d8555870ef3f2df844cc2a93a896e02527a4
SSDEEP 384:n5GiF9CcmyWCs38Nb8TUNTUlIxBydvHogajjf+8ogBCthkP+lFYS/t2Hy/7Igg:7Fccps38wgGFMogBCthkoFYS/u
TLSH
T1A9B24A36EC94DAB7ECE74F9AE74ABA07EEE001A3C19899D4DAC81D5D00C719D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 74664551a200ba9f9c648355e0b75889abdb549fdedc282be62f4022a5d7c889
MD5 4ff52d8a5ac1790cfdd538fc0d9df05d
SHA1 af3e7118e5ee40a26d63bf87c67b1dc30b8ceddf
SHA512 64753c986abab79488b816b748d073d8eb309fbce4222e29248c23b68690de236136003b8d7d21f01e4522fd0576560dc03d1ddbf18089e0b808ce40e9ad3fc1
SSDEEP 384:y5GiFKtNnNnb9d38NQ8TUNTUlIRfy3I0jjf+8ogBleH8jZALEntAXVjHy/7Igzf:qFKjZbX3bwgVGogBAH6eVQf
TLSH
T1F1D25C32DC65CDF7ECE65E99F34A7647AEE401A3898C5AD4DAC89E4C00C729D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a0cfd62e7364727f28f62dfbbdb1a2b2599ab3ab80c4e46057e7bd25deb632f8
MD5 1a8bb3f1e01ae0804ed793a3b2bd2e4d
SHA1 cc40c943eaa5e1bce86f68ecf017410590f04df5
SHA512 78179741f0e96973b2773023a88d130b2f55538928e520541ad5c7ff6afb8603233fb4ab9311963c6fe9e120a962f858fdf35f916e15ae8b01601bcdfa006513
SSDEEP 384:yLiFKtNnNnb9d38NQ8TUNTUlIRfy3I0jjf+8ogBleH8jZALEntAXVjHy/7Igzf:3FKjZbX3bwgVGogBAH6eVQf
TLSH
T105D25C32DC65CDF7ECE64E99F34A7647AEE401A3898C5AD4DAC89E4C00C729D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d080d5c56d3078307f2f73e89a73fa3bb5fb0915aaf5ba8747f2dc947bdaed30
MD5 c2a6653d181e966033ca25e3d9d3acda
SHA1 adf8d0be0b678a99f4f89a793c8be588f44caf08
SHA512 d94e4c764e471a1c88ae9b9d0e0af84869624eb45de5e7e552eda5f581e237f6fd7c6c0719af74369ceee7111edc8dbdbab24d59a68646625ae38c51839ca304
SSDEEP 384:y5GiF1tNnNnb9538NQ8TUNTUlIR7yBI0jjf+8ogBliH8jZALEntAXVjHy/7Igzf:qF1jZbv3bwgrGogB8H6eVQf
TLSH
T126D25B32DC65CDF7ECE69E99F34A7647AEE001A3898C5AD4DAC89E4C00C719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 666e3b4dea97262e1088d76218d274cf92998a4cfd0e1677fb9c0eb0991a9f8c
MD5 28ad7b6ff647d7ba56914ba70c1435aa
SHA1 3afe3718d3c97b6cc86b23755650cf41ab08142c
SHA512 2b97c70b245b6adcacb4ef6aed049003229d5d2a9b6ddac187313eb0296a1af59b631637069ae62031a293d6446b00293397d199b427599b989a7e18104e217d
TLSH
T16B4130E15C3D2AD1D0BE0E6FA45B38FC91E8D326F4A470396448EE94063920E714187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 adefb4e7c0c81124a349bc979392350c879bb9d4802b7c5569a4a84ae6910848
MD5 b1898d3903238a825e77626c16fa5e67
SHA1 1cebedcc778c923f4735b7003ff09d89daaff181
SHA512 c0e1a8a1486b8a649930ce4fbf9e9a5bb68c8e25ee769c1e83fbe12d9b6367c5311bc1596e6deb129b97fccd52e79702e86373525f790416bf0aea8013d075ba
TLSH
T1784120E15C3D2AC1E0BE0E6E644B38FC91ECD726F4A430796858DED4063964D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7fd73687e0262676f3a4c17e0ed2c5bca48b021f88fa343e0bbbd54a1a22a5ed
MD5 c89ad3b6da65e4acb04e7fd8d84098cb
SHA1 7ad19097d3cb94f0e6e31114f57c37671f7cf94e
SHA512 161e5bfacaab0546353fdcfade24f007c4dc9c63a40bfabc5cc272d0eeaf09c3bb3685a0a09b088174cad3ce5205c972371db5e37e81e0e5eb493a63b22289e0
TLSH
T1E24130E15C3D2AC1E0BE0E6F645B38FC91ECD32AF4A430796848EED8063960D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1360339092\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1736500011\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1736500011\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_782441501\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download