976be154f07bed12377690ddfe734bf94ff01858f9ce28a0a526db7617130e5e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data\flutter_assets\assets\auth-gitlab.svg
Size 684B
Sample260603-pgalysfy7p
SHA256 976be154f07bed12377690ddfe734bf94ff01858f9ce28a0a526db7617130e5e
MD5 b9b4d037f50930335a0e503cd9a35294
SHA1 91a8e0d1e843f687444a4c90b8ab3720e71e39e1
SHA512 f0d676d130f4a5b0b7e36b5d5dc95a3ba1adc69703ca4b4b3c51d4a92da0d1aa741dc8db72638ad1dc19118263d9bd8f5445d4129507ea6fcb44867f2eec6af2
TLSH
T171012BDC26BD3459990287F0CAEC21D705D7F0B7E10900D9F0481C18FD86B5FD6A7648
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_1637170221\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_995760955\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_1637170221\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_995760955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_1063836835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_2090266609\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2660	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2998493873"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257451"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249630554831935"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{F1F249A8-5AAB-41C1-AA86-FB3F5F066AA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1112	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1112	5072	iexplore.exe	80
PID 1112 wrote to memory of 5224	1112	msedge.exe	81
PID 1112 wrote to memory of 2660	1112	msedge.exe	82
PID 1112 wrote to memory of 4712	1112	msedge.exe	83
PID 1112 wrote to memory of 4712	1112	msedge.exe	83
PID 1112 wrote to memory of 4712	1112	msedge.exe	83
PID 1112 wrote to memory of 5060	1112	msedge.exe	85
PID 1112 wrote to memory of 5060	1112	msedge.exe	85
PID 1112 wrote to memory of 5756	1112	msedge.exe	86
PID 1112 wrote to memory of 5792	1112	msedge.exe	87
PID 1112 wrote to memory of 5756	1112	msedge.exe	86
PID 1112 wrote to memory of 5756	1112	msedge.exe	86
PID 1112 wrote to memory of 5792	1112	msedge.exe	87
PID 1112 wrote to memory of 5792	1112	msedge.exe	87
PID 1112 wrote to memory of 1528	1112	msedge.exe	89
PID 1112 wrote to memory of 3048	1112	msedge.exe	90
PID 1112 wrote to memory of 1528	1112	msedge.exe	89
PID 1112 wrote to memory of 3048	1112	msedge.exe	90
PID 1112 wrote to memory of 4700	1112	msedge.exe	91
PID 1112 wrote to memory of 6012	1112	msedge.exe	93
PID 4700 wrote to memory of 1044	4700	msedge.exe	94
PID 1112 wrote to memory of 1480	1112	msedge.exe	97
PID 1112 wrote to memory of 3936	1112	msedge.exe	98
PID 1112 wrote to memory of 4256	1112	msedge.exe	99
PID 1112 wrote to memory of 2536	1112	msedge.exe	100
PID 1112 wrote to memory of 2536	1112	msedge.exe	100
PID 1112 wrote to memory of 732	1112	msedge.exe	101
PID 1112 wrote to memory of 732	1112	msedge.exe	101
PID 1112 wrote to memory of 608	1112	msedge.exe	102
PID 1112 wrote to memory of 608	1112	msedge.exe	102
PID 1112 wrote to memory of 5704	1112	msedge.exe	105
PID 1112 wrote to memory of 5704	1112	msedge.exe	105
PID 1112 wrote to memory of 700	1112	msedge.exe	106
PID 1112 wrote to memory of 700	1112	msedge.exe	106
PID 1112 wrote to memory of 5824	1112	msedge.exe	107
PID 1112 wrote to memory of 4976	1112	msedge.exe	108
PID 1112 wrote to memory of 4976	1112	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\auth-gitlab.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/data/flutter_assets/assets/auth-gitlab.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fff8779c188,0x7fff8779c194,0x7fff8779c1a0
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4304029415459476220,15871833265581855002,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,16194658878423851293,2617044227174754637,262144 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,4000248863860915527,2841136848366971106,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10429955368092048044,16834801290032486814,2097152 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13958498366355680306,7358392186856260426,2097152 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,5898258940023964305,11849662873409988332,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,1058048919499944005,14695951183080386578,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10690545359683271628,9313943303606045877,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13322803069312447202,17681427755765558222,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13322803069312447202,17681427755765558222,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2906282988717678964,6581601937646789923,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,867555982583778992,5387037850748278455,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9942416894611783792,14817879854270497882,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,17929186948232881165,4935800157223238862,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10752462827394083540,4057677771294054818,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4450169494049611464,10594613502689881275,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7077723919179130338,16164111180793501992,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5763666464038952203,1952811317359622940,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3044,i,11762514170858151709,16598813229136291381,262144 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2620496699373471793,17002445167809648250,524288 --field-trial-handle=2156,i,1621478964642051804,2257727866642258103,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 01374ad32d4467809590da53e1b2fa37b5e50b6ea80b9b1a099d543866fd838a
MD5 0f1d6280ed85e0e5eea710d2729baea8
SHA1 6dcb03c28cf0fb2250cffc2b67e1ddb01a45f7d9
SHA512 386dc72af3c2f3aac9143aa7cf5e876ddb85ed81ad345ee853582f1b9ab802319d82f697fbe9354f9834e2ae32c3176e54594487aca026b5a82ea2a996163db6
TLSH
T184F0A9AAC925AC3714FD1B1970A9174AE751135B2780845F3B3E560C8FB563B468981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bff405174fbaea734469f3bd963e741fb44562d005ebc7139d6dd7304a3a4615
MD5 650de1dcf07aef411369f2a883f81cf2
SHA1 64096b08e9393e499b77199d561b6f756992f7d7
SHA512 a00b84a75374a8bb58f7d5335b31562a3799660edfbf891591e20462016a3adc88598611ad7c6f47c63de1f55a320782c139ab41f7c47f1190f578c7df69f3d3
TLSH
T17C417DF7C2E8856D894196F4BA18BE1FCE2D0914432C3D9A89E4AF1B93E2471E18165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6207859b8bb7f4b1d73fd8b5eaae225cb13e48923e0324c4416224afc9441e45
MD5 b1af71c4144575ef82be61841868c257
SHA1 9a71545a3be4456277af4b43c3d888e207a78653
SHA512 3aceb58db4d68580ed7b634a9ac289955b4aff3090aebd5e770c69534fc7f1a7fdec7f3c5edddf9471915cc9dd33d12ece352216f5aaa91def7e0476e8c74be4
SSDEEP 192:sxZlkR3yMqZjK1Ml8UQEcx/fR/sGIE0CXUyynDBzodpEg/W6+WNGY0dZnUIVe4IS:sxZeQqDx/f5sGn0Ly8q5/bG5nl6K
TLSH
T1B872F706AA34597B8CDBD21AF6457F53D7F9112292400E449AFC8F0C04E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24fbaef1a25f9ba4990df703aefeb2766f395c7ed4d78917e2695d522bac79dc
MD5 baf717418217b445cc9f0ff748c0443a
SHA1 e8585285d9f76fc97454153fe8a0ae538fef9296
SHA512 387ebe54c8fa5916075e8c903af916b63ad3d3cb23e24485c1853b345405132c0c6a1586318f95133ec357a702932c6794bc9d4735f1ba65e8469a67b9fb82d0
SSDEEP 192:sxZlkR3yMqZjK1Ml8Mcx/fR/s82nxE0CXUyynDBzodpEg/W6+WNGY0dgnUIVe4IE:sxZeQ0x/f5s82n60Ly8q5/bG5gljr
TLSH
T16762F716AA38597B8CDBD319FA457F53D7F9112392505E44AAFC8B0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 46979f90f7002370d4371842f21c47e96c3d7d8927e3ce175c4b7df854075cf9
MD5 8d4edf160f59629df11659aeb79a62f1
SHA1 840a052a56e7ee13ffc6a108ea426ef738b7bdd4
SHA512 3ab37322688db669c56280ea9202fc66718f9e74ff0fbbcff22ba6f07bae6fa60eba682a90597c9fd2c84436a0f80b5c89fce0e5b8375dfe6ecb63afcb49d5ab
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3J3pQLl8:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKJ3pT
TLSH
T113031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fc54d08aa34380f31504ad67aeb10560a54f7605f847e0cf22804acf84fdfbd5
MD5 3d87c904dcb9b2114dd6dd1c45084de8
SHA1 1473a59f5fc9d4813dc9627ac82bd9015f2687b8
SHA512 a050c9baf6faf8ebc2de6043cd6bac7afde9d21175ce5dfa3639f7988c2fcdb8b15fda7140e29a9db19de79f5b91c9c6411c9f6a37aa720335d5f8f37243b911
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv725+:AFBHhTofhno2mB21q3Llbfe3sLDdeEpj
TLSH
T145B26E56717B12023C3D291CA6919B370E8272A33458A97F77B800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b71491b37e5f7430b609b3feec97271e9094db37488573d197a38802c86f2d84
MD5 e24a4a3be444d868490047d2a2985569
SHA1 8bc44d176a1355ef531cd8b33735bf3a578fea3c
SHA512 4917bd518264592833d7d0b2f43644e03a01935b45ecab2a9d5fbe94bb59cbd7e70a5b4df469cc49f874aa91388eef8643db85485586105e679af031f6ff91c0
SSDEEP 384:n1iFmtNnNnb9J38Nw8TUNTUlIRqy+Pdjjf+8oYtNhRbpxXen1mzBab/i7NHy/7IJ:8FmjZbH3Hwgsjompwn1mzBabQVj
TLSH
T197D23A32E8A4DAF7EDE74FD9B70A7A03AFE441A385885AD4DAD85E0D00872DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dc6e9880200943e6a4c2bbe4200d375291a20b267f556f46945ef09e090b88e0
MD5 92f3d0a7c7f1a4a26d2978406106a56b
SHA1 1cb66e612f4a528e72ad42f46b631c4afa3ce3bf
SHA512 5001ebd48252ab52802fa147270f1692e07776cc0c4ff51a40a4bb9c1659430642ea698bb4990c2b6a0c36d1e63e548a2120c8f87006fe65602aa6733e381913
SSDEEP 384:n54iF9CcmyWCs38N68TUNTUlIxBydv2oHajjf+8oYtNhRbpxgnFdhkP+lFYS/yVM:RFccps3JwgviMompWnThkoFYS/z
TLSH
T147B23A36ECA8CAB7EDEA4F99EB4A7A07EEE00163859859D4CAD81D4D00872DD1347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 16141e7841d5951fc6c4fa1789c5388dc1c761aee581043157f3ebf700e623e3
MD5 0dd3c72c5a5da82364567e795a4f4279
SHA1 37e31f86139ca52a9f3c8227f5a90183c205cefe
SHA512 404c71d01159c1f9e9f092ec2ccba86fc738a79e8b8b3f2b2c3695cb6249f487d49406567ba04c74e9729db47850a630578a8cdc419825acc7f8f2eedbfddb14
SSDEEP 384:n5GiF9CcmyWCK38Nw8TUNTUlIRoyDPdjjf+8oYtNhRbpxXan1lLHy/7Igs0:HFccpK3Hwg7jompgn1lw
TLSH
T196B23B32ECA4CAB7EDEB4FC9B74A7603DEE4416386984AD4DAD95D0D00872DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 12e10b128a9ae9681fe4f632cfe68f76405c2a3d5eac2ab04d73dd1e6e3efcb1
MD5 0f9b38805e677ba6ae1b0c253d4ec8c1
SHA1 8cb24453e3e6707cdb0ed655cd1318558faf51ed
SHA512 603430775308192fc790411e1e4f90536744d94b8fd340b5c5f73dc300bbf7e3bbbc387dac03522c932a88dff5cb0ad83223387e7a324a803b238e3c8ee69b6e
SSDEEP 384:n5GiFmtNnNnb9x38Nw8TUNTUlIRqy+Pdjjf+8oYtNhRbpxXFn1mzBab/i7NHy/7O:HFmjZbn3Hwgsjompzn1mzBabQVj
TLSH
T1B3D23A72E8A4DAF7EDE74FD9B70A7A03AFE441A385885AD4DAD85E0D00872DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2ce8a0bc33dedddf5440224a85626d60a37302fc5cf2e6840799c0a4a90e052b
MD5 eb1ef79dc225f0c4a5b66ab6abc8c0ba
SHA1 52fe0223e67f0eaa217425c69528ff2ce7623e21
SHA512 9aca24519f872b2533633a3c6760cc8903a487499558bf380e71b08333a5111676f19f1f5b0de91e9337244cbdba126d358c67b7b8867a31ab06f7ccd94d5132
SSDEEP 384:nYiFmtNnNnb9x38Nw8TUNTUlIRqy+Pdjjf+8oYtNhRbpxXFn1mzBab/i7NHy/7IJ:jFmjZbn3Hwgsjompzn1mzBabQVj
TLSH
T10DD23A72E8A4DAF7EDE74FD9B70A7A03AFE441A385885AD4DAD85E0D00872DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.3.1\typosquatting_list.pb
Size 517KB
SHA256 11b1bddabaa5cf6005782a0dc1a19060440b8197c32d3cdc1bd33c6dec9541f0
MD5 659ffd17d4a31fa1244b7065b3e317c7
SHA1 98945de704d7fa4c6c6daca6db00baa30912183e
SHA512 f609e0007515cd608c69b59961302efc55edbb3b8fc45e0bfeded4bbac92ee3c1bfc88b228c5f7bfc1f21bd3660b2a23db5d690c1410634e2f6800ca5ec7b471
SSDEEP 3072:tibsRz1ELJN1UkUhOnDPvuVUL7PkPPDNzBJHfHQ1vJ//Q8fX0/1R+kRME71RDoDs:UsrELJNiIl7cnJ/IJ/lX0/71mM1oDs
TLSH
T1F2B4C5B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4584d88ab76c9347cb0c74703ce8e3a0c00bab46fc7993af36bfa7b3458f3312
MD5 4913aee648fe5f31782a604d93f11df8
SHA1 5c3e738d59a6c0916db1076a927136405b934a6a
SHA512 36e2841bf2b2c25e40deb5f6ea9f2e7c4a9aa1d3e25bfef4440b442a3c8e9102ab07560a2eecf0e64acbae707e7c6a1fe5ebf302a57484bfd731d32c3b67ae87
TLSH
T1EB410ED15C3C2AC2E0BE0A6FA45B38FC91EC8726F4A4347D6858DAD8153924A658483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fe9a4bdd9cbbc5060420a3598e99ad041f3854a8b02f6384068f0a764736a7ed
MD5 5b11d6630a3f0a851ad03cf637cda500
SHA1 e4435601f2a67f0300d524a549fd9cce03fe608b
SHA512 e4285831a03734be93190e6f1a0be7856e7c0462f31f88d949d2d69e1250e804acc00a224acc99b2bcc4761208d35e2b68efc24a5376d1ccd5073e06b0c1dd2b
TLSH
T1EE4121D15C3C2AC1E0BE0A6F645738FC91EC8326F4A4703D6848EED81679209654483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 666e3b4dea97262e1088d76218d274cf92998a4cfd0e1677fb9c0eb0991a9f8c
MD5 28ad7b6ff647d7ba56914ba70c1435aa
SHA1 3afe3718d3c97b6cc86b23755650cf41ab08142c
SHA512 2b97c70b245b6adcacb4ef6aed049003229d5d2a9b6ddac187313eb0296a1af59b631637069ae62031a293d6446b00293397d199b427599b989a7e18104e217d
TLSH
T16B4130E15C3D2AD1D0BE0E6FA45B38FC91E8D326F4A470396448EE94063920E714187F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_1063836835\manifest.json
Size 117B
SHA256 6fa06284765ad2e1f1edb8d748dadbf45ca1a9cef79231f666d2123e9ba0f8dc
MD5 ce58edd80dd7fc45121fdf5d2560895c
SHA1 c01dff5d5f54092863f27c08044ed2273a824557
SHA512 1212798008f6f3010abbd708503ce7310c2ed12ba45b65fe1d8edfd01e19758b279ff2f95a9b1cc50573a6e79cebd2fbd9df9be829cedf6c185c5c30be4ac42a
TLSH
T185B092B00C0AA03B22809320ECA066C2C3F80218E8021B1E088036491F8817880366F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_1637170221\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_995760955\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1112_995760955\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6012-165-0x0000029190DE0000-0x0000029191DE0000-memory.dmp

Download