ae13d3ddf6bb44aff98c18be1389b54568038c3703c2530f637a5981f43d6768

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
provinv/images/hexagon-green.svg
Size 649B
Sample260604-pfejhsd121
SHA256 ae13d3ddf6bb44aff98c18be1389b54568038c3703c2530f637a5981f43d6768
MD5 9dd958969cedb406d2980582fa341e54
SHA1 ccd95d412696a92a7449331f9c23a5efa1d6bc92
SHA512 f4e14d92e5bd31b0c2ce433f3187c7dc99449c16bec4063fb44c7dbe84ab5e875a3ee4baf401f5552241d4eac7a0499fcd3c3f154a914ee6a37ad62bcdd20aa6
TLSH
T18CF0D34682059C7E6124821097E866C273F8B589D1D449CCC9E62C3FE2259D0521D9D8
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1357666752\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1837822901\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1357666752\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\es_419\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3224_1254263117\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1607803483\_locales\hu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2666063922"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257650"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250490512003587"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{D79A0A28-5D54-477A-8742-2A0D1AF46F1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3224	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 3224	5944	iexplore.exe	80
PID 3224 wrote to memory of 5684	3224	msedge.exe	81
PID 3224 wrote to memory of 5200	3224	msedge.exe	83
PID 3224 wrote to memory of 3748	3224	msedge.exe	84
PID 3224 wrote to memory of 3748	3224	msedge.exe	84
PID 3224 wrote to memory of 3748	3224	msedge.exe	84
PID 3224 wrote to memory of 3164	3224	msedge.exe	85
PID 3224 wrote to memory of 3164	3224	msedge.exe	85
PID 3224 wrote to memory of 2644	3224	msedge.exe	86
PID 3224 wrote to memory of 2644	3224	msedge.exe	86
PID 3224 wrote to memory of 5076	3224	msedge.exe	87
PID 3224 wrote to memory of 2644	3224	msedge.exe	86
PID 3224 wrote to memory of 5076	3224	msedge.exe	87
PID 3224 wrote to memory of 5076	3224	msedge.exe	87
PID 3224 wrote to memory of 5868	3224	msedge.exe	89
PID 3224 wrote to memory of 5868	3224	msedge.exe	89
PID 3224 wrote to memory of 1200	3224	msedge.exe	90
PID 3224 wrote to memory of 1200	3224	msedge.exe	90
PID 3224 wrote to memory of 2436	3224	msedge.exe	92
PID 3224 wrote to memory of 2936	3224	msedge.exe	93
PID 2436 wrote to memory of 2404	2436	msedge.exe	94
PID 3224 wrote to memory of 5924	3224	msedge.exe	97
PID 3224 wrote to memory of 5928	3224	msedge.exe	98
PID 3224 wrote to memory of 3512	3224	msedge.exe	99
PID 3224 wrote to memory of 2300	3224	msedge.exe	100
PID 3224 wrote to memory of 2300	3224	msedge.exe	100
PID 3224 wrote to memory of 4116	3224	msedge.exe	101
PID 3224 wrote to memory of 4116	3224	msedge.exe	101
PID 3224 wrote to memory of 3060	3224	msedge.exe	102
PID 3224 wrote to memory of 3060	3224	msedge.exe	102
PID 3224 wrote to memory of 3500	3224	msedge.exe	105
PID 3224 wrote to memory of 3500	3224	msedge.exe	105
PID 3224 wrote to memory of 3584	3224	msedge.exe	106
PID 3224 wrote to memory of 3584	3224	msedge.exe	106
PID 3224 wrote to memory of 3936	3224	msedge.exe	107
PID 3224 wrote to memory of 4548	3224	msedge.exe	108
PID 3224 wrote to memory of 4548	3224	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\provinv\images\hexagon-green.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/provinv/images/hexagon-green.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffcdd49c188,0x7ffcdd49c194,0x7ffcdd49c1a0
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,11908257224803135929,10548752146617516064,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16532458690065330711,17595277801165659196,262144 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,3887992496534285300,3289061824299267059,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,16754892310984469367,4036950810007798435,2097152 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1098296267770440051,7615959399924781225,2097152 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,4564972092187843200,12181601155827639101,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,9013793362566330592,8331799765382158695,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13309942612770268403,1439351782796559955,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14639056530196796179,9332796574823733145,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13309942612770268403,1439351782796559955,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6314647240191384446,11931866203126720006,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14741866343363126610,6699009807423033097,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12772434574802143758,11130986983367143404,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,15934202929446641030,13777656321596302742,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9237656359350154137,18115682959261789015,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12820288754661241544,15997003114449083134,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,9239090012335126665,1435174440002501696,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,2898621360676074021,11079337841787435786,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5952,i,15479244027727022127,12930415938188932958,262144 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,653698545581416856,5400147777491869085,524288 --field-trial-handle=2424,i,9874187338179657578,3939296219032793051,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:14
    3⤵
    PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

448908b5-79a5-4cf9-98bb-bf510073eed0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\448908b5-79a5-4cf9-98bb-bf510073eed0.tmp
Size 27KB
SHA256 7471975cb0e0fe492e9b66ea8000ceb8d8ed4f530bff381792a8268c21a6c1d0
MD5 f767e2d9af4127b6d3fe4b1d7597415f
SHA1 d011fee4347a7571d556bf64a1782f6a5ab0536f
SHA512 32fdd7b6ccf2c0811c8b5e1c5a13a14a34374efde60fbf560da4e3d142172ce15fd58f7b8965e7a4d229c65e3ab313347773efceca66a84d21df53c7ebf6fd1d
SSDEEP 384:nXiF9CcmyWCO38Nd8TUNTUlIRurk6eas1ifbLokoK1+K6XiRaOcWMq57mvH1styS:SFccpO3OwgPino6+KiiRaOcWM67Q1Q
TLSH
T1A9D26B32DC59CEB7ACDB5F99F75A3643DEE010A3858C8ED9DAE94E0D008709D1B4B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

2e610d80-303b-4006-87aa-65fc7709641b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e610d80-303b-4006-87aa-65fc7709641b.tmp
Size 15KB
SHA256 e152061bdff75d254c33d1c892c46c38a896b49c600a68937b54f3670abf6ef8
MD5 bee00fc340e9b572a36effd3c6999d76
SHA1 fe432177cf183dbdc2a22c49772d6116a4974ecf
SHA512 203de7d3cbbc729b4504515d5f1864d423145ffc35fe03850d1c5c19c966f97b41461a1968db909e867c9f808a13f7257ad425b3d60dca57825f9b8e14576cb9
SSDEEP 192:sxZFRSyMqZjK1Ml8Mcd/fcsX+2KQ7PgYsw0/zodpEC/W6+WNGY0ZkRfIgjJGJ:sxZF30d/fcsX+2V7orw0UX/bG5MjJS
TLSH
T1E3620A06AA34597BCCDBD309FA557B53D6F9152392900E44AAFCCB0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 84e301309f63050b0c92d32ba07a6303807f9ac1e6db5cd6ca8d1c5cffc1bb29
MD5 6809284769aa6c122a264eb05c82621f
SHA1 c33c8a88dc28c5dd4b292f944fed7bc6e8aebb11
SHA512 d917329d24167956b1e094370e8ffd53d50f3a43c5fc1f8b75ff74387ab8ab6dd089ce132e0b94f147989545b2945feb7951ef8944d17e96f15ed77a34942a1c
TLSH
T129F028F6D8219C3B08FD0B2934945B4AE755132B2B40985F3B3D920C8FB463B499A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4a74bf52bc74c5b8470e211ea6bf6360e70e1200fbde56669debb4b2584e23f1
MD5 58b922e30a8c8114cd9c9455f56739d4
SHA1 046a2023e562a0bcb6f66bdeeb6b5d05c163cc4a
SHA512 0c737f4a366732dbc8a16d5b56f8db489907f2706a04573936f2a87af4d4aded57f007680aabb1678a9dd2fd221fdf30fcb519336696de1a21b3aac8bee38e3b
TLSH
T1B541AFF7C7E8856E891196F0AB18BE2FCE2D0914432C3D5A89E4AF1BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 79d1a652ecbf2519f6f3f8ded3a52ca55f493de9befc37415830098be9b8405a
MD5 b013b1a8570e99f77388885b3124787c
SHA1 e71f6fd3f6309537b4ad4e58ad7c46f060bd792f
SHA512 5263badbe16ba1a5865b894feb828b11d5ecab8afbdeede14910caf58d7ecb23fb4e714e8307a8f78d6ccfa719109297863d75e98052908208cdb2e808cdbc17
SSDEEP 192:sxZFRSyMqZjK1Ml8UQ4cd/fcs1+HKQ7PgYsw0/zodpEC/W6+WNGY0Z8RfIg5hFU7:sxZF3qXd/fcs1+HV7orw0UX/bG5s5U7
TLSH
T198720A06AA34497BCCDBD219FA557B53D6F9152391900E48AAFC8F0C05E6AED2213C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 2ba3883eda3eb4ebe3cbcdfabdb23311b25ec95b7b5c4fb6b32a551af0a9740d
MD5 dfab1a8bd7a84b6f470225ef26f24373
SHA1 bc625d9b5304c45b1ad68ee6327284d27ffe2e7c
SHA512 8fea5b9f670073b40398ab227e1abd9ca70ae982d924c7b8e1c845805c854dbc7ab25d7cce4a3e6193ce863f4e799e6a246af518f8c8e43deaa1892690787488
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31Gq9LlL:XwZh38Dv2SkEnZFWRm6GQFmu1jaK1Gqr
TLSH
T178030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 51ca318e9cc4cdc1e071401b07667d1178332f43baae8a8e2bf0171d6d53a3db
MD5 457f5fec3caf33b4630ece4b7a448c90
SHA1 ba22fcc5a4a67e99982d029084b3d0067d614439
SHA512 9262c663a4e3a78e14e68db2d82518e0230ba0d03537288bfe80eef0140293f327bacac5633534c7d45bd712763de29192aa41855d1b0eac09d977e6ed2a34eb
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlNwTkgKWCBG9MIspMiBR:ctGj+BCNC5qFVpKxpHD
TLSH
T1E4B2781632BA02023C3DB91D87A5DB375A42B1633018E93B7BE854B64E67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fefb296a1de233520ee208163d52b059d314947b57d80e13e4c67f52c925aa64
MD5 826107358d737956a3189b56ee6fe48d
SHA1 f96abeefa9af37f5fc514fef7235007e22c8fefc
SHA512 6b77e4e5f1b0c4a9a46dedfa2d9bf2589b6cbb34753b9aad82fb1825541dccb211117fcb1322dec7ca7440a9764e22638203506df65a7b9bbd8c0d87241ac024
SSDEEP 768:3FEurh9QrQ3OwgP2no6+KiydaOcWM67Q1t:bLQrQ3+P8UOTM6et
TLSH
T188D25C36E899CEB7ADDB4F85FB5A3643EEF010A3898C5ED4DAD95E0C008719D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3f6929707b3688c11bd4f2e0c8cdaa0c2e3c607bf9963960efca2af5bd545286
MD5 072bdf3454517587066bfa0fb3defabe
SHA1 bf240575fb798985d06e8267051c8e26c46262e2
SHA512 2ac20f5c9698cf5f6614a90cbea33e17b2bd5d113baed86abec3f856933a13c798185bbc24c312f018fd6aca66f850b0abc7a2b38675ea038e7f9fe671430256
SSDEEP 384:nTiF9CcmyWCs38NF8TUNTUlIxBrk6o/fF1ifbLokoK1+K0SacJe4KV8p0v1ty/7T:+Fccps3Cwg4jfuo6+K0SacJI8p0vc
TLSH
T1F4B26B32EC58CAB7ECDB4F9AE74A2A03DEE05167858C9ED8D9D81E0D008719D134BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e763bce1b430aab339eff13fed13c10244392a4b2054c0adceeb00388b6531c2
MD5 7547fb9fd6be65b48c7dd6efdc81a1cc
SHA1 689200850a35c316db49de3016253c8499bf075d
SHA512 3a3e7c1a79606f16717a1418086aa8a0c1baaa729db5ca2480231bffb519ef4c23546132d03ae5654d243497e8e8e188a3d0cb6211d54b8f246d6d8690d3ded8
SSDEEP 768:SFEurh9Qr23OwgP2no6+KiiRaOcWM67Q1t:qLQr23+PQYOTM6et
TLSH
T186D25B36E899CEB7ADDB4F95F75A3643EEF010A3898C5EC4DAD95E0C008719D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3d6c09584c11fd01e04e0655dcf10c59db48407cdf7abb976fde2c1abc3dddbc
MD5 284479064c8b5500cdaeb977050654b2
SHA1 c046e72eb2d4258a3038467097e3b478865d94cf
SHA512 041093b2c05849c50bfbade3fe4f132036ca08e255f8cb0653148947f797c993e2b1e740c1edb0ff55dabf6ec351e4d50cd62dd89ec3d78e547c85b8aa598a94
SSDEEP 768:dFEurh9Qr23OwgP2no6+KiiRaOcWM67Q1t:9LQr23+PQYOTM6et
TLSH
T1DBD25B36E899CEB7ADDB4F99F75A3643EEF010A3898C5EC4DAD95E0C008719D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ba10f43c787202155fc95f4480079531d70217161f01d316fe0c7b77009e2665
MD5 75c384a18d7d4e66ae0d7ff26a3cffbb
SHA1 d3f48e9043621ba2547370c7e31976ca3f33087f
SHA512 2606014d49ca90f2e7d7c69f539640ea6904e44038e4fb88daf4a53bb2a930a5360b3e8f21c62086cd501073e8c6efe9ad3e172fee6b56b3bc7a7eecb5f1a107
TLSH
T174412DE00C786AC1D4BD0E6E708B74EC92D8DB35F5A035796868EA940A7966C648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 be3de9d984f1e74f54db38be2920c2e231418a240cb3b913c3f4477148183c25
MD5 ef1489202eb61369fc67d76efabae39c
SHA1 e048c378e334ba85f349898ce68f149799205aeb
SHA512 1b36dabd9a3c152755b27e7ed48d452e514793d4d93cb53ce2e6e966dd005dcdae8416fa73db4aa56f2e5095c2806930bb8d35e2bc5b96760397f8f9b989fd4f
TLSH
T1024161E04D7C6BC1D4BD0A6F708B74FC91DCD725F5A034792868EA990AB962C648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f7918e4faecf2e50dd1d77264264323fc9abf57d8da3ff270b2b8697cce9dad2
MD5 e1b28559fe5bc538994347d12903b1b4
SHA1 40931a965a3c7620a3da619884172f30534b60ca
SHA512 1b3f2524787843224e26d5df14e47aa72a46a7d75f22f378be6a0c52cab17facbfcc460358c5b2ab9f9b09e7f8ddb2341c465d291cde937786c0cf56b5d7a54f
TLSH
T179413FE00D7C6BC1D4BD0A6F708B74EC91DCDB25F5A035792C68EAD80A7966C298583F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1357666752\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1837822901\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1837822901\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download