ef2501fba3fa0d6979aafa5277a9266775abcdce8fb33765f1594ea776c31861

Analysis

max time kernel
148s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
provinv/images/logo.svg
Size 3KB
Sample260604-pfejhsd121
SHA256 ef2501fba3fa0d6979aafa5277a9266775abcdce8fb33765f1594ea776c31861
MD5 5e413c9872b1ddf1b7b9644ec73faf8f
SHA1 16a88999d3f7cd1a3ea94c42f277d7d09d81457b
SHA512 4070f2636fd26ca378f582f041654d3700f1fc6380e09cc2fe3595019316a70b0d2d2283b5a6d20523adcda85ea9ff8b5328e43a00c2256e0cd200f81904b58e
TLSH
T12871AC570740E7AABD5601A8A97405EA73D6CCDBC0B0F2C49AE6B802E90ECD456DC5FE
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1622135567\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_448983990\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1622135567\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_646851343\offscreendocument_main.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5336	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4072714691"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257657"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250490824201493"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{AD0E23C8-ED12-4BBA-AC90-1CA3B38F4C3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 836	6028	iexplore.exe	80
PID 836 wrote to memory of 5592	836	msedge.exe	81
PID 836 wrote to memory of 5336	836	msedge.exe	82
PID 836 wrote to memory of 5580	836	msedge.exe	83
PID 836 wrote to memory of 5580	836	msedge.exe	83
PID 836 wrote to memory of 5580	836	msedge.exe	83
PID 836 wrote to memory of 1196	836	msedge.exe	84
PID 836 wrote to memory of 1196	836	msedge.exe	84
PID 836 wrote to memory of 5144	836	msedge.exe	86
PID 836 wrote to memory of 5144	836	msedge.exe	86
PID 836 wrote to memory of 5144	836	msedge.exe	86
PID 836 wrote to memory of 4260	836	msedge.exe	87
PID 836 wrote to memory of 4260	836	msedge.exe	87
PID 836 wrote to memory of 4260	836	msedge.exe	87
PID 836 wrote to memory of 2192	836	msedge.exe	89
PID 836 wrote to memory of 2220	836	msedge.exe	90
PID 836 wrote to memory of 2192	836	msedge.exe	89
PID 836 wrote to memory of 2220	836	msedge.exe	90
PID 836 wrote to memory of 4432	836	msedge.exe	92
PID 836 wrote to memory of 5056	836	msedge.exe	93
PID 4432 wrote to memory of 3516	4432	msedge.exe	94
PID 836 wrote to memory of 1668	836	msedge.exe	97
PID 836 wrote to memory of 2396	836	msedge.exe	98
PID 836 wrote to memory of 5512	836	msedge.exe	99
PID 836 wrote to memory of 4120	836	msedge.exe	100
PID 836 wrote to memory of 4120	836	msedge.exe	100
PID 836 wrote to memory of 2652	836	msedge.exe	101
PID 836 wrote to memory of 2652	836	msedge.exe	101
PID 836 wrote to memory of 2744	836	msedge.exe	102
PID 836 wrote to memory of 2744	836	msedge.exe	102
PID 836 wrote to memory of 4308	836	msedge.exe	105
PID 836 wrote to memory of 4308	836	msedge.exe	105
PID 836 wrote to memory of 1576	836	msedge.exe	106
PID 836 wrote to memory of 1576	836	msedge.exe	106
PID 836 wrote to memory of 4652	836	msedge.exe	107
PID 836 wrote to memory of 1920	836	msedge.exe	108
PID 836 wrote to memory of 1920	836	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\provinv\images\logo.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/provinv/images/logo.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffe5e5fc188,0x7ffe5e5fc194,0x7ffe5e5fc1a0
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,8445004519367566136,12891131505436661318,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4072470016660919478,12484250469654373081,262144 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,8343335670074193365,5757328256305237010,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,6875806650878828205,14491292111643094072,2097152 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,5177059778004898300,505759435669469548,2097152 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,11877662292092358549,3703940936612287367,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,525785214605442742,15735636514942186166,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10326195152849590270,15375593809089973156,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,8796553319303313528,17584822817346009845,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10326195152849590270,15375593809089973156,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,14776687660172595001,8073150328014595915,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16580974944120103399,9351009146682913240,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15350991080206443795,1080329393849920571,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,960849288501586074,10327218389705590709,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,5097611841078912857,10239914184178128541,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,12375132325791377681,10705259620608086907,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,1421825865958429327,4933031216977818224,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8334221853131546247,3746935052024319455,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5656,i,11865609473515022861,18405539777441238839,262144 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18369921028838346262,6105935039775105350,524288 --field-trial-handle=2060,i,13670842770800061069,10856424198861986539,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

5626b0fc-7a4c-4a32-ac34-9a6d561d5756.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5626b0fc-7a4c-4a32-ac34-9a6d561d5756.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 93591a51b37d463c273ba7e381fb40d2d240bd442b268ba34687b3f02a20403b
MD5 b0748d0d325e3ba911c83a997fad0f3e
SHA1 40dc48120c557f514f8bee371bf0a951313b50e1
SHA512 d23eda5ac3252a26a4e2425be7f037820cfaba9cab6b1fbf1c4b0da76da0bb3fb3189705a6c61dab61c45fc8ec4560b3bef5333bef317a39af08defaca8abc45
TLSH
T19EF028B6D9219C2B08FD0B2D38941B0AE751232B2B40885F3B3C930D8FB463B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 040691f6a9b51548be8d7660f6d61444f84f6c234f861ad979e98f37b951a9ef
MD5 a82c27d8e58b1bbf3dd45549a548415b
SHA1 b1dc64a09e660a4490a9daf84d39ada1f9dfbbe9
SHA512 ae7133c2a48f4635555ead68c986f845d426297198166c119415e3a3b4bf1ca8c68e83af7e3d9e5990f0b6d475356c60e484c0326a215f70c6fdbd5865961737
TLSH
T14041A0F7C7E8856DC90196F0AA28BE1FCE1D0914432C3D9AC8E4AF5B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b81630278180ec7a8c34310b0420fc7a37301e5465714b2c2d521c84e5661c19
MD5 7c4b5a8e2a83965e4de75bacd04e9307
SHA1 eb5305d0e21236af6a4ef73b2ce49362e125db45
SHA512 50b8bd9a769c9dba63f80d140147926cdac405ee4c5b675915645d63ab1e3a15a92485a1006f49f451ee63b31cbf352dcd27f11a84d17fb78e0ee42e6b477a64
SSDEEP 192:sxZGRhyMqZjK1Ml8McT/f6sf+oKQ7PgYsM0tzodpE3/W6+WNGY0ZkOUZSIgjJ9J:sxZGu0T/f6sf+oV7orM0me/bG5pjJH
TLSH
T16E620A16AA34597BCCDBD319FA457B53D6F91523D2900E48AAFCCB0C05E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2613c79962a28c9cfb0d6222800886d9fd7be94525eedaf3604187a58eaee858
MD5 de22e47a6588f20dea19dc57fe96c5d9
SHA1 0abe67fb88773419978cbc75e7dd70aecf78b9c3
SHA512 f7256f68d256c516c37290edb826bee1c35625774f5c1e705c1ac81ed9c8c3688dd0409658d6f2df8262656aaaa9face135c4bc770f367cc4bdc23fe505e3bd4
SSDEEP 192:sxZGRhyMqZjK1Ml8UQucT/f6sI+hKQ7PgYsM0tzodpE3/W6+WNGY0ZmOUZSIg5kQ:sxZGuqNT/f6sI+hV7orM0me/bG5rtUe
TLSH
T140721A16AA34597BCCDBD219FA457B53D6F9152391900E48AAFCCF0C01E6AED221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 fb0a28a3e446db2176b670c9046b995ad0d69096767d51cce1834a4a0dbc8360
MD5 b260655a6a9a3aa891fe451bd28993ad
SHA1 01a81f22e5fb8d4e57a431c64dd4062e0a5688b8
SHA512 1bb2b8fdfb82283d67271adc6fed0b4297f2ba25f2b29578ea174af923f11af7aeb6aa568bb517da600075cdd67ddefe8d5b7349da8d4dabe12bb144abaee3d1
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fGq9LlO:XwZh38Dv2SkEnZFWRm6GQFmu1jaKfGqu
TLSH
T126030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 d1bb65c1f6e8c97176ab3b11b1c5e9312b02da69d541702121881179131ee011
MD5 41cd0a42938b84b43b78df073969dfdc
SHA1 687c44967bc784651dd84151bed51d2663e83448
SHA512 5668515a00e07d63d5ee96cd0212778f39d598716b939bb51f574364beffcb78489c47d7b84ba82992c38a6019cd9e6f5f7e98cfec2c1ad78363f3f39e891de0
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlH3BbhX8:ctGj+BCNC5qFVpKxHxbh8
TLSH
T1DCC2781732BA02023C7D791D87A597371A42B1A33028E93B7BE954B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 26a3527de0f3d4333f5543e901d0d5684e2f11f8567a9ce2927f5b4ec11479aa
MD5 ecd39d34f8dc0eaec7036192a8339001
SHA1 dc562eb0b9469d3e8bf946ba845e20cd9ef15e4e
SHA512 5c4caa62720e3627c6185e44ddbe2442802552e291c68b7d195e48968024904be5c59e959fc3b3f442512d87cb04b3e37a16b749c683f95d81d6e0ce31db1f22
SSDEEP 384:n9iFytNnNnb9938Nl8TUNTUlIRtrk6pvMl1zCfbLoNuIn/9gXzHjoFbhyWBbIWZ7:0FyjZbz3WwgQ/TOotn/9QDjoBh9B
TLSH
T1EDD25B76D869CEA7ECEB4F89B74A7603DEF01163898C5EC4DAD85D0D009719E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 68a39ec8bed6863efa9ff776cf459e6b01e1708272c56aa492db1b41d9d89df8
MD5 5d7eab8cce03f700b3a44f324fd56cf9
SHA1 a0d199f55208ca6ab083b52cf321061cbb7bf507
SHA512 cd47d5a41c524f886911a73f3ea76a20a148ad7c0d6e26272a01d194fae630a77a6d2689231ec1e67be6a89c232736d9cb1a3e014158c878267d23aa24b67d37
SSDEEP 384:nIiF9CcmyWCs38Nf8TUNTUlIxBrk6ohAF1zCfbLoNuIn/9XSZwT6ty/7IgA:TFccps3Uwg49AzOotn/9XSZUC
TLSH
T106B23A36EC98CABBEDE64F99E74EB603DEE0127385885AD4DAD81D0C009719D130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e1b71a1485c9d997ae48c55b8559cf501da973213fd3a8527b318e73fa069fd3
MD5 c89937c7c3f759728d630d61b30aabfa
SHA1 532e04404132e6cad4315b570f4ddc6de3c8476f
SHA512 e0d8e51a112ddfc311fd440744773ca242919868f73ebc7693d4ae03b229b897161dc982a2971200329e61e5c105b417769bd4b6a996837aedb4e51fd7df02ac
SSDEEP 384:nMiFytNnNnb9M38Nl8TUNTUlIRtrk6pvMl1zCfbLoNuIn/9gXz8XoFbhyWBbIWZ7:3FyjZbu3WwgQ/TOotn/9Q4XoBh9B
TLSH
T1FCD25B76D869CEA7ECEB4F89A74A7603DEF01163898C5EC4DAD85D0D009729E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 151dbd49d2df69450548481ead253164a1c249042b485e497dc0794786aafc16
MD5 eef4989c2eedb5f473639c9aeb7a946e
SHA1 27e650e80e31cfacc82514e60b11f74d29f8e007
SHA512 7398a73811728c7998d6161c616cf66ebcbbfe579ec0aace17ed38336c2d85fad35218b6c1cb73c9dde797535e987c9a429d0fb85cc0142c70a5d4af2ebe5f8f
SSDEEP 384:nmiF9CcmyWCb38Nl8TUNTUlIRBrk6vvMl1zCfbLoNuIn/9gXz8RoFbhyWBbIWZR9:NFccpb3WwgQlTOotn/9Q4RoBhT
TLSH
T189D24B76D8A9CEB7ECDB4B89F74A7643DDE011738A888EC4D6D85E0D009B19D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7c16f435335a8b8d9e57da74175aa320527da9cd9beed0580a8c70ea2b34dd55
MD5 407f299a82bb17821762e6d823f4e9fe
SHA1 147b17f827ca572e1de8f132001a52af634c564e
SHA512 29c1d98d8efcf8c73bf2daddf722df068c1b82d435fa2619a8d3b262a12c81adeb27750e5fb5503f71fc651d8ff0e63e66642ceb47d8bab6cc8dc5d595fcc78c
SSDEEP 384:nmiFytNnNnb9M38Nl8TUNTUlIRtrk6pvMl1zCfbLoNuIn/9gXz8XoFbhyWBbIWZ7:NFyjZbu3WwgQ/TOotn/9Q4XoBh9B
TLSH
T17FD25B36D869CEA7ECEB4F89F74A7643DEF0116389885EC4DAD85D0D009729E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c70a49b0fb58dacb1e50954797d76a50e13226b23140d6860974fac0d84b84d2
MD5 6f2c45e82087501acca2d1a6b74f3247
SHA1 1ef4c006135af8270248375e485c6b5baf1b76b0
SHA512 dbae4e6c0901b7331aa8b394e25a6c15b8ecb6e3919e6ebdc98c0e7cfabf26ec7ab01402a010fa55867c6babbcbb3697d6b294278bd26cc99bccb8843294cbfd
TLSH
T18B515FE04C7D6AC1D4BD0E6F708B34FC82E8D725F5A035796868E999097962C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e558b1deb57bd9d0c4ddf1194e741b7b39204aa0facc5a51def07a576b90f460
MD5 410622ef52f71010cc7229aefb9f03cb
SHA1 e7986d8b07c8594ae667fa9d72b08463d94912c5
SHA512 4665069a741f1c604dc32e998eec3c3476c5dcdbd286bea78b40569d8598139aab2e6aacca4ffbb2eb63cfd8cdd134eb98edca7afcdc34241dfb89ffbcb45276
TLSH
T1D9515FE14C7C2AC0D4BD0A7F608B38EC81E8D725F5A034392858EAC80A78A2C648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7e54bdec83d30c8a98bbf7b7ecda5784362493d13f9516a787c863816cbbb400
MD5 4149f2ce83cf8de9afbaca5605cc90ac
SHA1 dd4e83b6827f3e16bcac508d06a9e7298c73324c
SHA512 7342ab0b67b43bfd79e613a4a8cb574165ba0520147162605adc1f2030178be3b0b164a34e5a42aac69136fb627bb1d44eea532fefced151aacc20d4f1da0cea
TLSH
T1E4515FE04C7C6BC0D4BD0A7F748B34EC91ECD725F5A038792868EA890A7962C348583F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1494283600\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1622135567\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_1622135567\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping836_448983990\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download