hxxps://www[.]pioneerhvac[.]ca/

Analysis

user interaction
yes
max time kernel
61s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.pioneerhvac.ca/
Sample261002-q9greaydka

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6E59F38D-ECBA-4010-9DD9-D3266DFB1E6B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4976	1596	msedge.exe	87
PID 1596 wrote to memory of 4916	1596	msedge.exe	88
PID 1596 wrote to memory of 5040	1596	msedge.exe	89
PID 1596 wrote to memory of 5040	1596	msedge.exe	89
PID 1596 wrote to memory of 5040	1596	msedge.exe	89
PID 1596 wrote to memory of 1628	1596	msedge.exe	90
PID 1596 wrote to memory of 1628	1596	msedge.exe	90
PID 1596 wrote to memory of 3472	1596	msedge.exe	91
PID 1596 wrote to memory of 3968	1596	msedge.exe	92
PID 1596 wrote to memory of 3472	1596	msedge.exe	91
PID 1596 wrote to memory of 3472	1596	msedge.exe	91
PID 1596 wrote to memory of 3968	1596	msedge.exe	92
PID 1596 wrote to memory of 3968	1596	msedge.exe	92
PID 1596 wrote to memory of 3776	1596	msedge.exe	94
PID 1596 wrote to memory of 712	1596	msedge.exe	95
PID 1596 wrote to memory of 3776	1596	msedge.exe	94
PID 1596 wrote to memory of 3776	1596	msedge.exe	94
PID 1596 wrote to memory of 712	1596	msedge.exe	95
PID 1596 wrote to memory of 712	1596	msedge.exe	95
PID 1596 wrote to memory of 1220	1596	msedge.exe	101
PID 1596 wrote to memory of 4100	1596	msedge.exe	102
PID 1596 wrote to memory of 1220	1596	msedge.exe	101
PID 1596 wrote to memory of 4100	1596	msedge.exe	102
PID 1596 wrote to memory of 2256	1596	msedge.exe	106
PID 1596 wrote to memory of 868	1596	msedge.exe	113
PID 1596 wrote to memory of 868	1596	msedge.exe	113
PID 1596 wrote to memory of 868	1596	msedge.exe	113
PID 1596 wrote to memory of 692	1596	msedge.exe	114
PID 1596 wrote to memory of 692	1596	msedge.exe	114
PID 1596 wrote to memory of 692	1596	msedge.exe	114
PID 1596 wrote to memory of 4516	1596	msedge.exe	115
PID 1596 wrote to memory of 4516	1596	msedge.exe	115
PID 1596 wrote to memory of 4516	1596	msedge.exe	115
PID 1596 wrote to memory of 4992	1596	msedge.exe	116
PID 1596 wrote to memory of 4992	1596	msedge.exe	116
PID 1596 wrote to memory of 4992	1596	msedge.exe	116
PID 1596 wrote to memory of 4360	1596	msedge.exe	118
PID 1596 wrote to memory of 2256	1596	msedge.exe	119
PID 1596 wrote to memory of 2940	1596	msedge.exe	120
PID 1596 wrote to memory of 212	1596	msedge.exe	128
PID 1596 wrote to memory of 212	1596	msedge.exe	128
PID 1596 wrote to memory of 212	1596	msedge.exe	128
PID 1596 wrote to memory of 4776	1596	msedge.exe	133
PID 1596 wrote to memory of 4776	1596	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.pioneerhvac.ca/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffd5092c188,0x7ffd5092c194,0x7ffd5092c1a0
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,7275311902578816375,18372084839472229120,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7919744571210333514,16762914542229526568,262144 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3356566869798789018,2650680754784110797,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,5353919569462437264,15447648679460508013,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,641496989660719577,5294711395074632047,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6361912772735152233,16771295598167424211,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,11679831724022795500,9116823805788399773,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,4070834980760381188,2133569892940502442,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,16070046993398141533,1781759065489579610,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10296486187722764586,17319963732079088404,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10296486187722764586,17319963732079088404,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,13103658444603172080,6264737657104375732,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5912,i,18133020923189031286,17408895600090541262,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3456,i,6253757959719848622,13210905209663448126,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3640,i,16145861484686367351,13390398246449757541,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=568,i,9625491906007257880,10075921769150255919,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,10913096709789636661,7520303842097774192,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,11561267501097598101,14860142947052493330,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6272,i,10242899746367575111,2763828229197993291,2097152 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12012348795166483151,17648811887930920981,524288 --field-trial-handle=2156,i,11809531286174590616,15211006669649194524,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a3d6f04-1d6d-46b2-ac6c-7a093dd37ae0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a3d6f04-1d6d-46b2-ac6c-7a093dd37ae0.tmp
Size 8KB
SHA256 4a3a09588d13686c61654edde4dbd42db1dbf55a85d252a70afc7747438c6f5d
MD5 236570e049a39f3e6c5d059d6456d202
SHA1 fe4cf5f0c0c85ce3ce5686dcac7cc12ca0755f72
SHA512 8f051f4e3b785feadd4937a996f99bc6d5c52fc2e1ecefafa67526ff7de616984e0a5e29082607026fc329b9fe9e2127d12764abeb75d568013a47c8fb864efb
SSDEEP 96:KqONkvQsjpfbUmjH5ih/cIPURHl8h4otop5ZaDSBKP4v+Y1xf//ojdpxBY6ywMdJ:BOND6JUm0QmiUySyso//gyweBCpJ4U6
TLSH
T13B02C735BC68B8BB8EE3AE85B4877B239FA4107BA6911F44DAD82F1D01D755C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7acf98b1-41eb-40ad-aa5d-32c17df43d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7acf98b1-41eb-40ad-aa5d-32c17df43d5f.tmp
Size 18KB
SHA256 6573c9c5277aac10dfb8a442aca8d93e2c62c07c5c65f16105730328cfac86c3
MD5 2500047eca3a8e5fd610290efa2b191d
SHA1 05ee518804fc8211921ee07e84ef34aecbeb9ba8
SHA512 f471e8e652bbef3d0abf8fc0ca35c511908ff24ceb370abb3528ceebd71125eff682aefc236f0b1198b431fbb0717bf36455d8137f8bfc1b86e4e39614153e58
SSDEEP 384:YZcIhsNyiMEeb0SEh//kXxYorp78tgOIwZOyWoZoC:mhuWI/cjp4Xs+ZZ
TLSH
T16F827D32ACB86C7B1DEBA185F18776035F784477A6C45F80C9EDAB1D05DA5A8030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98316242-c2e6-4737-a299-75150cd7885d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98316242-c2e6-4737-a299-75150cd7885d.tmp
Size 18KB
SHA256 309293208e59e81cce6415f27aae2cffaca6963fa3d4ece4d0f9df8cb6ea4750
MD5 4ff6f831bffe6da0b049cfc9f95d3f98
SHA1 537980c1ac56b75a98fbf502e936bf25ee805b20
SHA512 d897836314317643bb7558672462a2cf08b1ad210eb966607017cdcc87be5b7c6f15ac6f8015a53dd10f911f8c45e0a5fbec585dd77afc686304471a3f7f2fd1
SSDEEP 384:tZcIhsNy9MEeb0kEh//kXxYorp78tgOIwZOyWoZoC:1h9AI/cjp4Xs+ZZ
TLSH
T19A828D31ACB86C7B1DEBA185F18776035F788477A6C45F80C9EDAB1D05EA5A8030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

480f00a0-4df5-4578-bb0c-cf4953231ac0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\480f00a0-4df5-4578-bb0c-cf4953231ac0.tmp
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

6c414864-45be-480c-9e40-6114feed81a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c414864-45be-480c-9e40-6114feed81a7.tmp
Size 27KB
SHA256 a5ce820631e160be0ea8dd6132c51f6b4b1f2409d2fc5d7988852ed29c20eccc
MD5 b777e967e58752af4c0ca00dbc97fee7
SHA1 7a760ee74b315569776136461658a2653c465e57
SHA512 1c167e7fe2b99065d0647eac8e8110525194b0aa6c4454914492785df7d00c64e027439ac94009d89c9bebf3c22749b74423d5edbd2e5be35b557443e6fcad93
SSDEEP 768:THKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Mrooh:THKlm7QWvUYe0u1ja8/L/E/Xoh
TLSH
T1D0C2FA3B640CCB7E4FC05A9DDC5A6F972EA802C7A6588D4047FA994C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fee2732-e2be-4e98-b7c3-47add3853cf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fee2732-e2be-4e98-b7c3-47add3853cf0.tmp
Size 9KB
SHA256 02512bedc8893b84e9bc1304b7179da9bb2abcf127e59bf7e6439b7162bf19e3
MD5 83a2e7c526407d6ccf51cc73a0c74bb0
SHA1 37e4962cd09ee8d27759bd2fd44fd4b5846b33b8
SHA512 303350a938cb86c1f7caaa8b1f0e9144ae58af9d1393ed2ac7d8b3baf603f8b301ed71a6c251ad46c084a75169da24924104aee032c50221cc528a096b2913ec
SSDEEP 192:sxZMRrWK/ffsHbIdpWC1HW6+WNGY36aHpIg5fJ:sxZMgK/ffsHEWeHbGXIz
TLSH
T1F222C751AE38797B4CCBD20ABA15BF53D6F9503251D41E58AAFC861C09F6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ae7b8fc91b78cb1bdc644af4acdc239edc3d594324820e0aef33b2f95a446b7a
MD5 14fcd7ee44125c6f515d3dd939d4556c
SHA1 66ca6abd3326b4160ed05f6d398f168dbf7247ab
SHA512 39a68ea9b72b88049703dcaac4f14ac53eab9dc52cae14bbae6be4ed7082b8fc119dda88655b59ac83bfce6c29d903d3a5bc5a565d961d9646838ee7e15cdb99
TLSH
T13B517070DE6080A8FF9841BA94D00DBB363677A024739F3B1EBCCAF848363D949C8042
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 57a86e1274caddc5497b8119277323fb46c704a80880d23351b12a3661d1a50c
MD5 12ac3632e5518a46fd613ed68d247e5a
SHA1 e409fa1405bc5190a3e844925764aedfe612c7c6
SHA512 fabcf775a7dc69b3104730edab5b245f49baf9fe76ac62b29e7b8aa8f8b34f2993ada2a47d5fc61361d3919ed6f0129f0f1d0336a907557340eb4ea3da9e214c
TLSH
T111516F70DE6080A8FF8841BA99D00DBB363677A024739F3B1DBCCAF848367D949C8042
MD5 SHA1 SHA512 TLSH

Submit Download

6b9f85d8-f4b5-4bd4-a28e-08c52c301d16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6b9f85d8-f4b5-4bd4-a28e-08c52c301d16.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7b3587bc-31c1-4649-858c-20efc521155a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b3587bc-31c1-4649-858c-20efc521155a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ebff6eda-3bb7-4b6e-8e4c-e3c8ed67adf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ebff6eda-3bb7-4b6e-8e4c-e3c8ed67adf2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2b50524bbbcc9b64a0180b09130ceeed89fb3bc4037e7306b361f1bbaec55927
MD5 6e240c78d539b7acc7c32b9709ee02f3
SHA1 e3212a28641c5656cd37fa90fe8a91ff8d9409ad
SHA512 887d6724c2891a0138a64da73eb957a350c9f97e15ebfbeb9bea74d1173072388bb90c90f074ce1c2bfba4d165262518a25dc53abe78468273b0ec24783eadb1
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yLAPGKQ6uvbG9mISivK9+1Evx4/YF2e7:K8Y4KBm++HiKocL/2KQwGicgKZ+F
TLSH
T1F9C11D4130BB024039BE298C9061975E52423173355CF9BAFFBE00A68A6FE541EFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a237070c-d0cc-422c-a2d0-b8ce48f57c1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a237070c-d0cc-422c-a2d0-b8ce48f57c1b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

aa0bce7c-bc53-400c-b6bc-9f1adafe5457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa0bce7c-bc53-400c-b6bc-9f1adafe5457.tmp
Size 10KB
SHA256 982befaaca6e0ffc09533dc340aa2a012c1c20fb362b341404816da3878ae19f
MD5 64ca01ad8a53bdf31d968e739051f37e
SHA1 c8e7f1efa49b759a8c51784f0475b05e898c1d5d
SHA512 fa52eb70a51920023fbc5a75edcc9742509d3e64af631b0be09a87ae0efe31ce35f04fda6dfb7736e16e6217e48d42a44dc2b6a8d5049e0e669f2f853500c3a4
SSDEEP 192:sxZMRrWK/ffsEbIdpWCIHW6+WNGY36aHpIg59J:sxZMgK/ffsEEWzHbGXIl
TLSH
T15E22C751AE28797B8CCBD20ABA15BF53E7F9503251D41E58A6FCCA1C09F6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7e4c45a-e249-4732-a413-957fe615d59e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7e4c45a-e249-4732-a413-957fe615d59e.tmp
Size 9KB
SHA256 0e5d5fcc3518644e13667e7b2d920a25c8958c9f2f39bac435d11e36ec9e9aee
MD5 f05e16444b70f9bff863ff677b97a059
SHA1 152670c06ff0675a37a52a0bf3442053ef1f346d
SHA512 2c82ef7566f816e800341b3dc1a10fcfd662c4b6bf495209c7c278b56ac8d381fe818cb2ae464e2c9b7686f6dea961c5957e6e08e4934187047aabe0cbfea839
SSDEEP 192:sxZMRrWK/ffsAiIdpJHW6+WNGY364HpIgrJ:sxZMgK/ffsALJHbGXi9
TLSH
T17222C6516E28B57B8CCBD20EBA25BF53D6F9503261D41E58AAFCC61C09E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c54d4a-cc6b-4231-a212-1cc551a628bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5c54d4a-cc6b-4231-a212-1cc551a628bb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57021547-5a9e-4872-8a5b-ce0b4715625b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57021547-5a9e-4872-8a5b-ce0b4715625b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ea083b15-e130-45a5-82c0-989eafdcae46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea083b15-e130-45a5-82c0-989eafdcae46.tmp
Size 8KB
SHA256 e89aaffb8aca0da37c5642e3b80bc42f08b90da9489360b7987839032e106681
MD5 98e3282903bb9acc3f06056e5695fa5e
SHA1 6c033ca194f15dd300c48456743aa04f3ee0b385
SHA512 b965b70056e1f35f545d68f584cc4539f467739ea8405cf9459cc58bde2885f6245f3f2935f856c670dd98af67abb8dfd66be196843d32bb33edbdd79b766493
SSDEEP 192:BON76JUWQmiUybyEo//gywXFnPwoLNxpNqo8U6:BON76+yhEo//kXxYonp78U6
TLSH
T1D8121835B868BC7B5DE3A595F08376139E644167EB892F80DADC2F1C02EB1AC5307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

500e48b8-535d-4435-b477-761ba151263e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\500e48b8-535d-4435-b477-761ba151263e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e7eb95376aeb7a149fbf0e387207cba322b91d68948299c984be22f55ddacd5
MD5 8ef1f98b2db341e51e5c7e3e40ece2f5
SHA1 05ea82c770681152926d4949ffd558ca40e9251c
SHA512 8fc25ee26f371abd2943e55ff34c758ae96ac6f72a7dfa5ea28b7ffbba7fea9bfe1a645169c5a0d4d40721000b25f5f6de084675e1b743c476c012e18cbaa28a
TLSH
T19C412858AAEA1148B3B36F5AABF7A86D847F78771F07D45D10110E4F0A63B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads