d2dd6064cc8bb9aa425a52bf883d1f1ef5e57a4033ea355ca89767acf53afb30

Analysis

max time kernel
148s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/branding/bevy_logo_light_dark_and_dimmed.svg
Size 17KB
Sample260528-b79bbaez6w
SHA256 d2dd6064cc8bb9aa425a52bf883d1f1ef5e57a4033ea355ca89767acf53afb30
MD5 ae96940b58c65e347d4c258a85f5559f
SHA1 630b97a521e3c6343b77e4b5af3d473f3cd0bedb
SHA512 b1df545f6a995fff2f1e64977ae4b71d6040ccddbfdcc681311943859645434fbf7af8f6cc631317f45fcbdaba81f40a91c03d51003d538a86cac1955c1e5556
SSDEEP 384:xVmJ+6ZGFPVLCbqUH436C+kUI5J1DuJhhslotchdaILcVHda2Lc93h:xB9a4KC+kd5JahhsloChEIAdE2AJh
TLSH
T17482C601D3E504F862BA41B1E89A7D0DE51818D32A161C97BA0E5E31DFF34E77367749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_2030014371\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\edge_tracking_page_validator.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_2030014371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_124857854\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_124857854\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256229"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "722366344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244067029454845"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{50D92244-EBC0-4F15-ADC1-B876C2B8AFFC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5096	3660	iexplore.exe	79
PID 5096 wrote to memory of 5468	5096	msedge.exe	80
PID 5096 wrote to memory of 4208	5096	msedge.exe	81
PID 5096 wrote to memory of 3708	5096	msedge.exe	82
PID 5096 wrote to memory of 3708	5096	msedge.exe	82
PID 5096 wrote to memory of 3708	5096	msedge.exe	82
PID 5096 wrote to memory of 4456	5096	msedge.exe	83
PID 5096 wrote to memory of 4456	5096	msedge.exe	83
PID 5096 wrote to memory of 3076	5096	msedge.exe	85
PID 5096 wrote to memory of 3076	5096	msedge.exe	85
PID 5096 wrote to memory of 3076	5096	msedge.exe	85
PID 5096 wrote to memory of 3556	5096	msedge.exe	86
PID 5096 wrote to memory of 3556	5096	msedge.exe	86
PID 5096 wrote to memory of 3556	5096	msedge.exe	86
PID 5096 wrote to memory of 2236	5096	msedge.exe	88
PID 5096 wrote to memory of 2012	5096	msedge.exe	89
PID 5096 wrote to memory of 2236	5096	msedge.exe	88
PID 5096 wrote to memory of 2012	5096	msedge.exe	89
PID 5096 wrote to memory of 6124	5096	msedge.exe	90
PID 5096 wrote to memory of 1868	5096	msedge.exe	92
PID 6124 wrote to memory of 1636	6124	msedge.exe	93
PID 5096 wrote to memory of 6116	5096	msedge.exe	96
PID 5096 wrote to memory of 1384	5096	msedge.exe	97
PID 5096 wrote to memory of 3916	5096	msedge.exe	98
PID 5096 wrote to memory of 924	5096	msedge.exe	99
PID 5096 wrote to memory of 924	5096	msedge.exe	99
PID 5096 wrote to memory of 4944	5096	msedge.exe	102
PID 5096 wrote to memory of 4944	5096	msedge.exe	102
PID 5096 wrote to memory of 2924	5096	msedge.exe	103
PID 5096 wrote to memory of 2924	5096	msedge.exe	103
PID 5096 wrote to memory of 2556	5096	msedge.exe	104
PID 5096 wrote to memory of 3976	5096	msedge.exe	105
PID 5096 wrote to memory of 3976	5096	msedge.exe	105

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assets\branding\bevy_logo_light_dark_and_dimmed.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/assets/branding/bevy_logo_light_dark_and_dimmed.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffe724c188,0x7fffe724c194,0x7fffe724c1a0
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,6144912503816160310,5610447200763793864,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,8794089503956346134,8138523007009169800,262144 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,9716022397031504089,13998916309993264027,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13547167108270807492,16492675684257574947,2097152 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,13987530798551850192,10218086242325686270,2097152 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,10215098420779016987,18065023211740216098,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,4447537377185655155,1244880907796273157,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5431866970015643605,16838432805063759857,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6161866384677851222,17962716855450676351,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6161866384677851222,17962716855450676351,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1658036869573427401,4377655890264921019,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,14695904934801539363,6231169599777395883,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,5801970439337340214,13358342376777515036,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6582662527470440534,8459796777428774636,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6559569238249972561,11674010404139507383,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5911123547298423545,4280374050919772315,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:14
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5888,i,17923660216349378373,3411391247630202108,262144 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6523128922439125107,8043744673606024807,524288 --field-trial-handle=2164,i,11861382756266153154,3796809444297682699,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 11871ed4c1795760b56a0044e3b3b4d82652515204eb9e592e562d6e46287516
MD5 e9b78c5e5aa99fcee3a085d0080a98f0
SHA1 6f5604e59921108e4156b8189b091a7650f43d23
SHA512 bcde022f5a7299453c3f9875d94d29b2bdb3be3dcac567cb6f2933dd94c70ae27f56257aee0e6672990bfc786545e71f79255a2e5a8dbd30a8373a9f702e88c3
TLSH
T19CF0F9B6C821AC3718FD2B1960A45746EB45135B2B41495B3B3C920C8FB063B464586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 561b7a84f22a1c4aefb1e00872e4703f0ca4f00864b89aec8289ad0cb4741ab0
MD5 44920bb4d96abcb20304fd57b96ff44c
SHA1 b9ef6f9b51bb4fa8cbf8c0d86756611a0dd9a039
SHA512 218f388bead45fc26d196525ffb1e5e3158a6ef27874536b6375394bd080314ad4f3586a3b88e793ced2bfab6c515211037f7ed1cf7d65f0a2407957dd7b6f2e
TLSH
T1A641AFF7C3E8856DC90195F0BB187E2BCE2D0954432C3D9A89E4AF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9c8514a13cb5faacb19208abdf7a257e427fe9bf11ab1aa783372d1eed719b69
MD5 568f4ec0fd46b3ada0d30b7f3ea81008
SHA1 0eee221c5236a5020253baa4d3bf07a9d22cc191
SHA512 4ccdf09bfb6508557a1fb3af071c4fb36a1ec4367000848f209437ce7504a15d0e86db52042563669fdf44437568328de3e520f98fa5d0f69fb952b57191859d
SSDEEP 192:sxZKRHyMqZjK1Ml8Mcl/f0s6ZKTG5GN2jw3zodpEC/W6+WNGY0htdaIgj+EJ:sxZKM0l/f0s6ZUei2Ff/bG5Ij+I
TLSH
T18662E8066A24597B8CDBD719FA55BB53D6F9157392904E449AFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 91651686e9299f1d085abc94a21bcdf19919b66a55429dd6d0c0328b2a9d828e
MD5 185f6cc0317dc36eef1aebba6c22f38f
SHA1 82ddceef50ed0fc4739ed4f3b0734a814a185047
SHA512 a14db8deed0567fd914dc569311cd949beb241e275a0a8c25ddd2857193f05bf597907875f1a735c1ba7fe666c75814bbbd8288d01f6d2c039369b4dbe45b322
SSDEEP 192:sxZKRHyMqZjK1Ml8UQScl/f0sJpKTG5GN2jw3zodpEC/W6+WNGY0h+daIg5bTRTK:sxZKMqhl/f0sJpUei2Ff/bG5pHTK
TLSH
T1E872F7066A24597B8CDBD619FA51BB53D7F9157392904E449AFCCB0C05E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 0b7601dcdeb69077f8578c7ae20e433d4a39689779e9df1a8caaf2100fd85d30
MD5 6e28bccb199d1d999e27fd06aa77e515
SHA1 36ba75e6ccb715f8e065897fdee241aecc349641
SHA512 488903ca79069a6d662f94109fd8a15e58835867568626e80e30f990b644804313a503e06140cd98958817c98e1fb0c3538a43446c3e35cfddfd10c9ee4dd8c9
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5/:GZLVDJjEDPV0/ZdsLI
TLSH
T12CA2590232BA02423C7D390C93979B674A42F1633069AD7F7BA940B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9bd76e9-8350-46b8-b2e0-231a21b33964.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9bd76e9-8350-46b8-b2e0-231a21b33964.tmp
Size 36KB
SHA256 5dec1c57180a86e5fc2cee35fe9ba8e04743dc196545199c193c99c0629464eb
MD5 eb7b07e93bca5c3d7f7a2ee41dd10259
SHA1 25451f896e6cd59d1b3b33c0c1c79b272ee62b9d
SHA512 7643c6152829b66dfe389d1c5849cee128895264cd0cb36fb36bff10e34d8bcac0f185da02a081a0b6f26c9765eb232205976ae0d1bec433b5bb6fcc890962f4
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zzx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKzzxL
TLSH
T1FF03FA3B680CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 de8795757770aa86bccbfcaa10f7b1f3336062d33553552ead6ae9708be92bd1
MD5 b6371018199b7b73bc638a7d9fe966d8
SHA1 b861394a2dc71f0b4b4a50e5d73c4350e876c627
SHA512 125f548403f9f5beefff0f1ab519bc770fdeab1354c07c4986f121b59683a14c0981f0caa4995ddbfcb024cd0db64a07344ce529b9112a0862bb5c2b54087039
SSDEEP 768:zF3jZbb33wgGKekmD4GyRLeIdBST+R2ha:X/3wkEaBSJa
TLSH
T14BE2A3F198E78977D8AE4B97633D2E42AAFCC16374485994F7C80D0DCC861BFD606816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 348c652660ab3cd486df8bf6b4116112c4414fdff53409980b4af10a794a3bd1
MD5 d57238c295f0e687061d5c0e5493ae15
SHA1 4bd6d6a106b9bd89297d632b7743845e71b3713a
SHA512 f8cf13cc8656013ff75c8464c3e489e8f7c8102a9cd116fd750dec655f180d43b235a4272b235ffdc3e2e07d64629f34ff2771e73242b1a59e96765917a0ab2b
SSDEEP 768:oF3jZbE33wgGKekm54GyRLeFdBST+R2ha:8g3wkWLBSJa
TLSH
T1F6D24B31E864CABBEDEB4E99B34E7752EFE4016388885DD4E6D85E0D00D719D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 524fef2c5722f89de4b5793ea379deb0b9ed290f743ac5c62b5faf650ab6787c
MD5 5203de7e9455df35b5267c50c0094d9e
SHA1 06886ed8b9b5eec97bcf83a63c13b732b28aafa8
SHA512 1d9eb8111d905e242673d62b75848006d591b0e05656d581c95e1f571f317da4155ea2b4e8b582bf0311c1761bc35f6e843ed28f9113dad08c7164458489bfe9
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BPQPs4Jfb8GgFRLCaGBy1Ue4KV8P:VFccps39wgPKekmnkwGyRLeQWI8p0yt
TLSH
T1CDB26C31EC68CABBECEA4F99B70E7A02DEE05123859C59E4DADC5D0D109719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b9dc5ce1db0d8188f40bd9fe5e3d37e32eea77eac7413c86b95070cb8b0c3e6d
MD5 cd0b7c384ee9600738fcf57c7f6b6cb4
SHA1 91cd9fd54c39cfd25a6331c4ec6980571a3b38c0
SHA512 3b176c0e575a75ea41ba86d4c639aa94639d12a9b5f72447f7062ce763f6368ccd8445dc9f23ebbb4043b8be0ebc214fc94a12204f1e1b1f17264e7dde47b438
SSDEEP 768:9F3jZbE33wgGKekm54GyRLeFdBST+R2ha:Zg3wkWLBSJa
TLSH
T13BD24C31D864CABBEDEB4E99B34E7652EFE4016388885ED4E6D84E0D00D71DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 39c420de685f2dd5b615091c5fe7e27d079106e12bac3a5b73707e3c84597b4f
MD5 342d6c12ef4bf843d9ff2ebc7a016524
SHA1 b817dfbe2650e3eead6653b69922297ae523242d
SHA512 6f6298f8401917877918d808232575399c3318564960181cbedbd7df14f38f0306b3d47b74cf34cb161a548d122285145602c0b0fda71eef28af3c16c1531f7b
SSDEEP 768:9F1jZbc33wglKekmI4GyRLeVdBST+R2ha:zA3RkD7BSJa
TLSH
T18DD25C31A864CABBEDEA4E98B74E7652EFE4016388885DD4E6D85E0D00D71DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fa9cf21794aa1c2eee5a7ec708094f610898cde7a9163b2fa55949fd4d9d7f00
MD5 3a7c4c8f1599718c5abf6c46056bc3a0
SHA1 34da09fa43ecd603deb5dc0b3486c2a263953780
SHA512 532d5f8114eaebc24df6b1848bd683676bd113c1125e11c87a43695b4849216ec839f49d0a0b19097ec5ad7341ca1d3e97487ab1de9017b88d8abf5cb4af5374
SSDEEP 768:FF3jZbE33wgGKekm54GyRLeFdBST+R2ha:xg3wkWLBSJa
TLSH
T115D24B31E864CABBEDEB4E99B34E7752EFE4016388885DD4E6D85E0D00D719D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.26.1\typosquatting_list.pb
Size 447KB
SHA256 ad756d39f4fa4a70bee09929f53e29bdacbe552aa1d097309b849ccb92ef7a7c
MD5 c1229bb6439d3426ef7e54fa3911e9f7
SHA1 8623ef46acbf1e0f75a298c098800d1012f347c8
SHA512 d1be2ec8c1137138e38d616ee405172bac5cc61e7beecf6d3da2437adab44d8d702df300d84350020e5e9525220193c6015fc58f41a59fb9a9d4fd094e6730b7
SSDEEP 3072:ZOwNK6ZgDoFVUqY7O3Uw4pQXuDlalIfT1JCuGSrw5mWDecdCs:nNBgDoFuY4ioTCTS05mgdCs
TLSH
T15CA4A3B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b6d23fe3d25c59e64f788ab6fd8a243a0e5d1b3a8e2b500883fd5a935bf2bbd2
MD5 7ac6c28b7a0a56b74b3166cd70e655d3
SHA1 1faa015b3ff765219101add3e81146626b44ac3f
SHA512 c5786e1721e55fba8ebf1c1ae84f59fd0257ac1c2bddcd4ce899cfb14b80675d11b22b5008f6cfd511dab0d7f5cf1336f1d5593ac56cb0301c7e1f52c6c937a1
TLSH
T1FF512EE15C381AD1D0BD0E7FB08B34FC81E8C726F5A4347E6C58EA984A7960D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 321ee1d3ff66e9abac86e63744e790776ac95bd4cec5806d7a7aa3277375be44
MD5 e05f8df2835fa0dc25379228e87b738e
SHA1 6866480e0cda53f954436d7ff86c21a975c7c150
SHA512 c353daad8be45987f64a6e17604e162adb6a5f21f698bb3915897837786fde7436a17263802faef189d51a0aa1306bb2fbd1f6b1657ae672765ea6ce0620fa53
TLSH
T1245142E05C781AC1D0BD0A7FB08B74FC81ECC726F5A4347D6C58EA894A7965D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 53b1dc295e881e6d4b21ed51f0bb821ead2c00374d6a220d4ddece1ccc5f7876
MD5 cf9bb61f16dd00c0a3771032d0841044
SHA1 3f2da860a49c2adaf0785e0faa20e01d9873ee73
SHA512 fd90e682f927357e96c8996e8cefb5cea8152afeca1cf2fd66a24c005a21452aa8d046c1360fd0b212799ed1becb0c8205230d6b6f59e7a80e8bc2e3dae95d48
TLSH
T1D45130E15C781AD1D0BD0A7FB08B34FC81E8C726F594347D2C58EA884A7965D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_124857854\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_124857854\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1264922246\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_2030014371\manifest.json
Size 118B
SHA256 828658147aa137be854d8e5a079884dd0388f2b7c17400952338374ca0b53f4f
MD5 a9e80c400101025da0ff7fa3616810a5
SHA1 bd3f73166085a1d83452e87dba88ae9058842f4e
SHA512 d1e62ad4c3031173bebb6c8059c84d220a1dcbf993bff7db9ea6680cde90639571d9e57b0e1fc1d3b0c9b024a9027d551532ea28d10c14fc06fabe8a721d34f3
TLSH
T128B092B00C0AA47B22849720ECA06A8383F80218F8065B1E088036881F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download