7c8a923b29020037f8b642f8aaad2560e0e096ba39270f35c859fd9836df5357

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/AMAZONPS.svg
Size 2KB
Sample260608-zvsd2aez8x
SHA256 7c8a923b29020037f8b642f8aaad2560e0e096ba39270f35c859fd9836df5357
MD5 15adf99ebc408662672e9f23d58fe5f4
SHA1 42066d8f2337cd561d2fd6d9199a3b0d796b8680
SHA512 e1252c5aa76131584413eb655ee4f91ee2a3f59ef93d5a89398fd54c77c8fc93ea24185258bb54f3abf1c73ee42e6918665fc61a5f0874a5816d8e3efd3f2aaa
TLSH
T1635185CD8FF48DCC02C847C7BF14A0996D97B8BA19555D1AF15C6F0310E286CEDA6782
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1914172015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_139946364\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1914172015\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_378707649\_locales\hr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31258525"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "918012018"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254261688224253"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{07745C34-0213-47FF-B984-01B973EC5701}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4900	1912	iexplore.exe	80
PID 4900 wrote to memory of 3380	4900	msedge.exe	81
PID 4900 wrote to memory of 5900	4900	msedge.exe	83
PID 4900 wrote to memory of 2408	4900	msedge.exe	82
PID 4900 wrote to memory of 5900	4900	msedge.exe	83
PID 4900 wrote to memory of 5900	4900	msedge.exe	83
PID 4900 wrote to memory of 5252	4900	msedge.exe	84
PID 4900 wrote to memory of 5252	4900	msedge.exe	84
PID 4900 wrote to memory of 2860	4900	msedge.exe	86
PID 4900 wrote to memory of 2860	4900	msedge.exe	86
PID 4900 wrote to memory of 2860	4900	msedge.exe	86
PID 4900 wrote to memory of 3780	4900	msedge.exe	87
PID 4900 wrote to memory of 3780	4900	msedge.exe	87
PID 4900 wrote to memory of 3780	4900	msedge.exe	87
PID 4900 wrote to memory of 1044	4900	msedge.exe	89
PID 4900 wrote to memory of 1432	4900	msedge.exe	90
PID 4900 wrote to memory of 1044	4900	msedge.exe	89
PID 4900 wrote to memory of 1432	4900	msedge.exe	90
PID 4900 wrote to memory of 3972	4900	msedge.exe	92
PID 4900 wrote to memory of 2648	4900	msedge.exe	93
PID 3972 wrote to memory of 1992	3972	msedge.exe	94
PID 4900 wrote to memory of 1636	4900	msedge.exe	97
PID 4900 wrote to memory of 3892	4900	msedge.exe	98
PID 4900 wrote to memory of 3132	4900	msedge.exe	99
PID 4900 wrote to memory of 2236	4900	msedge.exe	100
PID 4900 wrote to memory of 2236	4900	msedge.exe	100
PID 4900 wrote to memory of 688	4900	msedge.exe	101
PID 4900 wrote to memory of 688	4900	msedge.exe	101
PID 4900 wrote to memory of 5660	4900	msedge.exe	102
PID 4900 wrote to memory of 5660	4900	msedge.exe	102
PID 4900 wrote to memory of 4628	4900	msedge.exe	105
PID 4900 wrote to memory of 4628	4900	msedge.exe	105
PID 4900 wrote to memory of 440	4900	msedge.exe	106
PID 4900 wrote to memory of 440	4900	msedge.exe	106
PID 4900 wrote to memory of 5768	4900	msedge.exe	107
PID 4900 wrote to memory of 3016	4900	msedge.exe	108
PID 4900 wrote to memory of 3016	4900	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assets\AMAZONPS.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/assets/AMAZONPS.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff9d196c188,0x7ff9d196c194,0x7ff9d196c1a0
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16624742898765740893,3795890563547780034,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13728082228417248379,7735340058190976172,262144 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,8121465126439222639,8677507552753318716,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3770428864238811337,6121843948600083985,2097152 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,3822476060759464136,12082429896148463343,2097152 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8073188287049582731,11827883405228953532,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,4369255449403594852,11435360172391627483,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6024763987829371433,15121666476020170266,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10821652259596447259,14983170995790319157,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6024763987829371433,15121666476020170266,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14126140188321459224,13784395650488023500,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8464971634251275377,3592385153009703829,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1219228799597145115,16647956069738324190,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,15990461642018922801,10487906071344536890,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,14657550681051523464,7989040774358440248,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,459558694908520765,17732923243887805916,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,6854410396426326048,6085725801889330724,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17705033687503105199,6764853562043613900,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,17043164771869707339,18255490252757679989,262144 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,16853427025665650643,3347412905886714384,524288 --field-trial-handle=2156,i,16906472525635480296,3484487449475855638,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 78e858afe3c1390624258fece6a0ba3f88c7d4562ae181ad8198fd0b7d1da906
MD5 0ee03012854dbab3629f8d7202f275c1
SHA1 2116be8fdf61a4a0306158ffd52005e0aa1f6572
SHA512 afc9015a1f23e3679e062175bc1ff094b36fe023a8c7922edfa24fe6f3f75dd95cef902a2166e610d6884399d37f27ae7efe90ca7403f4b4dcb70db84cbd6fd1
TLSH
T1C9F0A9BAC931AC2718FD0B1E70A95B4AF79113572780945F3B3D560C8FB563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4d064a52e8d7502ea6b077c4bd8367de5c18b716cfb9f2463bd5c2fcc203f980
MD5 447968d317d2050a86ae72cb7e2fbac6
SHA1 99e99bf6200bd47912bbef37264d916fac3fa78d
SHA512 f47b4e10c3f42b1da7e7071d8eaf0c645bd8ad4cf21d16d5b9fb3d93a9e127f1a207c6cc026ec48fb3c2c07d2ba345d5a529fe80c98589913644fad93906c184
TLSH
T11E419CF3C2E8856DC94156F0BA18BE2BCE2E0914532C3D5A89E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 60aa29492e45d4a9f8f4e41e9f26616b618934f849bf051bbf391065fe322934
MD5 c1bd7eb7a196c66442678c68002893dd
SHA1 9bbf832a92219314aa5862e673ab7fcd598d9abd
SHA512 2abd1a690a8c2bade6fda87d8308f4b9bbfeba28389479c8da2d613d23c436e0ed2c2d5d9721d5766cc9f956037a69fab4573f881cf17d508d4e1889b00d2f69
SSDEEP 192:sxZPFRoyMqZjK1Ml8Mcg/fKs8f4rjxE0CXUyynDzzodpEe/W6+WNGY0dgHc4Igjj:sxZ9N0g/fKs8f4rj60Ly8oT/bG58pjj
TLSH
T1FC62F916AA385977CCDBD31AF6457F53D3F9152392504E48A9FC8E0C04EAAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2c784f5de1efb851fe21890a0621608b4dbecf0702e483736f41eacef3318c9e
MD5 b503cc9d8c424ee05bc624ae6d9e3d49
SHA1 168eb381148c94d3404c37237eb265428f303925
SHA512 473ebd2f96c6771f59bafdd5942495b95df8c152a3fc655969145e0686adb73e70159959ab512b2feb77488d9539913dec07e9276cdc2ac1f70403e387007c6d
SSDEEP 192:sxZPFRoyMqZjK1Ml8UQucg/fKsc4rZE0CXUyynDzzodpEe/W6+WNGY0dKHc4Ig59:sxZ9NqNg/fKsc4ri0Ly8oT/bG5Gp2O
TLSH
T1DA72F916AA385977CCDBD21AF6457F53D7F9152392500E44AAFC8F0C04EAAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ea14935845a97f0176ce9d13ad9d5b082d84b88c9545314989b48df9d994d5ed
MD5 08f3f2168850ecfa3a75093d5fc1f824
SHA1 2e9ed3d87bacafe2aaa0651149e7d26735b33419
SHA512 36cb8c3976d3dbeffac887a3353d1fed990f5462d551c235358f4627dea147b42123f8bf3110668903df0ef428925bcba526525bda2ef735ebc994149c9c9baf
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3m3pQLlU:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKm3pn
TLSH
T1C0031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d66c6edd536e42205fd66043fb5bc3b50b4f8629059c236875b161d3e1b899c2
MD5 127531bd305412260018a41a56f4d654
SHA1 97fe448329680449d4151e56b1efec9299035a91
SHA512 216d313ea80b47497c509503a08701179394787fab4f32136f73334649f67a34a29f366574ea54f56aa86936f43c9f342405e03710c6f8a624ed674a00d95a75
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72zC:AFBHhTofhno2mB21q3Llbfe3sLDdeEpN
TLSH
T1BCB28056717B12123C3E290CA7A59B370E8272A33458A96F7BB804B64E67E115DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.106.0\edge_checkout_page_validator.js
Size 1009KB
SHA256 a4dfd6a3adecc01debbd3ece3d700d10b5802cc1c7b54c7e08b04d4ad62e4cf9
MD5 afc838115db31a9856dfa9b4c7c7c5fa
SHA1 9d4383ee8600346afca5c9fde4dd7b7779f59b0a
SHA512 6ee89e0f22f9aff074598b35b44f23b252ffe9eb6ef306e74ad0669cb6ca2bfd97492c4dae4a8b48d6860f42480d77b5cff1513f9b4ad36fc8e2edaf36b824a1
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9OUfq
TLSH
T18E252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cf1f4c466beb5c8799b970963c20db46c1fee306b179f8d7a3d9c614a4fd838a
MD5 7c96cae905259c8b91609e9a54cfb150
SHA1 689e5c56d6f7cae0f0d277ca68d023bd0c43200e
SHA512 f2e072b202e90f41c8b17a6dd016af19f8a4edd1e35078f223442495e58d86fcddde2b57a072be6e24e6f8577948c1161e74b44713c37dabc677a636d16c6014
SSDEEP 384:nAiFetNn/s3n9SwK38NR8TUNTUlIReyApDxUjGfb7oodhLCixdtwu/ejR+V0DJH6:bFej+9g3CwgsDxno6dtwbjE2TvU
TLSH
T1FDD25C36E854DEB7EDEB4E96B74A37479EF000A389885ED8D5C85D5C00CB29D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5cc2f9a9743afd4d65493773bbef3a476ed829065919f8839b2237f72db94150
MD5 290eeeb53ea6487b9a6fe8b90f544b72
SHA1 581cc1c6a763a47cc5c9b5eebb48cfb98309ce4d
SHA512 0c91caca10a358bc72d36fd01a282b632b28d78ac50e6296a5680043a1cd77743045a7d7cf5fc92a83aaab17011a67971ac591dcf12e532e2c9d98b531c303a7
SSDEEP 384:n5HiF9CcmyWCs38N28TUNTUlIxBydv1oWajGfb7oodhL41hkP+lFYS/VNHy/7IgS:cFccps3Vwgs5xo/1hkoFYS/P
TLSH
T1BCB25B36ECA8DAB7FCE64F99E74E7A07DEE00163859859D4DAC80D5D00DB19D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 19c89305c310051a2d61db18f3ef7b348976385caad91a7a6a6e42f447cc49bb
MD5 8b4ee8673c3ddb69fa98e8d2f0338f56
SHA1 482ff86bae5d81be26edbb035a487e2659c1c722
SHA512 64eca90f9961a69d81994274f20a59c9de483a8af124b819a67583a24f4f5c8750ebd8563d5a9c495fc83612a1b2bfa395c41450f84746ebe7389e5030ade4e3
SSDEEP 384:n5XiFetNn/s3n9SP38NR8TUNTUlIReyApDxUjGfb7oodhLCildtwu/ejR+V0DJH6:YFej+9+3CwgsDxnoAdtwbjE2TvU
TLSH
T116D25C36E854DEB7EDEB4E86B74A37479EF000A389885ED8D5D85D5C00CB29E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0d59be3cd540db9c34d70a5df807afa26efa9203da2c31d4e6dd61e802f0afa3
MD5 89671c3b351dc2837cbccb8e9b556ed3
SHA1 a0691b0af0b8d08c32188741d22524a9a3c75b9e
SHA512 0bb150660cf0b93d7715edfcfc085ab08e184361ffdc7f87d3181274c1cdbaca031de7a6395d02331e94bbeeb3adf3677047558deea065f20aa84e1e1c4d02f2
SSDEEP 384:n5XiF1tNn/s3n9SO38NR8TUNTUlIRKyKpDxUjGfb7oodhLCiLdtwu/ejR+V0DJH6:YF1j+9D3Cwg+DxnoYdtwbjE2TvU
TLSH
T15AD25C36E864DEB7FDEB4E96B74A37479EE000A389885ED8D5C85D5C00CB29D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d5f6b761db2dbccd4b0ff8e1218faedda7c35179c945da0337d1977e9eafc54a
MD5 0cfca89a6996170ed48d1d217ce87952
SHA1 506ca1e6ac47efcb9a9a81cfe018a113d6771309
SHA512 14b5ac8ace4bc9d2ce0843a8b6d51dd8857d8b6af16a3a59c307b207e3e02914d2b81565ed3b0220a60c59ace60ff73e93ed64631e9848b412e8c99a07bfc67f
SSDEEP 384:nPiFetNn/s3n9SP38NR8TUNTUlIReyApDxUjGfb7oodhLCildtwu/ejR+V0DJHyT:aFej+9+3CwgsDxnoAdtwbjE2TvU
TLSH
T1D2D25C36E854DEB7EDEB4E86B74A77479EF000A389885ED8D5D85D5C00CB29E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.6.1\typosquatting_list.pb
Size 555KB
SHA256 b95639cf9dc46683acccb9ead8440ae9d6a852a37407cc7cd9c0b309acf7af1a
MD5 fa2f059815f3357487cf7fc8f93e5252
SHA1 d7affd654c8571ba0177750adb5f63ab3443496e
SHA512 729e3443b5da00521d52c60acdc9056b11229d8ce69d47e2a1e1c12cb1784dac58c51f49e5f3423a687aecdcf5ed79697e855a353d5c253756857b7ad186d136
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDh:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhfk
TLSH
T1F3C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9068f36ee67c17cf2c50653d615f6b47f9ae168a0cb751749cb97a27192d9cd9
MD5 ea7368d8e33fbabce593cbe10059660c
SHA1 f07382eae89cf1cd2524c28dd447100003261406
SHA512 5fdc24d00b5d1f9092b5add73dab0e94d514b911d3559ba63296bda8d7d4730df9d3118b8f2a5a6a62c408c89e17ba0edc5c3c65f07252896cd4f56d602cc38f
TLSH
T1AA4130E15D3C1AC1D4BD0E6EA48B38FC92ECD725F5A075396854EA98097965D708083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9a7f63ffd4c00628962bc2ad42bebb5c359946a24793b9b71e050c1a227572ab
MD5 00ac045131d2f47b566fe5f4abfb9e6b
SHA1 ce66754b980db5fb5cfadcfa266bf65cafaa7e08
SHA512 bf77774ebf7dc8364326827cf2d03cba0cceb7836bb9f301aaf4f121d3908007b76dd011e2059817c0bb1a73c090f15e0e72560cbed86b7e7e1c0fb70f774c7a
TLSH
T1EF4141E15D3C2AC1D5BE1E7EA48738FC92ECCB29F49075396814EAD80A7975D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 66238e38541cd10112d7cc54621b52c8f44045c250589e05441d16f179e9569f
MD5 f5a9d1bd1c2d4d878653b04a87905b42
SHA1 55b3ed646960e3a8ded5ad40aa0d615f9d56e503
SHA512 d04ffdd8a2e990d97e3beadb1008d748c53cee165964e3e6acaf41c01c99934e0549c4af1e69c79e65148b26e798d5346be0f181146d44204ae8c85bc3a06705
TLSH
T149413EE14D3C2AC1D4BD0E6FB48B38FC92E8C719F4947539AC58EA980A3965D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_139946364\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_139946364\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1914172015\manifest.json
Size 117B
SHA256 0f38d58679ba75ccf1b80144c998549e09e08e8fce7e1c6ecf35142ef004131f
MD5 5836d59405b134944c3f2b02fb148539
SHA1 c577f1816960edd81a8fb469bc1ceb4e05bd0c55
SHA512 cb8c568105000d84c46aaadb4ab34c5a3747c9e588707dd4f3a5dc24ee3458983aec3e1ffca1a108ae47408daa6c96a0625dcc6e4a6970c8114f62eed82f20cf
TLSH
T1B3B092B00C0AA03B22849320EDA06A8283F80218E8021B1E088036481F8917880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_604836838\manifest.json
Size 146B
SHA256 111f63d9ee7042599d375bc997c0283a18fb0324f61b38c1bf00e193a62260d6
MD5 c74281305ace78892111149b1b11a6e2
SHA1 5c753fadde54afdd9a6eb6e8d33497b037d7ac21
SHA512 d74a5ea1aa973adcd634734ad5d9d671b5fd22a5999f6103e032987bcfc8a53c6a05ea9bdb7ffeebe9c0ed11dd47ee08fb61ef21dca46a299698b284131c5982
TLSH
T10DC09B73C931AC71557507D449F59745EB74578BF511B0563730018D0B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download