hxxps://www[.]amazon[.]com/Sportiva-Skwama-Climbing-Yellow-Equivalent/dp/B0G3S27DPP?tag=treelinerevie-20&th=1&psc=1

Analysis

user interaction
yes
max time kernel
32s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.amazon.com/Sportiva-Skwama-Climbing-Yellow-Equivalent/dp/B0G3S27DPP?tag=treelinerevie-20&th=1&psc=1
Sample260709-bjxmlscs5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280330724725110"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{5FE17E9E-01EB-4327-9285-2FA4B4AF3A00}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4400	2476	msedge.exe	85
PID 2476 wrote to memory of 2408	2476	msedge.exe	86
PID 2476 wrote to memory of 3708	2476	msedge.exe	87
PID 2476 wrote to memory of 3708	2476	msedge.exe	87
PID 2476 wrote to memory of 3708	2476	msedge.exe	87
PID 2476 wrote to memory of 1052	2476	msedge.exe	88
PID 2476 wrote to memory of 1052	2476	msedge.exe	88
PID 2476 wrote to memory of 5076	2476	msedge.exe	90
PID 2476 wrote to memory of 5076	2476	msedge.exe	90
PID 2476 wrote to memory of 5076	2476	msedge.exe	90
PID 2476 wrote to memory of 1012	2476	msedge.exe	91
PID 2476 wrote to memory of 1012	2476	msedge.exe	91
PID 2476 wrote to memory of 1012	2476	msedge.exe	91
PID 2476 wrote to memory of 3088	2476	msedge.exe	92
PID 2476 wrote to memory of 2488	2476	msedge.exe	93
PID 2476 wrote to memory of 3088	2476	msedge.exe	92
PID 2476 wrote to memory of 3088	2476	msedge.exe	92
PID 2476 wrote to memory of 2488	2476	msedge.exe	93
PID 2476 wrote to memory of 2488	2476	msedge.exe	93
PID 2476 wrote to memory of 4432	2476	msedge.exe	97
PID 2476 wrote to memory of 4440	2476	msedge.exe	98
PID 2476 wrote to memory of 4432	2476	msedge.exe	97
PID 2476 wrote to memory of 4440	2476	msedge.exe	98
PID 2476 wrote to memory of 4248	2476	msedge.exe	99
PID 2476 wrote to memory of 4248	2476	msedge.exe	99
PID 2476 wrote to memory of 4248	2476	msedge.exe	99
PID 2476 wrote to memory of 1840	2476	msedge.exe	102
PID 2476 wrote to memory of 2260	2476	msedge.exe	103
PID 2476 wrote to memory of 2260	2476	msedge.exe	103
PID 2476 wrote to memory of 4840	2476	msedge.exe	112
PID 2476 wrote to memory of 2684	2476	msedge.exe	113
PID 2476 wrote to memory of 4736	2476	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.amazon.com/Sportiva-Skwama-Climbing-Yellow-Equivalent/dp/B0G3S27DPP?tag=treelinerevie-20&th=1&psc=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f4,0x7ffc705dc188,0x7ffc705dc194,0x7ffc705dc1a0
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11485540270995844699,17642136336191931236,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13786373367970402056,1923315392709584019,262144 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,10250201624509538969,3489468061485515321,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,10946434669254414335,1364629459258454326,2097152 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,357962131343515164,6420295092108944211,2097152 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17419248825437112863,9281790076978380106,2097152 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,414047335862359484,15782523874073876640,2097152 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,3584619039567910747,14375690414424700219,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6760514906450671925,16140934289610252701,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5916,i,2876088155518331993,773684516011939955,2097152 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,18373717773968874000,16074619334117845201,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,18373717773968874000,16074619334117845201,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14905612510864743109,5943809287691962106,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,2095080505593283111,10193153060918236296,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,7091885337232666163,10669009755400043211,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,1452299142069546112,6855276900559088936,524288 --field-trial-handle=2328,i,10339174001591215776,11311001801999587407,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f83d598066831c47b4132cf9ed34c0cb36e375c20f5541f76b100ac2df81e60c
MD5 961b6db97842e34a07dccd33721b5a5c
SHA1 fad0bc11d0598827987b2e2b0b334baffe2e0bad
SHA512 fbf6388e37c53ce55a4a2a1bbb26dd98bd7c488dc57dc44cf7df70b30a47a0005968aeca35356d463875e22308811429ca0a2c1d62c4df0dbb3124c0914c4e27
SSDEEP 192:sxZwRxyM/jK1Ml8Ma6/f1s4XnKIdpt2cHW6+WNslC/Yw5Vb4IgrJ:sxZwTC6/f1s43DZHbB/G9
TLSH
T18352E9126B34997BCCDBD209FA55BB53D6F9047292945E44AAFCCA0C04E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 89df7f7239efdedca140c666dc497dfedaabd516c7e3e8dae7885ea8deab61bb
MD5 344c9e23a5440055c62e45ffa3698980
SHA1 c38db4594ebc5f7766b0cdb743f7994b8cd2f933
SHA512 1ac059a327bb135149e7faf6f6e7b5706fdcd970130deaa5ae01dc2561bb75d3fac3a531a237aa01d50c9d1a2a8e00767ef29e10b902f32e67d7379b0a4c3522
SSDEEP 768:Nm4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dCrohSDat:Nm4jeXmWvmKxEu1jacPLZQdZf
TLSH
T1D4E20A3B294CCF7E4F844E5CEC26AE972ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\9516684e-05f0-47ce-bca5-b708603ffa89\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\f7d99af6-4a11-4b74-a949-cfcfffd5b68a\index-dir\temp-index
Size 48B
SHA256 e17980ec23ef3695a4a45e97fb7f9f99be9c888d165a5ea35706a912cce0acf7
MD5 7c73850cc24954f4dfb101915bc0b839
SHA1 9f3b25e1c41238fe94090d5ef1dac1a8b03f0768
SHA512 d8b98ad816cb0df3d8e008a18ce8b860d220d1f19e7073ce3af8d4d10b21f53f3b605831200d756407e831ed3105f2da8d07c080dfc2450c4182b479ab6d9372
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt
Size 726B
SHA256 6e9dc8842ae62453478932462babd3cfa3710cecb1a6b2b05366ecab806d9e30
MD5 6250960d3efb94fa1203f88477a9bac8
SHA1 43f48f9528771230de72f24a47f201a3b48ec6bb
SHA512 a1c3b8dadaac408132001d69e852994e5ae5bdafaa29bac8b0c9ee3bb1c59b52c1b4029f0f9a9732384d1218cc1d913fd2a079f136c2d7b7d9a5c04a83d1f81a
TLSH
T1E301942147D3922CB0FFCFC2DA3029E55462FF1B6C25D44D4D21045F2D79011D11B5B6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt
Size 385B
SHA256 5957c1ea92b7214f8e145231b8aa02cd7cd307f3f21ce9239e60d987ef107015
MD5 b1b7fa304ae85ebd9f17505a2fd3e83d
SHA1 741d80843ac906b4698ba2a6c44eee45d3a99526
SHA512 63db43584a49709a52a8035fa7c1ced8d3d0d95ee353373c706a5822447681863805ca55d6074f2f4e601b2e6a0bee26b31c7bac6de5f980472cca18cb7e530d
TLSH
T10AE0C011CEE3913CB4FE9F83943418CA5432BF596C59C08E8C2124CF2A74012D67E9B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt
Size 498B
SHA256 33766a94d058023cd66a66bb0cef467b4b69a48e947fa1a11e7bf15fcd56eb9c
MD5 3330336b32333e581866353564a5d2d2
SHA1 6e69368959ac117a9790d8729506262ca8652fdd
SHA512 8b6fe675b1dd6b7785d1cc02e4f91649ee6ccd1ff4f1d58d5db54e772b54ef9cbc04800a466b8bb4eb0a8082a697908b8aff343307cb3726469a20de707abe3b
TLSH
T186F05411CFD3912CB4FEDF83A5341AC65422FF566C55C44E8D21508F2A74011E56D575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt
Size 614B
SHA256 e01432eaf15713184b49a3e19795e49f35c2af7dae53609cefd15a8755e61cc4
MD5 8c7a7acc4b9c75378758b15692ea2f9d
SHA1 8d682c193ee22626cd8ba055cac2497e854b43c8
SHA512 8e462231039225c7890fad653e370a6320fbd7a9ddc72b3ea1c2c485fe567cc59b4c63a8637a0f8627bdfdc24ceaa4d63f88f3ff7baecfab2271c2d879816988
TLSH
T12EF0AC118BD39228B0FFDF83A93429D65422FF566C15C44D4D21044F2E78001D12E5B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt
Size 733B
SHA256 9c2f726d961e91f844e4ec0507ec825b450a0446ea5920c5340ca31d165e3f30
MD5 945a80de646da4bcb5d3e6cbcdf41178
SHA1 bbf312870a4120c3e68d8f93f55de5784050f740
SHA512 20a7ecbe987c07cf5a9ac0bb8780e5e1ed3aab72a77f02ab5d745c509e0e859bd68ad7f34c0c18f72582e3a2845057d03e65ef63017528f85cbe95319a6b4935
TLSH
T14101701187E35228B0FFCF82DA3029E55461FF1A6C26D44D4D21155F2E79011D11A5B6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c5db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2a1c18365e83cb6e1347464058faa3d44e45a31c\index.txt~RFe58c5db.TMP
Size 214B
SHA256 ca062f0df78e6acc5c700c0a2fa77c72c35f689cc945e5d603dc0791978d0a3d
MD5 589bbc964c610e9f401d73df278937f8
SHA1 e8facf82b873daaad722935b04b49d313b46547e
SHA512 8acd0c6d7996e0ce78e03b15fdf26db3ef75e9e12745fab2087050a85fe82c94747ac971a51d4eb7cbbee90e9782f283266e7b3d8616b97c040ff9a2beaca4b3
TLSH
T18DD022A24AE1A10C75FA9BC3783511868432BE98AC99C0CD886078CF3E30023D22E9B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6c1afd89202ef8ebc479bee30ce67081fdf0a1243f21c459d240152e2b7a3785
MD5 851bbbc02188943fab5e424bc1e5b54a
SHA1 c6b44dfe8eb179278b2e56b23d61e5672ef28037
SHA512 a671c2228f7989e4cfafd9999ce8e92c818d12ac2f47343ce5c0dd1a133570a40c659df8d0bf0ba7d32b2ce100b8f95f586088d37e5bdb8ca6ec7ef68144346b
TLSH
T1EBA002118ADD125BC654C7747256D590B3A089911181060545A0D39ACC9D240524954E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59143a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59143a.TMP
Size 48B
SHA256 2c1e2dfd6d07226e3351f5842dd69541d26645ea8e8c2dfc6c8fc8d2e6f77c77
MD5 d20175abeadb8c295ae3796bcdc33a59
SHA1 904538df6f8b651ee3ccfde9766d784c82763ec8
SHA512 219e20212eb067e3e9649d6dca682b03ab57591f1deba3862e08858687bee4ef38c88368c6dc5599a61a9bc782b77401bc2be4961bc1cbd4abd9d14aa45e0199
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 c7590e6daa6ec9d6cdb2d46dca44c9ebed889c6b68454e09a8239b50ee0a98d7
MD5 6d39dc5e45ac9c02908a226063f7935a
SHA1 e140ff99a5e0a6677611d2b19dcb0ac087ce8a69
SHA512 8c57c36a48ec43d9908f857b0aaa580998bc75bcb11e42fd8bdeed3a47ff2596b75343ebe9512a2510f495cea374376af3f1e381b69bcd36297095c476d50b1e
TLSH
T10C216C50A1BF021428FDB53CF178A41A828274673926E43A77B901758F27E83AEFC5DD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5fa7ce878086fd0c64078dd3e5a00bd24b1ea53136662139754f3287ccf9d205
MD5 4a15bac5fc95a2a8cae0ecb41664dad9
SHA1 68bdb0bb441cfc5de55ea135ac6219bdf4ea46aa
SHA512 227b3a1f241a99d999bc4802a5387446f11403bed5f406203b31d13715af782babec670f63a56daeb46630cd3a26e858c2e61ff0a7ad49b33ed2d350e84efee9
SSDEEP 384:2tNn/s3n9SfsNbNBE/TYvf+W86nX6gFAOObjI9G6w7Tvd:2j+9UOmUn3X6OA29MTd
TLSH
T1BF929D3268399D338DD295A5F08B36278FF8517B97C53F84E6ECAF0C04CA6AC4312911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b13a9c4fd8b128e2e4756a99b7f591259963672834e5882545db02104209a630
MD5 8d55976536ed55a2a9bf95247236ab2e
SHA1 22c9bd761045c8bcdfb2ea961f76e0299bc5b6a7
SHA512 0fa33e6b8e63f2b0aa255ad28fa1df4dbf643e30b970d6b5a599382cf45fd6bef627884bd5522b02edc1fc59c6c036be0546017f5865ffc26fcfc58d24533d1d
SSDEEP 192:EONz6hZ0QmiUy1lpc/+jV8jzorxoE5wOZ0tU6:EONz6ocpu+W8672MU6
TLSH
T14C02C93568786C778EE2AE45F48727139FE8113BEE956B84D6F81B1C00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d542dea6e918cff79b4285599ac8b6b0e7c11b8ad71979d51a4777f12980c64c
MD5 251019231c97529c1030bf6f5df2c4a5
SHA1 911d5ee300a3e77fa4a39f3d940e7ab9a500960f
SHA512 9b5be1a064965fbba25e95bcb50c984a7759c236eca50c5fbe54a1d04d62743b5a81428eb42d2341dae854c0903c65597463ff1834e99f07016aa9f06fe5c901
SSDEEP 192:KRON+6hZ28QmiUyHltc/+jV8jzorxonX6x5cOqDqrU6:eON+6hEtu+W86nX6U9AU6
TLSH
T14A120A366978BC675DD2A595F48732538EE85127EFC5BF80D6EC1B1C00DF6AC230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 225b2cf118cfaa97f1dc7ef1f5ddb946e5657b61d9939d74d63560eb33d203c6
MD5 3704065f35423a7c4309e295457c45d2
SHA1 3c2e4a121e9e04fcfe888d8a6633caac166cc159
SHA512 11a727a77193246beb06ff03e899ad44784cc9117888a19e06d9837a164fc610e468127ef8d5a83b7787c9bf83f8d9c1c1cdd2d6b9cfbba32d87ec6ab08949a8
TLSH
T11B41D858A6E91158B3B7AF56ABF7946D487F78772F07945E10020E4F0A72A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads