4e10ba83982c485f5cece93596c6814d38ef71b493053e58e28c0bc5337f3b38

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
images/ledger-logo-long-white_4.svg
Size 1KB
Sample260522-pc1btaav5j
SHA256 4e10ba83982c485f5cece93596c6814d38ef71b493053e58e28c0bc5337f3b38
MD5 4ebcf8bb4691701fdb1986584905d3b7
SHA1 40473ce06fdb912cc7024f45e417fed5a61b9cf8
SHA512 16eea70b10eafef812dad06be5ee51b25fdcd22c0338c86ba0cb05df9b078db3dbeda2bf40880aaa6e625c08a76a9079b37f2f229654bc71355a1f661f9251ec
TLSH
T1A241B8D44BB002FDCC58A9FE0B58312C5A6551E5F409459DF7E39E2EAD9845CCC492F2
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_2120307766\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_2120307766\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_985728379\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_985728379\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2098735749"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31255083"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239255922698480"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{CF018D8E-B10F-4989-BFC1-CE7C6F5F1B5F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5184	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 5184	2808	iexplore.exe	80
PID 5184 wrote to memory of 5376	5184	msedge.exe	81
PID 5184 wrote to memory of 4468	5184	msedge.exe	82
PID 5184 wrote to memory of 5132	5184	msedge.exe	83
PID 5184 wrote to memory of 5132	5184	msedge.exe	83
PID 5184 wrote to memory of 5132	5184	msedge.exe	83
PID 5184 wrote to memory of 4272	5184	msedge.exe	84
PID 5184 wrote to memory of 4272	5184	msedge.exe	84
PID 5184 wrote to memory of 1572	5184	msedge.exe	86
PID 5184 wrote to memory of 1572	5184	msedge.exe	86
PID 5184 wrote to memory of 1572	5184	msedge.exe	86
PID 5184 wrote to memory of 5140	5184	msedge.exe	87
PID 5184 wrote to memory of 5140	5184	msedge.exe	87
PID 5184 wrote to memory of 5140	5184	msedge.exe	87
PID 5184 wrote to memory of 1604	5184	msedge.exe	89
PID 5184 wrote to memory of 1604	5184	msedge.exe	89
PID 5184 wrote to memory of 1964	5184	msedge.exe	90
PID 5184 wrote to memory of 1964	5184	msedge.exe	90
PID 5184 wrote to memory of 1676	5184	msedge.exe	92
PID 5184 wrote to memory of 4812	5184	msedge.exe	93
PID 4812 wrote to memory of 1672	4812	msedge.exe	94
PID 5184 wrote to memory of 3932	5184	msedge.exe	97
PID 5184 wrote to memory of 5536	5184	msedge.exe	98
PID 5184 wrote to memory of 1532	5184	msedge.exe	99
PID 5184 wrote to memory of 3724	5184	msedge.exe	100
PID 5184 wrote to memory of 3724	5184	msedge.exe	100
PID 5184 wrote to memory of 5752	5184	msedge.exe	103
PID 5184 wrote to memory of 5752	5184	msedge.exe	103
PID 5184 wrote to memory of 5656	5184	msedge.exe	104
PID 5184 wrote to memory of 2692	5184	msedge.exe	105
PID 5184 wrote to memory of 2692	5184	msedge.exe	105

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\images\ledger-logo-long-white_4.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/images/ledger-logo-long-white_4.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x328,0x7fff8779c188,0x7fff8779c194,0x7fff8779c1a0
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,14730256191255543998,2906884334299677834,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5767061006399638330,4965524275996791991,262144 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,8454744735379270021,4969331276433031231,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,11187100611011958821,12513134422724816215,2097152 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,9975515527982593878,1947289894799446794,2097152 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4901998789311653623,13638981386230300250,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,3127300619467664710,1081339281666777736,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,4113517859539134090,4656383284043423330,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,4113517859539134090,4656383284043423330,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,126503810348208056,17941458158716488378,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,11480528309155272246,7001829372667868761,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5568844584869944643,13895304763737548226,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6432546501791930806,8160827872276202953,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3080,i,6545903734802247153,12650338760415652762,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=904,i,18276246265073300762,5003632605009300479,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,14113622975763026402,17766590313782536763,262144 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,18337582152660988762,7942251391922793062,524288 --field-trial-handle=2296,i,16830985084462002262,14830814794652207552,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bbe8b1a7ff2672f0b7f11ecb0aceb50a37de6cf6c071291f45b5db9ee3dfbbd4
MD5 ab126d320e15997a8f13b777fa08d6c4
SHA1 fa6d2f7c66da7ce9514366464171d74b20f0e440
SHA512 c2961e54adb6c7c6580200327ee8698d7857f7fbd0d45479e7edf9e86f206594ed102050cdb7645e9f4bdd4c9de502baf50784eb15b2104068ae8f608bd388f9
TLSH
T16AF0CDBAC931AC3718FD1B2D70A95B4EE751136B2780885B3B3D560C8FF563B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

775d5611-39c9-477e-a79e-d4b49ef839f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\775d5611-39c9-477e-a79e-d4b49ef839f6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 38ec8cffa925c7823b96b7d1ef91821556e894fba4ebed7e4db2e7fde6641f96
MD5 847f7b2432256311ba47bfb8bd68cce1
SHA1 c9cadd512612eef51d7a761597850b7c054a74cd
SHA512 4ed7896a7ff3d844ba6817f9747fa75a573f094ebf57c9eeb899a2a47a14ec77b45965f85dc04f7fdbbfa0faed25b711d34c572458f72e4644d58a0b3628df87
TLSH
T1CC418EF3C3E4866DC90155F0BA186E2BCE2D0915432C3D5AC5E4AF5B93E2471E14155B
MD5 SHA1 SHA512 TLSH

Submit Download

a3f91f3f-203d-4c05-8015-b0011efc42fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3f91f3f-203d-4c05-8015-b0011efc42fe.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b91a1efdd4e2d231e74f830f76b99ace812314299be62c82e97f4d0b7bb8e90a
MD5 82f2966b1f19c174fc575b14bd658c4e
SHA1 0ac847044c155f16cea91e0d8f723d6d2021da34
SHA512 642f70d68209a8221dfc9964edef45620cde27f7f7758dbeae2a66fa579d9eb269dc9fddffe205f1d711a7439cdf1748523916cd8f894bc93fce1f7f92a5d51d
SSDEEP 192:sxZeR0yMqZjK1Ml8Mcp/fds8BaxE0CXUyynDOzodpE//W6+WNGY0dgWUF97jIgjr:sxZeR0p/fds8Ba60Ly8V+/bG5jIjr
TLSH
T1EE62E816AA38597B8CDBD319FA557F53D7F9113392500E44AAFCCA0C04E6ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6509426488b777a466be4b153d1a623176ef2bc6a8e4d2a9c76a6d26157e52b1
MD5 654a8ab2266ed3930e8f028ff556df9b
SHA1 5c2bfd197028047decdc43e7a37c207b88c023db
SHA512 15e406b18d97bd69a5844991f8ca770954d568e80d559e50bb922545e290082f6f2b0a1e68d18c2bf0be7a3089edfef5ab1ac42b20e9c5a7201f16f1c4fb9ab8
SSDEEP 192:sxZeR0yMqZjK1Ml8UQCcp/fdsYaE0CXUyynDOzodpE//W6+WNGY0d7WUF97jIg5U:sxZeRqxp/fdsYF0Ly8V+/bG5YIlk
TLSH
T14B62F816AA38597B8CDBD219FA55BF53D7F9157292500E44AAFCCB0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 46979f90f7002370d4371842f21c47e96c3d7d8927e3ce175c4b7df854075cf9
MD5 8d4edf160f59629df11659aeb79a62f1
SHA1 840a052a56e7ee13ffc6a108ea426ef738b7bdd4
SHA512 3ab37322688db669c56280ea9202fc66718f9e74ff0fbbcff22ba6f07bae6fa60eba682a90597c9fd2c84436a0f80b5c89fce0e5b8375dfe6ecb63afcb49d5ab
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3J3pQLl8:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKJ3pT
TLSH
T113031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cabfdb04f11ef7faccbc1fb07fa129ef7d6c11e5fc9c49081bf93630be264b20
MD5 b057efcbf4e32425818b8d590d683b88
SHA1 752ed6a1d5282051936f9de94c3280b404603928
SHA512 db33f2c48acf9136f8dbc693a3d7e343d7862f78cb20bef6ef4a464595568c0beebfff8bb4273ddb139ced94df76b440b8cd345ea7bed06e14a5684e7365657e
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7259:AFBHhTofhno2mB21q3Llbfe3sLDdeEpI
TLSH
T16EB27E57717B12023C3E291CA6919B370E4272A33458A97F7BB800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7ff22c870fe2bb67b898f2ed2aea72b38b4c7790e9e53e256e96e9eaa3d7ee86
MD5 f3617ffc2ba99699d4a7a63a4a2a99a8
SHA1 379ec8a03f72d66a515005293aa265a1c97bb369
SHA512 de90e3528f302afc0b99ce44ff9331d550409db4610c0c2869e637da48813c15298fcba0be9f1574bdd19476b1c4e23fdc834f6f2b158e3be191b3186578f720
SSDEEP 384:ndiFttNnNnb9138NF8TUNTUlIRlybb4gYjjf+8oYtNhRbpxXzmropDnND2i1xBhW:UFtjZbv3WwgAComphmr6Ds0HI1
TLSH
T161F2B3F298E789B7D99E4B87A73D6E029ABCC15375881980F7D80D0DCC862BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 357ee0f17cc5cd1f67e0f72787b2cfe024a6381bb4caed47d1bd26e3d99195af
MD5 9fb09b176093ef90b7fd85bebe16386d
SHA1 9c1fc280efcd8fe3eecbfe073ba73cd492045cf0
SHA512 28c54aa106e98c2c031e56b2f871a9202bd3c18f5b728c8febd2e220ed974c31a33cfbbb7c9b97c4db30c61f92658133b67ab721d3cd87e9b5f6b58ecdd7554a
SSDEEP 384:n54iF9CcmyWCs38N68TUNTUlIxBydvbUoEyajjf+8oYtNhRbpxgmFdhkP+lFYS/z:RFccps3JwgJAMompWmThkoFYS/z
TLSH
T146B24B36ECA8CAB7EDEA4F9AEB4E7A07EEE00163C59859D4CAD81D4D00871DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d2272ddf8491d67b9e8bb2771f105720fb03aa1877f8729da546baa9c0771085
MD5 46031b0ad67abc65ffaf5b8ebadb15ea
SHA1 b1bda3640401f52a2e6e53a880816fdc7cd1544a
SHA512 6db9deda64c67fa5c957c8f475484285301c20abba9f2988768e2565d8fcc8f035d39af2d57af5492be959c4b28a9e8a841b66b7cc7fa6716a2c763fceec2a06
SSDEEP 384:n50iF1tNnNnb9v38NF8TUNTUlIRHyhbjgYjjf+8oYtNhRbpxXPmropDnND2i1xBk:9F1jZb93WwgfComptmr6Ds0HI1
TLSH
T1F7D24A32EC68DAE7EDEB5F86B70A7B07AFE4126385981AC4D9D84D0D009729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 17e79a25e8b215fbfad6dc36bea32c5124356deca915534e2e9462e942b00670
MD5 6d39f25458477e295bdf4782ee7624d1
SHA1 dccb9655b61f50c6d2c0cc817a9bf7a809f1e807
SHA512 9e67f3ecd39af3ff284bf50e8eadbc3df918835ccf0c0b552fae8a9c6ddc8111597d28ae0336784fca97c4f1c88c86e43e7efec4d3352bb07636aa469d876185
SSDEEP 384:n50iFttNnNnb9I38NF8TUNTUlIRbybbjgYjjf+8oYtNhRbpxXSmropDnND2i1xBk:9FtjZbq3WwgFCompcmr6Ds0HI1
TLSH
T152D23A32DC64DAE7EDEB5F86B70A7607AFE41263859819D4DADC4D0D009729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e53363e6c834cd59ddc3bb3e8cc8bbbdc013d79d85ba6fd2d2051f5e7e9f5f0d
MD5 10c2bb4bb9ad25348ef944a57b175891
SHA1 1026855c9dacb881e7d71402dcaba00d4dc39400
SHA512 bd5b9996aef63207e32347b7a7a259ad4a8ad3d6fd4bc0e0a7cb05151aeb4ffb0e0133a2882767bc0edf489498bd43db0a3df16d3b45e83cba3ad4d2af498aea
SSDEEP 384:nCiFttNnNnb9I38NF8TUNTUlIRlybbjgYjjf+8oYtNhRbpxXSmropDnND2i1xBhW:JFtjZbq3WwgLCompcmr6Ds0HI1
TLSH
T158D23A32EC64DAF7EDEB5F86B70A7A07AFE41263859819D4DADC4D0D009729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 280f83299682f6f506bea108c73460cbff652a8c96d1692014889652959af8d7
MD5 70519335c6f9275c4df298ccadd36649
SHA1 6e7f412d7947d7562e1d38893d758fe366866dc7
SHA512 1ff28dbbea7997a422a4c434c414226f133489c3003131354e26aa5745cde6e3e22e0e541a458135cc9f32c9e2d8ecbe64f1bd9f5fd4fde35b3c72faa11ba31c
TLSH
T1824144E15C3D29D1D0BE0E5F649738FC95D8D715F4A4703D6458EDA8053920E658147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3c425266bfbbafed9c1bee5508597302669453ea4b95c088d767ad5d9767bec9
MD5 1862eb5383effe747b464f0a3afb6d94
SHA1 d7d85ba4be4c65a96bb6c5a30f3c793d8f9981dd
SHA512 e1f804722207f04b47b90ea6936a925f4e48be7c5d30c160457de87af0fd78fec4841d9a8516210dee131584deb125275ec279777598b192f81abfad01e36214
TLSH
T1ED4142E15C3D2AC2E0BE0E6F649B38FC95E8C315F4A470396858EAA8063921E258143F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_2120307766\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_985728379\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5184_985728379\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1676-165-0x0000021032BB0000-0x0000021033BB0000-memory.dmp

Download