hxxps://deltadisplays[.]com/wp-admin/wagger

Resubmissions

28/05/2026, 22:52

260528-2tpb4ady9r4

28/05/2026, 22:51

260528-2s4qdsd14z4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://deltadisplays.com/wp-admin/wagger
Sample260528-2tpb4ady9r

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1150432054\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_724485100\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1150432054\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_724485100\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244823762295353"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D3E3A281-8D58-44F1-9214-51D44AE2D659}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
596	msedge.exe
596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 5948	2416	msedge.exe	80
PID 2416 wrote to memory of 4948	2416	msedge.exe	81
PID 2416 wrote to memory of 384	2416	msedge.exe	82
PID 2416 wrote to memory of 384	2416	msedge.exe	82
PID 2416 wrote to memory of 384	2416	msedge.exe	82
PID 2416 wrote to memory of 4016	2416	msedge.exe	83
PID 2416 wrote to memory of 4016	2416	msedge.exe	83
PID 2416 wrote to memory of 3096	2416	msedge.exe	85
PID 2416 wrote to memory of 2920	2416	msedge.exe	86
PID 2416 wrote to memory of 3096	2416	msedge.exe	85
PID 2416 wrote to memory of 3096	2416	msedge.exe	85
PID 2416 wrote to memory of 2920	2416	msedge.exe	86
PID 2416 wrote to memory of 2920	2416	msedge.exe	86
PID 2416 wrote to memory of 2172	2416	msedge.exe	88
PID 2416 wrote to memory of 2172	2416	msedge.exe	88
PID 2416 wrote to memory of 2172	2416	msedge.exe	88
PID 2416 wrote to memory of 3848	2416	msedge.exe	89
PID 2416 wrote to memory of 3848	2416	msedge.exe	89
PID 2416 wrote to memory of 3848	2416	msedge.exe	89
PID 2416 wrote to memory of 1996	2416	msedge.exe	91
PID 2416 wrote to memory of 1684	2416	msedge.exe	92
PID 2416 wrote to memory of 1200	2416	msedge.exe	93
PID 2416 wrote to memory of 1200	2416	msedge.exe	93
PID 2416 wrote to memory of 4704	2416	msedge.exe	94
PID 2416 wrote to memory of 4704	2416	msedge.exe	94
PID 1684 wrote to memory of 3228	1684	msedge.exe	95
PID 2416 wrote to memory of 3384	2416	msedge.exe	98
PID 2416 wrote to memory of 3384	2416	msedge.exe	98
PID 2416 wrote to memory of 3384	2416	msedge.exe	98
PID 2416 wrote to memory of 5292	2416	msedge.exe	99
PID 2416 wrote to memory of 5852	2416	msedge.exe	100
PID 2416 wrote to memory of 2092	2416	msedge.exe	101
PID 2416 wrote to memory of 5980	2416	msedge.exe	102
PID 2416 wrote to memory of 5980	2416	msedge.exe	102
PID 2416 wrote to memory of 5980	2416	msedge.exe	102
PID 2416 wrote to memory of 1216	2416	msedge.exe	103
PID 2416 wrote to memory of 1216	2416	msedge.exe	103
PID 2416 wrote to memory of 4036	2416	msedge.exe	106
PID 2416 wrote to memory of 4036	2416	msedge.exe	106
PID 2416 wrote to memory of 5828	2416	msedge.exe	107
PID 2416 wrote to memory of 5828	2416	msedge.exe	107
PID 2416 wrote to memory of 5528	2416	msedge.exe	108
PID 2416 wrote to memory of 5528	2416	msedge.exe	108
PID 2416 wrote to memory of 5528	2416	msedge.exe	108
PID 2416 wrote to memory of 596	2416	msedge.exe	109
PID 2416 wrote to memory of 1816	2416	msedge.exe	110
PID 2416 wrote to memory of 1816	2416	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://deltadisplays.com/wp-admin/wagger
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff3be0c188,0x7fff3be0c194,0x7fff3be0c1a0
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,5126855501449450532,2586185087067960107,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,18035925698960126232,4852276315277170271,262144 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2430437956177668282,3089834510708141555,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,10636615901848038468,10660745079866531012,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,11361565686780556276,4586299359868145993,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,6457751966567703252,11832049670933932558,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,11093072905779235397,17131254568059512442,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9476960379074118483,1604834645267436380,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9476960379074118483,1604834645267436380,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,4006869945174053657,17870759518942974277,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,4794105139806812526,14522164540931034314,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8610815602703887974,5115024974239647838,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6344,i,10618671808177503969,11959222965006787919,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,16802553040510625036,14616632134976133833,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,2287004756753196920,14252238583231056995,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5872843785591112769,14765173126751354169,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5724,i,10836358478420998856,11370509331201540487,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,14342060183025287117,1149567473429725949,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,4296223469269218732,9417573055403058955,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,17230946440000034040,4859304004982800004,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5872,i,12477708840740494022,13336121907146314320,2097152 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,7162412744903149116,15719288999247766901,262144 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8468788865966737131,15935880515066509471,524288 --field-trial-handle=2196,i,5900269543249523730,13342409096281089571,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91bdf000-ba3a-48b8-a2fd-e045759cc275.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91bdf000-ba3a-48b8-a2fd-e045759cc275.tmp
Size 28KB
SHA256 a9e05ad8cfe292880af6d96256af94b2c80baf4650327af63dbb0798c28af518
MD5 be31ba8eab4394b5517a58648b80153b
SHA1 941522490d0cb2c050a3b851f01ff372729bf0d2
SHA512 214d36f055ea2ac34db0d56fb8953b70ea4ec11d0586a7421bbd221d3edba301f510b71637fa2b77c3d80d2760755a729983ec33ec5cb8e222d758f182b4dd08
SSDEEP 384:nqiFItNnNnb9J38Nm8TUNTUlIRnyITQ3jkpfb7oSFsvyvAEMBULP4Tr1QiHy/7I1:hFIjZbX31wgFQwJoysvPEMBULwXcI
TLSH
T13CD25A33E864DAEBEDEB4F94B65A7603AFE01157958C5AD4EAC81E4D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 819ab2b7379b4dbc80f75277f5fe7cfcf95bb09b23131be0d76138906ecdb4ad
MD5 1fac04c7ca552ea075207b5a4b9c9e6b
SHA1 d09ade2408c4c7e2bbda42e7e4ce206836d9289b
SHA512 72f801f61e7569bc7842fa612e04f22fdf10d4a17fc82b11ff380f56d391a75ea214fb113d126f3af2a9061fd468f697b72efbf21731c215eb9f84d52be94982
TLSH
T1EFF0A9BBC921EC2718FD0B1970A95B4AE75113572780845B3B3D560C4FB573B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de3f8feafdb5261fc3b9dbcf38250e468c8d8f43123a8df5a7f6064026485cbe
MD5 d037d35c63a7a2d2524b47edbb54a573
SHA1 43b2fc25f3d526624a37735bee7aa58f0ca6e9a5
SHA512 9dad0ae25a4ca22578db43d1920dbed99802aa692cf480abc60f3f27d220830967e19e6899e0833224e53e25eb81d425008dbb99e527d6f066a0fe2ad424bdea
TLSH
T1C9416DF7C3F8866E8A1195F0BA286E2BCE2D0954432C3D5A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 978e7da54450177722748381d2f2fe696366c1cdff57dfed26927fc55ccbeb27
MD5 fffc4ee5bb06bfd381f7bde99ab3799a
SHA1 ef0b98106c5a608b4cbab78002273a0ce38e2269
SHA512 2dcb02539f78946f806a46ebeb5e88ec247f78ace377f39f7cf8bf94c06cb3ff39b9ac11917604d265ce26df46421002634a569aaa830f13766ae4f93c4cc6c8
SSDEEP 192:sxZVRUyMqZjK1Ml8MFB/fvs8K8HxE0CXUyynDHzodpci/W6+WNGY0dgpN6IgjnJ:sxZVLdB/fvs8K8H60Ly8MP/bG56cjJ
TLSH
T12F62F816AA34997B8CDBD319FA557F53C3F9152292405E44AAFCCB0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8c783a15e01d2d4222c2b997707c6abefeefa2688e5398957c41d1337a424d53
MD5 c026d687416a32dcf59db8ce6499594f
SHA1 2c8e2b7b09b53a942695b5c9f45608a8c2109e83
SHA512 b8c7d501aa06a065163f63e491724f3f999f5f58685766ffd448bd0b1d89fb94f5a8012f74d420f2f131a1ce5f0c023cfe3d7e12e9b48e26141bb833438f415b
SSDEEP 192:sxZVRUyMqZjK1Ml8UQ3FB/fvsk8EE0CXUyynDHzodpci/W6+WNGY0dlpN6Ig5n60:sxZVLqVB/fvsk8r0Ly8MP/bG5hc80
TLSH
T1F872F816AA34997B8CDBD219FA557B53D3F91522A2404E44A9FCCF0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ec4a9ea347b4cfb176da9e5a4f9ae350f3722c25466e37fff0259c7c44ecea78
MD5 6c2e11a5f1297d3409c2f3228ab0717e
SHA1 719f11fa960458a6094a7d5300eb905e82e90f56
SHA512 ed35d14c146c26c97361210189bb438322feebddc53dac4c51f6d6eabd5272a128710b8ecc3a49e7e9c9740f8e79d18c48b3c9c963db00e130c33f4ac740e81b
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3d3pQLlW:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKd3pN
TLSH
T12C030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c0f6d0755b1d69dabe40e0fe8fdf30b995d4f2b20c5252186184d41c3aac1481
MD5 da3590437ade2f05968ddc097cfe10bd
SHA1 79eb502ac434a1c567f9c9d5e5027f9e18ced10f
SHA512 ad54a487c8e204a6b3b971c09ba7141a6b1e6de74bae1e41e0f98fb627070fc950f8b281bcae5acf179bf6a9ac9c7e38ce9023a3f63e3841cb61062152508763
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7MeI:AFBHhTofhno2mB21q3Llbfe3sLDdeEps
TLSH
T1BDB28F56717B12023C3E291CA6A29B370E4272A3345CA56F77B900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 74c8b96fbc4e802a7da4390c2ee8ba52bbd69ed82a45073f0e7759caab20d4b5
MD5 b3ec2a4f2a499123ae16846c41afe0e4
SHA1 696dcad92a67b14afa4b2dc5d099811a94b58847
SHA512 8a0c9b62a3d1278eb6272881b2f9535fba831ec5cf5ada90ba9e915533b1edcfe9cc9850a8bfa92df797280f4c005d6ebe0fd6cc3a0455d911eb87596cc628e3
SSDEEP 384:nRiFItNnNnb9538Nm8TUNTUlIRnyITQ3jkpfb7oSFsvyvAFdMBULP4Tr1QiHy/7a:4FIjZbb31wgFQwJoysvPFdMBULwXcI
TLSH
T140D25B33E864DAEBEDEB4F94B65A7603AFE01157958C5AD4EAC81E4D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4951711ff74947fee02e42e4ecb763afb87bb9bb2df2f9b87407ba3657e66927
MD5 00a673c485bca0e9410c19e3d77e0e20
SHA1 a49fbae7161bb8c442529c0236b1dc017e46c44c
SHA512 ee8600d17c1f05faa611b913f37c1ccae4a2d9cf95745a2e869d7f7f7546dbe3e97831c0cef652ded72a8809503882a3d1d9fbe70efb19599e6cabbcdaf8cec7
SSDEEP 384:n54iF1tNnNnb9n38Nm8TUNTUlIRbyDTQ3jkpfb7oSFsvyvAEMBULP4Tr1QiHy/7a:lF1jZbF31wgmQwJoysvPEMBULwXcI
TLSH
T1CAD24A32D864DAEBEDEB4F94B75A7603AFE01157958C5AD4EAC81E4D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5689fe5ca7bbf3b4640a384b2bdef33de06641c2b909a9035adc1e53e27d95e6
MD5 def010072fc766a08eb4109235cf9a95
SHA1 b2049c0ac82d3ac9efcb0ed77137fee6842d6d05
SHA512 8bdf786a5defd4cdb6f0399d792a8e17dce18e972b552cbe6d8a58f99a38299ea0c0b1b91d651513cb2ee3c39a2b703d520b0b16953b0866460b9cdc39664b4f
SSDEEP 384:n5qiF9CcmyWCs38NY8TUNTUlIxBydv8o/ajkpfb7oSFsvyiYhkP+lFYS/60Hy/7F:nFccps3rwglI7JoysvBYhkoFYS/8
TLSH
T1E8C24B36EC58DAB7ECEB4F99E74E7A02EEE01163818C5AD4DAC81D5D00DB29D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 200cb5f3d97c0935832b3b20cab19c0ca98ab0de2c19d741bf29dca768c5e2c8
MD5 7cdbc26c6db98267a62f489a2842c83b
SHA1 f0da4676b0aeb64ba54a20b23b9922c78e0698ee
SHA512 f39bdb0e83f6f3e8327b8eefc5aac18430304515a7a9ced2d20fac9904f5fc3606c5cfd209fe4a80b85b73f79b91764c6eba90a5fc04c01681e80b6d58d2fa13
SSDEEP 384:n54iFItNnNnb9J38Nm8TUNTUlIRnyITQ3jkpfb7oSFsvyvAEMBULP4Tr1QiHy/7a:lFIjZbX31wgFQwJoysvPEMBULwXcI
TLSH
T130D24A33E864DAEBEDEB4F94B65A7603AFE01157958C5AD4EAC81E4D00CB2DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e70e8b8743a25be5c59f81e522c4ff36a644045bc2ac516b55c20d92ebe356
MD5 c4b0d590ee04da586d12ebc5feb88ba6
SHA1 33e3f5b81fd46087b3774706cadb29c7f2f0d216
SHA512 8f84250c6ca92a38693bcf3125eac4f7ac8a7492e09f3424d24e14dda3b42348d897f9fbe6b93c5b4a0e4a889dca7822dcc924dc6a332f0e796240e7989fc3bd
TLSH
T1BB5160E05C7C2AC1D0BE0E6FA48B38FC82ECC325F4A4357D6818EA88097921D748083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6a4aecd4ed148884a63e4abae2168c52414a1142610b58465aa6bdca459952a3
MD5 73c8164afa45fac88a61daee9f231ec8
SHA1 4a8d70370da9180edb84ed7527fc645da7e6baaa
SHA512 6f4f439006a7fb81fcd68936c2d3baf32e2abf509eae7e7e7e57e694a1818bd5c0fb783d1c3f84bab342dcf6fa8765809a161b3a28f55b6d068315418f35c28b
TLSH
T1A55130E15C7D1AC0D1BE1E6E648738FC81ECC726F4A4347D6818EAD90A7961D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 32928efc456d8009f0ee5241cb69b1b39b138c47ac1cbd09483afada9ffa74a0
MD5 9072900bd29f29e99664f744b3155f92
SHA1 c5293f4d1ec7cc57c98f40a3bb3ce090c44f0a69
SHA512 d81d7642b8d4d7405088f0be1b8c3482ef1c8098fd83a5e7d6940e03b1b9f481db520f664a734a788906e1e478105c4ceea568f461c89323e5a22b18b389663e
TLSH
T1DF5150E15C7D1AC0E0BE0A7E608B38FC81ECC725F8A4307D6848EAC9097972D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1150432054\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1150432054\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1540434274\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_724485100\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1996-165-0x0000026843F70000-0x0000026844F70000-memory.dmp

Download