c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72

Analysis

max time kernel
148s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/wp-admin/images/freedom-1.svg
Size 1KB
Sample260528-aptbpsd16s
SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
MD5 0b28aa39660dddc94f4a1aa117a75db2
SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
TLSH
T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-RU	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_531477800\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1830321844\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_531477800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1830321844\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3589191337"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244017355190034"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{8776DA43-C53B-4BF2-A51E-19139C189203}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5196	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 5196	5932	iexplore.exe	80
PID 5196 wrote to memory of 4480	5196	msedge.exe	81
PID 5196 wrote to memory of 2072	5196	msedge.exe	82
PID 5196 wrote to memory of 2548	5196	msedge.exe	83
PID 5196 wrote to memory of 2548	5196	msedge.exe	83
PID 5196 wrote to memory of 2548	5196	msedge.exe	83
PID 5196 wrote to memory of 1124	5196	msedge.exe	85
PID 5196 wrote to memory of 1124	5196	msedge.exe	85
PID 5196 wrote to memory of 5628	5196	msedge.exe	87
PID 5196 wrote to memory of 1232	5196	msedge.exe	86
PID 5196 wrote to memory of 5628	5196	msedge.exe	87
PID 5196 wrote to memory of 5628	5196	msedge.exe	87
PID 5196 wrote to memory of 1232	5196	msedge.exe	86
PID 5196 wrote to memory of 1232	5196	msedge.exe	86
PID 5196 wrote to memory of 4400	5196	msedge.exe	89
PID 5196 wrote to memory of 4400	5196	msedge.exe	89
PID 5196 wrote to memory of 5380	5196	msedge.exe	90
PID 5196 wrote to memory of 5380	5196	msedge.exe	90
PID 5196 wrote to memory of 2472	5196	msedge.exe	92
PID 5196 wrote to memory of 2320	5196	msedge.exe	93
PID 2320 wrote to memory of 3892	2320	msedge.exe	94
PID 5196 wrote to memory of 4428	5196	msedge.exe	97
PID 5196 wrote to memory of 5060	5196	msedge.exe	98
PID 5196 wrote to memory of 5496	5196	msedge.exe	99
PID 5196 wrote to memory of 6020	5196	msedge.exe	100
PID 5196 wrote to memory of 6020	5196	msedge.exe	100
PID 5196 wrote to memory of 4460	5196	msedge.exe	103
PID 5196 wrote to memory of 4460	5196	msedge.exe	103
PID 5196 wrote to memory of 1780	5196	msedge.exe	104
PID 5196 wrote to memory of 1780	5196	msedge.exe	104
PID 5196 wrote to memory of 1100	5196	msedge.exe	105
PID 5196 wrote to memory of 5764	5196	msedge.exe	106
PID 5196 wrote to memory of 5764	5196	msedge.exe	106

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wordpress\wp-admin\images\freedom-1.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/wordpress/wp-admin/images/freedom-1.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff981dec188,0x7ff981dec194,0x7ff981dec1a0
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4639242670325422592,9213896175312781978,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6835579891108626547,14504766812570810822,262144 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,9263221182069475238,12781114695221415315,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,5680073974700586844,15013634689568564751,2097152 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,13427131028771307066,7396578512958276448,2097152 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,15464693181126119483,14840152193369163114,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,17558003848907402940,13410653458577576616,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,4394913503319134175,9067660527669939941,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,4394913503319134175,9067660527669939941,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,5486151245249103317,12250460633368586076,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12331418892127177385,10593418314638858843,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5895253991526620676,4055108975385220103,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8280982418744987989,10596201772042927485,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7828181036661775249,4974651510890086446,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,10635719538151695980,11441458424943786698,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2896285615205250184,9327223201664865458,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,3948510151899761121,4094690904550273548,262144 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,8280936612027524847,13110052147479034907,524288 --field-trial-handle=2204,i,10740537025959390330,8379448500974578042,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:14
    3⤵
    PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fd82cd01de364addf119c00598a1a152589544a88b8d48882c85c0b976b9ccb7
MD5 342e1cb1cb32e6b7b220cafadf735db8
SHA1 576deb39bcd11aea2acb6f4ef7b61595187e9056
SHA512 2684751b725138e6ce8417c45bcafb79189226b206972c27ac4dfb9643bbdeb825407d55836d37a63067c048464e031bbf41d4a2d05403ff3e5084d76e6f561a
TLSH
T1B8F0A9BAC931AC3718FD0B1970B5174AE761135B2780995B3B3D560D8FB563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ba02d13385ced49025f41d6abc5226c9b2606259e462b211ed00cc00f354307
MD5 e5a4295299e66369ce1daf69d216411f
SHA1 cc9564645cd218337ce93a3c749c4fec5c9a2f73
SHA512 2cf048bbabeb458ae741441827f5e509e7ca2bdf41b2c836d42e0ceaba847b2b426d09c5e1295c5d2e5047bc70cb1a6997072e53693d6925bb4ba1841d84a644
TLSH
T17941BEF3C3E8866DCA0195F0BA187E2BCE2D0914432C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 51a010cee3ae5f4cb6433e18a136020605efd8dbf6794386191ec9888908d7a9
MD5 aae6f9bc46d79fdd87792242d9b324d9
SHA1 c61ec8398c2d4062cc4ad8aece1799541ddba2b1
SHA512 729baab132bcfded4e3fd5bddc169c0405dd8390e7d21cfa946e88a35bf2fd178d7981594a72d361c8efdc2364cd5e377fb9691131abfeed2801c5ccd381e999
SSDEEP 192:sxZoRZyMqZjK1Ml8Mcu/fks82AxE0CXUyynDuzodpET/W6+WNGY0dgJqrIgj/J:sxZoq0u/fks82A60Ly81+/bG56ojB
TLSH
T178620706AA38597B8CDBD309FA457F53D3F9152392505E44AAFC8F1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c22b747752b985147068a56dee109e2dfcdb1c02dfb2d47af8cc50e5360bc2db
MD5 60b1c8d13562f6fd161e958e51540964
SHA1 4c3b54989369285a8076d4601001053e94d495ed
SHA512 76d355449b716c7a07d1b6dca2012d2bc6cd95c4d240f59c4b77a120f8885c90958ca0b5f9c558c784e304eaf2724e5f37d437fedf0df3a4596070afd26e6d5e
SSDEEP 192:sxZoRZyMqZjK1Ml8UQ0cu/fksTsE0CXUyynDuzodpET/W6+WNGY0d1JqrIg5cLWF:sxZoqqTu/fksTz0Ly81+/bG5doIWF
TLSH
T100720816AA38597B8CDBD219F6457F53D7F9042292540E44AAFCCF0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d9511cf79a49c8b69352bd98d14910a7878162c34d96bf9097134580314d3add
MD5 662a5d42d927304b083439154e2c6990
SHA1 81e588b32432ff6f2414f96374b1cd2f35dbffac
SHA512 bd6268884aff2909060f4572653b22cb8bba76ed77e2e64867e8ed28dae967e281725a182cb9cc206d8aa0a835f02c985af5db2c174f8604992597b01195d6b0
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3x3pQLle:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKx3ph
TLSH
T1B8030B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e4fb8e399be8798e2c25d7b55e81e861c9457efa138fc98bdc59dc1275af7c0f
MD5 5e8349d8b26ed317c0e7acbd0e450ce1
SHA1 789cd2dd1e2ba652e78c087fc5dde17d8b8a60ae
SHA512 1a54daf5a4de5870d2e732ad13b27b50288e3979840092ed73a25e95b9ac7684524608c55caf868e92d42b3dca0beb72b3f90b285e2ec2cd4f807d02a4a7a0ea
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Svh:AFBHhTofhno2mB21q3Llbfe3sLDdeEp2
TLSH
T1F3B27E57717B12023C3E290CA6A19B370E8272A3355CA56F77B800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2064223ff1c4b9bf0a27c281945cf58270eda69f5b88682f0df5d5914913415b
MD5 69d91be57b31f365b18925c6beb11441
SHA1 996e3154b9c059c5e648a96047a6d0d8f9770ba4
SHA512 b8721882b8f6a5aed578061ee96781fdad53569e45e8cf882fbe3cd35a8d04968e2f350cc504e0622a8301c3bcbcdb44c54401bcdf5e38dcf24acf5a6345f55e
SSDEEP 384:n5riF9CcmyWCs38NV8TUNTUlIxBydvgo9ajGfbwocWK1RfPhkP+lFYS/5xHy/7I8:4Fccps3iwg5AiocW8PhkoFYS/C
TLSH
T1D7B24B32EC98CAF7ECE64FD9E74A7A07EEE0116385889AD4DAD80D1D00DB19D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 93a122cd34282c4b11c7c864a990fb320320d75d5c1ac5b8af74c202954fb1fd
MD5 8b456a99813987be8375c6b90003058f
SHA1 c36cccda1d6e8115991708e5bc027d9708f89b32
SHA512 b3229bdba5a66b9774daaadceeb03966fadb38c54e5c4aa4cec48f71eb7e1ae3448c4beb2534fbf333dd76c1353aeab5f73b266c0231ff72425cbe344b6b615c
SSDEEP 384:nF0iFutNnNnb9638NU8TUNTUlIR9ykttjGfbwocWK1Rb4/q2BSTK3RlUVoFHy/7U:FPFujZbM3vwgxpocWzq2BST+R2y7D
TLSH
T126D23A32EC64CABBEDE74E99B70E7A07EFE4015385985AD4DAD81E4E00C729D1307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ab93fa828f1b257443570a035593fb1ab5b9cb3012e8f0e1952c92838533be25
MD5 473bf35273d212c6515c56eec2679ec4
SHA1 13228837c906cfaf8bf3976a584fd243d2f57379
SHA512 9ea06a7b36507e6116702ad1d83f028376b7495f8572bab0ab961fc3b9a87369de9b1e2bfc3980b0e4e7997a4a01d2e50fa34ab2389a792b6798bcbc466a1a3d
SSDEEP 384:n5niF1tNnNnb9B38NU8TUNTUlIReyuttjGfbwocWK1RbM2BSTK3RlUVoFHy/7IgS:cF1jZbL3vwgupocWX2BST+R2y7D
TLSH
T10ED23A32EC64CABBEDE75E99B70E7A07EEE4016385985AD4DAD81E4E00C729D1307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ebd68dc58369407ca54f122ce387389d5da140775b091a0f24bd020cf61e5ac4
MD5 128bdb69a4e8e9920c99401ac3781ed2
SHA1 f97c4288b440f4f78e6692182e88bb5d7089e81d
SHA512 9ff0a6b65bfd750d2e4db65202c6b2dc256ed2408cf21ee43bc9e5c6786864f4ca19a325d44246dd74db8da87e0a6ea1819408b7fc5a207190a81dc1abdee801
SSDEEP 384:nIiFutNnNnb9Y38NU8TUNTUlIR9ykttjGfbwocWK1Rbn2BSTK3RlUVoFHy/7IguD:TFujZbW3vwgxpocWe2BST+R2y7D
TLSH
T178D23A32EC64CABBEDE74E99B70E7A07EFE5015389985AD4DAD81E0E00C729D1307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fc64758e7db39bd27ec00951c985f5119f4641ad05058fc2fc3aa284aef3cb2e
MD5 6daedbaf02d1a747fdd5b4332f8488d5
SHA1 cd39a2d88995ecd19c28030d93e1bf0e8be6e43e
SHA512 03daac50bac8e6c46b1b499d82b4fa5ef651e55c0501849d7622bad4fe9b327f28934411850cb2e11444e0804ddb8606409e8ac4ca483c37b0efd7b17cefb698
SSDEEP 384:n5niFutNnNnb9Y38NU8TUNTUlIR9ykttjGfbwocWK1Rbn2BSTK3RlUVoFHy/7IgS:cFujZbW3vwgxpocWe2BST+R2y7D
TLSH
T1F2D23A32EC64CABBEDE74E99B74E7A07EFE4015389985AD4DAD81E4E00C729D1307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.26.1\typosquatting_list.pb
Size 447KB
SHA256 ad756d39f4fa4a70bee09929f53e29bdacbe552aa1d097309b849ccb92ef7a7c
MD5 c1229bb6439d3426ef7e54fa3911e9f7
SHA1 8623ef46acbf1e0f75a298c098800d1012f347c8
SHA512 d1be2ec8c1137138e38d616ee405172bac5cc61e7beecf6d3da2437adab44d8d702df300d84350020e5e9525220193c6015fc58f41a59fb9a9d4fd094e6730b7
SSDEEP 3072:ZOwNK6ZgDoFVUqY7O3Uw4pQXuDlalIfT1JCuGSrw5mWDecdCs:nNBgDoFuY4ioTCTS05mgdCs
TLSH
T15CA4A3B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 097a397f8642d9784e1b0b7cfbf8eb9a5419904c83c73210fd266a187e172c0f
MD5 0943a477a415c64e1451d748fc2a251c
SHA1 7306d8d4ababab375fe07274c32c7bb27e67d898
SHA512 7d2ec41b502f8b56e42e3cedb55e330be13e99794b62ee0218517e33069c6560af61a7030d3dc8dde413d710b249be8e8a61f37283b2f433949301c10f282ddf
TLSH
T1D84141E15C7C1AC1D4BE0E6EA58738FC91ECC725F8A4347D6858EAC84A7965E248087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a4990d9c56f9f0b39ce5966f9c508a404d27298ae1b43a9328add06e261693b
MD5 4db3a011e324e090f527d70089ae7f92
SHA1 34b53743b204c47328e0a50830d5212b03a4b86a
SHA512 1a12c40168c7281f3873a26af5d9460eff654a9da30997cfd20ecf73789dd7750603ee25cce3bb77f57f5a09f6f5832cbc0bafcda8fc7f7ceccea76cda47453d
TLSH
T1B04130E05C782AC1D1BE0E6E648B38FC82EC8725F4A4357D6818EA98097921D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 034f14e88308391da0f6da5970b7770e3d971e5f9b2002bdad54daff8578156c
MD5 b6e7826fa8d87b648a3dd810a0172578
SHA1 b7c1ffd0d9153eb53a397ebc3ad59e47fca1659d
SHA512 e849577d921213ca04c4d0edbf4879b7a8acc3a4ab19bf12136a69d6cb346a0712ca692056545f72f35d8d8fb6584de451591e180a4119b3c17cfea2bb9a9126
TLSH
T1474163E05C7C1AC1D0BE0E6F718B38FC91EC8729F4A4347D6858DAC84A7A65E258487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1830321844\manifest.json
Size 118B
SHA256 828658147aa137be854d8e5a079884dd0388f2b7c17400952338374ca0b53f4f
MD5 a9e80c400101025da0ff7fa3616810a5
SHA1 bd3f73166085a1d83452e87dba88ae9058842f4e
SHA512 d1e62ad4c3031173bebb6c8059c84d220a1dcbf993bff7db9ea6680cde90639571d9e57b0e1fc1d3b0c9b024a9027d551532ea28d10c14fc06fabe8a721d34f3
TLSH
T128B092B00C0AA47B22849720ECA06A8383F80218F8065B1E088036881F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_523527187\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_531477800\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_531477800\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2472-160-0x0000025BCA250000-0x0000025BCB250000-memory.dmp

Download