e287ecb82e52a66059c761ea19b4f211b0a8d360453f96e16be09ec871a9a24e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dana/dana_v11a/id/www/nlhost/kominfo-logo.svg
Size 4KB
Sample260528-phpr9se17k
SHA256 e287ecb82e52a66059c761ea19b4f211b0a8d360453f96e16be09ec871a9a24e
MD5 c4dd27ea8f7bdcee398d4d91de126d06
SHA1 1192c6cad4903df46dc5d9a4a491a4c3ba4a62f4
SHA512 c11c4388aefb6033156c0528dcf96c97ab8206054f1719c325b31edd412b49835c9c9cb0bb494282a93717f2c0f78cf35e6ae51e250230b251ea597602aa3cc3
SSDEEP 96:LYFmGPQWH+XMUVU5IcQ6IPQvi7RZcNveVhQ3++fYvBEYdLeWUpKlKcan:MFQKhkU5/I4EfcQ2YvBEoe0ltan
TLSH
T1BBA165C543205380E5C7DAEEEF27EEC8151F74FE9D6695C9969F8904544BD8CFA04844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1987694326\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1987694326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\test.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1839615019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1839615019\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\us_tv_and_film.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5188	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "515616598"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244448412304349"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{BD698BDA-428F-4A5B-9624-882BD6821B26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4420	5056	iexplore.exe	80
PID 4420 wrote to memory of 2060	4420	msedge.exe	81
PID 4420 wrote to memory of 3148	4420	msedge.exe	82
PID 4420 wrote to memory of 5188	4420	msedge.exe	83
PID 4420 wrote to memory of 3148	4420	msedge.exe	82
PID 4420 wrote to memory of 3148	4420	msedge.exe	82
PID 4420 wrote to memory of 4764	4420	msedge.exe	84
PID 4420 wrote to memory of 4764	4420	msedge.exe	84
PID 4420 wrote to memory of 5304	4420	msedge.exe	86
PID 4420 wrote to memory of 2804	4420	msedge.exe	87
PID 4420 wrote to memory of 5304	4420	msedge.exe	86
PID 4420 wrote to memory of 5304	4420	msedge.exe	86
PID 4420 wrote to memory of 2804	4420	msedge.exe	87
PID 4420 wrote to memory of 2804	4420	msedge.exe	87
PID 4420 wrote to memory of 5160	4420	msedge.exe	90
PID 4420 wrote to memory of 4380	4420	msedge.exe	89
PID 4420 wrote to memory of 5160	4420	msedge.exe	90
PID 4420 wrote to memory of 4380	4420	msedge.exe	89
PID 4420 wrote to memory of 6112	4420	msedge.exe	92
PID 4420 wrote to memory of 2796	4420	msedge.exe	93
PID 2796 wrote to memory of 4384	2796	msedge.exe	94
PID 4420 wrote to memory of 5724	4420	msedge.exe	97
PID 4420 wrote to memory of 1408	4420	msedge.exe	98
PID 4420 wrote to memory of 1660	4420	msedge.exe	99
PID 4420 wrote to memory of 884	4420	msedge.exe	100
PID 4420 wrote to memory of 884	4420	msedge.exe	100
PID 4420 wrote to memory of 3276	4420	msedge.exe	103
PID 4420 wrote to memory of 3276	4420	msedge.exe	103
PID 4420 wrote to memory of 2588	4420	msedge.exe	104
PID 4420 wrote to memory of 2588	4420	msedge.exe	104
PID 4420 wrote to memory of 3544	4420	msedge.exe	105
PID 4420 wrote to memory of 676	4420	msedge.exe	106
PID 4420 wrote to memory of 676	4420	msedge.exe	106

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dana\dana_v11a\id\www\nlhost\kominfo-logo.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/dana/dana_v11a/id/www/nlhost/kominfo-logo.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f8,0x7ff96658c188,0x7ff96658c194,0x7ff96658c1a0
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,6703758754710098794,5615209104814794731,262144 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10012394867804469442,1097390095378694882,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,34776423712328632,9983011403751236517,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9787758651858554883,8480319252318700440,2097152 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,6819149236805681422,10724171394279794360,2097152 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,10363108766699041700,13222855252867083500,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,3892335858330124720,11881603839409298709,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2156428441401253441,18335384046507797205,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2156428441401253441,18335384046507797205,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,14855000398482394499,6410468019993363776,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3501567567381635444,9689853553916752528,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8150873736007479960,7527602556177482427,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,604791194034648933,11929291946079802093,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16718937140959335700,16160890163632842196,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15373568294533905015,13503981253380797702,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,4528307504827473932,494790731065604943,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,7464241235045521928,8613255192434178266,262144 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11472703395563444708,6407563047739361969,524288 --field-trial-handle=2164,i,9736197596716331820,4744139052674235523,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 583b59b86a5378f593ced14f01656e6cbb7054b87133d27fb0e63398523d3fe0
MD5 11033ec8ecc393cffcc5d7ebd666453a
SHA1 95ec46df6241633cbf62a40bd2c0c8118922f95c
SHA512 720d2f5823162619bab39963247cb797e1b6a9c99a1894e49baa40d7afcb6b7db2e34178fa77843f7f495dee5808136743b1ad7892247efcf1cfbff9ac80f5ab
TLSH
T196F0F9AAC920AC2718FD0B1970A5174AE75113672780845B3B3D420C8FB173B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20421dadcde2c276a767defda705588df9843254b55d8cd72f98355caa9d56dd
MD5 c03b391ed552a9f6b6867f91b29145b0
SHA1 4002840e6a074568bec1d51850aa495dbb8fc33a
SHA512 1c37f8faf4a77615f9359ea38bd1bb90915b79518237de544c49ebb2ef81abcd22090b99dc479668da127f7fa92208eae33cb1b8464ae1b6b2049b4dba404b5e
TLSH
T16D41B0F3C3E8856DC91195F0BA187E1FDE2D0914432C3D9A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 78a3d03ed4bbf0a989906aae0de1f2cc43f31a57e94cdb49e640287eec19e0c3
MD5 705cafd6a9d8c2425e8bf6c55892ba29
SHA1 ef202190d6a77ef47358cf31c79808795e8b7bcf
SHA512 31b9a0bb83612022204a664d0b852b599e8e5cd0512e1776e3562bf594c5d26088f39cf35eb22802f2f52cfa89b175e478ad46f666fd54ff35eeb7b18d586936
SSDEEP 192:sxZMRUPyMqZjK1Ml8Mcx/f6s8znxE0CXUyynDWzodpEm/W6+WNGY0dg6QIsaIgjY:sxZMS+0x/f6s8zn60Ly8tz/bG5JQ76jY
TLSH
T14B62F706AA38597B8CDBD219FA457F53D3F9152392544E44AAFCCB0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f8ff92c50aaa7bd622305d30fc8a3374dead2014efa2ed275d6049ffd53b9247
MD5 aa35072fe4c5c401dd4f68fd020ea4f5
SHA1 66ff931866fdd14fd9d2a586855e4e32138f0c75
SHA512 bca2fa72e9e94ea68a264957b3e4381cad8a5ae96b6853bbee6f3a93e55744ea9a66d7f77a02b6e8726db6e182d378d633d5c82c003316997fcf29580ac08b5a
SSDEEP 192:sxZMRUPyMqZjK1Ml8UQucx/f6srCE0CXUyynDWzodpEm/W6+WNGY0db6QIsaIg5k:sxZMS+qNx/f6srN0Ly8tz/bG5cQ76Blu
TLSH
T13B72F806AA38597B8CDBD219FA457F53D7F9152392544E44AAFCCB0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 aa9dd2921b6abbccfba9ff3fb16a9e37486319486e064054310ab237e21c56ba
MD5 bf3edea4b8ef31efc9b69dd32a052826
SHA1 1fe0693c41cae8c0976af928c0faa914c03cac1a
SHA512 2fa1ca9d219b0ed076476771b14adb3e499d9ff92c9cb4242a5ce85bafadb807179a13de83bdc290477d80743c211c498b92b8a99bc0904b0aa915e6dd99d4af
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3v3pQLlr:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKv3pA
TLSH
T14C030A3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2b08aabfd32255edbaaa9d79dd2e4c21b25791699978ef60e482ca29f33c8393
MD5 8b2ba45d9ed7bdccccb80c721962044d
SHA1 018bd6841c6c51b58756632a2f2bfdc6cd4ab340
SHA512 e31d4bf6f9e971e9d76a767e2da5d76b9bd00e06bba00d0e3cf100bfafc1cbd7a6f3e7638a9c6abaf7d066b996aec5c7615d4bc68be996155bf24d8b62025bf8
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7cE9:AFBHhTofhno2mB21q3Llbfe3sLDdeEpz
TLSH
T17FB27057717B12023C3D290CA6A29B370E8272A33458A56F7BB900B64E67F615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 043031a3adb46a4e8246778a079816870620cda8fd8452d005c08cb5cf6a3c1b
MD5 b86b6d2e92e3e0e0ea1339a8f55e03bb
SHA1 4d74c9526e1a6fc42aa91c55b5de7a8770a230ec
SHA512 44e7388f483f3f806c3f45425f4d171db32cae12022c1d3f6b682958679d83f3f6543edb8ee697944a092b92ea59e20561a0b550da96cc7dfd2531c7295e6bea
SSDEEP 384:ngiFBurQXin91ferX38Nx8TUNTUlIRFyI6gdjf+8o/64QmOW7vu0K70gGg9ofYIl:7FBurh9QrX3mwgWgo/JQCvu0KOganNZ
TLSH
T1C0D24D36E869DD77ECE74B8AB71A3643AEF41193998C4ED4E9C45D1C00DB1AD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d96af443e063742fe3460ca77205b36f4ad3b1d320a6224a7a6f39e19d63d0ab
MD5 7eadc30a3bee19bc2782ecce9a4e6d95
SHA1 ad9064c14ddaf043700dddd27d80760448932f6b
SHA512 6ce3f0a40dde9554a5c73fffb0dcaca4da5c7f9ee7e00928584a444f52caa559f1fe1e1763debcf570bdc3ad100b31bc2801a6588c01cf5a669a6120196f2de3
SSDEEP 384:n5qiF9CcmyWCs38N18TUNTUlIxBydvxo5adjf+8o/64QmOvzhkP+lFYS/vkHy/7t:HFccps3OwgcAOo/JQdzhkoFYS/F
TLSH
T196B24C36E8A4DAB7ECE64F89AB4E7A07EEE01163C58C89D4DAD81D5C00D71DD0747C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 eceaaa5c2e2a4cc7ed4b465f796cf31c3e173a9102e6074c06871a474a715ae2
MD5 637285691cd65c6935f18c9ee379bcdf
SHA1 50cb590387bac540a0fbbd74b89644c83303374e
SHA512 77717f5749a0e1bc65c3aa3bb276605bb5da644453b05241975d50d75c5ba5310042e4dacf0ffcfca0fb460ad69a1c92b3368b16f80a3828f9051c41dd96fbed
SSDEEP 384:n5SiFBurQXin91ferg38Nx8TUNTUlIRFyI6gdjf+8o/64QmOW7Zu0K70gGg9ofYw:rFBurh9Qrg3mwgWgo/JQCZu0KOganNZ
TLSH
T128D25D36E869DD77ECE74B8AB71A3643AEF41193898C4ED4E9C85D1C00DB5AD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b3c66a61a5c4178d8b02bbca27ff4129248077f0af46a36cab6606baf118a75d
MD5 d56259ecb1545fa193e2ef3f0414bbac
SHA1 888156841c8d178ab4eb85d02bbe7efd533e0474
SHA512 87ccd804994e6dc9bc413ebd627d2a8f24d5f312d7de5c31167cbf334a6f3509a9f9c78ea7dd111a90418b31d5741f31395eef60275bdd40805ccdf523e3731c
SSDEEP 384:n5SiF9CcmyWC0s38Nx8TUNTUlIReyR6gdjf+8o/64QmOW7uu0K70gGg9ofYI1Bvv:rFccp0s3mwgOgo/JQCuu0KOganNv
TLSH
T120D25C35E869DDB3ECE74B99B71E3643EEE411A3998C8AD4D9C85D1C009B1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 429c572d9546f29c138174159127314f39e99acda10e9d489ed4c1f995f9364e
MD5 d06221c5c206d1aadf288fbd1abbe5a8
SHA1 f88ed7dd5e0c2643f8bd656d6f71b21aa95b8987
SHA512 baeadae9d701cb84079597f40248c4ad3b7f9243e5a168aa4052e8b7190e6c0ce45fcfa6fda7c939868fd5905fffef1c8f78a3c439f4907d26432b530972054e
SSDEEP 384:nPiFBurQXin91ferg38Nx8TUNTUlIRFyI6gdjf+8o/64QmOW7Zu0K70gGg9ofYIl:aFBurh9Qrg3mwgWgo/JQCZu0KOganNZ
TLSH
T1EFD25D36E869DD77ECE74B8AB71A3643AEF41193898C4ED4E9C85D1C00DB1AD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 852f07dc6fac5879f2c1ff2a0b6a283900e23a829baf17ff4ed85346017c2d0d
MD5 05b488470fd37895762e33277dda6890
SHA1 bb9be160896c53601ebce78c7a25fab472f1e939
SHA512 14480bcd70d3fe14fb88f5be54c4ebfa62cd52afc0e545037d5b7ed422123b6868c5746185bb2b1a43b9df0cf4b9008e351288c7e052dce44d4e83e5dd4924d5
TLSH
T1B43143E16D3C2AD1D0BE0EAF649738FC81E8D326F4A8717D6448EDD8063920D654187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e1b7124ea5b99168a7c0f38255c1d9b159f6dcd7ad58dfe2b36c7aa7151cc161
MD5 5cdd109a8040e21bbe10ad59dd44c01d
SHA1 4e86f63587bb4df574e3437cacd33d832190f6cc
SHA512 0fa11b508cbef9eea983adfd9eea4912917fa47be8d30cd5c27d91259af6bf5d442d54849081f1178000d89d6a8855095ca78db53956fbbc9c0313763fc44589
TLSH
T1E24130E15C3D29C1E0BE0EAF645B38FC91ECC32AF4A4307D2848EAD8467960D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5655401b6b36a02b55bb76bdc12c0acfa43b40f2a605775c1ddc44de43886440
MD5 bd71ec2021a54c728b3aea4bf20a904f
SHA1 0c8bdcad2de6a5b3db3367a83237f79880ffb25f
SHA512 852b942fa636392233eab2387b499a96249a8c7e0f4444050ab51168a498ea7f2c804fe7eed86d6cf55989972f763351547889444a97826172dab2e59fb5f491
TLSH
T1B43111E15D7D29C1E0BE0EAF644738FC95ECD32AF4A830796848EED8463920D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_123842214\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1839615019\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1987694326\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1987694326\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download