873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity/Velocity.exe
Size 32.9MB
Sample260530-e16hmafz7j
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
68	3348	msedge.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1380041638\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1380041638\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\us_tv_and_film.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1052027175\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1052027175\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\passwords.txt	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe
3348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245888004609966"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{8162EAD9-B2F6-4ED1-A861-B0558CA87C5A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 3764	5124	Velocity.exe	81
PID 3764 wrote to memory of 3244	3764	msedge.exe	82
PID 3764 wrote to memory of 2500	3764	msedge.exe	83
PID 3764 wrote to memory of 3348	3764	msedge.exe	84
PID 3764 wrote to memory of 2500	3764	msedge.exe	83
PID 3764 wrote to memory of 2500	3764	msedge.exe	83
PID 3764 wrote to memory of 4600	3764	msedge.exe	86
PID 3764 wrote to memory of 4600	3764	msedge.exe	86
PID 3764 wrote to memory of 1344	3764	msedge.exe	87
PID 3764 wrote to memory of 1344	3764	msedge.exe	87
PID 3764 wrote to memory of 1344	3764	msedge.exe	87
PID 3764 wrote to memory of 3900	3764	msedge.exe	88
PID 3764 wrote to memory of 3900	3764	msedge.exe	88
PID 3764 wrote to memory of 3900	3764	msedge.exe	88
PID 3764 wrote to memory of 2148	3764	msedge.exe	90
PID 3764 wrote to memory of 2148	3764	msedge.exe	90
PID 3764 wrote to memory of 2148	3764	msedge.exe	90
PID 3764 wrote to memory of 6100	3764	msedge.exe	91
PID 3764 wrote to memory of 6100	3764	msedge.exe	91
PID 3764 wrote to memory of 5796	3764	msedge.exe	92
PID 3764 wrote to memory of 5796	3764	msedge.exe	92
PID 3764 wrote to memory of 5796	3764	msedge.exe	92
PID 3764 wrote to memory of 5948	3764	msedge.exe	93
PID 3764 wrote to memory of 5948	3764	msedge.exe	93
PID 3764 wrote to memory of 3644	3764	msedge.exe	94
PID 3764 wrote to memory of 3644	3764	msedge.exe	94
PID 3764 wrote to memory of 5580	3764	msedge.exe	95
PID 3764 wrote to memory of 4640	3764	msedge.exe	97
PID 3764 wrote to memory of 5056	3764	msedge.exe	98
PID 3764 wrote to memory of 1160	3764	msedge.exe	99
PID 3764 wrote to memory of 1708	3764	msedge.exe	100
PID 3764 wrote to memory of 3272	3764	msedge.exe	101
PID 3272 wrote to memory of 2308	3272	msedge.exe	102
PID 3764 wrote to memory of 728	3764	msedge.exe	105
PID 3764 wrote to memory of 728	3764	msedge.exe	105
PID 3764 wrote to memory of 560	3764	msedge.exe	108
PID 3764 wrote to memory of 560	3764	msedge.exe	108
PID 3764 wrote to memory of 4192	3764	msedge.exe	109
PID 3764 wrote to memory of 4192	3764	msedge.exe	109
PID 3764 wrote to memory of 4924	3764	msedge.exe	110
PID 3764 wrote to memory of 3808	3764	msedge.exe	111
PID 3764 wrote to memory of 3808	3764	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2fc,0x7ffe8468c188,0x7ffe8468c194,0x7ffe8468c1a0
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2221789578104994752,14379886756082761425,262144 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11703470428938315648,12478826181136465844,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,7839644635723658071,18146953077879107442,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,4932694436352106872,13437441563273323956,2097152 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16180483151279894349,12402717934663604223,2097152 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4820,i,9358746362975484940,12559669161095164857,2097152 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5459707433643447271,16027442966825029108,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5236,i,13889787657718373450,9741798506980352055,2097152 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2617975844003332296,2431100128273639977,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,894906274424464269,7310168300894610526,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6528950314291083854,13713438269562732755,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12389679587295756446,14379940764336759727,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12389679587295756446,14379940764336759727,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,8244167986882245776,13897106181155701388,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,12578707431052897724,18422090114612235853,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,6198710460548420209,4097392921780199350,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,17342563611075603864,17804704350487703650,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1096
      4⤵
      PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14311833557970476595,17688068379799320140,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11578628640056539690,16839449586761050710,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15630001379666108603,11129672421390513931,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6096,i,14270563584182143013,15388893306485355240,262144 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13831885367953641722,15619865203426329038,524288 --field-trial-handle=2144,i,5704482349410934926,7429810314381974359,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f1aacb42f1fb9de31e111b17c1a507f4ddda563fa12fdadedb585a32bdaebe45
MD5 c167a50ff2339e4b844bacb50506983e
SHA1 051ff94a02212f77bdc07b90ba34c47b503de160
SHA512 04df63274b8704f6c882b53ed253480dae7d8ff921b2cb5ecbaef26e7d6149c0240626e50e01747878e47283b7a58790a908b3a53923dadb2af28f9b13077ec1
TLSH
T1ABF0F9FAC920EC2718FD0B2A70A51B4AE79413672780845BBB3D560C4FF567B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 227269f1b29f449c1e34d2a4bb06f93890a5171223823c163801f1e0bacfbd7b
MD5 b4222d611f47fa7b0bf9cedf5b09e0e5
SHA1 2c430c1fb51fc29d4c0ea49018599bafeb0f8e54
SHA512 a25f0ea064e0f3e1f5426740ad96497c9437615067bb564004df2bafb2301fbd0aed44d4258314b527d187d3d12ee0ae589bec1ef6ca5cd2fc08c7c2e72b9325
TLSH
T1C0714D4405A21937F330327FB8E00FF074708752AA5F8E6A015869F6680A7ECE1B755B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cea5.TMP
Size 3KB
SHA256 3ab9b9ee2e57b8df8002a252c63a01b255bf9670abae274658e464a3dc3962e6
MD5 76513262fdeca7b2f02cfb3bfc1a7872
SHA1 2f6362cb8eafb6b8cb35a3b9355f34fe610eaee2
SHA512 a38608610b45e5542b349df8ebd3a89b4af2b1ce86a23da1905920e68fd72d85432d78ce923e26ef418224414e39cd8b7a2ce143902671a1cd1136d0fcefa4a2
TLSH
T1B171804501A20937F330327FB8E10FF1B57087469A5F8E6A005468FA281A7FCE1BB59B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e7963563-943a-4b86-970a-9d8ecdee5227.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7963563-943a-4b86-970a-9d8ecdee5227.tmp
Size 3KB
SHA256 d76f5b7fb270ccf52d031cb4bbb8ae5595259c3b2fd061c3c9b70dc9e31a575d
MD5 07f171e4ec820ae562b3c98aa7384ce1
SHA1 949a2ca81603ff1638cf659a60834e526dc7341a
SHA512 ee35bf204cfa41dc5fc4e847324e9b5a9602ff10976d0f084df085ac278318139aa916f28909cf58b8bdec82c364bb90ba3b60003b2a31df7a4997d10480f31d
TLSH
T1B761AFF783B4856ECA1195F0AA18AE2FDF2D0615431C3C6A89E4EE27D3E3471E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 494d584ba3106d6696dda00b0b6643643d898d4761b0e58d82f1fd2e58896293
MD5 b4df3bab04ba86890f94f5185a56dbcd
SHA1 0175f31e66850dc3796e49f4b96814a1a4c296f3
SHA512 aa5d07f1b73068769b9fd3dadc9808f121bae3737b4bebfc3df5db862502a887afd7c94fd94c0a4a0d0c2e1cc7920dfa5b90fc925fab32ce988036c7eb54b0a6
SSDEEP 384:sxZDBtE/fesIcipd0Ly8pm/bf/5so5aAM:srrE/fQpd02/bn5/a
TLSH
T17172E816AA38597B8CDBD209B6457B63D7FD152392505E449AFC8F0C04EBBED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e26728fa6dd8a12d51b35ee27757bbdd79821a15354994942c593f10f38b9feb
MD5 4bd48047a64e6eed64e4c437be9bfed4
SHA1 bd740f964b1a00b2eb4fe0be79b60b0130c54d37
SHA512 df87b12ecb6b4049635726f5bca7f7224dd62980de329a5597bc43bc6dd90b5939d0863193d07eda1b79a4d5ab898caf785dd3a52670336fb69d5e41c1a0de9f
SSDEEP 384:sxZTB0E/fes88cip460Ly85m/bf/5/oLjn:srKE/flpf0y/bn5Qn
TLSH
T1A562F806AA38597B8CDBD209FA457F53D7F9116392505E449AFC8F0C04EBAEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 02c8c093c7d92da00c74764f112b55aded24f68deae240b64c43326072e4cc65
MD5 39f3af60a0bfbe46412e4f66745f33be
SHA1 93fbdba460f92c3697cb50abba37e3d14ce857de
SHA512 fa22285c1a4ce4e683c171705acdfcc2eca73e9f4077b106bdce679407c095b79c4b31fa96a1d0990f4c6e9f1d48362216d8df6a8cb73c0d695058e2d9959e80
SSDEEP 384:sxZDBqqE/fesIcipd0Ly8pm/bf/5so5aAM:srIqE/fQpd02/bn5/a
TLSH
T10872E816AA38597B8CDBD209F6457B63D7FD142392405E449AFC8F0C04EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5b7eb819a7137fb0e6443b545ef4f3ba0a351bb473bdac596b9907f17590ee39
MD5 1213bdc86f5eb7f55891e1f5193c9980
SHA1 cab7b4412122aae0f48e0e2f5a29a3dedd79f496
SHA512 b30d9a9154f62fc23aa7a0b8e55571bb4df1c135a9f5e59ed2fc4eb14ac53ab35b84cd73a8358cc7e64cd1efc2526bb859f8eaad018c50a6a1dbcc103dad5ae5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3K3pQLls:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKK3pj
TLSH
T1C7031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 94d4badcff2aad23dedb4e5271d326432adccf8ec6688fad88fb502b795f6cc3
MD5 acc484be6833b419ea3c9731b278aeb6
SHA1 7047b102edf33049194e3c08eb1af88ddfa9e580
SHA512 833b454453c822e39370698a8d035d3608602ca5143ae2e496e308d955dad0370273da92f45e031ce32107d7330cd4787c652e450b5f4d2e3c9d7f4916b56996
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72j66rkASMW:AFBHhTofhno2mB21q3Llbfe3sLDdeEp5
TLSH
T1DCB29F52717B12023C3E291CA7A29B370E4272A3345CA56F77B900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 525a8e333c3390cf5441ebb8b8929d8533823edb19f6f72ebcb51259350af214
MD5 e5ce7bb403357fd891ac9345b3d75341
SHA1 1dd98b05fe0e6cd91ee7650742a6638d3095c51f
SHA512 30d8113c754d80c234a2fbc1a979beca0eeb97a7689e52f243429af066ebae2294b07875b42d72541c545f1bde2d2b40da33366f3678fada74c92144b0d83572
SSDEEP 384:yJiFKtNnNnb9m38N/8TUNTUlIRuyMT9djf+8oug9FfggF1wKT+B872+sRDcdvsPY:pFKjZb830wgGBoug95vTw8+ygRD068
TLSH
T13CD24B32D864DEB7ADE75B95F30A3647AFE4415388885ED4EAD84D0D00DB2DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1451cb2aba7a58f9cd9a555d0959fff4ee2dc73df47e7a37deaca7695ab74681
MD5 5d9d8df09b5ec7faa6934b142d4119ac
SHA1 6923ad9ebac2746e97edb243da8ac762f5cf7729
SHA512 9f281e42f585b77f348ab5599b5624f05408649aa319ad4238fc4ed652b6f537daa782bb1df8ecb35ceea12af67ec3f7e45db6e3f7d1632941765b26868d6dbc
SSDEEP 384:n5NiFhCcmyWCF38N/8TUNTUlIRoylT9djf+8oug9FfggF1wK1+GHy/7IgR:CFocpF30wgtBoug95vTwE+x
TLSH
T144B24B32DC58CABBACE75B99F75A3643DEE4416395888ED4DAD80E0D00CB1DE1B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d461485c41f3b26f46ae764f7d67ae6fa8a6a7443aeabc2f0243a23a23b742d0
MD5 0da9c7b00c5cb4d3cea702de7eda7582
SHA1 ed0d2c20522ebbfc6aa2c9ae00dc119584c7755f
SHA512 1af745409185d574138794207a6527fcc08b1dfa36e388493d2414129ef5a91526b7318220c6dd105560557962d6f41040dad3b0071f0fe7ff89128e16d62444
SSDEEP 384:n56iF9CcmyWCs38N88TUNTUlIxBydvOo9adjf+8oug9FfggF1wRUhkP+lFYS/r15:jFccps3/wg3oOoug95vTwRUhkoFYS/fz
TLSH
T144B25B32ECA4DABBFCE64F89E74A7A07EEE00163858889D4DAD80D5D00DB19D1747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a17f870b4552bb489a3554487007cd249f573e5f7c017dfaacd27f227e150a95
MD5 eef5816c3a39bed15735ea214bcd93db
SHA1 5abe0b596ba8cff3025e601fe11e0f53eaf4868f
SHA512 eebc71c32918dafb55aa37f731c8e5970af2f9fa35f4f804b53c381d697a9e5dbd7208c8438bbf54f1a91437c5aafa8d477d49204ad90f04b7ab4dba6a47b1fb
SSDEEP 384:yAiFJtNnNnb9+38N/8TUNTUlIRuylT9djf+8oug9FfggF1wK1+B872+sRDcdvsPY:eFJjZbo30wgnBoug95vTwE+ygRD068
TLSH
T159D24B32D868DEB7ADE75B95F30A3647AFE4415388885ED4EAD84D0D00DB2DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 de00ba9b76018a7de66ee99b41068d6146ae0aacb64ba400d71cbfa24306c3f6
MD5 f8c04944c57f2a3c236c4b02fd17157e
SHA1 5588dbb5babdd6341c32b106d5a106498a2d494e
SHA512 c25d1c54c339053b7710b1a824b27942ea1da9733dac0b6949e36bbf3e6a6391b449c4696532b18723cdeba41aa96260ed9496f878f948f72fe2b16bdb656402
SSDEEP 384:yAiFKtNnNnb9+38N/8TUNTUlIRuyMT9djf+8oug9FfggF1wKz+B872+sRDcdvsPY:eFKjZbo30wgGBoug95vTwS+ygRD068
TLSH
T19FD24A32E864DEB7ADE75B95F30A3647AFE4415388885ED4EAD84D0D00DB2DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5655401b6b36a02b55bb76bdc12c0acfa43b40f2a605775c1ddc44de43886440
MD5 bd71ec2021a54c728b3aea4bf20a904f
SHA1 0c8bdcad2de6a5b3db3367a83237f79880ffb25f
SHA512 852b942fa636392233eab2387b499a96249a8c7e0f4444050ab51168a498ea7f2c804fe7eed86d6cf55989972f763351547889444a97826172dab2e59fb5f491
TLSH
T1B43111E15D7D29C1E0BE0EAF644738FC95ECD32AF4A830796848EED8463920D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 852f07dc6fac5879f2c1ff2a0b6a283900e23a829baf17ff4ed85346017c2d0d
MD5 05b488470fd37895762e33277dda6890
SHA1 bb9be160896c53601ebce78c7a25fab472f1e939
SHA512 14480bcd70d3fe14fb88f5be54c4ebfa62cd52afc0e545037d5b7ed422123b6868c5746185bb2b1a43b9df0cf4b9008e351288c7e052dce44d4e83e5dd4924d5
TLSH
T1B43143E16D3C2AD1D0BE0EAF649738FC81E8D326F4A8717D6448EDD8063920D654187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e1b7124ea5b99168a7c0f38255c1d9b159f6dcd7ad58dfe2b36c7aa7151cc161
MD5 5cdd109a8040e21bbe10ad59dd44c01d
SHA1 4e86f63587bb4df574e3437cacd33d832190f6cc
SHA512 0fa11b508cbef9eea983adfd9eea4912917fa47be8d30cd5c27d91259af6bf5d442d54849081f1178000d89d6a8855095ca78db53956fbbc9c0313763fc44589
TLSH
T1E24130E15C3D29C1E0BE0EAF645B38FC91ECC32AF4A4307D2848EAD8467960D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.8-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x86.exe:Zone.Identifier
Size 185B
SHA256 d06aa85e3075889a6ed0e8b6fc14686a81cd7be7275bdd69509766e52b547672
MD5 48cdaf390eba3d7f2c59a885fa50a7bc
SHA1 e383fb182ae1ca1cba153891060708a251928c8b
SHA512 5f99183b5185c0c37e1be158feadf3de06fc3afc5812dd1cd7db9db3e00f7990558ceb47a2752c54c80577961419b12ce61a4489946a240564e1d2454f505f06
TLSH
T1DFC012EBC80044520E3022921B6ED559FE0F2D166D81C38898C48096E9529D6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1052027175\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1052027175\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1380041638\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1742993195\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download