187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
Size 1.5MB
Sample261015-2sr2lattaz
SHA256 187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c
MD5 123b3493fbf27a83b9c3197848a4c4a8
SHA1 02962e52cc52be0caa98f790ebd92939908143fd
SHA512 d8bfd8381fd474634889af5a234e6deea6139d9da6f5f48a5011f1b103de4a85d79c88e185e5deb9591278bb3da2e25ddcaefe531283df7159269c1f858d25ef
SSDEEP 49152:vM9og1Pv3TDNtKrVv4YJCIMiVOuPDxW6uo7xwN0:k9ogh3TaJCvGR3tL
TLSH
T140752300278998A3DCE3D73231B5DB2746E07D45F1B1AD5E2629F00A2E33691FD1DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2324	Free Live Radio.exe
1792	Free Live Radio.exe

Loads dropped DLL 6 IoCs

pid	Process
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
4216	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Live Radio = "\"C:\\Users\\Admin\\AppData\\Local\\Free Live Radio\\Free Live Radio.exe\" /delay 0"	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1059812461\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1059812461\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Free Live Radio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Free Live Radio.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Free Live Radio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Free Live Radio.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Free Live Radio.exe = "9999"	Free Live Radio.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{AAF6EA23-0337-4FBF-BC69-AFCAD3DCE9FF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
3044	msedge.exe
3044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
1792	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1792	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
2324	Free Live Radio.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	Free Live Radio.exe
2324	Free Live Radio.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2324	632	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe	99
PID 2324 wrote to memory of 4216	2324	Free Live Radio.exe	104
PID 4216 wrote to memory of 60	4216	msedge.exe	105
PID 4216 wrote to memory of 4624	4216	msedge.exe	106
PID 4216 wrote to memory of 4620	4216	msedge.exe	107
PID 4216 wrote to memory of 4620	4216	msedge.exe	107
PID 4216 wrote to memory of 4620	4216	msedge.exe	107
PID 4216 wrote to memory of 4916	4216	msedge.exe	108
PID 4216 wrote to memory of 4916	4216	msedge.exe	108
PID 4216 wrote to memory of 4864	4216	msedge.exe	109
PID 4216 wrote to memory of 2348	4216	msedge.exe	110
PID 4216 wrote to memory of 4864	4216	msedge.exe	109
PID 4216 wrote to memory of 4864	4216	msedge.exe	109
PID 4216 wrote to memory of 2348	4216	msedge.exe	110
PID 4216 wrote to memory of 2348	4216	msedge.exe	110
PID 4216 wrote to memory of 5016	4216	msedge.exe	114
PID 4216 wrote to memory of 5016	4216	msedge.exe	114
PID 4216 wrote to memory of 5016	4216	msedge.exe	114
PID 4216 wrote to memory of 1472	4216	msedge.exe	115
PID 4216 wrote to memory of 1472	4216	msedge.exe	115
PID 4216 wrote to memory of 5616	4216	msedge.exe	116
PID 4216 wrote to memory of 5616	4216	msedge.exe	116
PID 4216 wrote to memory of 2176	4216	msedge.exe	118
PID 4216 wrote to memory of 2280	4216	msedge.exe	125
PID 4216 wrote to memory of 5944	4216	msedge.exe	126
PID 4216 wrote to memory of 4276	4216	msedge.exe	127
PID 4216 wrote to memory of 5188	4216	msedge.exe	128
PID 4216 wrote to memory of 5188	4216	msedge.exe	128
PID 4216 wrote to memory of 4844	4216	msedge.exe	135
PID 4216 wrote to memory of 4844	4216	msedge.exe	135
PID 4216 wrote to memory of 4904	4216	msedge.exe	137
PID 4216 wrote to memory of 4904	4216	msedge.exe	137
PID 4216 wrote to memory of 3044	4216	msedge.exe	138
PID 4216 wrote to memory of 1996	4216	msedge.exe	139
PID 4216 wrote to memory of 1996	4216	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Free Live Radio\Free Live Radio.exe
  "C:\Users\Admin\AppData\Local\Free Live Radio\Free Live Radio.exe" /firstrun
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:http://results.hfreeliveradio.co/s?uid=185c132c-6589-4e9c-9e43-c1dacaad26f4&uc=20181101&source=d-lp0-bb9-sbe-ab&i_id=radio_&ap=appfocus1
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe35e9c188,0x7ffe35e9c194,0x7ffe35e9c1a0
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,7728850463328525796,10289005333772128969,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      System Time Discovery
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,12431587637526401621,4121383942540641525,262144 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,9832969442987374095,9361467770145474839,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,5548013246863906619,11154405963005050332,2097152 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7475969104025258883,15732777372863733865,2097152 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,2011814890306025565,1022206730908518721,2097152 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,2427262877754578661,8024427444825498253,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7982268577842435340,8372416990682196169,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12270115513029574849,7513979888965685606,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12270115513029574849,7513979888965685606,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8234067250524792015,14762484819642823236,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6469593884012471231,4209151418979264406,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,8255184991769519611,5736785898838517750,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,6523219670821343917,8304242999491394844,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7457657773429228508,4444086119975436772,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,5056462463552917804,4681682717295350075,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,5482258836979042553,5796884476965197953,262144 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14511129757303051565,17847583567921699754,524288 --field-trial-handle=2260,i,15084462218870416838,17093851100236207577,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      PID:1996

C:\Users\Admin\AppData\Local\Free Live Radio\Free Live Radio.exe
"C:\Users\Admin\AppData\Local\Free Live Radio\Free Live Radio.exe" /delay 0
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_etld1_domains.list
Size 6KB
SHA256 8babf90cf0c44b6e36537a8535a0e3d89e04001ae8b08a7fb50a51419c88a2e9
MD5 412aad0c01696dda21dfd839dc7ae2c7
SHA1 28a3a41d4d8dfee7fcda638c4373aeb2b384cad9
SHA512 944d8cb2340ba8fe3dfb84dcaf2b600f33f5e944e488be0bcade0787a73d3f6fa4255f005d230d74e0d8d13a7ccd4d3e2144626d6ea4ea3beb078f3cdcf71e31
SSDEEP 192:6D8dUysbBX9GyjW7xeU1ypJ5cz626OpqRiaFDBGUPJ:I8dUystXqsU16J5lvoEFlFB
TLSH
T1C7E1BFECF4C887F13BF43727C47F2A431A0EA119BD5A5229C91E6F00311D748182553D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4216_1986670917\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4216_760408374\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

Free Live Radio.exe

Path C:\Users\Admin\AppData\Local\Free Live Radio\Free Live Radio.exe
Size 2.7MB
SHA256 8a8e1b74d404f5cd680253eee7342220a8e18f0e71e8a1a5aa3473a47556302f
MD5 123714923607754257a7f052ccc0311a
SHA1 b6dd7a6c6b289ac0b97dac2f390a64b8e4f014e5
SHA512 ba66cc870ef3ae8c8ba422ac4641b0a6b0f938e84c36ab33ac4bb318dbb27663b690c0c9f9df615f249b578eb534ee365c963e09d4641858892a07cc8cf7e13b
SSDEEP 49152:OlWwlvEEI4B+r+XU7lgkUyfc1qaXCwL7v+ABH0/uWdMyWjevlODyYX4KqC0FYT:O5aE9k7lgSc19tL7dHrDR
TLSH
T1F0D5BF213A81D437C13201725D3EE26B657E7D129B6408D7B2DC7AAE1FBCAC16632F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

169b5ffd-4e5b-4811-b854-3962716a73da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\169b5ffd-4e5b-4811-b854-3962716a73da.tmp
Size 25KB
SHA256 e054cf46b0269cf33ef49bc7ae3c485fce03c70bf6ac50dfe08847de6eb323ae
MD5 8c4584bfa80366dfaee68f1f69149e05
SHA1 5a163a767e8b444ffb55d4715a89b86daa192eca
SHA512 ee601b628dce5185afd538262cf1b705b376b0d46953f2a64001022b9aec2cc633572a1915d911c4296098c060c96acbce3fa28942a66845228aed333b1147a1
SSDEEP 384:npiFiZcI63sN08TUNTUlIm25mg5MnK2fMBPOmJu/LBXHN7O6R2Feo4gL/7IzQo9:AFQ63pwgSDQBPWXHN7TRya
TLSH
T14DC24C32EC94C9BBEDFB8F99A74A7A07DEF00263859C4AC4DAD95D1D008759D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

881598db-6961-4b6f-8552-812828477194.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\881598db-6961-4b6f-8552-812828477194.tmp
Size 26KB
SHA256 55e1c871035f934cd59a16e4cb83d8556f19e5c575208d9daed102371a14b461
MD5 ae5089b232371e88227b887e5abfcac9
SHA1 560467e0e088cecffe52136bee6ae9d2c68e4270
SHA512 7be433181c4461db0badd322c76f11f19a9402aed4455556542f32a71f3af2fd0edf5879a826b0ae052fc9f6ad5fd60dd6223c204018b72d97868c21563f0810
SSDEEP 384:nv2iFiZcI63sNb8TUNTUlIm25mgn2+Z6K2fMBPOmJu/LQGgH/7O6R2Feo4gL/7IX:VFQ636wgS8JBP3H/7TRya
TLSH
T1FFC24B31EC98C9BBECFB8F96A74A3A07DEE05163859C8AC4D9D85D1D00875ED1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

16ce1233-785b-4b50-ba0f-f988b6bd6ffb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16ce1233-785b-4b50-ba0f-f988b6bd6ffb.tmp
Size 414B
SHA256 15a08c08bead9549f98ce99ea149fff606d72392db704162e09c7572201c32c3
MD5 bc1159f4dfa77135514fc07eaea225f7
SHA1 bbe87d88aafc0c37cd9fdaa9b6ce13a6776deb84
SHA512 4be12c7d6a7059ce9d047fd51bf9fd0c87afc0d8433966d45470565c0e327e36af1ba8914ce3b267c3bbdcbcc6f6966593811fd949a1d5c57087f7b31b7625cd
TLSH
T1B5E022E9C82ABC7B4DFC0B2854A40686EA51034B2B80888B373C800D8FB1A76428686C
MD5 SHA1 SHA512 TLSH

Submit Download

8fd5c75c-8be3-4991-a817-9ce035240444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fd5c75c-8be3-4991-a817-9ce035240444.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9323fce2-f7e6-4c25-97cc-37c84a870160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9323fce2-f7e6-4c25-97cc-37c84a870160.tmp
Size 13KB
SHA256 5b687547dc17ea0da9d02fdcd75ae19ece44d71a238cae4be3c052febbf650df
MD5 2f82512f55b7fd10c8f616b3599ea4fd
SHA1 31bee6a22d150e9d56d2732725bb3cc482f9b14a
SHA512 46a134e919d93fd173d982163f97f4a0a7382985eae078d8065db97d4ea698f90663401fadd3443fc59c3386f049049e403c19ef50bab0ea9d8b7586967a381c
SSDEEP 192:sxZrRmw7/fKsKQZZNINrwzodpfglVHW6+WNxAx/rIrEg5Iai7VI5bWUybINaHYYn:sxZrx7/fKsKOZNSzkHbC/rM/8VoSYhjQ
TLSH
T16C52E956A9286A3F4CC7D51AFA55BB22D3F95033A1944E46AAFCCD1C04EB6DD210380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 54b35b8e012190eb813e40dc03935e627d9b2f95f4661dcdae595a73f3e34f2d
MD5 29c2c597ad33584380725806736d1a9f
SHA1 06f50e57e8bca7afbc47b873c1461af3859ac5a6
SHA512 ead981a3c50d7fd8670d0b4969ecb5f1f91ce5305cb6a0b8fe012408c4f67bff04e1773a0704ab13afe166c46be96743a3d96de71fde05495e35f5fe240563d3
TLSH
T1BE61FA82EE50441BFF95BFF09CE4257736B866F254835E1218F8E8F55B823B482E5840
MD5 SHA1 SHA512 TLSH

Submit Download

597c1a13-3b82-4b02-a1a5-bb486507a209.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\597c1a13-3b82-4b02-a1a5-bb486507a209.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_results.hfreeliveradio.co_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

22c98210-003c-43e4-9faf-251b9dea1d09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\22c98210-003c-43e4-9faf-251b9dea1d09.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a2036637-7709-4df2-8b05-8667dd2542da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2036637-7709-4df2-8b05-8667dd2542da.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

effe2331-99bb-440d-bb77-b45986b5c319.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\effe2331-99bb-440d-bb77-b45986b5c319.tmp
Size 7KB
SHA256 f083ce3ed807248ad1249a80505050a9090c6505bf07ee51eb1f5bc5fb61fec4
MD5 7fc1d1d3517b5840cc93c14e729f0cc6
SHA1 56641fed669946f0d41712ef9485f4f3f5857bed
SHA512 01d0e933f5b199c766b5f16e563294a9ad5398093393a26f0128ada8a6382c67ec9e7efe88f2018fdb79e9daeab0c4678ec01001ec5d2c7e64c4ce4691b9af0e
SSDEEP 192:D1E2Wl6ehGpHeFAaa4L12iGRgR5PHYiRj7C7CVmajpjxaTT:D1zWl6ehGpHeFAaa4L12iGRgR5PHYiR4
TLSH
T1B0E1CBF7D6E8867D8B5192F0A6247B2BDF1C0529432C3C5AC1E89F5EE3F2460E28151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 da85810c2d5a1585f416cdbab02ae36cdd4431152bde9f5e76e3c43d02a4fd3e
MD5 2be931539f5ab0cbade2016bbd6a0064
SHA1 61b33aa2d7d7dfdc73c534108e998f4db48f4a3c
SHA512 7557b27657574124ee49580ae9a24e688ca6c3dc94c9b721c0367ab84ea6a9fdbd5262f90e3568532c7759eaf86395d79896648cef3939d6bf1ed74d3b77f6de
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXal1/3:OtfFvpopPxrB4Rhfar/3
TLSH
T142B2631471BA021038FE791881B59B6F064232B33159EA7B7FBC14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada55746-d02a-4e7d-a704-325151a7a39a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ada55746-d02a-4e7d-a704-325151a7a39a.tmp
Size 13KB
SHA256 c9d75e3e378bd320e0da7d622877970ef36221a3da9c1ab6c06198050c7a0064
MD5 af0061ceea47aad710e3a5595259ea71
SHA1 db77ebafcd37992e15a9f3234f1b5455d37d341b
SHA512 0eafbcf44e8aaa2a99eac00092dca8ee55dce65ac1dcf7f291089404defded2ecf6de3e31b831b7ef6e31095eb9ca9d8677e5aadf87adaee0b917b2de81a643f
SSDEEP 192:sxZrRmw7/fKsUQZZNINrwzodpfglVHW6+WNxAx/rIrEg5Iai7VI5bWUybINaHYYz:sxZrx7/fKsUOZNSzkHbC/rM/8VoSYhlQ
TLSH
T18452E856A9386A3F4CC7D52AFA55BB22D3F95033A1941E46AAFCCD1C04EB6DD210380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2b58c6c-d66e-4f93-8416-957b022842ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2b58c6c-d66e-4f93-8416-957b022842ae.tmp
Size 13KB
SHA256 c97b0197927592eede835f45de304c90b6a9bf1eb86c84c1b548af0a5a0f3294
MD5 7830c1bf62191b1e2532ac46fae2f76b
SHA1 983f113f9e912eb7271a52965a34e6a8f9de2166
SHA512 d1207ae9d87b8181d99820a1ade9d7f86de27a63275e847f7fbb0a72f6217af4bb27d471eebe1363734c210bca5a2b0432818c387da87452f3fb9c2703580b77
SSDEEP 192:sxZrRmw7/fKslQZZNINrwzodpfglVHW6+WNxAx/rIrEg5Iai7VI5bWUybIAaHYYA:sxZrx7/fKslOZNSzkHbC/rM/8VoRYhWC
TLSH
T12F52D856BD286A7F4CC7D619FA55BB22D3F55032A1941E46A6FCCD1C04EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0021805-cf8a-41b6-ab7e-2d72f92122ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0021805-cf8a-41b6-ab7e-2d72f92122ca.tmp
Size 32KB
SHA256 68d67d9c1fe02a97a9a68c4b98f52c1625382cfb3a296da65b91be28d5ea0f49
MD5 284605b00dd576f3c8e6f238fcb1d797
SHA1 eaa425bc66e081684fe12346558e0533218fed82
SHA512 93f06e1a7471951e37cd3697fc162e6de8d6e1b10d08dadbb3aa1605a70cd34811e66e6c2825604a764fcdd14593a210516662e56f683b7c9629a28e152b5e8e
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OViwLWLlMC7fnroU:0RyktjYEbvnWvDBltu1jaPwLWLywf0L4
TLSH
T1C9E2FA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.155\manifest.json
Size 177B
SHA256 77a882c1ca9977c89f8e67a15ec1854a8eb84e1e79bf7009808ae9eaf5193b65
MD5 b9662cf1a01e6a1e875d12cf69862abf
SHA1 8644cbd5900e21cf6422e12dcd8b12c203f32504
SHA512 840e37081ac9b9974a0c9c151d17c04544be2b70810a0a2d5baf30f0decfa927596df9282a8b9728f9588a6da051962b45b3198328c1df05bec31c2a7b9b0858
TLSH
T109C012EFDC509DB115EB4323156D43C4E733CF0B1546450935FB66082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af4137d0-7413-4176-bb93-166d10cedc4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af4137d0-7413-4176-bb93-166d10cedc4f.tmp
Size 26KB
SHA256 bfd94a584b8d51c3c39462586890228e0b48eb638693dd446bdf82a141a28301
MD5 d3a99da397a97609a04cd761c6ca7b48
SHA1 eeb52506e83fb97b6f893527bb92eaab96422f04
SHA512 21670c1e05da400f64ff1ceb402f77913324a2fb47b55da403d7dcfeeb883e9101996b9b89154126ca22c46bbb74867991435cee5d23f2bfb4bfb84c5cb691aa
SSDEEP 384:nu2iFzQkUSv63sNn8TUNTUlI4/2E5mgSHVZpK2fMBPOmJu/LQGCH/MTWHgL/7Iz1:aFd63qwgFl8BPLH/MTRLc
TLSH
T178C24A35ECA8DABBDDE74F95B74E3647DEE0522385984AD4DAC95E0C00872DE1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc0ab8ca-3166-4b89-93aa-7de2920a83a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bc0ab8ca-3166-4b89-93aa-7de2920a83a3.tmp
Size 31KB
SHA256 8fe5d5a9e7953713a52439c173e85a837c787131f8ed9581edbaa3d0bd57abbf
MD5 6b7318ac3d51d2c97f7526619214c695
SHA1 e457341f2681f9d8ddfe7f8b3ed76459bb2a6dae
SHA512 225eb4473d7c811590891068270d0b1c6e55d6188fc839fc040d610564a442eb14612a4c33b56111edf135b0ff048c134df48cc8a5e5e9f2a1d8b5afa6213fda
SSDEEP 384:nyqiFzQkUSvvL3sNn8TUNTUlI4/2E5mgSBtZpK2fMBPOmJu/LQGmH/MTWHgL/7IR:yFdz3qwgFb8BPVH/MTRLc
TLSH
T176E29FF5A8D7897BD8AE4B97A73D2E029ABCD113B5984984F7C50D0CCC821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c54d6c0d-38ad-472b-ac9a-5687784f89c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c54d6c0d-38ad-472b-ac9a-5687784f89c2.tmp
Size 26KB
SHA256 7c6662e19bffdff087cf28578995c624b90de2539f037444a23d1bde951a6b2d
MD5 3a9e4127f4daf5272ee7aeefdb6c696b
SHA1 ea0e7517b9925de96079338de170bb866fe71b60
SHA512 4b9c3fbae2f8a6299d9ee5fed9526313b9a1238a29630f35dfe662b72cb234eac08d01b28dcf5258e8f4d2d7daccb45dc59a11904dada60636a9e1ea76837b38
SSDEEP 384:ny2iFzQkUSv63sNn8TUNTUlI4/2E5mgSBVZpK2fMBPOmJu/LQGCH/MTWHgL/7Iz1:GFd63qwgF78BPLH/MTRLc
TLSH
T1A4C24A35ECA8DABBDDEB4F95B74E3647DEE0522385984AD4DAC95E0C00872DE1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6198a3fa-9e3a-4c1a-9a93-d2f932428da7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6198a3fa-9e3a-4c1a-9a93-d2f932428da7.tmp
Size 2KB
SHA256 f63863ce415d4590d68124ba5b99dd17c732a2c19b4addd2e68bb3d57f678754
MD5 b95b40e79e9e7d0d94a35e6c3f7b9742
SHA1 a8ce3bd3c90d4a652ed935d3fabe7f96c10de770
SHA512 f6b0f5d91fcf8769ee492ae6dedae819bfa29c383043550a380eebf351eceaeecf686b4e7ba0953134d9ef0eb9ac20e08ea1576bf0ace5fb48e372b425ed277d
TLSH
T1E44120E05C395AD1D0BD0E6EB49B39EC90EC9721F4A4347D38A8ED984A3A61E614483F
MD5 SHA1 SHA512 TLSH

Submit Download

776d9d72-8879-4710-90f8-9ac980afe3d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\776d9d72-8879-4710-90f8-9ac980afe3d6.tmp
Size 2KB
SHA256 f948e9e90287c668d7d72e7c937f32cdcb7045a9b5579e0d375fb1d67c5a2793
MD5 f3cde2e94b89dc02a389ff301035edde
SHA1 3851c64cd35c5efa32d0d4538563db89fc6dd649
SHA512 66d9b065533ab909bdd7a32ae3006d2af878d8c71ef0ea4ca2f86e0fec58515d250e1f7da44d79b61bd892b0a1d6a53f1de058989d720a95667236115518a83f
TLSH
T147410DE05C396AD1D0BD0E6EB49725EC90EC9721F4A0343D7898DD984A3A51E614083F
MD5 SHA1 SHA512 TLSH

Submit Download

b2650566-fe38-42dc-bb51-707bda58a2cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b2650566-fe38-42dc-bb51-707bda58a2cd.tmp
Size 2KB
SHA256 76a091bc8ec9789531ee861ec40b98b5fc19c1cedac72b10dd2fa5350f364356
MD5 5a8c5858a7b39cb612dfdafd75b6e709
SHA1 89165f53e7ac0f31405f72f2d910beeeb0e73862
SHA512 19dc9e661a7586749f6fe4d12ea1229b47aa80199507c41727c1204f14724d43ac806280b6678a0460488cbff4f0b08e4f12bc4bd1e0f3b26f6adc6aa842241e
TLSH
T1BA4101D04C3D1AD1D0BD0E6EB49B25FC94DC9721F4A4387D2868ED98493AA1E714483F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43b0ff598b26da7038a1f8da684fb48159cf5f41b67b80c686424bf3bab2eb32
MD5 00b2a67191430005ab937a7a4578a981
SHA1 b9aff0cdcd085332f5fc4b6fa0b9490fc908042d
SHA512 9eacb07b862df6e792eff0d60ddcd3ad6e0bd66e67f3aaea2805aeac99bc1e9accd254d68753520d4a16e1f30bcd57dec8370cc855e4c86ec3d59428cad93ebc
TLSH
T1FE411A99B6EA1148B3B76E6AAFF6A86E447FB9272E06D45E00110D4F0662B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnA41D.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnA41D.tmp\npHelper.dll
Size 276KB
SHA256 7576aba6b1401abcdf821ef63d447d855b584e66fc6a3e87984b0a3ea47a7c1a
MD5 f8ca603bb06b017d25373e46d419fc61
SHA1 5bed6ab329b26b3be62c3973ffec9d7cc0b8b6a7
SHA512 2a662082bad2f7aab06f9d5d32d5bddab4fd14aed4576a3231b2b7bf7831744786ace3ded8d21ddf10ab5aeee1a0681ac5067cd8a702b808ef01d7a98a471ff4
SSDEEP 6144:IYQ1Kr6cOyE8YxY/fecRAOuO+/aPv4Y9dsUXPkG1p0:IYPF3E8Y4XkdMr1q
TLSH
T1E7549E117582C432D4BE053018789B6A46BDBD300FA4C9EFA7D41E7D4F762C1AA36A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnA41D.tmp\nsDialogs.dll
Size 9KB
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
TLSH
T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Free Live Radio .lnk

Path C:\Users\Admin\Desktop\Free Live Radio .lnk
Size 2KB
SHA256 cf7fbfa61ae13ef088d33194c8f70df05a065215b70719169a2ff49c0c0c95d1
MD5 6398a8ea0918ce4d8d1bb6b8d7e71612
SHA1 24a2cbea307229f2baea11f6535c4f6ad2eaf1f7
SHA512 a27bd56709a318ef27d9e64262d2c0d4866528b8b1c3b365d5c3212446b5e4c3ef71e4486db7b04f03252abdc4a671f0218d433de3d3e88cc6c91a2b6a5bcf93
TLSH
T14341EE629AE21090F3FBF83EF5F323058370B554C5292E1E81E0C14A5E63B425EA9B0A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-21-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/632-20-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/632-24-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/632-23-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/2176-285-0x00000167DDCE0000-0x00000167DECE0000-memory.dmp

Download