873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity/Velocity.exe
Size 32.9MB
Sample260619-v9cvnsbs8t
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_122458019\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_155326399\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_155326399\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_122458019\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-sl.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	msedge.exe
940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263644942230852"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{27A7107E-77C4-4253-8C02-C1B8ECD9A4F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5904	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 5904	1276	Velocity.exe	93
PID 5904 wrote to memory of 3968	5904	msedge.exe	94
PID 5904 wrote to memory of 940	5904	msedge.exe	95
PID 5904 wrote to memory of 4016	5904	msedge.exe	96
PID 5904 wrote to memory of 4016	5904	msedge.exe	96
PID 5904 wrote to memory of 4016	5904	msedge.exe	96
PID 5904 wrote to memory of 3400	5904	msedge.exe	98
PID 5904 wrote to memory of 3400	5904	msedge.exe	98
PID 5904 wrote to memory of 4148	5904	msedge.exe	99
PID 5904 wrote to memory of 4148	5904	msedge.exe	99
PID 5904 wrote to memory of 4148	5904	msedge.exe	99
PID 5904 wrote to memory of 5996	5904	msedge.exe	100
PID 5904 wrote to memory of 5996	5904	msedge.exe	100
PID 5904 wrote to memory of 5996	5904	msedge.exe	100
PID 5904 wrote to memory of 3172	5904	msedge.exe	105
PID 5904 wrote to memory of 3172	5904	msedge.exe	105
PID 5904 wrote to memory of 3172	5904	msedge.exe	105
PID 5904 wrote to memory of 972	5904	msedge.exe	106
PID 5904 wrote to memory of 4028	5904	msedge.exe	107
PID 5904 wrote to memory of 972	5904	msedge.exe	106
PID 5904 wrote to memory of 4028	5904	msedge.exe	107
PID 5904 wrote to memory of 2304	5904	msedge.exe	110
PID 5904 wrote to memory of 4668	5904	msedge.exe	115
PID 5904 wrote to memory of 5092	5904	msedge.exe	116
PID 5904 wrote to memory of 4652	5904	msedge.exe	117
PID 5904 wrote to memory of 1384	5904	msedge.exe	120
PID 5904 wrote to memory of 1384	5904	msedge.exe	120
PID 5904 wrote to memory of 1332	5904	msedge.exe	123
PID 5904 wrote to memory of 1332	5904	msedge.exe	123
PID 5904 wrote to memory of 5648	5904	msedge.exe	124
PID 5904 wrote to memory of 5648	5904	msedge.exe	124
PID 5904 wrote to memory of 4468	5904	msedge.exe	125
PID 5904 wrote to memory of 4468	5904	msedge.exe	125
PID 5904 wrote to memory of 2472	5904	msedge.exe	126
PID 5904 wrote to memory of 4292	5904	msedge.exe	127
PID 5904 wrote to memory of 4292	5904	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Program Files directory
  - System Time Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x314,0x7fff0a21c188,0x7fff0a21c194,0x7fff0a21c1a0
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,10278433078490767817,9386005137904437712,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,14691063114958866901,11119520542675903882,262144 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,18213960835951223232,14159420281149386212,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,9462586236834692827,8340320162505809249,2097152 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,2881218389352557944,7716032146292233019,2097152 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4864,i,6991211215090681017,15745791045084548403,2097152 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,18173404308444386378,17848165417076030023,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,10228775363771018734,8193941885997630187,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,15117961546300177988,835235207175941868,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,15117961546300177988,835235207175941868,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,1567433332725343039,3275266774973400251,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,11785297701114127815,2360825981977687211,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8118782741691684282,16049976463688343033,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3252708560194957075,3530487543234660357,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12880507471795605363,15264200334419590929,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7636497802101185040,1922433420287760528,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8124952909364292606,1896961707611414881,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6404,i,15941442958854239103,10290975761278798254,262144 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6236304992764535993,11060614593010248147,524288 --field-trial-handle=2276,i,15706725194627433186,7470063966456483031,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_122458019\manifest.json
Size 118B
SHA256 c69f54826c476aba601ad617d924a7008ef9682bb4d0f18dd96f3bbbbd335c56
MD5 609afb1d30a5a4f845f09b67253a6b24
SHA1 ac6706533d045576079ee4fb37010f58529d5b27
SHA512 3fe729bafa2cc74cadbcab5e2062e1c797feea1527a25b982268591f4809cdec01da52c2cef55a521c46e307638634dc5f320a228ccfe3d3b3c2a7f947b05441
TLSH
T1CFB092B00C4AA03B22C09360ECA06A8283F81218E8021B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_155326399\manifest.json
Size 53B
SHA256 34c6c656afcde12c0ea7c692ae7565eae13bad0400e1bf3d333d7180ebd2552c
MD5 bb42365a05fddf6f1343d4b7a6f456d5
SHA1 d5a660cdb20cc10d1e5afaef4af5468918fe42c6
SHA512 51fbc63d4af85745f78c269f2ebce4314f91a1c2ccdf4a32e25d76901b746c0622a31ae649098ba899e5bd0664b7175546d94dda2bb0c940d7fcde4697760f8d
TLSH
T1B69002604414951716C10E5065B0B8819391661995850D1D04451759029556CE0502D8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1626046729\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1657392895\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 62f476a0ac92a385740cff9fc4d94d5f52e38e6ded5ffa7bf603c2f2f9baed5f
MD5 4167124746d9e6c8329318ecf3024382
SHA1 becf3f1c8a2f4e1d1d961034bfcbddf4c81c357c
SHA512 e70cc4e79221c62d8079d4c2a556e5f06312b33c6fdcb10b62c8287f9bdc6141a3c793fd4b3bd088ca8c5b81f78f582811b1031f6726cf7b6c7e162570e895c4
TLSH
T1FEE02B66C872EC3708FD0B19E0499A46E70113173E40494F3A3C920C8FB4A3A85C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1eea6e4048d58245b491a1ffbd35d9d262897889eb739fd6cca43c51d7523c9
MD5 fb51228634b0699655e7de32393db2aa
SHA1 e482b907f344aa54b2accfac0e000ac7670c33ac
SHA512 7b821c9dacda93519e7d3265595639649cddc22e4f0991f4396c58e0fd002358f7d8e22bd491c99f666a140fffe20f1e1044a1b7fe5430cc3946fc5a2b9b1ffe
TLSH
T10341BDF383F4856ECA1196F0AA18BE2FCE2D0514432C7D9A85E4AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0fbe3da767d4a559cdddb440faedce42aeaa9da2fe917c36c684b2091b4e74cc
MD5 09f1b669623571392499c2d74120cc41
SHA1 796ac50ccecc8ea160343f322551c48b1ea1df7b
SHA512 129c284540a4b8e85744ff9037094488c2f357a110a22c5d78a12fcf9b20338c9820f8349dbedce30db614cbbd275ce760194f7cfed7114bc9e0a19d663b2d90
SSDEEP 192:sxZFRYJyMqZjK1Ml8UQsiW/fIsOO2ZdIaRuvyzodp6hHW6+WNrgn/Yvm8dvjIg5B:sxZFjqhW/fIsOO2zIKYJaHbM/YzWm
TLSH
T19172E806AA74497B8CD7D619F645BB53D2F51162B2904E84A9FC8F0C05E7FEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fbdb8b0b54101134010bfaa40cff0998dd7995fc667b7eb3caba7b1ba20917be
MD5 dab3d45b9b06adf16d4639e0266909b4
SHA1 60ee2146e446abdb7c6611687b2d1127758aae2b
SHA512 a9e2f62627b262e4b256008fc7116c4ca009df9615c45896ed9fe3e60b5ab8b329b84fb85443939931e6ccf308a0869355f8a9f55b54540dd64a2ec1cb450eb7
SSDEEP 192:sxZFRYJyMqZjK1Ml8MiW/fIss6OjaZdIaRuvyzodp6hHW6+WNrgn/YvEu80vjIgy:sxZFjqW/fIss6OjazIKYJaHbM/4zjO
TLSH
T13362E906AA34597B8DD7D609F645BF53D2F91163A2904E449AFCCB0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9284b2038a16a76f373d4d140d94b6593a8d2368cb06c51a28ed6ebd4fe1fe84
MD5 aa225caab4d578416612392eabcf638d
SHA1 90eea5cb12cf1f951d186048f147cf1b374f5994
SHA512 d76c9cd5896a726ec93cdad869703e7fe20827719d017ed68d24852c7698dedd887a1ab4c9be3c7adb3dd7de9759e2c8124463802cc17d5f51f3eddeb29690e7
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOysy10Llz:eY8Od/HEnFhWvFvmXu1jaKt10Lm2NuLE
TLSH
T1DEF2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE801CB5698895447FA844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 951e6ddcda30a5b869571fe84f3811bc2a626f707fd00d0b6f12f8ec0ab283e7
MD5 504d0e29172bd9c178fe0f00a7b081bd
SHA1 bd61814e56443df6c694ad3a07d7db0155c019c2
SHA512 735f4e13d2eead269ff1ffc45a6ae407c9d751f9c3d3f85c5fc4bf67749dce498b65214b0d2d1cf7c64b391642c7a4947514bbcd6015c18f358c17b339b6474c
SSDEEP 384:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVBtTChBG7c:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVG
TLSH
T1A7B27A5A703B0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.12\data.txt
Size 147KB
SHA256 1c4baed71f2c86cc449c5afac08c9a601f2b4928b42556162bcc327564295fbe
MD5 220b967f37c210bdc91ea3c91c21f2f1
SHA1 82a989656634676ef5dbd273b554a66ad88299bd
SHA512 df4bedaab82ba2d1590fa78ba78125ace31d7752a7b8c9043ea1817017d6649b28a22c99bdcfb5a0d186c3b67f5b3e66562e35fded4ce0f58b7f9ef322c3393f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEsoMIGaHD9XG:4X1aI5aZoKzMJ07NsoP98
TLSH
T180E3F211CDC41BDDDF6C252860BE0F1E93E1865D852B76C9E763FE0A6FA790852231C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 672230630df08f24b5fa097652e6837651f231b4066061ce46f0b3d986a0395f
MD5 587b29709b257ab24e5fd5fe19b9be48
SHA1 b267a91c2b84d505c9d558e1ea1b36bc524c974b
SHA512 bb838ed3fd0a84752202c19e6a47ad9e8708a2d2c13d6f77398cbd60eb6c6fe9a1cecd7bc168fb0465d76eee711ae3311bceebf579134a8fa691556059d2f7fd
SSDEEP 384:nhiF1tNn/s3n9Sk3sN48TUNTUlI40QckCrbAVphiftGgEM9Dg9gmtRFd4CpmITGi:IF1j+9V3Rwgfkz7oGgLggmXL4xi+01vb
TLSH
T160D25B32E868DEBBEDE74FC9B70E3A47AEF00167949859D8D9D91D4C00971AD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1bc62edab5fc0046d74a37771b5d48db9977bda48cef5a9883e4b70912c08629
MD5 6f3f05fbdd32cb700c47cae4a1a81704
SHA1 d53a50085ecf90536cb3c3cb436f5d6dbc4756b6
SHA512 a625e93b54de4aea673a4be6675962a7669493ccade443d69052856fafaae64b968688335ac589bbfaa4fbb12cb623f7021d0dad42e0cab162c05193997dd3b5
SSDEEP 384:npIiF9CcmyWCs3sNy8TUNTUlIm2QckCr9lCKphiftGgEM9Dg9gmtRFgrpAe4KV8x:pTFccps3DwgbkUIkoGgLggmXOSI8p0KX
TLSH
T1A9B25C36EC58DEBBECE78F89B74E7A07DEE41267859859E4DAD81D0C009319C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ef3067cc7b43544b5eb097efea09969c646d1adb8bf1e5c094c38f02aed423ed
MD5 6462aa3d64bd394620ae50d3a023896e
SHA1 e27882c57d9e82e0640f5aa8cf6e4f1b58ee0140
SHA512 d2ec321452890d7e960a4d81d952d194b99da4ee08a851f1324026d142d9f2361daa9e1960139e45bd2203889ed85eccd4a454fbc147469fc3937f0c4b06ec8f
SSDEEP 768:pPFccps3hwgbkUqIoGgLggmXLfxI8p0KX:Rs37zeX8I8p0Q
TLSH
T1CDC27D36EC58DEBBECE74F89B74E7A07DEE41227859C59E4DAD81D0C00931AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c0e796b4a31594c1c49c4bcd8cd2c094aedf80a186050badc9c16b22c1509a6e
MD5 9f1bb2317be211020196aea7d2542950
SHA1 efe3f18a9b5ff61c3d48a5c2a0370e671515c002
SHA512 812dd7d4cbf9d54a4be85241ce26273b722fccf060bc920aa0cf02b02f1e8a6aa78c7dc7b336c8288e7f09989bf47b7b8a7217373e4037caca40f4499a7fab0f
SSDEEP 768:pmF1j+9V3Rwgfkz7oGgLggmXL4xi+01vb:39V3vSeXRiZvb
TLSH
T175D25B32E858DEBBEDE74EC9B70E3A47AEF00167949859D8D9D91D4C00971AD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 837b75bd582767b1f7a0717d3756d8040cc4956658b85bfb3e882c5d828467fc
MD5 135d53c49232f8c99fc4eccf487f8e95
SHA1 f50154207d2025111b68e12530b423d1976d8e74
SHA512 2014c0f29be72ddae1373103ed9d357ce65d6821f071c21293057d68f76746b37463ff1721bdd63ccf45ac3e3d4f3c5be82a5371d7c72e86bb6b75605f301afc
SSDEEP 768:DF1j+9O3RwgfkA7oGgLggmXL9Pxi+01vb:q9O3v/eXgJiZvb
TLSH
T13DE2A1F298D799B7D8AE4B87673E2E469AFCC153B4885984B7D81D0CCC821BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.19.1\typosquatting_list.pb
Size 605KB
SHA256 7da58ff3d84feeb8a94b55e70518e057296402a1da741ad8e49a94fabf1eaf93
MD5 93453121ea141385a7a9491797631215
SHA1 0f89c47fd4a62433127ed6887d962f3e6768b981
SHA512 3b318c36c8b12c384e25f0b9cf3dbc0d75872b074c10b3093f339abebe4575f04c9cc03ce1b073641c2a2644b89a59fc593cad7dc8eba65d82f64fb150c34e73
SSDEEP 6144:UaN6nBkyjTP0IJwOY7qU82A8fdkZwOG8Aoa:HN6nBkyjQIJwOcPkZwOG8Aoa
TLSH
T103D4B4B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7C859F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

187219df-0479-464c-83c2-53395cbb14c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\187219df-0479-464c-83c2-53395cbb14c7.tmp
Size 2KB
SHA256 14f35ec7b58aed84db5865e482d1758b3ab8f73734f321dc1dfe70f8d6c41133
MD5 1e87c35fd0979dc081ee539945000f40
SHA1 7288cd61033108306bf372e20c3809496f3622fc
SHA512 b1d850e81f53efb8feabfffe937863acd33910ecf4c4c7f8bb2ad0323cd78b870a8330a459fee91325b82c0bc79a6d862d81133f717d03fb7345a671671a0a75
TLSH
T1854141D15C381AE2C4BD0EBEB49739FC85E8D725F1A0347D6898EA940B7D94E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77b551c02e11e3960190d54246ff4bbda71bf67e1e2bb66d661e46f5d4bf90bf
MD5 47fa9803f547843add5ad2bca9e50cd9
SHA1 93cdc68090675fe3baecf2b82d15db32a21d238e
SHA512 31bc41245373aec341a26b882199d96535123aea94c1058e343fabdf3f4d9aa2c9d4fb42f7fb92eadf1c77dea99bdb3afc1a2cc752562ac716cf2b6c47014071
TLSH
T1DC4110D15C381AD1D4FD0A7EB4DB79FC84E8D62AF1A070B92858DA844629A4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c50fd2f8ae0ad62dde4d1063f6bdb762b1eac8c5196a97e6b96b43608b7e0721
MD5 df3b7884e5bc46d35b327459b49a47a9
SHA1 e32b48d375d23db3fe78d54c46e4a06abd0fa9f1
SHA512 6263cf3ab7e273c6da67fed3f2a4aeff2914b85dd3d28c6cf4be4f9df77f77ddd8366ef85476a6f3df72bdd16deae25274887b9cad8bc7cced5412b278e57292
TLSH
T1354121E15C3C5AE1C4BD0EBEB4DB78FC85E8D62AF1A0707D6898DA94062D94D608143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e6ced9af0b7edd04b3a429e9c19371261dafcd4d9a301a62011fd4d92c2f23c5
MD5 69a9e4fa7607e055f5644a5681eb3eeb
SHA1 d2bb5eee775036207ff4420eb35511a9b43269fa
SHA512 24b4875ac440a9660741ee0b90fceccdf8034b0f22511eef4d936730dfa9d55ed26d0232a8ea15a052411d4f1bc12da290248146718d77d3c6992e0e64dabacf
TLSH
T1C1412B58BAFD1148B3B76F569BF7A46E487ABC772E0AD45D10110E4E0627E40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2304-171-0x000001CA2AB00000-0x000001CA2BB00000-memory.dmp

Download