e60aec2c5115d65b3acb3c55ea21576dbd770f579166c017125571e46ae560ed

Analysis

max time kernel
299s
max time network
328s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/07/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WorldBox God Simulator/MonoBleedingEdge/etc/mono/4.0/machine.xml
Size 32KB
Sample260716-bpskvadw2w
SHA256 e60aec2c5115d65b3acb3c55ea21576dbd770f579166c017125571e46ae560ed
MD5 32bf879734966ef6659d914a217691e0
SHA1 7a9bca61e6af9ad720da1d7d24192637d9037886
SHA512 2dac20c7daef07de93513366d8fd22eb10a6c5d62dd2142ed3b1c485d1b916afd4c8e93045e9badac6e902ed58bf937dbe19490a7d2b5c408ed185271f5115b9
SSDEEP 384:PbtltttttSRtNRtcRtGrRtSRtBDRp5Rt70gRt2RtTf1RDRty6ugyunHMSeuWuGR0:7K3
TLSH
T129E2F1703609BDEE08432B235C5499C447BF57096AA86C4CB5FF725CEE2688B97132D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1955981470\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1982075124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_570022982\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1361839312\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_719977460\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\buynow_driver.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1064535096"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31266026"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286388436359766"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{D037F02D-5232-4626-9E50-2630E6791545}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5784	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4992	5048	MSOXMLED.EXE	79
PID 4992 wrote to memory of 5784	4992	iexplore.exe	80
PID 5784 wrote to memory of 3092	5784	msedge.exe	81
PID 5784 wrote to memory of 1732	5784	msedge.exe	82
PID 5784 wrote to memory of 924	5784	msedge.exe	83
PID 5784 wrote to memory of 924	5784	msedge.exe	83
PID 5784 wrote to memory of 924	5784	msedge.exe	83
PID 5784 wrote to memory of 2780	5784	msedge.exe	84
PID 5784 wrote to memory of 2780	5784	msedge.exe	84
PID 5784 wrote to memory of 660	5784	msedge.exe	86
PID 5784 wrote to memory of 816	5784	msedge.exe	87
PID 5784 wrote to memory of 660	5784	msedge.exe	86
PID 5784 wrote to memory of 660	5784	msedge.exe	86
PID 5784 wrote to memory of 816	5784	msedge.exe	87
PID 5784 wrote to memory of 816	5784	msedge.exe	87
PID 5784 wrote to memory of 3220	5784	msedge.exe	89
PID 5784 wrote to memory of 3252	5784	msedge.exe	90
PID 5784 wrote to memory of 3220	5784	msedge.exe	89
PID 5784 wrote to memory of 3252	5784	msedge.exe	90
PID 5784 wrote to memory of 408	5784	msedge.exe	91
PID 5784 wrote to memory of 328	5784	msedge.exe	93
PID 408 wrote to memory of 272	408	msedge.exe	94
PID 5784 wrote to memory of 3144	5784	msedge.exe	97
PID 5784 wrote to memory of 1248	5784	msedge.exe	98
PID 5784 wrote to memory of 912	5784	msedge.exe	99
PID 5784 wrote to memory of 5616	5784	msedge.exe	100
PID 5784 wrote to memory of 5616	5784	msedge.exe	100
PID 5784 wrote to memory of 4900	5784	msedge.exe	101
PID 5784 wrote to memory of 4900	5784	msedge.exe	101
PID 5784 wrote to memory of 5316	5784	msedge.exe	102
PID 5784 wrote to memory of 5316	5784	msedge.exe	102
PID 5784 wrote to memory of 1728	5784	msedge.exe	105
PID 5784 wrote to memory of 1728	5784	msedge.exe	105
PID 5784 wrote to memory of 3628	5784	msedge.exe	106
PID 5784 wrote to memory of 3628	5784	msedge.exe	106
PID 5784 wrote to memory of 1872	5784	msedge.exe	107
PID 5784 wrote to memory of 1872	5784	msedge.exe	107
PID 5784 wrote to memory of 2148	5784	msedge.exe	108
PID 5784 wrote to memory of 1620	5784	msedge.exe	109
PID 5784 wrote to memory of 1620	5784	msedge.exe	109
PID 5784 wrote to memory of 488	5784	msedge.exe	110
PID 5784 wrote to memory of 488	5784	msedge.exe	110
PID 5784 wrote to memory of 2988	5784	msedge.exe	111
PID 5784 wrote to memory of 2988	5784	msedge.exe	111
PID 5784 wrote to memory of 4868	5784	msedge.exe	112
PID 5784 wrote to memory of 4868	5784	msedge.exe	112
PID 5784 wrote to memory of 3588	5784	msedge.exe	113
PID 5784 wrote to memory of 3588	5784	msedge.exe	113

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\WorldBox God Simulator\MonoBleedingEdge\etc\mono\4.0\machine.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WorldBox God Simulator\MonoBleedingEdge\etc\mono\4.0\machine.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/WorldBox%20God%20Simulator/MonoBleedingEdge/etc/mono/4.0/machine.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7fff217ac188,0x7fff217ac194,0x7fff217ac1a0
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,5584719372378907076,17072065958705760419,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
      4⤵
      System Time Discovery
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,10896045461036223631,12473514078966250989,262144 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,6687882689336204746,17884492181797322814,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13740789218604904661,15184024332460073145,2097152 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3274406961786315738,9087307560108713870,2097152 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,11755470291588577916,6763219377538342639,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,13539052114953735261,8617861966972224690,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,11205208458097696850,16776590329600052362,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,663312143991069786,982999223528521238,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,663312143991069786,982999223528521238,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,12421682801395513334,2815492882745585801,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15772543305712045157,3939193362399743914,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,5523222205440950654,4943454006878195135,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13713075575421236054,7888181045178951849,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,14219503615529329743,7909152010493126393,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3317331881497496637,16615084051314086886,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8005341587881978455,14810918067721603410,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3400783180433261720,15225102252016687306,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,284831022313328342,18218196121274542623,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,7209094723389468635,15670590124233683259,262144 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,8894131753226707669,16646522517927774090,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,15470824857673656657,4618553995609544430,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,1507855213663818041,1771728562840790603,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,5009640266844939877,16535528132693719073,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,994036704809492795,5314718408157974216,524288 --field-trial-handle=2204,i,5517473091178193804,8819433752315912637,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ed2e0410aac7d8df260452145cc9e1bb9c34261d42e6a2edc922ad3dd0a96b37
MD5 2aa1488e84c8cf6bef62b61178f6429c
SHA1 7d9510ba9d0c83eee72362df850a03f7c8315591
SHA512 75cb08f055b69e50323ef8044bb9a3fe2e144f32d6b0e124bbc840a2c0538f1ef0d6987499cae2c2475dbe70880ae2b80dbc60e4b370db9baa5dd798fdabc400
TLSH
T198E02BFACC619D3B09FD1B2861515786E74417572B828A0F3B3CC1088FF063A468585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b371544e0f4b65e9e087e0e72b5b4b8a73b74bd5baf4976040363d3d3a69d9ea
MD5 26974c15a36f52a756d95bd35579e22b
SHA1 c74c42f3448cb6c6710fd23313451f1e650e9cd7
SHA512 24325c635fb356a105a5658f701a5113a9130d965b039c8459ad15d231003dba99c002d1fd32345e34094643dc40e0ec56feafa01e2a750b740cf36fea10a8ba
TLSH
T199419DF383E8C56DCA1195F0AA187E2BDE2D0914432C3D9AC9E4AF1B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 30a581bbc28c246b17791da40e6ae253ad11c0305115d65e0ce05c542f52a8bf
MD5 c7ffcfa849056804b7ad40c5d0cd7393
SHA1 16d389f288df720942ae5fb5ac2ee2c614e5f343
SHA512 b781595601403c72bdf7539eb66d32912900cc919791b3e599136c1e618d7e521ad06f8ca468455b400b677f016f10a27632947bb6e5c9221bfac86004fc736d
SSDEEP 192:sxZqRuyMqZjK1Ml8Mci/fNsodKTG5GN2HwszodpES/W6+WNGY0hfYbBIgj+IJ:sxZq30i/fNsodUei2i//bG5cj+s
TLSH
T11B62F7166A64597BCCDBD319FA45BF93D2F9157392904E449AFCCA0C00E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fb88a7f8b880ab045c252e6673f367ae956fbe5ee4cb2bdd219ed4932838ae29
MD5 a0f0163ba541579483a19c61a922bbe9
SHA1 c71d2f05f5e4513cc732ba28b15eafe98e1cbe94
SHA512 360031e077df51730ff639ad1fe74d0065f38e0e305e126376f1c637b17fd1ef70380ee32befd5cc208e767b74065f554ad406c00ae9292389b9b65176705f66
SSDEEP 192:sxZqRuyMqZjK1Ml8UQDci/fNsQTKTG5GN2HwszodpES/W6+WNGY0hXnqBIg5cRaC:sxZq3qIi/fNsQTUei2i//bG5MvGn
TLSH
T1CE72E7166A74497BCCDBD219FA457F93D6F9157392904E449AFCCA0C04E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 11e8488d68d1e68c36bd496b607d0d7f9702b08d144af696de6bb6cd1f19a817
MD5 7e4aad8f6ce87d6b00aa70d53f37aa08
SHA1 399cee247db4be699932899e4058e11be3561e69
SHA512 5a4ed218e176888cf52fadda71c2e0af3dbb20101ad2e3e641aa17afb892a3e0843c14cf968e06b1367cfd743303eb7d98cdddeb9b0ec59da29877d6bc5f1007
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3szx4Ll0:wQAKq8y02yqEnjbWRmj1QWTu1jaKszxj
TLSH
T1DB03FA3B680CCB7E4FC04E9CED277E8A6DE8028BA6988D5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 b3723ecfe3d0899996ad8980ceabecbb84ad0b1bf18f758a9ab28ce2feb43c9f
MD5 666ecd30c677a58e4833989a61c4a8e4
SHA1 8539a9214fea603f594ed9f9a6bf3e444751ff31
SHA512 a385481d1e0aa6a28c2f6fb9f00156d67e2be334abd3508091f12ce83a4742ff3e37288d242120eab05e2d8479b5c14480005b5a67ef6f233d5d48e440dc449d
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5g:GZLVDJjEDPV0/Zdu3N
TLSH
T137A2791232BA42023C7D390C92969B274A42F5633069ED7F7BB940B54E67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e173f1bbf8fe42d265f7605217a5fdf9306e034fc2934963430bfe1802466482
MD5 ed4ddd29286105d6715aec008bd9df7e
SHA1 b7b2975154feb93ef8d2aefc062958430151cceb
SHA512 c08f03aca70f0654e93127a756ce3e610efd38039cf90fbdbafe4a6ee81730ac89598b31bbc7f56cd669808fa6ed76393093187499bb5d4865059f5e5146c2be
SSDEEP 384:n3iF9CcmyWCs38Nx8TUNTUlIxBPm3ek32nn9B2Q7s4Jfb8G7vGSMW3r2Le4KV8pa:yFccps36wgPKekmeYwGqSaLI8p0t
TLSH
T130B25B31EC68C9BBECE70FD9F74A6A02DEE01223959C99E8DAD85D0D00971DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8ff16f264ee8d851bc63c0d8696578becc58999b156d71233cc431a84249e16c
MD5 fbcfdc7660b647e4d321a117a217b227
SHA1 9ddf4c5e282b5b6f1993adb4eec7abedc061526c
SHA512 b1925e61e231d0d58d21154fee4cea49cb578600b81a519a1dccd7fe8aa4c1151affca460b7d95eb11e4ce7882f4594161c150938eb5e15b6a2be51bcf6773f6
SSDEEP 384:nViF9CcmyWCs38NY8TUNTUlIxBPm3ek32nn9Y344Jfb8G7vGSMW3rEeZ/e4KV8pa:cFccps3zwgPKekmIUGqSv/I8p0t
TLSH
T119C25A31E865CDBBECD64FD9B78A3682DDE01263998C9EE8DAD85D0C00971DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 580f766ddd089f9ff970f43b49fe16caf238adb072c5a62ef39776e2ddaac74e
MD5 4c9b4dc53cba61785b8738a98860039d
SHA1 894619b635cf46a96dea7390dd0bce01968106d0
SHA512 cb739538631eb44e13cf2023c1a323c3b48e4ebed93780576e225a89f82c35e7d09f56efbe7a84af651c48347d2e18ffc2b23d4be78e48f2418af700e4598a92
SSDEEP 384:nNiFrtNn/s3n9Sb38N08TUNTUlIR5Pm3ek32nn9CdGu4Jfb8G7vGSMW3rEe2/OOy:EFrj+9Q3jwgnKekmIxGqSs/29MC
TLSH
T1A4D25C32E865CEB7ACE74ED9B74A3A5BDEE00267998C5EC8D5D84D4C00C729C170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cb0c498bb66eca0a0f74fcd4e63732a888994fd262a0d2228c65d95178a1b817
MD5 c183b7b5f0487b252777126c683f2efd
SHA1 e91639cd8bf2173b9360b95bea0b95823d7d74d5
SHA512 11f01fbb386299afb8c7791fcfa453beed6d5720151c8472561bd8c99dd4e0087204bc63ef82b878685b2b61b030bbab498187d0f4cd1133eb9796cc5475aca7
SSDEEP 384:n0iFrtNn/s3n9SM38N08TUNTUlIR5Pm3ek32nn9CdGu4Jfb8G7vGSMW3rEep/OOy:PFrj+953jwgnKekmIxGqSD/29MC
TLSH
T1F1D25B32E865CEB7ACE74ED9B74A3A5BDEE00263998C5EC8D5D85E4C00C729C170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bb617786bb7a401e864998eee6339df33cc7bb5959332f6e936447756698b2c3
MD5 885a9b2e4c07f9376c0b319f3c1caf41
SHA1 e5305496d14a739052ea89d7738db6b548a78588
SHA512 5222c31b261f2a49392bc86302a334a5fc7ebda390591ac7be1a17c0fd98e79f0f0e69836ddbb0a0046c34ed76ba33fbf1eb0da07b1451f98decd65870480ad6
SSDEEP 384:n0iF1tNn/s3n9SE38N08TUNTUlIR9Pm3ek32nn9udGu4Jfb8G7vGSMW3rEep/OOy:PF1j+9R3jwgnKekmkxGqSD/29MC
TLSH
T143D25B32E865CEB7ACE74ED9B74A3A57DEE00263998C5EC8E5D84E4C00C729D170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4c96d39f128605da903fb3e8d41c342b9c0355945e0cd36af120c14ae79cae0c
MD5 fcd313cbfefe21e194dd981314bcf583
SHA1 6b3d5c2572b65717a628e3edff051e39b64f625e
SHA512 169413137bacd5eac1dff0170e86fd54a0446d06130b260afe75d6f93956ad0272f412d610e9ef0342b30ec11f47b7e809289282bb1cdb5547f783699620cfc7
SSDEEP 384:nDiFrtNn/s3n9SM38N08TUNTUlIR5Pm3ek32nn9CdGu4Jfb8G7vGSMW3rEep/OOy:uFrj+953jwgnKekmIxGqSD/29MC
TLSH
T1F0D25B32E865CEB7ACE74ED9B74A3A5BDEE00263998C5EC8D5D85E4C00C729C170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.11.1\typosquatting_list.pb
Size 713KB
SHA256 7c99eba9e3fae4c14308b5d58902e5edd6e11f864ded930c70e625756c916b37
MD5 d5d6de318daa53b466cbd23c49350d5a
SHA1 4cbf25e540962c61b87a9bb26382522e238d1a31
SHA512 9aa19bfc6101cbebc7346d609488b825937c334af3759c994a8f9883787960a360a75183891bf54ceb27421ac85e65c539b2892701e382e49f7e158d3fba65fe
SSDEEP 6144:yDBMg6Kh+9j66p13jbh3dJdTjOIsoAq3o2CZxSQk+PNLemXT1+A8hrI:UBMg6Kh+F66pvNCIBn3o5f9T1+A8hrI
TLSH
T13DF4C6B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f3adc31655c90fd92d39defc3872c904fac65fdef60421250aacafedd3caade
MD5 f09ddc8bd05eca3087bdcd6708121b2b
SHA1 f2a649561e836230959a31288fce5e5ce8b03695
SHA512 af5111603475a23204e587b6030055f435f0dac48d4eee615fe7600aafa368520f8921e46bac1a081aa711327f7105c89f0ce54f57e42018e1daa794cc8d6ca4
TLSH
T1B2511DE05C381AD1D0BD0E7FB48B38EC85E8D726F5A0347D6C98E9984A7A60D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cb5659a75ed0ed5be98792d07de54e60c2dec3a06ee8508afc5679717193a932
MD5 075b5a3c982f53ec1d78083dd4c54288
SHA1 a1bdc8b1b6059e418e8b8c9df13d765d5c422e24
SHA512 bfe2e29376181d728394501f8fe93e9c6515cba86782ae53baeeed6b941346dc1e3c727abfba2bdcc634dbded784320c0a866bde44b5281970e21e5b552994f2
TLSH
T175512EE15C385AD1D4BD0E7FB09B34FC85E8D626F5A0347D6858EA984A7DA0D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d211660bbb238a3fe33b4c8255d888f9e6faef5e52331a2a5b381c4c41f5c3ce
MD5 c20a7eb12704a64f0e83f5c38a4cc97d
SHA1 9b393bd0d6a40b16dacd3fcb297df982b09fc9ac
SHA512 3fc537f9a0f4d2930ac400140ede098bac26e52a6f6bd37fdfbe624b5ce4a53af13c19ef1e300a64a33fd91c79677fd9b1ccf44afc55dcfa82f5366933157377
TLSH
T1E65131E14C3C1AD1D4BD0E7FB08B74FC84E8D626F490343A6858EA985A79B1D208047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3c4c7ce328438295df8d59b44bcc99a246cd5cfd1b88fd66cfbf22571ad29028
MD5 22bdcfb5694cd6a53e27517b77d1ddb6
SHA1 65720585ead56f7171624f0f3b4112e33acaa382
SHA512 106d5b0827f3f2b15112a85aa499825836609119d3e88856a3a1c90464a51e7384e427f8077b89187280a32a7eb4aab7b6eafe62810556eb0eb9f788101eae3c
TLSH
T1FC5131E14C3C1AD1D4BD0E7FB48B74FC84E8D625F4A0347E6858EA984A79B1D608087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 205ae18a9a36d14e39d98c689699ed1a371dc6ef3cba1087e3fcedabc71147c9
MD5 ebf5662dff2b2c407991dcb507de2e18
SHA1 40fe803b64ac239eeaefda9482c16a725aa07baf
SHA512 e059015cf1cb37ba14e88e1ce77e02731107050d251a553755ff7fe455901a49363a1691dc37af31c817890f743980667b07b25e4cff528f6d1758bbdafa0dc8
TLSH
T1785141E14C381AD0D0BD0A7FB09B78FC84E8D625F4A0347E2858EA984A79B1D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a1dc57c2b32b1658fb24d06079da4c5c6f802bebc9bc18b73c54407a8c9ec284
MD5 802c6d975aaa354604a486388cfc98ad
SHA1 03675a6dd4c73e39d699544a44e1955187b131ec
SHA512 0a9b1301d031395e7447da2ec2957741abfc4cbffcee4fc4e831904e08b8f8f1030eee8b5625d1995f0d187742ceedab4e6f3d6d4af2dc8f6fe5372067460bad
TLSH
T117513EE14C381AD1D4BD0A7FB08B74FC84ECD726F4A0347A6858EA984A79A1D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d590f1765c6036928c180dc5eeeec4434f8c3ebfc52389dcaffbe7771e97c90
MD5 3a2f1485bf0031867d8056a2960c201b
SHA1 2af7b357cb71494c3e766dcd2f1807a6ff17e8cc
SHA512 97a964145091ed1d395d8db277130af55b19e9c8c7c0813f5ff19626a58c1d36eb2bed14b6d4f966fc2049dfabbefe881f684b8089be25dfabd74b1c6d11560a
TLSH
T1BC513FE15C381AD1D4BD0E7FB08B74FC84E8D726F490347E2C58EA984A79A0D258047F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1538228800\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1955981470\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1955981470\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1982075124\manifest.json
Size 118B
SHA256 9884eab7370008ea0366a3516952304fe3dfc3e4af613a701b140070052ea2fb
MD5 c2eb53757016d742f60dae3f6dedd5dc
SHA1 59e8ee7a18522944c88977476e3b2b37d5eb8b81
SHA512 905ee402639d8ae8988817e1726c97e466676b6b007b8c045179999f034f39855403c97a530bdfe38318b5f1b1fd5fd525d940c04e546ef33a3d0d37fe69c81c
TLSH
T1ACB092B00C0AA03B26C19320ECA066C683F80218E8025B1A088036881F8817880362B6
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_281703807\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_566172174\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_570022982\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_719977460\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_719977460\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5048-9-0x00007FFF30AA0000-0x00007FFF30CA9000-memory.dmp

Download

memory/5048-8-0x00007FFF30AA0000-0x00007FFF30CA9000-memory.dmp

Download

memory/5048-12-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-13-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-14-0x00007FFF30AA0000-0x00007FFF30CA9000-memory.dmp

Download

memory/5048-11-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-0-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-10-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-6-0x00007FFF30AA0000-0x00007FFF30CA9000-memory.dmp

Download

memory/5048-7-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-5-0x00007FFF30AA0000-0x00007FFF30CA9000-memory.dmp

Download

memory/5048-4-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-1-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-2-0x00007FFEF0B30000-0x00007FFEF0B40000-memory.dmp

Download

memory/5048-3-0x00007FFF30B44000-0x00007FFF30B45000-memory.dmp

Download