78d424badf462dde017a8666bf6cc82aa1efd2e3776d791d3aad521ec52a01e5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe
Size 40KB
Sample260716-tkvthscx91
SHA256 78d424badf462dde017a8666bf6cc82aa1efd2e3776d791d3aad521ec52a01e5
MD5 833f30683e4462f4d716a60a1d8b9884
SHA1 93fe66a3d8f7999cf4a0dcb9594c6252ab4f0a51
SHA512 c33fab07ca9e39037e48edfb428d434d8cd70c819b580ae9cc60368cbba8a4656ef631bbfecf480be6abbd58838cdd138147baa6d1c7ed54fa39c9215ac680ca
SSDEEP 768:Aqo2ArwpPqfJr9CTbEeLtkxKAsOfZ5ALphA:no2AqqfJr9ChA3GA
TLSH
T1B113C5AA76BB042DF6F66EFCA8B0504D0AB2BC4E9C1DD25D1445402888B9F4C4F4BF76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011108351\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_816952139\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011965131\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5232_2132224815\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1108414709\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5676	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286916673941215"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3C261FEB-2443-4A4F-8000-B458716F8ED6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5232	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 5232	4080	2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe	86
PID 5232 wrote to memory of 5884	5232	msedge.exe	87
PID 5232 wrote to memory of 5676	5232	msedge.exe	88
PID 5232 wrote to memory of 1696	5232	msedge.exe	89
PID 5232 wrote to memory of 1696	5232	msedge.exe	89
PID 5232 wrote to memory of 1696	5232	msedge.exe	89
PID 5232 wrote to memory of 5840	5232	msedge.exe	90
PID 5232 wrote to memory of 5840	5232	msedge.exe	90
PID 5232 wrote to memory of 4596	5232	msedge.exe	92
PID 5232 wrote to memory of 4596	5232	msedge.exe	92
PID 5232 wrote to memory of 4596	5232	msedge.exe	92
PID 5232 wrote to memory of 5280	5232	msedge.exe	93
PID 5232 wrote to memory of 5280	5232	msedge.exe	93
PID 5232 wrote to memory of 5280	5232	msedge.exe	93
PID 5232 wrote to memory of 5276	5232	msedge.exe	102
PID 5232 wrote to memory of 5276	5232	msedge.exe	102
PID 5232 wrote to memory of 5276	5232	msedge.exe	102
PID 5232 wrote to memory of 208	5232	msedge.exe	104
PID 5232 wrote to memory of 208	5232	msedge.exe	104
PID 5232 wrote to memory of 116	5232	msedge.exe	105
PID 5232 wrote to memory of 116	5232	msedge.exe	105
PID 5232 wrote to memory of 4044	5232	msedge.exe	108
PID 4080 wrote to memory of 4768	4080	2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe	115
PID 5232 wrote to memory of 5580	5232	msedge.exe	116
PID 5232 wrote to memory of 5580	5232	msedge.exe	116
PID 5232 wrote to memory of 5580	5232	msedge.exe	116
PID 5232 wrote to memory of 5072	5232	msedge.exe	117
PID 5232 wrote to memory of 5072	5232	msedge.exe	117
PID 5232 wrote to memory of 5072	5232	msedge.exe	117
PID 5232 wrote to memory of 312	5232	msedge.exe	120
PID 5232 wrote to memory of 6036	5232	msedge.exe	121
PID 5232 wrote to memory of 364	5232	msedge.exe	122
PID 5232 wrote to memory of 1868	5232	msedge.exe	123
PID 5232 wrote to memory of 1868	5232	msedge.exe	123
PID 5232 wrote to memory of 4292	5232	msedge.exe	124
PID 5232 wrote to memory of 4292	5232	msedge.exe	124
PID 5232 wrote to memory of 4076	5232	msedge.exe	125
PID 5232 wrote to memory of 4076	5232	msedge.exe	125
PID 5232 wrote to memory of 2364	5232	msedge.exe	130
PID 5232 wrote to memory of 2364	5232	msedge.exe	130
PID 5232 wrote to memory of 2436	5232	msedge.exe	131
PID 5232 wrote to memory of 2436	5232	msedge.exe	131
PID 5232 wrote to memory of 968	5232	msedge.exe	132
PID 5232 wrote to memory of 968	5232	msedge.exe	132
PID 5232 wrote to memory of 1440	5232	msedge.exe	133
PID 5232 wrote to memory of 5188	5232	msedge.exe	134
PID 5232 wrote to memory of 5188	5232	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fffcecac188,0x7fffcecac194,0x7fffcecac1a0
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,5207458882170502175,16979569935873923143,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,6932940161033458624,16806805810959552237,262144 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,5257983747689344549,535509313514001804,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6983956016496369265,1040907685269535871,2097152 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12771244739223520508,13979451827129250614,2097152 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,7589594170868144069,10412760318265069042,2097152 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,2736348287157559633,5283929182815825567,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,12980190369835748809,1734198216030076760,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7060596666734780178,17661580818357641575,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7060596666734780178,17661580818357641575,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6204,i,1616197322383458562,2490089156340235401,2097152 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6356,i,8813651955212383162,14433819204089850931,2097152 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,17117322238522056172,910204919074813199,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,17246272194965652953,93833633187788939,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7995918380581329809,17478941532049329515,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,5970062289603325788,18403462241990008227,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,16123661955692425390,12931209917112457461,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17018390970727460935,15511668639051606196,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6897920044073943109,5972593956028948846,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,13491066040586474435,12997775292241485635,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6668945173758449781,12680607003443347003,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,12957095619067257819,6157253452092085675,262144 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1144,i,7785765700458179534,13399340733659408527,524288 --field-trial-handle=2252,i,3769222585315717302,572663484491116934,262144 --variations-seed-version --mojo-platform-channel-handle=1140 /prefetch:8
    3⤵
    PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-07-16_833f30683e4462f4d716a60a1d8b9884_destroyer_elex_glassworm_wannacry.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_1277622188\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011108351\manifest.json
Size 118B
SHA256 9884eab7370008ea0366a3516952304fe3dfc3e4af613a701b140070052ea2fb
MD5 c2eb53757016d742f60dae3f6dedd5dc
SHA1 59e8ee7a18522944c88977476e3b2b37d5eb8b81
SHA512 905ee402639d8ae8988817e1726c97e466676b6b007b8c045179999f034f39855403c97a530bdfe38318b5f1b1fd5fd525d940c04e546ef33a3d0d37fe69c81c
TLSH
T1ACB092B00C0AA03B26C19320ECA066C683F80218E8025B1A088036881F8817880362B6
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011965131\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011965131\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_2011965131\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5232_816952139\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6f1ebee1bc1d8bcbcede55223f34c9595d6c3541205f4d80c77dfca38f46bc53
MD5 6a6ab9d337d5edd71769df66993d93ce
SHA1 124ba2f66e56e14a5e5370b2f90794e46551efa7
SHA512 256cb5b49f7f7eb764e5d81f26e2d34863f150c367b46ff14d1dd38ff801aaae172357ffbf67290e8b36f6a561c2850b1b25e8ea8a5c851220cfca11c2e8b27c
TLSH
T106E02B7BC821EC2718FD0B58B0098646E71113172B414D5F3B3C824C8FF462B55D585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f3093e27a060dc71c74b1e42077db33b3f060820f2ed37112fcec8e8164a8a8d
MD5 4e7331034c4126c9657dd1d80f612bf5
SHA1 88b524fb56dfbbb14c6ca9ec92b17efa5a14715f
SHA512 3107eb03e6c692dd03317507961ffac9aec180fd6984693f31d1523a94afe876cba0884adc1fd99699202a635a7c2e63cfed10823ff781ae3d943cc5c78566e9
TLSH
T1B1510736C78948AFFB1146308CCF3069712072E8FA075DC186578836A6F83B7E5ACD18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e942.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e942.TMP
Size 2KB
SHA256 28a4a5cdc31f28c707a645038a8d082625cbdc22022a853f5bc4c363a49afe17
MD5 a569c81c3f77cf0751939fb9a962dcef
SHA1 4dba51eb80ebaf13cc8d58c7a4b657c5596bb314
SHA512 bdc073dfbedd3f6563bce50df33e596a6576bda9dd636c084a96c1dad44da90ea8d10f58520e276c49750642be7498845d2c29d5f0d5d81cfc5c3e48a943a9ee
TLSH
T1B551F536C30948AFF31146308CDF3169B060B1D8FA075CD08967883AA6F87B3CAADD18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 265abb5936192fe5c4820ee1585a98287e26fa4389e14008b72756057b21237c
MD5 3b806ce0769595c2ada0d5fae3917d03
SHA1 49af144636bf5f176e450bf2a436b4f74065ea1f
SHA512 c15c859ef03729262022fe6215d22b69cf27dc4af14abcb7f683b44073a0b0b984b0a1a21b106c2d49d83c6dde30a52ed7f433fb8c8cab118486ccd53426056c
TLSH
T13451EFF783F4856E8A1095F0AA18AE2FCF2D0515432C3CAA89E0EE27D3E3471E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6ce36d9554a103b2ccdde6a04f4f07fd04531a89c4e9901f0cf62609c14da43a
MD5 62ff4f017ba3ad72eb6380744a37963a
SHA1 c6dc5ecef901b6c5db6351f72ba1cc8e471635d1
SHA512 b209287cbb2a367d2c10376ac58415f8312546bc243467a34df73ece0463a7fbd4b17e6855f2f9dc9673f8e113757e6af37c88a0ff598ea203dd508e06f4b14c
SSDEEP 192:sxZOR8yMqZjK1Ml8UQTjO/fQsaoZdIaRuvCzodp6pHz66+WNHGafYf0fHPUI+NIz:sxZOFqnO/fQsaozIKY5eH7ff99qw9
TLSH
T1B672E816AA344D779DD7D219F644BB93D6F90163A2904E44AAFC8F0C01E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ca0f657702f8378c93bdba454e2d9d56cca4c3e051e30fb92c84a5d306f46eed
MD5 2f4592857286b8a4ca4e7788246b217e
SHA1 6001de5c5bd011b8c61d129f7caeb56fdddbb994
SHA512 950f9b27f4a09dbdf0249b684f3cfa91fef1d60b60d3434abbc2ebccac2ddb96316dc1a0a03bc763bcb4d187fc400f320bcad4891b0457822df0f9ee9e44a960
SSDEEP 192:sxZOR8yMqZjK1Ml8MjO/fQssZSaZdIaRuv9zodp6XHzW6+WNHO0/Yv+uHuUI+NII:sxZOF7O/fQssZSazIKYWIH/p/h9qj3
TLSH
T13B72E816AA345D7B8DDBD219F645BB93D6F9012392944E449AFCCB0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d4f350fe97b5057b1e00c40e312cf04f37711d8880d85a43dcdbad1a21643481
MD5 67abcc5035e5fa322c0464724116151b
SHA1 da34898f4a80d5325a6c1bb841bd657176711c21
SHA512 87dba719701ac4f2bc437450e864ed055a0160d5facdbda3293bc400a3fc5a4fc9430eb2ae8c1f6ead8fbff0703cdb7b414e9fb4e86c3a6788bb8fcfc7fcaf39
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVysy10Lli:eY8Od/HEnFhWvFvmXu1ja9t10Lm2Nus4
TLSH
T151F2FB3B6C0CCB7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6dbe796d272ebe43c5dfa909c58294a3d9c12f3ad2a1f3272262d1757d7e7ebc
MD5 af2a5dc557b5eeb778d759ca0f2768ae
SHA1 c61e755ca8d38d070a1abd8b903bf8ba7b7b4f24
SHA512 4dabca2bc572dd5ce954e4fe1a533fc026f8c21bfe47059163b47bcc7f77197afb2226000db27e35855f75eb701ebbd2f5cbb842bd83da3d5360b31574d32a80
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGR:05ppxnY753RNBvRJJdt7p5J95Jn1
TLSH
T1F3B27C5A713A0211397E2988B39596364F4235A37058F4AF7FB814A14F2BE224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a103f4a8f18a46cf6b69bb11c1dbfa63ff5b116a02c2b12c2e173e49d118d54f
MD5 528cdb1165cfda0d0139e9966e214a84
SHA1 d7c4ac9166ddc33e803d8670a1e87958c6d846d5
SHA512 d6d0db49734fa05ee606b82f7c2b1aa4c9c04c8dddc74272282d9ccc77d2a115d2457fa22c0bc31fbbf7fc3e540d52f2b8e8a5a3832e0b5c4876e45dd982ee8d
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlIm2QckCr9lbKphifGGJf4Kqh/pwe4KV8p0vHdtyN:p/Fccps3WwgbkUhkFGPqhOI8p0vzC
TLSH
T1B2B25B36EC58DEFBECE74F89B74A7A07DEE01227859C9AD4DAD85D0D008719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a225949983c9dd94a97c6e27b68f6fc96a128f02b74696d92389423a54f8ad32
MD5 8fd079179431910e4ef3e15c6d3b1615
SHA1 5730a87bc722a8df7abb6cc0f06fa478ee9b356e
SHA512 5f8704bcfe9f0f9d11a3fe5031987b05602f629bac5d305b8eb9c4408ebdb683d35e37cf5feccc3f02ae84d120786a99ec1eb7a2f3bd0c35ea7beb2556959421
SSDEEP 384:npsiF1tNn/s3n9Sa3sN38TUNTUlI4oQckCrnq7dphifGGJf4KqPL7WhJpvOObjII:pXF1j+933iwgBkRTFGPqPnWhr29Mv
TLSH
T1D8D24B36D859DEABECE74FD9B75A3A07EFE0126785CC59C8DAD85D0D00871AC4307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 80aa0de6fbfe0b507e554edc183f4bf06ea09ecaa23e036205f27aef7f6bb987
MD5 bf9be68c85fa0067afd82f3c7412d5f1
SHA1 9dfb97a079a67f4f56ca480131abb804db1f8a8e
SHA512 86728260a4c4c1d874e12c3b623549dd5572a6b148355c7788d8d017995e608b6ee942b7e439bda91b80e8ff247786f21a76bbf43740ceb7804d35a3f82b8e5f
SSDEEP 384:nYiF1tNn/s3n9Sa3sN38TUNTUlI4oQckCrnqeG2phifGGJf4KqPL7WhJpvOObjII:jF1j+933iwgBkAGoFGPqPnWhr29Mv
TLSH
T14DD24B36D859DEABECE74FD9B75A3A07EFE0126785CC59C8DAD85D0D00871AC4307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 69b76f8f118a19ce8fd5b47a881ce2d3e526decea1427c7d8e5a0a0cf01a5cd4
MD5 ae8d48d1fdc93352b4a5b4667b74383a
SHA1 901425ff47e38f4d2c30b66d9e31cf9dda0a1274
SHA512 85252b75403f5d78adf904420e9a244f3353229b52dcc728fb7f07a1f3047fc8a2a2f1dca7902ea3082c1e419a4dfe4368bb387ba403dd7d8251d7c440ef2c6c
SSDEEP 384:npJiF9CcmyWCs3sNr8TUNTUlIm2QckCr9mlOphifGGJf4KqPL7WwJpve4KV8p0vu:pgFccps3ywgbkUswFGPqPnWwrI8p0vzC
TLSH
T1BAC25B36EC58DDEBECE74F89B74A7607DEE0522385DC9AD8DAD85D0D00871AC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c644b655be8409e6899b27890a0ed23d19a640c372ebdf8dd860abd74a9c5c3c
MD5 e9a9c78695aae11ff0d306a9563f81b3
SHA1 18ce05990a21addb6e58a15fe652ac3a4186363b
SHA512 0b0a9e24a4d4175a75dcfd0698e87ccaf5d5d73c974d06ff579d9e07112410faac6a78a6ee2525a8c54da572b9304b8c2cdd032d28c70c54557830c120f3d727
SSDEEP 384:neiF1tNn/s3n9SCG3sN38TUNTUlI4oQckCrnqkG2phifGGJf4KqPL7WiJpvOObj3:1F1j+903iwgBk6GoFGPqPnWir29Mv
TLSH
T10BE290F598D789B6E8AE4B87A77D2E069AFCC163B5885984F7C45D0CCC821BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.11.1\typosquatting_list.pb
Size 713KB
SHA256 7c99eba9e3fae4c14308b5d58902e5edd6e11f864ded930c70e625756c916b37
MD5 d5d6de318daa53b466cbd23c49350d5a
SHA1 4cbf25e540962c61b87a9bb26382522e238d1a31
SHA512 9aa19bfc6101cbebc7346d609488b825937c334af3759c994a8f9883787960a360a75183891bf54ceb27421ac85e65c539b2892701e382e49f7e158d3fba65fe
SSDEEP 6144:yDBMg6Kh+9j66p13jbh3dJdTjOIsoAq3o2CZxSQk+PNLemXT1+A8hrI:UBMg6Kh+F66pvNCIBn3o5f9T1+A8hrI
TLSH
T13DF4C6B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 83752d4e158459170b68e6b0b1121a4994a19394e6048eca50adb4a1e7dddc6d
MD5 be8a93152aeb8187c33d5d29b251f338
SHA1 07c9ca9fa59249ed3b7782d4ae9f90ae14211304
SHA512 8864289317d844da3d3e769663643f6ac8c080baf883424e0a00ea84fc4545becc6a3172dcaf988d5793eb89402a646890f8135ff0bef5b4562754c08a4faa57
TLSH
T1DA4131D15C381AD1C4BC0EBEB48B39FC85E8D729B1A0347D6C98E9940A6DA0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a605567393f193a237b0bb63c5f578c97f6617758f7b0119e735dfe9a81471ba
MD5 de3f537019022ede3bbd4f1b7e4ea790
SHA1 47cd67376a38626d1f826c6ef37f3e561d2ce74f
SHA512 b3a024a989186cfc1a7881b38d8109ecbee91b606a83fbcabd6a0c4366dd7f94689ab42264bd0266c11b34012c9aa1451cc03d4b73f665ecc7d255e2bce81192
TLSH
T18C4141E15C385AD1C4BD0E7EB08B74FCC5E8D62AF5A0347D6848EA944A2DA0D708143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ed6020a6c2a31690867302e72beb465259423553efe549cb9e49765f4614e10c
MD5 b8e1f76b2e1b5fdf6586b740a078ea1a
SHA1 4a560caf2d2ff2044a7ac5f04007fe292c772715
SHA512 1fe69e20ebbcd910061119c8251233987d794cde8453bf1e148692b7ddda35f35fe89420b53572bd1cae2e6d0f9afa6ee0070e5aa800dec5db4d876049adbc4f
TLSH
T152413FE15C3816D1C4BD0EBEB0CB74FC88E8D62AF5A0347E2C58EA944B2DA0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

ecfb8072-6777-44b6-9235-3844c4c2c008.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ecfb8072-6777-44b6-9235-3844c4c2c008.tmp
Size 25KB
SHA256 671be7e855d9599d63eb4cea308c18b832f5c8046d312e6c7ba829198a3c3ad2
MD5 b1ab9b94fd9b306961c43e889949083c
SHA1 c2a274247bb749c6eb68ff172bab4f8ffd6d6cb5
SHA512 b27e52d97983baf2cc19f42bb490c3fa5c2bf64d05b7535b940816b237cfafbda849d19e8db833c9ec806e2e9cdb8a0c6cdb78eb3875dae20026f15883f5ed4e
SSDEEP 384:npsiF9CcmyWCi3sN38TUNTUlI4QVQckCrT7dphifGGJf4KqPL7WhJpv9ty/7IgS:pXFccpi3iwgxDkYTFGPqPnWhrp
TLSH
T1CEB22A36DC68DDABECE74F89B75A7607DEE4126385DC5AD4DAD84E0C00871DC134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 72800dad40c18aaa4497f70e307f963f70acf52dc0753f335ee27b944a4123e6
MD5 7735e3b8bde43e5e406931c1cc3dd11a
SHA1 6057f2c10bcf2a809eefcecdedbeabb402946c0f
SHA512 df4d71633b347b7a082c05ce369bf7028b6c927d92586dd74982209147e233ede86cfddc018d109d9129c553017f74cf8d28a12a9c2bc5983723eb80b6936d21
TLSH
T1D0412B5CB6F91148B3B76E16ABF6A8AE487F78772F16D45E10100E4F0666B40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4044-256-0x00007FFFDE2F0000-0x00007FFFDE405000-memory.dmp

Download

memory/4044-253-0x0000021D3BC00000-0x0000021D3CC00000-memory.dmp

Download

memory/4044-255-0x00007FFFD92F0000-0x00007FFFD938E000-memory.dmp

Download