a6cc9c65d87c851781863b1e2852806e41a89b12d35867d4c220d769a3d9ff5a

Resubmissions

18/07/2026, 20:06

260718-yvt27abx3q10

18/07/2026, 19:53

260718-ymdegaev8w4

Analysis

user interaction
yes
max time kernel
150s
max time network
218s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/07/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fl Studio 2026.rar
Size 1052.7MB
Sample260718-ymdegaev8w
SHA256 a6cc9c65d87c851781863b1e2852806e41a89b12d35867d4c220d769a3d9ff5a
MD5 ff8830c89dbf8f7349e9482f9ad6142c
SHA1 be2a4102a6a9302a78db148d1b358d08654f620f
SHA512 796a6e11bcc613376524840f2daca4888128c1334418a511dfbd35e9f4f7363e6a632aa04b37081ed818ccf673928759cd508723d5ef5abc0bb7aaf5694187c5
SSDEEP 25165824:4WglfXv871suGGhz8+z8LcDdarMYlfQK5Ql5Xn:4Wg27JPNIsui+6l
TLSH
T179B933C913660CC990D42D967E6EA72CC6D362936F6C841098F72DD02D6B71E6F8F3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1752025550\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_2094498493\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_2094498493\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1752025550\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1944112207\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{924B1A0E-61DF-4711-AB7C-72D3C2153458}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5452	msedge.exe
5452	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2160	7zFM.exe
Token: 35	2160	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	7zFM.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 3892	5452	msedge.exe	94
PID 5452 wrote to memory of 800	5452	msedge.exe	96
PID 5452 wrote to memory of 1292	5452	msedge.exe	95
PID 5452 wrote to memory of 800	5452	msedge.exe	96
PID 5452 wrote to memory of 800	5452	msedge.exe	96
PID 5452 wrote to memory of 4668	5452	msedge.exe	97
PID 5452 wrote to memory of 4668	5452	msedge.exe	97
PID 5452 wrote to memory of 1304	5452	msedge.exe	100
PID 5452 wrote to memory of 5632	5452	msedge.exe	104
PID 5452 wrote to memory of 3556	5452	msedge.exe	105
PID 5452 wrote to memory of 1036	5452	msedge.exe	106
PID 5452 wrote to memory of 1812	5452	msedge.exe	112
PID 5452 wrote to memory of 1812	5452	msedge.exe	112
PID 5452 wrote to memory of 1472	5452	msedge.exe	113
PID 5452 wrote to memory of 1472	5452	msedge.exe	113
PID 5452 wrote to memory of 5568	5452	msedge.exe	114
PID 5452 wrote to memory of 5568	5452	msedge.exe	114
PID 5452 wrote to memory of 4864	5452	msedge.exe	116
PID 5452 wrote to memory of 5868	5452	msedge.exe	117
PID 5452 wrote to memory of 5868	5452	msedge.exe	117

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Fl Studio 2026.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15983542822162677191,15957829002459096489,524288 --field-trial-handle=2140,i,14437043045633587983,7082348114952587589,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
1⤵
PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,7621897573340401593,6421528201288032613,524288 --field-trial-handle=2140,i,14437043045633587983,7082348114952587589,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
1⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,14163368186046252917,18264165236166513109,524288 --field-trial-handle=2140,i,14437043045633587983,7082348114952587589,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
1⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc48d5c188,0x7ffc48d5c194,0x7ffc48d5c1a0
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,2925028663396887945,5136194612085416454,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,5045923121428306630,18287603008744410350,262144 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,18030111646344005572,2321757016805791146,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,7888406906041018319,14815216118233773718,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,7888406906041018319,14815216118233773718,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,6735173291764427961,15314231582618077706,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,2243952077217311879,6845237746158204684,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,9557887456335795063,1239598176856271286,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,4858016261367351912,17435344614451906491,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13076905863699007637,13596464174770855012,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,3726621090991895614,9046924699806159411,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4516,i,960942043237990691,728388965217177918,262144 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,1540226047728471166,10307620787305526409,524288 --field-trial-handle=2216,i,5215216416022303945,1632131467625511669,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:14
  2⤵
  PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6627dc3feefcb903028914d6a5c0b9a4f31395daeaee46db5f10117417b2647
MD5 eaecf4122e780db1885e3f40d0404be8
SHA1 4b5d48dee93025b4931b034308294dd5d7ef11df
SHA512 29dd60ec1fdef0316ef4241e89e2051bc93fcb275f1ca03c7090244bcd3a2cef8ffd966c65b6894e681332bbfbb280a98da87b8513da244696a062bbc00c4ede
TLSH
T166D023A47769BC43C73F3030B4D0C32177A5A5D0354DC5516160C40D9DB51D9D7CB086
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0a94639fe76f774acd63f21f969bda6c52610fb314a97fa5f1e4f5bb962591c0
MD5 322bf7c5a83ffed884f25d3259863703
SHA1 293d6678a25ed420919b9e65b72af84a63e0db77
SHA512 a4c4c36e34c0456a482d22376a1ceb6f810a4988a330968f7efb6228f361cec3655ebce33d37d3f03c8e28bb7b421d57f2f43629cfb57cb00934c3a3747c2a07
TLSH
T194E02BAAC822DC2B19FE071978585742E70217272F41495F3B7C820D8FB463A059691C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 94aecfdc3483cc24ac8c10998f3bc9f72dc73239859f28062d1941bfb2a8971f
MD5 41c381ada3bdd7c32801f678e1b7d898
SHA1 9805bb0693603b7b05f6ff696c4f36ca9b22ceb0
SHA512 89291cfa35636b9d7792ceb28f7514e4d48e7d9a5ddebf3cd0c555d0c4b7c6818282c1e008b370c30e467ffb402817bf57643e8ac0ef1893ea02883023fc45e0
TLSH
T13561AAF783B5826DDA1195F0AE18AF1FCF2D0052436C7D9985E0AE17A3B2461E052B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 55ac66a68107996753d4902524e54e84282825c68581810f698d55f6dcad074b
MD5 641e4ddb59bbf75a70c69dc730ccf034
SHA1 227c6603854b3d9ea15baa2207020eeacbacf410
SHA512 bc8229994c6e25f073d6fe667fade60bbcf37e9754e3df56cde9ec39b074bc00b76db94fa1c90059d15d6d1c283b18b85221351dc3f97ec73b13e6d9dd9b8073
SSDEEP 384:sxZNnOXTb/fysQWvCcHV7orm02MCTr/bE/5bN/ad:sVODb/fyYCcHi2Mo/b25S
TLSH
T1A792E7066924497B9DEBD319FA467B93D7F81523D6944E48DAFC8A0C00E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 68d60a14983d27d2a1f3f064038cfee71b3f10fb1808fcf0c0ef56936c5720e6
MD5 b61011e2ebb6fa1f696170b14620055d
SHA1 64441eeabeb6448efd01096fccc0597abe252782
SHA512 35c20344cce2f61a20a60990c6b54a3b540d5fefbc1d2e8cb33e6ea4686b2ae4a73fa9a0a5f17c311537d2789e058a9b8fb23f952a15939de04a6a5fa2d5446f
SSDEEP 768:XwZh38Dv2g47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eGq9Llc:XwZh38Dv2gkEnZFWRm6GQFmu1jaKeGq8
TLSH
T17F030A3B280CCBBE4F844E9CED266F8A6DE8028B56988D5447FA494C03C67EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 3ffa4d1b79ba34dbab03b0adb4ad4ba5bd76a88210ae865be78b420ddd039231
MD5 b3e2bcd63ad1157815ad7af6ff2c7b55
SHA1 431813830fc0d6dab5dcb2db70adb1965edccc60
SHA512 f645e3831008a6de788a15749c2b2fc019099bc65afb441841f4980a9a263c43f422757b08e77d29fb4dd2e20f25137034f158a201f86b5be2612890bf1816fc
SSDEEP 768:ctGj+BCNC5qFVpKxlhcE5YUKmyT2/wsQpwSTkUf6kRWE:ctGj+BCNC5qFVpKxlhq5WE
TLSH
T1BFC2681672FA02023C3E791D879597371A82B2633418E93B7BE814B64E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 db64e356f738f96d07ec993c1e44dc665ba7002978581c43ac5512842b875139
MD5 21d6fefd0015ac16a5dcc949069fb054
SHA1 88bacb7a2c3b021a88617797413ee47c1899d6a7
SHA512 b8898c43e381f7e3c1c9ccb3d08cdeda1034cb220239352c450daee408c996243529bedce6f479106e468ac75956cd1cc42b21c145e037657c53c62565efec22
SSDEEP 384:nkiFntNn/s3n9SY8NP8TUNTUlIRcGTik6ek71zCfbLoND7jUHdmYSCzKnA4AObje:/Fnj+9PwwgvQtOoNDSdmpgKnA4U9Mm
TLSH
T1DDE25B3ADC99CE7BACDE1F59B74E7A57DEE00173C5984988E7D84F4C009319CA706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 be8b538f09d41fc5d2ea124b199a6fd902e85227e1b3ba1ba551e06669d02c1f
MD5 445554f7a94770b7f2dbaf3789044508
SHA1 e4246102b78680148fbda9b89eaa4c6fdc93b5f9
SHA512 540524846f1917e4bff45c771ba9f85a13fccdf923b7ae4a480bf3157c3efc5c194fc87876e0400a23705c700e1efa8925440b61bcf838c4b63fe3dfefb65672
SSDEEP 384:nXiFntNn/s3n9SY8NP8TUNTUlIRITik6ak71zCfbLoND7jUIXjnNOObjI9G6w7xE:SFnj+9PwwggMtOoNDBjnN29Mm
TLSH
T11CD25B36DC99CEA7ADDA4FA5F74A7687EEE00163858C4EC8E9D85E4C00C719D470B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.18.1\typosquatting_list.pb
Size 738KB
SHA256 baa1fa28ae7a9bebbc1a10251a80f97d44b6350776ae69847a714020974072bc
MD5 badadbec63b0f53468bbebfb4ab905f2
SHA1 91e9ed360fd8e6c2ca5a578f5b26522549a22792
SHA512 bc7b0ba056db828e90627d0726a8c3908f4748e4f5bd4881732997e2256ee123fb89ab2a3d94ad0bdadb60947dbf604c39027f0b3b8d9793fb7885de75dd9edb
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O0I:BfPL6KxmQX5rzPZGI3eaFiUFko898O0I
TLSH
T18CF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9e2576f08316deec69a973e75ceac3047d7fb55c7cd2ee8888f30c074a5bac57
MD5 27e4a4cb21775059b9dd553230c88645
SHA1 2bfc94adb9cab166394726aa76c9c78e1ab6f7eb
SHA512 ab56180f1619c18b991a4f327309e84cb826b9d80b3d56ff3ccb84764447143f6a64703ab90aec9d3fb2e0295fedad0716003a4eab426f67859bbe7b4d1b1f39
TLSH
T1314130E14C3D5AC1D4BD0E7FB08B38FC81E89625F5A035396858EA944A79A2C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c5451fa0da27c0ee887bfbf0f1a0474890d97ed3985f8efec4c6686cf3f1dbda
MD5 3a739df51080beba277dc58cecfdaa25
SHA1 afb09a7bdb08d4617aff37f51d7288061274143b
SHA512 f062879a9d05d0722eff013e3bc8f33cdddc05404cc11f600bbf4c6a18dc985be59b81e867488cc25ab868ee0e63f7ac9ed615481228dbe1a62adc10994cf3b7
TLSH
T1F4412EE14C385BC5D4BD0A7FB08B78FC81E89626F59039393894EA944A79A2C348543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ed595adcfae0353c1f2200350152d0e5a1eb2a7d7801689148842e5cb9b81359
MD5 a67781abb8f64c3f05aefbe0db13e7f4
SHA1 764d25af5882cd710603619a201201b208d405c7
SHA512 35dfe878ce585c0cb3c7c24e682daa74e413b180ce51746d6700478c1625829b6281b8f79191946b315bb9d57d3efa306296d1410cbc32a61a160fd5866ceb5c
TLSH
T12A412ED04C3C1AC1D5BD0EBF748B38FC82D89725F1A035796C94E9940A79A1C748483F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_1752025550\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_2094498493\manifest.json
Size 118B
SHA256 a21d32a4d121a4633a13e5372ff151b7dbc4f0ae505831592be92b5984e77130
MD5 65c86931db1f43c8fabd535f32be9b0c
SHA1 96c629d5e3dd3fe0c5d648285c7a981d0b34e689
SHA512 954785c1cedea7431bd5eecb09aeed91175719f0b691e6cf5e100488125b71356ca9e6c3a2c937e0c48c8b5791ca45acfede25459578ce639162b42e722ec471
TLSH
T110B092B00C0AA03B22C19320ECA167C683F80218F8026B1A088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996143502\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1304-124-0x0000019780000000-0x0000019781000000-memory.dmp

Download