d83eb549d492d0053062b29c6f456a4e45327842fb21ba441d0b58fee52536e7

Analysis

user interaction
yes
max time kernel
388s
max time network
387s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voidaccess-1.6.2/public/va_svg.svg
Size 13KB
Sample260720-ksemtsb17r
SHA256 d83eb549d492d0053062b29c6f456a4e45327842fb21ba441d0b58fee52536e7
MD5 8921cbd1e96475d590ab6f2f1a984f3a
SHA1 658283a138a02e1fa94280db9b56a1b58f516bdc
SHA512 418b2b7906955aee2d2e592efce20e78e6f573975ef7039c205879c85ac24d8864528d1cb53631f6d07114e1d0944d443bbf355105903b6f17945f9f2c16a733
SSDEEP 384:OUBcpnIJz8VWHIOYOTOvOEOTODOaOyOROx:OOSI58Mw
TLSH
T1CE5231BA379C780EE8624265FBAA54D1032F91F6F10043699C2F1F6A9416ED6F13F2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
110	raw.githubusercontent.com
111	raw.githubusercontent.com
112	raw.githubusercontent.com
113	raw.githubusercontent.com
114	raw.githubusercontent.com
115	raw.githubusercontent.com
109	raw.githubusercontent.com

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_713064729\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1267335722\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1267335722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_713064729\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\_platform_specific\win_x64\widevinecdm.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3592	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2330525207"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31266876"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290111796405235"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{A159F33B-ADDA-45E5-B53A-0354052ABB27}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2496	4992	iexplore.exe	80
PID 2496 wrote to memory of 5780	2496	msedge.exe	81
PID 2496 wrote to memory of 3592	2496	msedge.exe	82
PID 2496 wrote to memory of 2188	2496	msedge.exe	84
PID 2496 wrote to memory of 5168	2496	msedge.exe	85
PID 2496 wrote to memory of 2188	2496	msedge.exe	84
PID 2496 wrote to memory of 2188	2496	msedge.exe	84
PID 2496 wrote to memory of 5168	2496	msedge.exe	85
PID 2496 wrote to memory of 2152	2496	msedge.exe	86
PID 2496 wrote to memory of 5180	2496	msedge.exe	87
PID 2496 wrote to memory of 2152	2496	msedge.exe	86
PID 2496 wrote to memory of 2152	2496	msedge.exe	86
PID 2496 wrote to memory of 5180	2496	msedge.exe	87
PID 2496 wrote to memory of 5180	2496	msedge.exe	87
PID 2496 wrote to memory of 3848	2496	msedge.exe	89
PID 2496 wrote to memory of 3924	2496	msedge.exe	90
PID 2496 wrote to memory of 3848	2496	msedge.exe	89
PID 2496 wrote to memory of 3924	2496	msedge.exe	90
PID 2496 wrote to memory of 5628	2496	msedge.exe	91
PID 2496 wrote to memory of 5860	2496	msedge.exe	93
PID 5628 wrote to memory of 4504	5628	msedge.exe	94
PID 2496 wrote to memory of 344	2496	msedge.exe	97
PID 2496 wrote to memory of 220	2496	msedge.exe	98
PID 2496 wrote to memory of 3472	2496	msedge.exe	99
PID 2496 wrote to memory of 4456	2496	msedge.exe	102
PID 2496 wrote to memory of 4456	2496	msedge.exe	102
PID 2496 wrote to memory of 2588	2496	msedge.exe	105
PID 2496 wrote to memory of 2588	2496	msedge.exe	105
PID 2496 wrote to memory of 1260	2496	msedge.exe	106
PID 2496 wrote to memory of 1260	2496	msedge.exe	106
PID 2496 wrote to memory of 2352	2496	msedge.exe	107
PID 2496 wrote to memory of 2352	2496	msedge.exe	107
PID 2496 wrote to memory of 2352	2496	msedge.exe	107
PID 2496 wrote to memory of 2512	2496	msedge.exe	109
PID 2496 wrote to memory of 2512	2496	msedge.exe	109
PID 2496 wrote to memory of 2512	2496	msedge.exe	109
PID 2496 wrote to memory of 1880	2496	msedge.exe	110
PID 2496 wrote to memory of 1880	2496	msedge.exe	110
PID 2496 wrote to memory of 5068	2496	msedge.exe	111
PID 2496 wrote to memory of 5068	2496	msedge.exe	111
PID 2496 wrote to memory of 5068	2496	msedge.exe	111
PID 2496 wrote to memory of 4924	2496	msedge.exe	112
PID 2496 wrote to memory of 4924	2496	msedge.exe	112
PID 2496 wrote to memory of 4924	2496	msedge.exe	112
PID 2496 wrote to memory of 2416	2496	msedge.exe	113
PID 2496 wrote to memory of 2416	2496	msedge.exe	113
PID 2496 wrote to memory of 2412	2496	msedge.exe	114
PID 2496 wrote to memory of 2940	2496	msedge.exe	115
PID 2496 wrote to memory of 2940	2496	msedge.exe	115
PID 2496 wrote to memory of 5460	2496	msedge.exe	116
PID 2496 wrote to memory of 5460	2496	msedge.exe	116
PID 2496 wrote to memory of 748	2496	msedge.exe	117
PID 2496 wrote to memory of 748	2496	msedge.exe	117
PID 2496 wrote to memory of 2844	2496	msedge.exe	118
PID 2496 wrote to memory of 2844	2496	msedge.exe	118
PID 2496 wrote to memory of 5172	2496	msedge.exe	119
PID 2496 wrote to memory of 5172	2496	msedge.exe	119
PID 2496 wrote to memory of 4024	2496	msedge.exe	120
PID 2496 wrote to memory of 4024	2496	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\voidaccess-1.6.2\public\va_svg.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/voidaccess-1.6.2/public/va_svg.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7fff2a36c188,0x7fff2a36c194,0x7fff2a36c1a0
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,5020665814727948279,9482831284194518363,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,4911087800490809709,8661040307088048353,262144 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,10825108209253965247,15247793822260212382,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6804496934721869790,10553164109479874316,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13681991040945128883,5925319445301606442,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7333942058264359160,2398819990388873703,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,18236926835675174983,12406218800375941699,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,8680957046632557695,12083896804495668281,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2242006234408978079,16170905628316335183,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2242006234408978079,16170905628316335183,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,16746901877361819764,5719207429667435325,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17658830667256930845,8448495720645784353,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3660526642684054245,4609904124637089710,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,18310938517818822766,3339936023070377340,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,14795684121464983984,13586552878185753884,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,7198830576140006791,16691576252384053334,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5096,i,13153916337004923514,15262478786541694097,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6884,i,17288239228568918250,12895314875446432724,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,16499140395335081099,6222287294256378638,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6880,i,16477461433063593307,7500022015495924797,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6944,i,2947707450971037082,9087195583187686173,2097152 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,10249053669283621521,14396884659321879401,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,13861949219087940636,9227331138887591761,262144 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,6684124734490630967,17579746262346268474,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,8215682757246056638,2558007795750633883,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,2757436638516238636,7630184041119148226,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,16542331337990720128,3006248338272161163,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17465389398129185943,16555857925365531839,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,17376648953286793559,8765902271431269677,524288 --field-trial-handle=2200,i,363597678250278416,16214333794277465529,262144 --variations-seed-version --mojo-platform-channel-handle=1148 /prefetch:14
    3⤵
    PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:72

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 5c9fc4c076214a74a28b04efb8cc06c29c4c513480f683608409856538657d04
MD5 4411ab91d2a4820beb5fefd843fb918a
SHA1 beba613c9dafe66b14c12969db284c8349cb2fd1
SHA512 93ca94ef78eaec843dbc0c18f3fa8c5274ae061ace4074e3ecabfc4cca50df51e3c9936ce1f5fc4e51433968c2c88c56464098753ee76ac8bc6e032d5c4c7c9e
TLSH
T18EE0D82A1285C1EFCB01A54684D6D71DC021A30FA54968593B0F789C34430009B75AF8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 fcf4faaddb07b6f4cf15bace86e729366a8873f795cba7e7961adbccb1746b18
MD5 9bcf798463419e7532d34bd7c53922e8
SHA1 b85f3df12e25a23f22efbb3af5259cd56ab72955
SHA512 3931ed9abbb73673f5e8f8e6c52e5b58aa837caa11a2c0ecf5eb9bf1521c616e74ca4c44c45002df3088d5f90fadc6011e3416f74d2b58d65f50076ce4a2a144
TLSH
T186E07DA706C8C31ED201E44B496C430CD2A1375AD6C8AD8E770AC48C3003091E7E699C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a80d48892ce140efcf0c3e6c1fee497c1c7642ed7e270b35bef3ea9212f8f0e9
MD5 f9f6e0f24b040e7e83fe6deabbf6f4c7
SHA1 6f1ab9d1f21464e22d9a160ea7693186b3373420
SHA512 5d73b867428ad78b7a855bef173bae2647a2a6424eb0f96dadc0edbae2e8116dd5c72590e6d2c9a7214914c42c29c7618550ba511ab9c786847001ab97ea0927
TLSH
T1A5E086AA85C9C2AEE304678746B9D30CC6E0770AD6C96E6A270AC49CF142584E3E2DD0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
MD5 2445f38166b3efa1b0ad6e117099c9af
SHA1 b3f93bf435f496b755324d28eaa543af6048af19
SHA512 2035296a44e12f4683e79ba3ae34e02da77a1dcb85b7bcc0a7e8be1f00a770d159e4d9feb7582f35800ffa0c18b03c501aace9b79d531548b2faf5089f6c5f8c
TLSH
T177D02B9AFDEC9E8EC7E44ABD57A9B4000A4802A3840B9B1310347EC034956F01E35030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 b9c154afc47de5568aee2d07928a9509417f62ec731ecb3b4d39bc985088314b
MD5 51c765d90c5196f5ef8d9b047eb34828
SHA1 809462dbabe10c7bb44793358c056cfa0665463c
SHA512 b0f37b73ba75fc9ce7db6782a5a13aa4ed354495cc81ff5903050e6b40acead2f9241aa01b45174102142fe970bddc406bbadc0632ffa6e0733162321f9a781a
SSDEEP 96:aXWMPqBjAsnDN7ZjGRyCckHYhSxP9ScxQGRNC9BF6C:aXWMCEsDdZjGRfckHTx3BNC4C
TLSH
T17EE1170C83B93713D7752370C1D176E0BCB97AB5019BBEA97100563B4227FA1C65B634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59d3e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d3e0.TMP
Size 3KB
SHA256 2f84923b141d95a88a8c964feb2aee2e8abbc89e487f4d2de752991240d4f182
MD5 fdbb4ee71c0665c16d658fbed2fa0786
SHA1 cf9a5f8bf8b0ff41c4a80a32a4146c5099b846e7
SHA512 1fe8162f586b33371e63b418c6fddaa0198f31c14a04ed147e8119d88cf5c9369b9fb5f3eaefff5e630dd71a5807f229a1c3f80000452791fbca842c39060e69
TLSH
T122710A1D86727763E3202336E2D102C57CF66C941697BEB6B5804B7B5719F72D21F908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7955c15a684db3d04891492ee9bcee0b0ca4bb16c91b8997ecbfe69fbd0a6abb
MD5 54d2149036be9df33147ff444cb1526e
SHA1 eacff8c220726e2aa5bec70f8a7d00aacc23cb3d
SHA512 91411b8e5b2daab4f72fe1df8c6c52a6157808fd888c5c33fb1e726d5acfc58ab409a2ac2b37a03e7fe2e1207b446fee36867aea325b8a6985d0ab95854cf412
SSDEEP 96:D1PODJmpaaij6XzLTwxzEevmDmndmDmgmO+mtmyx:D1mDJmpaaij6XvTUz/vmDmdmDmgmzmtP
TLSH
T123818BF787F5866DDA1255F0AA18BE1BCE2D0514831C7CAA84E0AE17D3E3871E141B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6a970a94e95ff5ad6b8fabee957b0e26d06cf8fb8b72b118787b786a4a6e542b
MD5 238a640d372328854a93f2e8e27e73a0
SHA1 d19f0167817e28cff48d84e1f1c2abe4e0d085bd
SHA512 c781ec959e3d7d1b2516d263cd2b0a13b5c62f9395318ac7600260c05da8f34ceacbf520750306c89efd06f551f5bcdd882a6ce2d899bd2f853cb0d07bb54890
SSDEEP 96:D1PODJmROKaaij6XzLTwxzEevmDmndmDmgmO+mtmbdx:D1mDJmRbaaij6XvTUz/vmDmdmDmgmzmw
TLSH
T18C91ACF787E5866DDA1155F0AA18BE1BCE2D0514831C3CAAC4E0AE1BD3F2871E141B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0aca2fe7bb8fc5982e15a17e77c700ad818a959dcde08643bf9597547810472e
MD5 bd6fe183c507a18eb4bbef4e1f08a867
SHA1 884e17c519dbb17d1fd6cc10dc688210d2c9d44f
SHA512 8bff5c5448bca88de1722742d2972d582c77d898d58045ae65d5fc99291d200f2c53902e9ae7f514ecb2d56f8e3a8ee4a5a38b742faa5f1a1f378527aee2f601
TLSH
T18341BFF783F4856ECA1196F0AA187E2FCE2D0510432C7D9A85E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bdc1ff58293ce44728218c896a8d4db7cbacb0a293540e61b7ab512583b235cd
MD5 7f6949025858fdd537ba564c3cb5f939
SHA1 bc3f661da8cd8cdddf1e2663ff85c928b7c181ec
SHA512 caaebd9cd508f50a7cf794bac333d8366a40a14b489103bff5fce50db72dd88dc06ab255183c8ff9051662033d9c17d65f383f55a07a3e9391aa8f0c805b31be
TLSH
T15BD0A9336204A0B5A5A83A8D416ABCCE832600380C42DED51490B89D16A18681B4F640
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 f8952033f61aa2d1bcb1268b1def272e5cc46d1744702791eb88e01f7e8d67b7
MD5 6226ce55763fcbd81e6fedbe50f2c1c0
SHA1 7739b547d2db9aebde37cbd214e6b845fe29929f
SHA512 5cba975d546dec30fa67917eb279ff49227175612be26b9eec8e5d36982ff2c8a39c3dfe5fbfba3ed0900edaeb742da7654a433b145484db8a772bcecdcbab55
SSDEEP 384:sxZrj3qRm1E/fesLPI0Ly8W+/bIu/5tsuERI:s3aRm1E/fNI0f/bN5gI
TLSH
T1A692E756A5248977CCCBD619F9657F53D7F91422CA814E48AAFCCE1C00EA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 ce611d5db3309b923e5631779f1224a3f926b7b5191b88f9af07a3637bf604d3
MD5 cbb99d7e87ef67d42e456165069774d1
SHA1 2c3e28931f11511f0b73437468ea5e53bbe38c9c
SHA512 07c52bc10ffd4a9f8ae37830362ecacf3f19e63680f846d14f67c714a31a2c509a1760d6299fdc972dfcf580927e310930c0ac1dd7adeba2a78b4a17b6279e7c
SSDEEP 384:sxZG3Pm1E/fesLPI0Ly8NN/b9/5gsuERI:su/m1E/fNI0x/bB5DI
TLSH
T1E282F816A62489778CCFD609FA657F53D7F90462D6414E48AAFCCE1C00EA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 059cc5e3328ccdcc9c92170371aad70822f8789e5cb00b89e62e1fe6584c47f4
MD5 c195e43289701886de505560921f783a
SHA1 e97ac9a190ff3e967fd36b83804fe4b884966ef4
SHA512 4bdb20506d5af7f15b1bbd0d437db7ff74a08dfbf62e99219aed40a772b6ceff645d9ef5f9cb8c7641a962fe2dfb10e5950acb6f7d59b6713577b88377431ac0
SSDEEP 384:sxZrj3Pm1E/fesLPI0Ly8W+/b9/5gsuERI:s3/m1E/fNI0f/bB5DI
TLSH
T12982D656A62489778CCBD619F9657F53D7F90422DA414E48AAFCCE1C00EA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ed043f787561655b243f6e866a8141e4a01af0f89a0a53c01aff04d6e0d680a8
MD5 d47a5fd193210a121269c4c2447669dd
SHA1 10f42315e22cc5015e6dee60d825923bad7c42e6
SHA512 669e04cf989c42721c826d19e70587b11c4577f90192d6739b0b13675fd19c0b9e5f0aa022e3dcce2fd6dfaee389a10018918f72c0e70b4534aa076865ceba35
SSDEEP 192:sxZGRSyMqZjK1Ml8McE/fes8P+P8xE0CXUyynDIzodpEh/W6+WNGY0dR4xevIgjJ:sxZG30E/fes82P860Ly87s/bG5QsjJ
TLSH
T19362F816AA38997B8CDBD309FA457F53D3F9152292404E44A9FC8E1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 53362fe11950e627123cb8b59c5a4c06a2d8dbc6775b4b09d6a285b2ca459e87
MD5 80537ae1efedc655cb55c2f13fa30aae
SHA1 db8b6348c05549d190b801f1df3b8145149054fc
SHA512 110694fbc66d5a4fbd559521b0026e3f26160ea79143794ee1456e88c9c2c36a670463e673527c249c78f9a52a02d9b166d6a7d40861e84925bc2a6a10d74eaf
SSDEEP 192:sxZGRSyMqZjK1Ml8MBJE/fesm+PDE0CXUyynDIzodpEh/W6+WNGY0dwZxevIg5lk:sxZG3TE/fesLPI0Ly87s/bG5Ssu1
TLSH
T17B72F81AAA385D7B9CDFD319F6457F53D7F9146292404E44AAFC8E0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ec4a9ea347b4cfb176da9e5a4f9ae350f3722c25466e37fff0259c7c44ecea78
MD5 6c2e11a5f1297d3409c2f3228ab0717e
SHA1 719f11fa960458a6094a7d5300eb905e82e90f56
SHA512 ed35d14c146c26c97361210189bb438322feebddc53dac4c51f6d6eabd5272a128710b8ecc3a49e7e9c9740f8e79d18c48b3c9c963db00e130c33f4ac740e81b
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3d3pQLlW:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKd3pN
TLSH
T12C030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fe3d0f173035eec442192c3b137a34f5112bdf8f9e3e3a2846932d7e988ca8d6
MD5 6e4c75f3eb508d83a486af32796a6cd5
SHA1 cc841d5c2d8f0c46a02e84981063cba1863c027b
SHA512 ad1326fd51122e842d045c23003f5d6be94f56dd51406b81e43192e8f112919cd4ae100701809bbf91ffe866b13ccf79fd5c6f98e434f42fd24d019d5325b881
TLSH
T1BAE0C0B33CE72414F82F87D5547214940061F899E895BE4E143EB1E7B0A039A2816C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2b85e46a49da8d98a89b9aad58c137f81d339858d80f80092a0163148d94625b
MD5 cc6fa4aa2c6634ef1208c71e593e9b3a
SHA1 90287a6daaaabbb2b737fded69a6016e993fd37f
SHA512 cbe83f660273d41debefce5e8e20fca9bf61c56ee390f1049697a120a7ba27fa7ed910e0ebc90136da101b5cadcea5f1fd3b6934caede5c479ac0a43de41e71a
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Mew:AFBHhTofhno2mB21q3Llbfe3sLDdeEpU
TLSH
T152B28056717B12023C3E291CA6A29B370E8272A3345CA57F77B900BA4E67E115DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2b57e58-d9b1-4be3-8d60-9ee33bd44fdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2b57e58-d9b1-4be3-8d60-9ee33bd44fdf.tmp
Size 414B
SHA256 aea97d8431e470daa3c56561c3d457f4655eb99d2a2cb7c122615f8e61e4bea3
MD5 11a327a923c5b2dd07758283807f2711
SHA1 85ca1efc250b84ae313e542193c1135ca456d9e0
SHA512 f7337d70ba6cd60dcdedf80d02ec3ec0e5c5e0edd878f46633ac6256bb05c10cf87d88f65c9c62d657b6c1a57b31dde8b4bd30ed610997aff0613e39458b9a80
TLSH
T16EE02BAFCD60EC2B28FD1F1AA055074AEAA013576780845F3A3D450D8FB172A43C981C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2a5eb85365694f4aa4a207db63c6b4e417d056f0259c348175f642494661df6a
MD5 0c394e95325921855f7818da5c452fd3
SHA1 9690a077babb615b03ff374dd2710ba6371d58f7
SHA512 4696aa8a9864f4c1f40c44e3d2f6eaabef9f4f3b452e75ecbba54bbcc20f196d0aeaf9cd04baa8892ddda86fc22b7a4ee00118bc25733133db859056244bb4f1
SSDEEP 384:nJiF1tNn/s3n9SI38Nc8TUNTUlIRryusDcjkpfb7oSFsvyvAK/OObjI9G6w7bHyt:gF1j+9N3fwggDhJoysvPK/29M0
TLSH
T1C3D25C36EC55CEB7ACEB4E99B74A3A47EEE001A3858C5EC8D9C85E5C00C729D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c5f85c6c059dfd581387d8c083da12e38b0695fd80359293b96f4623365f15d2
MD5 916e8b904422e926f21fd5d0c25a1f85
SHA1 81a00a212a1efc59cfcc9571fbae4b3bc3e42ce0
SHA512 165fba97cf69a92e09f250f656f3dcf2be7d5896827e6b41ad201f04dd563462bfc063899a02a99ef5dd0f7c97f5800b18bcbedb61f3a27ace9d228d40b87f3a
SSDEEP 384:n3iFKtNn/s3n9Sk538Nc8TUNTUlIRryTbsEcjkpfb7oSFsvyvACn/OObjI9G6w70:yFKj+973fwgvEhJoysvPCn/29M0
TLSH
T1D3D25C36EC55DEB7ACEB4E99B74A3A47EEE001A3858C4EC8D9C85D5C00C729D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 aff19d7532c8b5898cac7ff3c5036737b39c23b793612ec9b4f957d7cd25c96b
MD5 cccb8c3106ece4b0a2f79e8b04c0bbaf
SHA1 e0c565cf06849eccdc256c6ae777ee7cbcc66aad
SHA512 fd5de82ff3adfa037f39acc0e35f3b8622911da9f0ca5daf6a53e42aea54fbb9d8ef376b766efde2313fe6edd257418483a4ef8771c1e7485650c37b488c53fe
SSDEEP 384:n5SiF9CcmyWCs38N48TUNTUlIxBydUsdZjkpfb7oSFsvyvAC/hkP+lFYS/60Hy/h:rFccps3vwgiduJoysvPC/hkoFYS/8
TLSH
T19EC25B32E859CEA7ECDB4F99B64A7643EEE00163C58C8AD4DAC95D5D00CB29D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 beba37ed8429b2c47dfda67e573d091df07d3e5f428f1f2c369de303b05591ae
MD5 a09955c103a6558e37ec8a3f8a3decbf
SHA1 380d19754e1b1c00f27434f7272fad3ca8cf140e
SHA512 f08dd5be7b31cd4bc9d67b047c1ad05915f6e79c73f0aa4bdf8fbadc1fae4d19e656dea6997ddb0524348654a1c77f947cddc81dd2576f35325f1efb15348785
SSDEEP 384:n5XiF9CcmyWC938Nc8TUNTUlIRVy5sDcjkpfb7oSFsvyvAC/OHy/7IgQ:kFccp93fwgXDhJoysvPC/4
TLSH
T1ACB23A32E869CEB7ECEB5E89B74A7643DEE05063C58C8ED4DAC94E5C009729D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d7e58fbc49e684123b965f789006d8715607562bb1f2870ff98546f3387fffbf
MD5 00c249fe0705228158b1334788fa970a
SHA1 b2015fe8fecd37755e52603eb4bafea38bef9049
SHA512 3d64ecd72f4b29285b1471c42145d2e11fd0216e13a33d9eb2ba02cf4a0baa0735fa0e96d09bb5e5a417dc19c08287739d421375535d5686ada3e1837e4ef7cc
SSDEEP 384:n5qiF9CcmyWCs38NY8TUNTUlIxBydvshoTajkpfb7oSFsvyi4hkP+lFYS/60Hy/h:nFccps3rwgXhM7JoysvB4hkoFYS/8
TLSH
T1F4C25B36EC64DAF7ECEA4F99E74E7A02EEE01163818C5AD4DAC81D5D00CB29D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0a269550655807b8131f3db1d1a7c7c5e2d1771d1f5c350607548b22a06b3595
MD5 c09e9f0ea5155ea9c9a92a064e52dc68
SHA1 de2f8ccf384326a629b2e6ed8b2cb3337209df41
SHA512 cac93dc69d1f83a667ecf1fc5dc161bfd558a44589ea6b012753d2ece39e51bdb27f38425b70428a05e2ff79ef91405bf1b5ceb47dd5b87565a617aa1c94029f
SSDEEP 384:n5XiFKtNn/s3n9S/38Nc8TUNTUlIRryWsDcjkpfb7oSFsvyvA+/OObjI9G6w7bHg:kFKj+9q3fwgoDhJoysvP+/29M0
TLSH
T136D25C32EC65CEB7ACEB4E99B74A3A47EEE001A3858C5EC8D9C85D5C00C729D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c788d839ae757bdd4e462722601bdad3d1da26a1d66c9063e0afadd080820e33
MD5 ada9cc97e7420ee56f8125d901c001ce
SHA1 c3dce1676f5d491ceb3f8636f349b1ab06cbbb03
SHA512 97f95466578d7ae14a33c8f444e1a3e83e699603ae69908421ae05ad2e54e2d8bc1d2d3eea74bde0c0ee56d6c92591094799e570301ccc1915f83bbfa6787aa7
SSDEEP 384:nJiFKtNn/s3n9S/38Nc8TUNTUlIRryWsDcjkpfb7oSFsvyvA+/OObjI9G6w7bHyt:gFKj+9q3fwgoDhJoysvP+/29M0
TLSH
T1E5D25C36EC65CEB7ACEB4E99B74A3A47EEE001A3858C5EC8D9C85D5C00C729D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74afad97d993f8324a4d22991c8776dc60bb7cf18b624bcf65a3750b96fdf4f3
MD5 023745af2731f109c7a5d49e924808f6
SHA1 811cc8709953ac50c11a501797f1f045889a0712
SHA512 48bee6270903485f81407c4251bc129e9bd99f11aea6eaf9c3d283f9540ba46a4f0be769bf473b17ac01079fa3bdafe8a3933cf739a7e8c0515494aab1538b6d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe597546.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597546.TMP
Size 392B
SHA256 d7d79076bf8136a6f5f149a122268739ba3318f6b1cb44da16591270a0288e33
MD5 d23e766bb897aae38d297e8ac5c7a039
SHA1 bf594dea38953a39ddee42a475680dd7350068ed
SHA512 3e17fc3d5403f07c7e22879d1a8c148c5478fcf91c9620dd1deceb534f4d24754cfdb0a1af3c20e02e9817954204e09daaa4e2294e2a9aab5f0fcf65f5532373
MD5 SHA1 SHA512

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.18.1\typosquatting_list.pb
Size 738KB
SHA256 baa1fa28ae7a9bebbc1a10251a80f97d44b6350776ae69847a714020974072bc
MD5 badadbec63b0f53468bbebfb4ab905f2
SHA1 91e9ed360fd8e6c2ca5a578f5b26522549a22792
SHA512 bc7b0ba056db828e90627d0726a8c3908f4748e4f5bd4881732997e2256ee123fb89ab2a3d94ad0bdadb60947dbf604c39027f0b3b8d9793fb7885de75dd9edb
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O0I:BfPL6KxmQX5rzPZGI3eaFiUFko898O0I
TLSH
T18CF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 55d593cd00b38a54a2bd08aa62504aaa3d849de36b4e6b6a817fe75d29f3ad79
MD5 1c1d6bc8b4e663a3c9a10f8e53caf1d1
SHA1 3bc81aba23a13127be6a9ee0e630cc908f12c601
SHA512 fcd05648a2680fe949eb426fd3ed44860f062fcaa8e860d6c2c1b2c0198bf3b6734c6b1172ccf7bfb215d911bce4d5d49d3ae642c6b105a6364f276faa90230a
TLSH
T184512EE19C3C2AC1D4BE0E7FB48778FC85E89715F4A034396858EA985A7A61D308187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7a7144dafa86975a00502451db1f05c41c51cf7eb425ff5e2085facf7f6a584e
MD5 80f4bc2b2f64f7a1b9264dcd301bcc30
SHA1 6cb3f86ee9da80b042bee93bfb0816c3de0e60a3
SHA512 58ce2e093ce704f387068c58187afdce0695ed0fd331bc25ea4e3a278c7db769fcf7256b55078c86f0d1fec0b90e5929dd1e4fad0185297fdc9c2864ca7719e7
TLSH
T11F512FE19C3C1AC1D4BE1F7FA48738FC81EC9725F4A034396848EA985A7A61D308187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ecc89da1f25177f5b81a392c646592dc426520247e7ef0a521e08f56352c0478
MD5 759e35ad94fb0ceba94aa4eab49fa580
SHA1 08a5333ccc112c7b51b7879c9c12eabe80418bf2
SHA512 cfedd954009ea9b7aedc162bec18ecff9d46e63ba0c038f89a6e63df0228989d001e26fd7e0f8524a92b5f86e63deb991e82761bf4d2d37f4a0abd79949f43fc
TLSH
T1235120D14C3916C1D4BE0A7FA45778FC85E89715F8A034396448EA881979619318587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5820746cdaeec81ae228b4039d0cc1f502b4334601bbd929bfb4b747eb25f4c7
MD5 2c0b16311d2ce4992457ac3792fec992
SHA1 8ee7f129a4bd3e96f5a46188cc402b71983e2776
SHA512 4edf14bccfafa91e48f999bc74016f9b58467be6c5e49817e8a0918274b87bb0630d0a147faf18cb01e620ea0d192a391f85e6a478a6eab640a8db4fd9e3ce5e
TLSH
T10C513FE19C3D1AC1D4BE0E6FA48738FC81EC9625F4A0353D6848EA984A7A61D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 356a4ede1e6106d7d213fa14907970aa4a9324f65ce348058c1c4cedbf729e49
MD5 b8f26b5de2a0c83281c43b6c1f78742a
SHA1 a28e1fb043a2056823fd14b1b9eb1b3f7831ea3b
SHA512 a7298cfe379da59fde9b90477c5c5df023c858631cb0983ef6550634014d34b312eadaf8310198df4b084aa109685ddd2358e1b2fe5799924e45ed15e47656b2
TLSH
T1AC513FE05C7D1AC1D1BE0E6FA48738FC81E8D725F4A0747D6848EA980ABA61D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_112142469\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1267335722\manifest.json
Size 118B
SHA256 a21d32a4d121a4633a13e5372ff151b7dbc4f0ae505831592be92b5984e77130
MD5 65c86931db1f43c8fabd535f32be9b0c
SHA1 96c629d5e3dd3fe0c5d648285c7a981d0b34e689
SHA512 954785c1cedea7431bd5eecb09aeed91175719f0b691e6cf5e100488125b71356ca9e6c3a2c937e0c48c8b5791ca45acfede25459578ce639162b42e722ec471
TLSH
T110B092B00C0AA03B22C19320ECA167C683F80218F8026B1A088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_1479352149\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_2105060314\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2496_713064729\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download