c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

max time kernel
119s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260912-tdf2saec22
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
66	5840	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1960_724871381\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1960_724871381\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337855204328834"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{3A39113F-2985-47B5-8FF8-FF5E2D740E2E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1960	5024	VelocityLite.exe	85
PID 1960 wrote to memory of 4676	1960	msedge.exe	86
PID 1960 wrote to memory of 5840	1960	msedge.exe	87
PID 1960 wrote to memory of 1384	1960	msedge.exe	88
PID 1960 wrote to memory of 1384	1960	msedge.exe	88
PID 1960 wrote to memory of 1384	1960	msedge.exe	88
PID 1960 wrote to memory of 5700	1960	msedge.exe	90
PID 1960 wrote to memory of 5700	1960	msedge.exe	90
PID 1960 wrote to memory of 5712	1960	msedge.exe	91
PID 1960 wrote to memory of 4296	1960	msedge.exe	92
PID 1960 wrote to memory of 5712	1960	msedge.exe	91
PID 1960 wrote to memory of 5712	1960	msedge.exe	91
PID 1960 wrote to memory of 4296	1960	msedge.exe	92
PID 1960 wrote to memory of 4296	1960	msedge.exe	92
PID 1960 wrote to memory of 616	1960	msedge.exe	96
PID 1960 wrote to memory of 616	1960	msedge.exe	96
PID 1960 wrote to memory of 616	1960	msedge.exe	96
PID 1960 wrote to memory of 6076	1960	msedge.exe	97
PID 1960 wrote to memory of 3548	1960	msedge.exe	98
PID 1960 wrote to memory of 6076	1960	msedge.exe	97
PID 1960 wrote to memory of 3548	1960	msedge.exe	98
PID 1960 wrote to memory of 3548	1960	msedge.exe	98
PID 1960 wrote to memory of 1424	1960	msedge.exe	99
PID 1960 wrote to memory of 3944	1960	msedge.exe	100
PID 1960 wrote to memory of 1424	1960	msedge.exe	99
PID 1960 wrote to memory of 3944	1960	msedge.exe	100
PID 1960 wrote to memory of 1784	1960	msedge.exe	103
PID 1960 wrote to memory of 4144	1960	msedge.exe	107
PID 1960 wrote to memory of 1316	1960	msedge.exe	111
PID 1960 wrote to memory of 5608	1960	msedge.exe	112
PID 1960 wrote to memory of 5872	1960	msedge.exe	113
PID 1960 wrote to memory of 760	1960	msedge.exe	114
PID 1960 wrote to memory of 760	1960	msedge.exe	114
PID 1960 wrote to memory of 6016	1960	msedge.exe	115
PID 1960 wrote to memory of 6016	1960	msedge.exe	115
PID 1960 wrote to memory of 2084	1960	msedge.exe	116
PID 1960 wrote to memory of 2084	1960	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x31c,0x7ffec002c188,0x7ffec002c194,0x7ffec002c1a0
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6450393302320927545,11362028243591108412,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,1084766105275275278,12696329429593728458,262144 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,11167657949954857763,11841069030868446867,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6246620599450841760,13034606445074985374,2097152 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,366807872156351297,11069041456809181682,2097152 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4852,i,13392523751762777058,6483700516834506365,2097152 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,12855835303284940267,9825632966389734186,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,887067958439355887,6700453356321456086,2097152 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,16854124478423762313,6548907586100555336,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,17129728278625933611,16030572024282706842,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12460961019082867474,8746065193874479445,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12460961019082867474,8746065193874479445,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,1820224561435666524,10866148196394118565,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,520878609232247356,12604775358841533878,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,3102655928027109974,8823318831393769789,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,4515682490194535452,6543978846120988019,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2794420354918799684,8193530905388428821,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15537923475933025030,9403309180553312702,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2872,i,2387340029690177373,12298614520060290964,524288 --field-trial-handle=2300,i,13481679312656927507,15642517963359899539,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d96ebbc1caa65bcde597044c543ca7a35b2bf3c27c489d1a36182d6835a6c33e
MD5 67c048fd08b434f0864569b3fe83d57d
SHA1 f4d09cd3655fbe175de8c4316b30256f180d27ee
SHA512 d6f461863bc9aadc366a844d308465dfa1cea0817f9e82fbe6d6bd8db469c29c7d333d3f033032086a3cc1f0ca4e2e0b63f259acfbd562ed247da72c0fb3c9a4
TLSH
T17C7151A49959D0E9FB99B27197EF20CB323855A8BB831FE31864F82C5C4E36DD16C0D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f553.TMP
Size 3KB
SHA256 b212de5594dd887eab6fc1a2184c96e6193d5d77fdd89df66830c88c40b081e3
MD5 314fc5d837526403023c69c9acfd207b
SHA1 fbd88f578375cdbeac6c8e417445616800088ca3
SHA512 2c4dad00448c9cbe938cec63fab8a40f4de144f57dfc85eeb200a76090e15bd81f29fac0e228eb87c589e63e133c84766cc36ee8ff5dddf9be0d011f01329c2c
TLSH
T1CB613EA45658C4D9FB98727197DE11CB323895A8BB971FE31860F87C5C0E36DD16C0C0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2f02166c77b0a741a8dfc7e617f6c058de83df0bd7959987de01a3deba8f8a14
MD5 1e45f7018e02ec30b882f9ea4c7504f9
SHA1 4d8d6df244284362e4e37638fd088a056e31297d
SHA512 9e273449d0c6d64d381978db405c10cd213c50dbbc082238b39de4233dd28b9de34f0499f1793fde664da6d776753ca9887d7b6c64d3d97c5c388ddf4b63a208
TLSH
T10B619BF787B4856ECA0096F09A18EE2FDF2D0615431C786989D4EE27D7E34B2E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a7b15e26f7a0f653cce2d65b1e6d3157339b4bca8c49a33a8be6bc112bc54012
MD5 76bea24b34e1c11c253426e47669b1a1
SHA1 7faa0ad1ba6411a91bd19b6aea516c97501d10de
SHA512 a4d90597e72aa25b201145888ba7a9ee0e475c1c166c4c6d25757e0a514bd18184b369871c258d1c90a13ddca21b3186b4be59405764bc280750800677f5139c
SSDEEP 192:sxZORLzy/f/ssNaQZLjl8Izodp6LHW6+WNreY/Yoi2SFwJIg5rtMJ:sxZOly/f/ssAOPq78HbD/ZSCVtw
TLSH
T1F742C755AD24A93B8CC7D619FB55BF53E3F9103390911E48AAFC8A2C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56109b4ed8ddd00f752c628d33d1a2fdab55f1dcc60a2b7e8bd7b129af1133da
MD5 17a4fbe9a0526f8752a4056fc2df0814
SHA1 6634bdc8997341b36f5c58c483d2c1392c5c7c24
SHA512 a6d6d46c0c9f351573eab40ebe69fb95271fb702cbb1c29c321ceae2aa988a7d7a621c4350527df20bef331feed2c135b172c4320407754b6bea032ccc771474
SSDEEP 192:sxZORLzy/f/ss2QZLjl8Izodp6LHW6+WNreY/Yor2SFwJIg5rtQpJ:sxZOly/f/ss2OPq78HbD/gSCVtQT
TLSH
T18942C755AD34A93B8CC7D619FB55BF53E3F9103290911E48AAFC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 41c6cf3727c2e9a98e65d867f5cc30dd8f303fc3a2e60d03094625a630870f2c
MD5 5551c2c01f9ce612c5d0782d918bea1c
SHA1 6f9ac6522c35f1316c8968268855882596cbff66
SHA512 ee688235e8c35a855c7a22a5d261b2b33a240c68403021cc2e3d371abd57f3dd93ed0f0d757003a17eea43afc9cdbbd5da7178d1d174166b4257915524ad30e7
SSDEEP 192:sxZORLzy/f/slNaQZLjl8Izodp6LHW6+WNreY/Yoi2SFwZIgjtMJ:sxZOly/f/slAOPq78HbD/ZSQjtw
TLSH
T1DA42E855AD24A93B8CC7D619FB55BF53E3F9103390811E48AAFC8A2C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 57d6cc4f5a095ffd51681ea7fd0414ef2ded26dc0454177e46ce85b1b4ed553b
MD5 d1fb7c16c6c19a0fd7cf36ad30939ef7
SHA1 86f40845f7b823b21c09862bac07c95dd3d993c6
SHA512 7ef896cf54ca753cf683edde9e157083c89137c4f052d6cf3b6bb83e590c2904d6d70f64b75f25b7ea93d1be053f2c6fdafa4e4eda8f2e49e5cd9cc4333029db
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVr1qpLlvVajYroS:Px6r8s2EbG+WviyUKu1jai1qpLd4jjo/
TLSH
T132E2E97B780CCE7E4FC05E9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 9f1ba3f87464bdd713fd8bf4e36a18a557f49b152b15674b58517c3ecdd50362
MD5 273be85506ec34c968e716200432df6b
SHA1 1bb7bdce077888a3deffb15e423101b3a039b034
SHA512 f235c7a9aae612947b9894d590f293760005996f81638f5b3d1a6c2db3dfc671538adbb6ca41f42c7b2fc972e76c206e3016a852bc20f9b910a848c0f9a183a9
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgY:ST/2dXOJhJlpfnpp3tNXVrN3aJhbz/V
TLSH
T173C22E1571BB021039FE291C91B69B6E168231733119E66B7FBD40B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5b9e8199c11494fd93c092ec4d324a51d4ad4a563fc8eb8dd7e5af6daced32e1
MD5 5434edb3b3fcdc254133bd729da6de23
SHA1 d51d55ae855fecfe4104231ca774845fe08aa067
SHA512 86a5f61238b1292e02b268e4b5bc0e41fcb703e832fcb92409558a4a43fc8122477e529d770011904a37c9aaf7e67cdc01b4b2f8746a19a8258b5b9291425356
SSDEEP 384:nUiFiZcI63sNU8TUNTUlImFaKMis4wzWfLBCh7SUZ4mYpFmPsa+VY5agL/7Iz6o5:vFQ63BwgDdHEBChf+mYpFmPhggq
TLSH
T153C24B36EC98C9ABE8FB4FD5AB4A7603DEF001A3959C9AD4DAD91D1C008759D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c3805efd024809ebf1eb1b9f4f9420c05d422e93cd52101bd98af6e6feb260c6
MD5 2738f096ef5e2b414d9d2c1374e21950
SHA1 614c91ed0a4004c07023967c45d23bebb2e2ae01
SHA512 012f2eeef93724c5de204e8f34b53cc5625908872ed7f3220ec16c6d3e1c127ef2df7d2f1e419ba3c574016bced4d71d0031cdc47422c68847fbea6007aec73c
SSDEEP 384:neiFiZcI63sNW8TUNTUlI4raKMnNFduwzWfLBCh7SUZ4mY5uWimubdgL/7Izco6:1FQ63XwgPXFHEBChf+mY5pimuyF
TLSH
T1C8C24932ECA8C9A7ECEB4AD5A75A3A43DEF40163D88C9AD4D5D91D1C00935DE070BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 52ce289b2acb092faa47ecd1ff1d3e5bc89839e0a71ebcff8fb710a181846b53
MD5 895f9b2bc0628fcd107fe95e92bc08d9
SHA1 bfd55b95f11c981ae3d3515631ccfaacf2195b50
SHA512 8a24ba177eba7b697bd2b10de25ec976c55dfcc391d8fea06759006e0adb5ea471cabde0e419eb3b3c062c582ae223cd50ac5225a61368d3e41689b56b265dd7
SSDEEP 384:ntiFiZcIr43sNW8TUNTUlI4gaKMnNFduwzWfLBCh7SUZ4mY5uzmmu7O6R2Feokug:kFQE3Xwg8XFHEBChf+mY5Cmmu7TRE2
TLSH
T1E9C25A72E868CDA7ECEB4AD9B74A3A43DEF001A3D98C9AC4E5D91D2C009759D070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.13.1\manifest.json
Size 118B
SHA256 e1a6a74d9060051aa97af7e42ed804b03cf8cf4143ccbd3ab272643d4940d01d
MD5 ce3a12963598e73f7e0e785453854a4b
SHA1 81f77db0fcd5a1b2f316c86ebdd9211829b66adc
SHA512 84f6c9ac4d9e93bc0d3da1dbbf2193cf60797d6284eb96efa966aba13c4eee3577522c2433896e7156a2dc24a801a1e26f6f1762c3ab2668a3430be0d4d4de26
TLSH
T180B092B00C1AA03B22C09360ECA0668283F80229E8021B6E088036481F8817881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.13.1\typosquatting_list.pb
Size 1.4MB
SHA256 0414c635327db9a80d457d1d85a5a89416226dba075cc42f40df1c8d03945094
MD5 31de08def6b909db7007db42b53dabbd
SHA1 2d84ecd75ff5c7f3859d34987f720cc44cef598d
SHA512 646b5476e86a424ff9500097e82d0fc7d4a56fc1c6c980d6b1ab11d0a1b313195e497b08e142572ffb8cdef6c482fb4b86486bb3d667b3872d396b07d369ac9e
SSDEEP 12288:hRLoLUprE/Ih6R9SiY/I1fYXYXHxLwkLaCgfo+8SRLRnrR+C:dFAR9SJCfYXYXHxLwgaCRSj
TLSH
T1BF65C5B9DFC00194DAB8112D20BE71D8181412A540F9DFEAFE7C858F2BC69C977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 283a1f01bd9a720755a065a919fdc89a3f0de1febd6e1154b4105add549ae861
MD5 af314a692681650082fec3811b0f529d
SHA1 519b5e99fd57804d35a8eb702b88e3d4f0884944
SHA512 d966b55c5f4217ba61470b2c8de783025036b0f2224b1db12e589d80cb7321cd3a4987fe0b178cdba71732a92183d2a01d1a2114dfbbdfbb099712a27fe927f5
TLSH
T12B511CE0587C5AD1D5BD0E7EB09B34EC94ECD621B8A4387E2858E9985A7A61D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 352b34f71824991bab2f1ae5d6eb3ae271ebb97791c0342ba44d0ef1130cb212
MD5 084e1db0aeaed4fd82d5e834a4dea670
SHA1 f6d7982e2603d8292780932c401ac3870559606b
SHA512 4b200268b9f727289cb57253a83a0ee94dc4e00a15fbfed67f406ba42538d68379047228b35df77adf894ebab4f6068585073e976029cc0bf559a6ab3aff61a2
TLSH
T1EA41D998A6F91448B3B37F169FF6A86D487AB9772F06C49D10120E4F0662B40D971737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads