a6a2f4915718bead91b3da98bb0b762be1e4940fa0238e4ca3d6808dff2b78e0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe
Size 5.1MB
Sample260929-prswaazfnd
SHA256 a6a2f4915718bead91b3da98bb0b762be1e4940fa0238e4ca3d6808dff2b78e0
MD5 02b6dcd0757ef5f907cc76d4c9f3c970
SHA1 85d88d655888d871d2df2e34665f4dc1722e1429
SHA512 6f8902267e522574c97b282bc4bec13ae21d88f03587a98f249c7f756e359c450262eeb04af09cfab43d55a2741fa819e5c50f86e00884433e2caee3fc016375
SSDEEP 98304:PssF9QGJmURrloXGH5G3xJdG+u0+Yf4i:pF9QGJmojZ+dGAy
TLSH
T1AD367C03E2A580F8C09EC178835BD533EA72BC894935B6AF1BD48B612F66F50AF1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1799772321\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1799772321\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1638579209\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1638579209\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{DC3B0943-4F67-468A-8023-F6684B067B91}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 4332	5956	2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe	86
PID 5956 wrote to memory of 4740	5956	2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe	88
PID 4740 wrote to memory of 2964	4740	msedge.exe	89
PID 4740 wrote to memory of 812	4740	msedge.exe	91
PID 4740 wrote to memory of 796	4740	msedge.exe	92
PID 4740 wrote to memory of 796	4740	msedge.exe	92
PID 4740 wrote to memory of 796	4740	msedge.exe	92
PID 4740 wrote to memory of 5700	4740	msedge.exe	93
PID 4740 wrote to memory of 5700	4740	msedge.exe	93
PID 4740 wrote to memory of 5108	4740	msedge.exe	95
PID 4740 wrote to memory of 2036	4740	msedge.exe	96
PID 4740 wrote to memory of 5108	4740	msedge.exe	95
PID 4740 wrote to memory of 5108	4740	msedge.exe	95
PID 4740 wrote to memory of 2036	4740	msedge.exe	96
PID 4740 wrote to memory of 2036	4740	msedge.exe	96
PID 4740 wrote to memory of 4516	4740	msedge.exe	102
PID 4740 wrote to memory of 3708	4740	msedge.exe	103
PID 4740 wrote to memory of 4516	4740	msedge.exe	102
PID 4740 wrote to memory of 3708	4740	msedge.exe	103
PID 4740 wrote to memory of 3496	4740	msedge.exe	105
PID 4740 wrote to memory of 4680	4740	msedge.exe	114
PID 4740 wrote to memory of 4900	4740	msedge.exe	115
PID 4740 wrote to memory of 5620	4740	msedge.exe	116
PID 4740 wrote to memory of 5540	4740	msedge.exe	120
PID 4740 wrote to memory of 5540	4740	msedge.exe	120
PID 4740 wrote to memory of 1052	4740	msedge.exe	123
PID 4740 wrote to memory of 1052	4740	msedge.exe	123
PID 4740 wrote to memory of 3916	4740	msedge.exe	128
PID 4740 wrote to memory of 3916	4740	msedge.exe	128
PID 4740 wrote to memory of 5048	4740	msedge.exe	129
PID 4740 wrote to memory of 3404	4740	msedge.exe	130
PID 4740 wrote to memory of 3404	4740	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Users\Admin\AppData\Local\Temp\2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk.exe" --internal-wininet-refresh
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dashboard.data/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffeaee1c188,0x7ffeaee1c194,0x7ffeaee1c1a0
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4201956762768380007,2568987538559308984,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - System Time Discovery
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,15778917130708368252,4003194189931775057,262144 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,14964944142472000724,16157926441717894866,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,5856829371166735801,13227706972938107271,2097152 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,1665063443235893965,527171456315330478,2097152 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5491501482520013175,16011117763902492471,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,8754247476682479525,13652654467943187476,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,5422753774708021166,14149091843703305485,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,5422753774708021166,14149091843703305485,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12959167204225983221,13740734802925017332,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,215790213445464714,14566755183716323516,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,17914138420068709774,1253589651974993755,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1120,i,5025867767527877684,8980383709301451990,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,15878402650671338436,7855957487040460318,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,8882423863905915418,7088473244917813884,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5072,i,10523369780927293373,10258755583623505525,262144 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,6577882011710437166,9109027684285841689,524288 --field-trial-handle=2132,i,10565399734026639665,10104332481397218778,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1638579209\manifest.json
Size 118B
SHA256 272b7391992a4fe4d1c67d59adf02e7d8c42008c5bc943b8bf812bbfe6774f8f
MD5 0d1129793136a291c7cf24f07dc0152a
SHA1 6b79935e4987489abf3f30e979d25cb6abc0b40b
SHA512 039b3159681b473efd497101ae57c5f36b8d8351b9a3d9e36292504e827d1f70a8da10a0cac03b200e7a2d1aa21da40f402d3a24022a0af06ab6721ad617add6
TLSH
T181B092B00C1AA03B22809760EDA0668283F81219E8025B1A088036482F8827881362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1799772321\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_35517273\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9d2ba828f646bf766769f02cabf526262c27508d74a2c803d1b1629a6301bdaa
MD5 6d8300f3c20a29bf030712b373af4f60
SHA1 e469d5567641753a39a3f8c7a674353443fa8dd6
SHA512 fe3237178896a0f88ab5cb71a3a725b264c9379039a37aaade9a629ce0d59d856ac3a3faa4b73033e3f18a3fcdb6a2f13e40d5ca4d682b7f3e42733356d5635e
TLSH
T185F0F9B5CC25AC7B08FC1B2950644A46E75113572A80889F3B3D811D8FB1A3B854686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b3c9af89ff87a7dc97c13ca97255d1088d71c6cb51fba0936b3b501406867f4a
MD5 c5cd8707a8e59800b389d7daff785733
SHA1 b4d2678806a7f6662f0c531a31ce56dd12bff75a
SHA512 ebd38bd9e7bb768ecc6d05ad8cfd05e21064bda247402f3c3e870a6f5d224abb734c71b8d6718a843193ae6993864c72a6c2a0005118259e5b8795a280553ba0
TLSH
T17441C0F3C3E8866E890196F0A718AE2BDE2D0954432C7D9AC4E4EF1B93E3471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7083ec600ec2b1ef5bae916b93116f21a43b3d4937177c9844541ec627dabed
MD5 0ea91247209e8b345694c4786b8d7047
SHA1 e0c4b4e5aa67b84efecb89c2d35f7dfce80f54ab
SHA512 58bf1ec7a1692fac1cffbb2c600ef8ea4ee0abe5fda374d89691b9d8929a5cac28653362251a34e7b2342f1920980c3fc69c0964dd5ed693a1d9977abe29f2d2
SSDEEP 192:sxZDRpja/f6seQZZNIN7Nzodp+EJHmqs6+WNAyO/YbIAxYnIIg57gJ:sxZDXa/f6seOZNIGrJHHtA/FUYENE
TLSH
T17B42C815AD28697B8CC7D219FA55BF52D3FD5032A0D51E88AAFCCA1C14E7BCD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0574b147facec957a6b6caa00c9747a81b90b7d56154b4b8e5c0aa952ee526d7
MD5 e2de8bffc0cf2a8c37f82c30d2acaa95
SHA1 6876023f631583cffcc715d2a8882efc3c1412ed
SHA512 28b6437a77160bb1d15d7156e78818a8686e400aac3734008cf77e0a6c5e5a631903f4da0410bb41fd2b9a9effcf7e9b7873597ceeac6becd7243fdaa4d05801
SSDEEP 192:sxZDRpja/f6sbQZZNIN7Nzodp+EJHmqs6+WNAyO/YbIzkxYnIIg5NG4J:sxZDXa/f6sbOZNIGrJHHtA/F8YEOc
TLSH
T19652D915AD28697B8CC7D219FA55BF52D3FD1132A0D51E88AAFC8A1C14E7BCD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0c7be7b86af0138a735a552aa26f8701f5d885f283cf37aca35d735b0848bb08
MD5 8041d44507e56ef5f6378be8c4080a79
SHA1 672a336a193189235438398a41af29b56ec61bc0
SHA512 1734e5f0666950570bb97e8ba7337ca1a9f815b1e5b886d4578267c6e32eecc0a47ef7b5f31d6a8bf96cf412dee55a210c9a958789fcd2eb5f251566f20231fc
SSDEEP 192:sxZDRpja/f6sgQZZNIN7Nzodp+EJHmqs6+WNAyO/YbIAxYnIIgjgJ:sxZDXa/f6sgOZNIGrJHHtA/FUYEjE
TLSH
T18B42C715AD28697B8CC7D219FA55BF52D3FD1032A0D51E88AAFCCA1C14E7BCD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 086e4dadd2541ae80a71cabcca716c57c09fe0d4e1569fd75787ac3c81d93d2c
MD5 06a7530eb9f7b91e3588aa07de36f1be
SHA1 a3e442b064d6ef4b219c9469fa559b5465c30dc4
SHA512 c0bc4ad8d0ecde30cd326d901f9891398e14603cf2996e26590ac45540befbf08396ce6f34f6c9c4d7b402c617147176f10058555fe28ddbad7faa825b2ada5a
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4wLWLlMC7fnroD:0RyktjYEbvnWvDBltu1ja5wLWLywf0LH
TLSH
T111E2EA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C67EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 edc86b0ed36a16c919b5f17bd355f7eab9785a5df2739494108b99fbe02a2d2c
MD5 8e8b3a11ee2e9b4ad71274ba8dec9bbb
SHA1 2ad1149d9d672f06c5b7fee88c7288f1fb1073c6
SHA512 f34b591052f79dc053c493bfd7deb6391d71f71a6df29a2604da2e647c539a4b1cee19433edd8af0d3a9dd7e9b3346077f44dd90c42415be00e02d753d232913
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgDPn:OtfFvpopPxrB4Rhfgrn
TLSH
T18FB2241571BA021138FE690881B6871F064232B37158EA7B7FBD14B69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fda0801dca8e15a1599ad5c30cddc234ed315dd46fd19b6d06cdfc284f65d020
MD5 b5114b164dc191f88d242ce763269e47
SHA1 7afd9f95f003a851a6c9e1c0131888f48b843b38
SHA512 17f7f2b9dd6e90f13870aea1aee1b2b2fbefbfd55abf1bc3a392a8b1ce6fae4892aa145aacfb0460ffbd5a38d18633d311f8af95d02f23ae99f2e34ea02f2c2c
SSDEEP 384:nQiFiZcI63sNp8TUNTUlIm25mg5Hn4zfMBhFd1rv0cLMYtdsa+VYdzgL/7Izhop:rFQ63wwgS0xBhFdOc4Ytdhg++
TLSH
T1D8C23972EC94D9BBE8EA8FD6A78A7A03DEF0116381DC59C4DAD85D0D009719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e4f2991e0820ee5db49458c9c193b4d254a33a072f0d20c4efa684aad52fbdda
MD5 8f0737a715ff5642a3b89633e94b7b99
SHA1 7e795902afb99f9d80ebc08e008d3591391766fc
SHA512 9cc53d1197ea0aa0672f172078d54324982d14f465d0b356bb81229512b9226f2cda83e71f5368ccb82d3c876d1f1261b5c8568f2b877e87c46b3a379422e070
SSDEEP 384:n8piFiZcIV3sNd8TUNTUlI4Y5mgnzY4zfMBhFd1rv0cLMYPtttgOIwZOyLngL/7H:pFQV3UwgeO2BhFdOc4YFtXsrP
TLSH
T15FC24A72D8A9CDBBACEB8A95B34A3643EEF0116385C88AC4E5D94D5D00831DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 37574673e5355b5d3b9b308ba9a6eeb085ccc2a24e746a2fc800d1659d67dbcb
MD5 29aaa985211fa65be355e2e2a70efe75
SHA1 cc09fae0e7d059f4a3c59136b7b0b8bad50c7878
SHA512 b7d51f36ffda0fa891e8a5519c01d69c655a03162a2a9f937f8ddc7add0a5604652a2f45c536ece0ee72a5d591c81f071ecd7be49972c2634e9cad00a2c70cfc
SSDEEP 384:nMpiFiZcIV3sNd8TUNTUlI4Y5mgXzY4zfMBhFd1rv0cLMYPtttgOIwZOyLngL/7H:ZFQV3UwgeO2BhFdOc4YFtXsrP
TLSH
T104C24B72D8A9CDBBECEB8A95B34A3643EEF0116385C88AC4E5D94D5D00931DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 6d603a9cbfeb2158973793873a840ef2604b284660d00ff8a86f946c578b7760
MD5 a3fd0ed109ae4b159562aded3518acf2
SHA1 ff666c3ade0ff622fdc58c5f16e3af62faccebae
SHA512 993bf85c8446720e444530257f64507cb594ae88d3ccaec97cbef3483a39050d48aee4ffb469ec642d39b026c1f89c82f05ff0a289ac4b13a747b961fc1d99d5
SSDEEP 384:nMziFiZcIcf3sNd8TUNTUlI4Y5mgXWY4zfMBhFd1rv0cLMYPXttgOIwZOyLngL/L:nFQK3UwgeH2BhFdOc4Y/tXsrP
TLSH
T1D9E2A3F198D789B7E8AE4787A37D2E029ABCD153B5884984F7D44D0CCC821BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.29.1\typosquatting_list.pb
Size 1.4MB
SHA256 ef35f1b1c075ce0dd292baee3f7aaff8f0f0527a849d1112d4a52dd354221fec
MD5 4833779ff2e1a78f96ecf13fdadc44b9
SHA1 a5b98ec675ad8756ca1519c3b90591299f7e17f5
SHA512 38dca6b0a91d9621217668787ad591b54d06e7f47d26446004fa2e5a7d5cad924bb8bbace62614e7cf2e6d5b016d526e7f24834ea20a6de06e7f10153a4ecbbd
SSDEEP 12288:3NH1o/AtTKm9uuIE8WHZhnVniHSYKhDJcyY:MgKm9H8W5hnmSQ
TLSH
T10065B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c951369a8a85c4eefa0d436c5028512724cc4d226d6786023f08c373ecb7b3e
MD5 f5ed10a3883deb99cb39642c58d8bdee
SHA1 86cee67f4e7c3f024c6b836095aef3a0a23a35eb
SHA512 4cb267177f8b87dbabffbbf299758e1b16cc8f87b894de8edf7d5e70c5ab89f4eeb90001925c340d81cc415bae7646e1479952e2bb9a85158d2cacb070e0c989
TLSH
T11A4112E05C3C1AD1D4BD0DBEB49739EC94E89722B4A434796859ED98867A61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9564e6fb4eb883201ac503fe5bd9fb287137c349216aad920bafa4ac4430615d
MD5 b7aaf65a01a2d87fbcf9804c5b4577a0
SHA1 d1e1d61f0b22833e63c6136e837e9b47a3dc1ec4
SHA512 8272a33fc1fcd6d377fdf4c6ec244aa93d355b1450e4df54b352d7e2231a5951548c747f75f9ef327622d3a85fc53e3d73fdd6d1dbc6bcb71ddbd0f71b22fe50
TLSH
T1424111E05C3C1AD1D4BD0DBEB49735EC94EC9722B8A4343D7858EDA89A3A50E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26574987e03d8a1d901ddb350ed46d95b154da1eb3468ba075b2e4246819fd60
MD5 50b96db8092e492404f88ec8facc426e
SHA1 347e67826e8d78f2b308165d961c49a7e1bd6a53
SHA512 db1243ed5fb92f661ad8619ae12436b044872749111a919d6d729defe5bbb8992779bdb3f5e1d871e9d992cbc5d263717dfade8e67b8af93f3d8b8e0f7c82d6d
TLSH
T1DB4124E04C3C1AD1D4BD0DBEB09735EC90E8D726B8E4347D685DE9AC967A61D215083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 38e3819773724c29793f266fdca89d93e315270fc3f313bb2971412c33f23731
MD5 d20646a6034f5acfa97de617a8387f98
SHA1 c54e7ae8af63452f487ad67252857177ea5a30bd
SHA512 084141cc6bfbfac13166ccc2809fb7aad5625f768e84788c6956ebcd456ab89b8d079df85573ed3258a6fbbb5d3f0c88ed310810963c9ea5796fd61bad1dbbb9
TLSH
T172414858A6FA1108B3B76F5AABF7696E047A7C772F0AD45D40010E4F0A67B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download