873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Resubmissions

22/06/2026, 15:07

260622-shj4kadx4l8

22/06/2026, 15:06

22/06/2026, 15:04

22/06/2026, 15:00

22/06/2026, 14:56

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
900s
max time network
748s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity/Velocity.exe
Size 32.9MB
Sample260622-sdctpady3w
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
71	1800	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Wallet-Checkout\app-setup.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1103843065\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_212357445\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1977030800\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-crypto.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_2049050169\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_323150268\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1977030800\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe
1800	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266145011816047"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{BC647A65-555C-4E65-BDB0-D8E5CE95F564}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4608	924	Velocity.exe	82
PID 4608 wrote to memory of 956	4608	msedge.exe	83
PID 4608 wrote to memory of 1800	4608	msedge.exe	84
PID 4608 wrote to memory of 4052	4608	msedge.exe	85
PID 4608 wrote to memory of 4052	4608	msedge.exe	85
PID 4608 wrote to memory of 4052	4608	msedge.exe	85
PID 4608 wrote to memory of 2340	4608	msedge.exe	86
PID 4608 wrote to memory of 2340	4608	msedge.exe	86
PID 4608 wrote to memory of 2508	4608	msedge.exe	88
PID 4608 wrote to memory of 680	4608	msedge.exe	89
PID 4608 wrote to memory of 2508	4608	msedge.exe	88
PID 4608 wrote to memory of 2508	4608	msedge.exe	88
PID 4608 wrote to memory of 680	4608	msedge.exe	89
PID 4608 wrote to memory of 680	4608	msedge.exe	89
PID 4608 wrote to memory of 3784	4608	msedge.exe	91
PID 4608 wrote to memory of 3784	4608	msedge.exe	91
PID 4608 wrote to memory of 3784	4608	msedge.exe	91
PID 4608 wrote to memory of 4596	4608	msedge.exe	92
PID 4608 wrote to memory of 1196	4608	msedge.exe	93
PID 4608 wrote to memory of 4596	4608	msedge.exe	92
PID 4608 wrote to memory of 1196	4608	msedge.exe	93
PID 4608 wrote to memory of 1196	4608	msedge.exe	93
PID 4608 wrote to memory of 3280	4608	msedge.exe	94
PID 4608 wrote to memory of 5552	4608	msedge.exe	95
PID 4608 wrote to memory of 3280	4608	msedge.exe	94
PID 4608 wrote to memory of 5552	4608	msedge.exe	95
PID 4608 wrote to memory of 5596	4608	msedge.exe	97
PID 4608 wrote to memory of 5828	4608	msedge.exe	98
PID 5828 wrote to memory of 6104	5828	msedge.exe	99
PID 4608 wrote to memory of 3068	4608	msedge.exe	102
PID 4608 wrote to memory of 2752	4608	msedge.exe	103
PID 4608 wrote to memory of 2988	4608	msedge.exe	104
PID 4608 wrote to memory of 4028	4608	msedge.exe	105
PID 4608 wrote to memory of 4108	4608	msedge.exe	106
PID 4608 wrote to memory of 4108	4608	msedge.exe	106
PID 4608 wrote to memory of 5976	4608	msedge.exe	107
PID 4608 wrote to memory of 5976	4608	msedge.exe	107
PID 4608 wrote to memory of 3032	4608	msedge.exe	108
PID 4608 wrote to memory of 3032	4608	msedge.exe	108
PID 4608 wrote to memory of 4484	4608	msedge.exe	111
PID 4608 wrote to memory of 4484	4608	msedge.exe	111
PID 4608 wrote to memory of 2180	4608	msedge.exe	112
PID 4608 wrote to memory of 2180	4608	msedge.exe	112
PID 4608 wrote to memory of 2028	4608	msedge.exe	113
PID 4608 wrote to memory of 3848	4608	msedge.exe	114
PID 4608 wrote to memory of 3848	4608	msedge.exe	114
PID 4608 wrote to memory of 2588	4608	msedge.exe	115
PID 4608 wrote to memory of 2588	4608	msedge.exe	115
PID 4608 wrote to memory of 2900	4608	msedge.exe	116
PID 4608 wrote to memory of 2900	4608	msedge.exe	116
PID 4608 wrote to memory of 1176	4608	msedge.exe	117
PID 4608 wrote to memory of 1176	4608	msedge.exe	117
PID 4608 wrote to memory of 4212	4608	msedge.exe	118
PID 4608 wrote to memory of 4212	4608	msedge.exe	118
PID 4608 wrote to memory of 6140	4608	msedge.exe	119
PID 4608 wrote to memory of 6140	4608	msedge.exe	119
PID 4608 wrote to memory of 5372	4608	msedge.exe	120
PID 4608 wrote to memory of 5372	4608	msedge.exe	120
PID 4608 wrote to memory of 1520	4608	msedge.exe	121
PID 4608 wrote to memory of 1520	4608	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa11c0c188,0x7ffa11c0c194,0x7ffa11c0c1a0
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17941866181181675419,8721139458168758912,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3247878855578120599,18160481461937018258,262144 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,17563734376560405472,9507177945188791835,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,746156923404649469,15323874066539230694,2097152 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8816615054667610164,2699155120516225768,2097152 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,17784489578738229888,3803495677011744235,2097152 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9829711083456088487,3491058137790228109,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5184,i,14360117205471714018,8722181915763361914,2097152 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,9506095632462920486,15128417617235898123,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5669094831366248821,3309113961705191890,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,7785192459446508650,17631366390168762629,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,7785192459446508650,17631366390168762629,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,15783636370927967958,6329267107754309885,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,5877235003268110765,1871596243670653597,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,12809318443114843262,6517035501632318188,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,16506879617530878013,37511587950502336,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,9251892470079125686,12861299009017971806,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,5204056446844770933,8320976031890415049,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,17821352066756625421,7217802169973807617,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,10231167092553065618,17932383754240211180,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,2611808933018310457,17336613176391068076,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,15458165789066681660,13498952862353800032,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6964,i,5374000212224589008,11579763125420201329,262144 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,2610557942859109757,3266605749453560971,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12993732318934808973,11687624211272997135,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,939756790767908202,6001485078270973294,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2569443573180098656,17351280970874612296,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,7818598189525034659,16238076987426865328,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,7176219583343196407,6155483407704734769,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3479370528211388555,2937353979925701009,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9885773699249174595,11257981988174402315,524288 --field-trial-handle=2044,i,3106040601140142034,10910505037970232587,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 29d7052200e6c7a9aaa1b2864db8bc8e3b47f0b5eef53f23d0ea5a933125ad7e
MD5 2d731a33625c9877a74d6e9ff6ad489b
SHA1 ac3057cbc6afa631578646e93da0bf60f34b0cc3
SHA512 19eeabcb72bc82b878e6e9603e0b8162adecce938f27a8fb0a9f48fa31ec7eacbc853625c384e8b76e65cd1cc2a57fcdb7cf0e57b93edfc7b72fbf236a86559f
TLSH
T112E02054C5CEC31D6308B487C3FC530CC241760E96C5BD5F17008DC87041550B1D7661
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0c4c0e6d4e956daa926eb630bfe0cc86739ebc338d035c6fa6556b8687358d92
MD5 d1899eeb4ed5b4d8ad7cbcec11b9d0b5
SHA1 4143ea4a22dec1e5aad81c20674835912cfcbf49
SHA512 220612a6a73460cfb82f64bc5fa71392d6e97f845eb0d84c7facfa9c729a1334224b79861076729fc6d141dfacd2a36ee5a09415cfe37bea558ec1ddd89ac2f4
TLSH
T162E020764AC8D31D51C4B4C742BC630C5141368EE6C5695D5B04858C3141344B39E964
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8904576b0b61924107866aadc88cf62ad5901e1fcf196dcb4f28c48079ec3aaf
MD5 a54b5d3beeeaa25613d77726f4fbf5d1
SHA1 e4a3aba5be68dd488d34481fb7ef97877507a77f
SHA512 57353396ff69b2bd1c36ff674f23dc5cc1940c03ac246209b07fd345032cfd6b054cf5f95e7154918de8dd53f3a02386841cba1cf67158e26327a0b8199e0c5b
TLSH
T191E080D445C9D35E92C475F7417C970C41D03A8E96C55D6D1708B68C7942684B3BB6E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 777754131d74987064f7d8cb689f876e43f6cc2eb180a26ff29fef9501e3ff68
MD5 b38a73873ebf98406f161a5205b4d7b2
SHA1 1a8b9db2f9d34f8146449035e4c96457eda87fcd
SHA512 1a30fac8740be8dc56bd4373578806c0acb3b6f4015022aafb940ee43b288f62e852aee9364aded1405141c684f1a99dadbb481a9346bf531e7741bbb5e2755b
TLSH
T18FE02BE6C822DC2B09FD071874511646D701132B2E40990F3A7C831D8FB577A269A95C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d7907258d4552032178384cafd2243675ee6549e3cf442e6342396b1ef669636
MD5 5e5d485238653d7a7d4e586698d5a458
SHA1 afde6188a17788cec66b5f1ad68745c8d89a9629
SHA512 34103cdbdf8bbe56fdfab380b7682d28e36ad3d6ae82ed37aed39c15e1641bcc6413f9b00e03dd66c01e7c5caf9a51bb98ffc32c48cc3466bf404b39056be234
TLSH
T18F51534B1E97CAB5F32106777EC096A4BA3148D8CDC71F515BD80575B41BFE61D31108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591bdb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591bdb.TMP
Size 2KB
SHA256 78af9bd39e8f9f54f98855e05261a466b74316300120da30c8665303f5aefceb
MD5 cb4e824516d93ff84cc1d60c09498267
SHA1 71613ad25b26e0b16c9cdffd6d6b28a2f4bf642f
SHA512 4de6ede030f673a075c7967d68a0e2f95ec67ec5ccfa4b10102ba4a53e569ad0690eaa1e0374218618cc7c16ad9464cb67ff9cf1c18e475d541d0802978689d1
TLSH
T19C513F8B0F4BCAB5F362027776C092E5B93288D4CDD72F416BD849B5B41AF661D32208
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 72fd73752c7992d6272e31801d9ad779af6e134d0b24a4cb958a1a4e7cbd46a0
MD5 551e2a698e6990f433652d871cc7fbdc
SHA1 a67e60382709ba4731a91fe4d7273eaa89099ce4
SHA512 80d0476da4c3357527868aca6f7a38435266b88584eb04db06d37517c43ab2e80cb0bc66fe9fcba0ef63f399b46ec0e238f33911876cb8e73ffcbd62536a59a0
TLSH
T19C71DEF787B4856EDA1195F0AA18AE2FCF2C0611431C7C6A89E4EE27D3E3471E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5e8c29f92eba0e6aefbb9f10aae11d12bb936c388fd2b6382fc0a282480feed1
MD5 622bad42554e6b07a849c192742adf0a
SHA1 6c2924b3af44148f702659074fe7c805e2f60b58
SHA512 b2c1f3d72d78b4fd3184d80287dc0fb1e6aaa1eccb740e799496c6fecbc12a927d70644fc2701a1351db57dfdfdf8cca2a4438ea3e01bd099bb86a2075b64b3a
TLSH
T1A361A0F787B4856ECA1195F0AA18AE2FDF2D0615431C7C6989E4EE27D3E3471E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fddfc0c3cb25e7ef5fede60851e20d17cac02dd5279226cf54e25bbd5be98ac0
MD5 196904c95b08ca5b093cf1e085d759f0
SHA1 6e9a99ab6dcf1ec7b29a4da5a996f9a2b1dc275d
SHA512 5648dbef7b71a371b8b641b2c92838db22617442428fc42fee8499b2066864735ad3ee5184e114e4ead3aa17c7c5f2ef3527dd6e9a1b85786670029d852d75a4
TLSH
T17531A0F783E4856E8A0195F0BA18AE2FCE1D0514436C3D9A85E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 030ec7d0f71ad95e48fd35e72ebabbb755c4ceda7b46525d3ae493649084a64e
MD5 9dbe771edfaf4288da58087fd3df8aea
SHA1 c60b1793518b45f63fa99c2fa246a20ade9414f1
SHA512 2d4b2a5402729d31749a78a66f0bad6b4a1ce01d5704a40012c39499cc7beb6e4c5586f3cdeb8f3252eef69a4d5626fba079977a96cb3971860f129171ed5e13
TLSH
T15821B1ABC2BFBA66103D187F0E097C1A6D76B832539298F5D996C32CB0414F30B0B417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d15583205e6886d23e14d9047ad765475536c16f8500a26c6b11dcaa22170c39
MD5 819c959934849b2fd239cfe333b563fb
SHA1 08e02f2e29184250fe47301896eed86ba2100822
SHA512 fc18b6a371bfaf09a9a66e2d0c24e02b3afb6fa4642b911b05203cfe627fcce4f3dd483aacd2c08c04bff24332ad37cea56975fd8a8fc34718358adde54f6286
SSDEEP 384:sxZWZq5t/fsscE1PV7orK0U3/bE/5LoPfB:seA5t/fL1Pai/b25Mh
TLSH
T190720A16A6349937CCDBD219FA457B93D6F91563A1900E44AAFC8F1C00E7AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 23430e8055b4244154fe38c9dcb9c4c4b3fa89e689526e3687bda701f077f584
MD5 02ee804a38f7289f8f534bb1d2746896
SHA1 b1f760f56a4d5995ea2db057ee56723e0f7660a3
SHA512 4aab5620b4e60f2883d0043d6a5a8ff08efdb57b0e8f714cb412e2d7206660f844b1c7538cdd62d4e875e4d969368503b7ae66640ed372dd989cd35666da817e
SSDEEP 192:sxZWRuyMqZjK1Ml8Mlt/fsslE1wKQ7PgYsK0/zodp5B/W6+WNrUL/Y0Z65mhfIgH:sxZWZtt/fsslE1wV7orK0U3/bE/5jjJF
TLSH
T10E720A166A349937CCDBD209FA457B53D6F9156392904E44AAFCCB1C00E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5eb28bc1eb63ae68762ede2134109b3eae534e24abde0cdde2ad9024eba3ffb5
MD5 727b72ab0221c9891db5a87e134cec29
SHA1 a0409e164282b04d4071f2c811ed1b7720d50ed2
SHA512 38d89347d130cb67f3c6b77cfc33a2ebd359e4b5b39765e022f897287f736199383031016658399f79d16094be85e2e7d40abdf483a80d2ee6f5f82e403d2cd2
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GGq9Llw:XwZh38Dv2SkEnZFWRm6GQFmu1jaKGGqQ
TLSH
T152030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index
Size 72B
SHA256 b20890b6a69fde0e209315919d1ce31bcfb614f180336acfce76cd36bd26c09a
MD5 f7108d7352af4da2f40e29a975bdbf9d
SHA1 943b2e6df0c129879d2e2e1667372a398b675c5b
SHA512 cadc756124a6a78650ef5f3ba826366b9aa2fffaba0a0be38e9092428f4f840fbab2700aa8d01f666cd08105209d86f26489484fe2db1dec1af75568f0b77102
TLSH
T199A002546941095BE6480271694235602700492A4290667246E00B44BA6748B8351811
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5ac5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index~RFe5d5ac5.TMP
Size 72B
SHA256 ab110f24ae43e2d336fd653bbc513470932bd984481295c9623356e9ad53bf8e
MD5 e2508a24dddd75d89c50fc0a99c25aa1
SHA1 ad2f05f7963d560d2a9cbfd199a4e975c8c5a5ee
SHA512 661dc5664a406ef6da41136b139860892f90c7b43c9d547c0adbd49e932b7c7396163cbeab177139131032df49c8af950b35ace56a16b82e8b1f84b37ce95080
TLSH
T1FEA002D857453149E22203745942D2746702897940F5563246E107449CE68464732811
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 64722d8de178833bff46f3f419b314121688ebc92588a26beb4a1f1b7aabee0c
MD5 52d920d5a918e796c1ea3827273cdb0c
SHA1 720257443eb9408d72efa325ba9d3259b5b3813e
SHA512 239f99617d4c49bdf7dffc0e6bd60761eab49127d9174ab236e75345fa1df866c264321a3af4abb52a670e1a1966eab1481ab8a8e66ac31bb2489af2b42266a6
TLSH
T162F027B76DE63D25FE6BC7E1103105B5041579A6C910AC6F102EF29690A1B692899CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ba54c2f034feaa19019c02ea5982deb42f885bb7ce068b6f6ab094a89082c211
MD5 7335c3c7a2499733547ea90f5170dc49
SHA1 b050db9f90ca5f23e6357cd415d18694e6a73026
SHA512 96ea1831598f0bfca6013e84411f1e67f9c360f312e1ddd2c097261c8d25c8db9da7b499c67e660f93cc1ee545a0571201f4d5a51f50b9f8d9cba68ed75ee63e
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlh9/8:ctGj+BCNC5qFVpKxhF8
TLSH
T12EB2471632BA02023C7E791D879597371A42B1B33068E93B7BE854B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.12\data.txt
Size 147KB
SHA256 1c4baed71f2c86cc449c5afac08c9a601f2b4928b42556162bcc327564295fbe
MD5 220b967f37c210bdc91ea3c91c21f2f1
SHA1 82a989656634676ef5dbd273b554a66ad88299bd
SHA512 df4bedaab82ba2d1590fa78ba78125ace31d7752a7b8c9043ea1817017d6649b28a22c99bdcfb5a0d186c3b67f5b3e66562e35fded4ce0f58b7f9ef322c3393f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEsoMIGaHD9XG:4X1aI5aZoKzMJ07NsoP98
TLSH
T180E3F211CDC41BDDDF6C252860BE0F1E93E1865D852B76C9E763FE0A6FA790852231C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e838fd142a4da0257823de143690a16e2776c1d4329967347ea9535e3ed32470
MD5 474db0d98d233505b5fc9c095a4107b7
SHA1 6d00ca59288c07d928dc9761147df8dacb8dd922
SHA512 36381d43ca2faa6313b90f547ed912ebc78889b0a8e9e1d52ef9f9af050d716624aea794b0400a8646d666d869b8a2f0e3c1d098b23b549a07d3e9f5478ed824
SSDEEP 768:iFAur0h6S3hwgCkAo+Mv5i+WNMgmMkTfZc:u+t3ibuiN7xSm
TLSH
T117D24B3AECA8D9B7EDE74FD5F30A76479EE4119386C85AD4E9C80D4D00875AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 48ef965525664fe25cbff633e5e009efe8482f991e649a20073867e49cf719ef
MD5 fa165e8ff05d01e2510b8c368d0e02f1
SHA1 47cf13c306c6d568c75e8f92a77ab432bb151466
SHA512 f9ecf7c64a0ab45b9fdfd3671779c5ddb8a2bb3b0e7c417d242de93c6d05bd4e3e25ea1d397b4b69c1dc9b6af3b8310d35d937a19678115146a48831082177a9
SSDEEP 384:nIiF9CcmyWCs38Nt8TUNTUlIxBrk6oMQF1ifbMorrmViv5inbSbHvuTQwty/7IgF:TFccps3mwg4wQTo+Mv5ibSbPuTQB
TLSH
T12FB24A36EC98DAABEDE74FD9E74E7643DEE01163869C9AD4DAD80C0D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 94e3f9a01f7f75511876b956a20a02b763023111182e24bbb49c89df86a28d92
MD5 d52c8babb07fb5d7354490d520416120
SHA1 94ff4e63ef9c83033b9b58e90424e0099aab438b
SHA512 ce55966ce775eb258bc55abd4b36a3e5f73d4f13fe0343c104e457ffd02f797b8ebce8535a0cc45be19afa176b4b45203dad8b321df10913a3d3c9ba1665eb95
SSDEEP 768:rFAur0h6b3hwgC+Ao+Mv5i+WNM+WMkTfZc:7+W3iVuiNjhSm
TLSH
T111D24B36ECA8DAB7EDE74FD9E30A76479EE411A386CC5AD4D9C80D4D00875AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2eaee35f11c72a7127c6abdbdf235a2a354e9e6560535f83a9a9abfff746d8d9
MD5 98a6310cdaa9e02e3499702b10a3e538
SHA1 c48614e8401d611d500f09740b334b59521ff549
SHA512 472e6b48dc10b56ba35245c987c34584eaf4bf87a548c8ddf32ff18ec6eb7dec1ed4d84081cbc246044fba1faf7e8a8fcb043d4c79d2537bf54eee21b7659d87
SSDEEP 384:nDiF9CcmyWCs38N+8TUNTUlIxBrk6/H+51ifbMorrmViv5in+SZGy+j3uRMHvuTu:uFccps3xwg4K+vo+Mv5i+WNM+RMPuTQB
TLSH
T19AB23A36EC98DAABECE74FD9E74E7647DEE01163869C9AD4DAC80D0D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1307e3d1553004952ddfe361192320e05398aaa8ce1ffaed9e4cb563d79ba523
MD5 aae732a65322a19a33df4a48b92baaf9
SHA1 d478cefc89495d34089b8118d8db010bed4e8630
SHA512 374cd2647696cd44f530b229dfaa76364d92550f2fd9bfe13d5b3db78cdd2344cdadaf0be9352373d32b398fa83f84cae81bbe87b00a0d5dff2a29cc472e35aa
SSDEEP 768:SFAur0h6b3hwgCkAo+Mv5i+WNM+WMkTfZc:++W3ibuiNjhSm
TLSH
T1F0D24B3AEC98D9B7EDE74FD9E30A76479EE411A386C85AD4D9C80D4D008759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.20.1\typosquatting_list.pb
Size 632KB
SHA256 3192da2545f929add7bbcb36bd0167526c02aea68ce3357fab96a076a2276c99
MD5 d126ae10eaae0aaeef1843d73c77dd98
SHA1 9110f2de56750a3cb963e8128e4187ba81b8f678
SHA512 532512d263fc2a28e84a7658018b6342579bbd419fec17d019419ac384aa32563f400d43efb8fb581d845c3a36972c5679d438d9e231ddeeeb10a3fec2747fa2
SSDEEP 6144:O/K6mZ8qhjAh0XI3q74/7o68QMPuavZ8Da8Qua:aK6mZ8qaUI3q7/tvZ8Da8Qua
TLSH
T154D4B5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f242526be1f5a340560b5ac6b04e8d720cc29069cb068d719a85c283a8e240c
MD5 9114ab6a1bc89d9f6f25c99d815a12f3
SHA1 13b64ef559a9e46fd7b5ed96cc4fd84794559337
SHA512 443dc6ef5586dca133502a0221246ed40e7a50c85b1f809aca55ac535d406b7d112b82e5e26708baec24d356e777bd4a1260dbf13fafb71e3cd3e9967865c651
TLSH
T155412FE14C3C5AC5C5BD0AAE70CB38FC85E89735F0A034792C58EA944AB9A1C258443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 27f7abe13cbb7f30953ef0b0a343a18712eef7322a5e7ba800870b2e159d9b93
MD5 e403d26d97d2629ad76b0546b7ceb3c3
SHA1 0103b3f01ddbf7cb476db8061e7445f459b6f5db
SHA512 6ec7da9eb8073ba4d2ce2db8f6d26744026e877d8bec0372f537391e5990e7e9f9764d53de1cfb7467ff69ff31d66a7a114eadcf3c798ad8c4b8eca8946a5c26
TLSH
T10B413FE04C3D5AD1C4BD0EAF70DB78FC81E8AA39F5A034792858EA944A79A1C658543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 85f6ab8b6135544d0aaed18034595ce560081811b829eb6b8d6c5982832df3b5
MD5 92230d02e5c84cec15b07668c1cfd5ee
SHA1 e49aaf926efe7e474ae069b8d8133aaedb1ea75f
SHA512 7ecbdb1dfd5e914a8d5f69a3d76eabed2b3ff0c45ecde585106d16baff92386c10c2dd8951bbe611a16996e4c85523ee310726443e2e7181e8f5aa7f540387e0
TLSH
T12D4141E14C3C66D5D5BE0A6F709B74FC85E8E725F0A0347D2C58EA9849BA61C248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 76457be6ea0247b0aae16107b54be074b08e8f39865287316a616b1add38517e
MD5 3561c48fe67fcfc699f060f2d8ed974a
SHA1 a9280ad90ad83a0af6ad88329469b8ce56644a74
SHA512 3bafbca317c8b90efdc806dd3d3e8c19a82d14410c626f78d3bd63e1e97396dd4c6b9370a38d767a8a4f37982c97d6e43a70262a320e601379b9b711c9f08da1
TLSH
T17E5162E14C3C66D5D5BD0A7F709B78FC85E8D725F4A0347D2858EA8809BA62C64C483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 98330621e12bef405850d119ad46166760c4f46c2a206f95060367d609f41beb
MD5 cb379d0e8a6db2edf492884f65758111
SHA1 d8ab5856c9349e6bfb252268d49411a5c57608ac
SHA512 d7248bab90036b2c44a177076846b679dc605b79acb8504d12b1c6c5d3a500b61fff7a87506f49e093f6a302c518e6ff8928d66d63e879d7c2c7512a1ca3a673
TLSH
T1124131E14C3C56D5D5BD0A7F70DB78FC95E89735F0A034792C58EA984A7A61C248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 250d243e533ddc5d2fb7ba0a390ee0ead575f4a06452f331741467675bfc2a4a
MD5 62cc0c5f5e05a3218a5b3029a5b26f5c
SHA1 91172d687ce6f81eb53c7a26ac28d3d691fd5f25
SHA512 38d69ef33c2a9e5eac0346deb0ee49cf2a86424ef9c50ad5c91ea2721930dda9f8d50a20f57632675d3b6a16f52d2c12c0052239925893570393313fd67bb6e0
TLSH
T1C8413FE04C385AC5D5BD0EBF70CB38FC81D89B35F1A034796C98EA940AB961C648583F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x86.exe:Zone.Identifier
Size 185B
SHA256 7410545c52a5a13c7fdcee2e822dd849bcb983077b9014a0517d8f06a5f1f283
MD5 4a8fd05f4a52fddb0dde6a9b2f2706d5
SHA1 3830f879408fd0414bdd89bcdce4e9ff26e5f02d
SHA512 8d5229a1cac3856ddefc7e3fcf0a654583e6ed054b544e9394be7708edcb0205d6db0a628097fd5d4fa29d7f9e8822ade876878893bfda8d823fa1ae14134b52
TLSH
T1D4C0126BC80044520E3022861B6ED599FE1F1D135D81C38898C48096ED529D6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1103843065\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1434535264\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1681576151\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1977030800\edge_checkout_page_validator.js
Size 1009KB
SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
MD5 21147b0280aa959a020d50a7d5738f17
SHA1 2e57c2a0e0b2c1f1cc78acf1a8fbb833c01b984f
SHA512 92db10d864968ee94156df795552867723aeb7ef03341e00c7f8cf11542a8443f83e1eb2487631ed38b441d4af751c8f4b3f99319312e50d8501df74263c01a4
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErg/OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErg/OUfq
TLSH
T1B5252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1977030800\manifest.json
Size 146B
SHA256 c97cc8be28f97c110b37ace786188903f2f1c9d6736e5b0ebd875d900340f4a1
MD5 c8b91ccf65e0519cd165ad5171ae6169
SHA1 bff29cece85fe2c0e817a1de9746ab4ba86c5626
SHA512 01197a05068fd9a4f7fc08e09f3192d5418dde6b62b6e5ee5aecc2e19cb28b4734f8c7b5d7175f08f55ac2c6e8a501e7c2ffa1725b3960f7920632bc456dcc4f
TLSH
T150C09B73C931AC71157507D449F59745EF74974BF511B0563731018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_212357445\manifest.json
Size 118B
SHA256 24eea24bda3818844238313f1c08693716828b65756120bd899d4dd3c4a0d9f9
MD5 72be58b72814a19359e3f375a173ac91
SHA1 60275b58da734ebfa661d448add786866121af0a
SHA512 e85f7cf0a5691b024b066c5c57d517660ca13ec3765a05b675b9efce0fde8b3214233fd0bac65354d1dc163e7993c8b28b68786398b64d45703dcf5167cd716b
TLSH
T1B6B092B00C0AA03B22809720ECA0668683F80218E8029B1E088136481F8817980362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_323150268\manifest.json
Size 53B
SHA256 34c6c656afcde12c0ea7c692ae7565eae13bad0400e1bf3d333d7180ebd2552c
MD5 bb42365a05fddf6f1343d4b7a6f456d5
SHA1 d5a660cdb20cc10d1e5afaef4af5468918fe42c6
SHA512 51fbc63d4af85745f78c269f2ebce4314f91a1c2ccdf4a32e25d76901b746c0622a31ae649098ba899e5bd0664b7175546d94dda2bb0c940d7fcde4697760f8d
TLSH
T1B69002604414951716C10E5065B0B8819391661995850D1D04451759029556CE0502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5596-248-0x00000199C6F70000-0x00000199C7F70000-memory.dmp

Download