af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-143791-i1za3b.html
Size 214KB
Sample261002-ejwbbstajc
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{16558F31-18A1-4FC3-8CC6-1E407BA4A3AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6028	msedge.exe
6028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3284	5092	msedge.exe	88
PID 5092 wrote to memory of 4664	5092	msedge.exe	90
PID 5092 wrote to memory of 1108	5092	msedge.exe	91
PID 5092 wrote to memory of 4664	5092	msedge.exe	90
PID 5092 wrote to memory of 4664	5092	msedge.exe	90
PID 5092 wrote to memory of 5200	5092	msedge.exe	92
PID 5092 wrote to memory of 5200	5092	msedge.exe	92
PID 5092 wrote to memory of 256	5092	msedge.exe	94
PID 5092 wrote to memory of 4052	5092	msedge.exe	95
PID 5092 wrote to memory of 256	5092	msedge.exe	94
PID 5092 wrote to memory of 256	5092	msedge.exe	94
PID 5092 wrote to memory of 4052	5092	msedge.exe	95
PID 5092 wrote to memory of 4052	5092	msedge.exe	95
PID 5092 wrote to memory of 2056	5092	msedge.exe	96
PID 5092 wrote to memory of 2056	5092	msedge.exe	96
PID 5092 wrote to memory of 2056	5092	msedge.exe	96
PID 5092 wrote to memory of 4524	5092	msedge.exe	97
PID 5092 wrote to memory of 4524	5092	msedge.exe	97
PID 5092 wrote to memory of 4524	5092	msedge.exe	97
PID 5092 wrote to memory of 6016	5092	msedge.exe	99
PID 5092 wrote to memory of 6016	5092	msedge.exe	99
PID 5092 wrote to memory of 468	5092	msedge.exe	100
PID 5092 wrote to memory of 468	5092	msedge.exe	100
PID 5092 wrote to memory of 4548	5092	msedge.exe	102
PID 5092 wrote to memory of 2688	5092	msedge.exe	106
PID 5092 wrote to memory of 5168	5092	msedge.exe	107
PID 5092 wrote to memory of 6036	5092	msedge.exe	108
PID 5092 wrote to memory of 1496	5092	msedge.exe	109
PID 5092 wrote to memory of 1496	5092	msedge.exe	109
PID 5092 wrote to memory of 6028	5092	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-143791-i1za3b.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ffe2d84c188,0x7ffe2d84c194,0x7ffe2d84c1a0
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,9955393154376337317,8769221526607542573,262144 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,1230665047368574132,15714879468793388430,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,8200058760580635957,7846090922773610205,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:13
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,17585718798189530792,1423042924520002725,2097152 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,5879151422524104949,2085731688875307900,2097152 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15701440211038647257,9768064227698383533,2097152 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3660693378620504361,121497541650225153,2097152 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:9
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1294621769983214677,17582544894570134428,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12931282417661000594,4736158495949152880,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16682212297069976126,7854126977721679390,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16682212297069976126,7854126977721679390,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9367182410336638075,17409942252781223936,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3306639508841144326,6469632571456689396,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,5433149018031744025,8961604712942091044,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,16032456252914389440,10349429398142958856,524288 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,7273171332163049327,12972316196556563237,262144 --field-trial-handle=2248,i,14221939726271198826,2031878961741874466,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40de095a-cac3-4127-8fc3-94af8df2cf99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40de095a-cac3-4127-8fc3-94af8df2cf99.tmp
Size 36KB
SHA256 3d09095d48e625eed2d3d9d6c5d62e4444e8af941e6fc11c9634d3c236d802db
MD5 26c2163783581be85a75c101f71eede2
SHA1 70ed752626a931b14999d2c890f564faa1c53577
SHA512 1b5ef33e8bd267a3972f3140a752f9cc034d744867ccc494a09b7fb5274129a2ae2242614406e7b48c4fe3909b1b3f0f973f05f4e3fbd41869569ec0a43d9307
SSDEEP 768:gFQs3qwgBvpeSFajtbfUnqMwQi5BgK5/CwYcZ02sKS:Ts3+wNUVmBg8/d62sKS
TLSH
T136F29D32ACB0CEBB6CFE8654F68633029FF46297C895859585DD6D0D01AB8EE134BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

2ab837aa-5ad7-4bf6-b2aa-dfce19238ac3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ab837aa-5ad7-4bf6-b2aa-dfce19238ac3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e3dca0b-b3dd-48bd-a5e4-76667537110b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e3dca0b-b3dd-48bd-a5e4-76667537110b.tmp
Size 11KB
SHA256 3777be67c8af7de2d1f631bb42b37d1610935d7881c264f5896b55fa897ec4ac
MD5 b736f4c3a0f95d7949986ebacca30d02
SHA1 6e3bbfdeec4452168eb4fd58a8c223b349c47d42
SHA512 d0318868ac946705a3b64cd2a9dbebe812d51ebb5404c04b78c47c8da3a9f5037c19dd5d459ff0abbe2537207e23ea008f33c3bc0356726a02fe2be89cd4bf69
SSDEEP 192:sxR5gRVbP/fsysfQ7R72+zoA8p4x/g6+WNIYlacWgGwOkIgDUJ:sxR+TP/f/sfy72jg/5Io0
TLSH
T1AD32B815AE28A97B8CCBD21DBB657F13E2F9503360901E48B6FC961C05EB6DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37bf707f-24e3-49a8-9ac5-73dfc6ecada6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37bf707f-24e3-49a8-9ac5-73dfc6ecada6.tmp
Size 23KB
SHA256 0ad3da914cb60b3c180e3fb40f003c2987f075009422cb9e3a844cbdf57874a9
MD5 7dfac53707390963db2a650130cd015d
SHA1 79bd30950c62ee94d364665196ad53f7406862cc
SHA512 738975d787d14f9c97f53954d79412945099c62638d993f3740410da057b07cd088879eadfd16d4dd5c5a7dc25302200d764a151a2c2f60ee9a62c31d68cd749
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfaroe2V:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0VG
TLSH
T194B2E93B640CCB7E4F814AEDDC196F976E9C02C79A588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ec99be5-aa27-4839-b6fd-8c22fc05ce00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ec99be5-aa27-4839-b6fd-8c22fc05ce00.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c0a7fad71ed529cd4a30608f233d0ad5fda062f4f199ade01526d4e774344ea9
MD5 521c54b953635bd18b5cbfb78c35b556
SHA1 d7d9bb2011a78a3ef94119c52471bb0f289f7e46
SHA512 0303c355d129336ca29adee9941831931ad2498459af0a3057d081599986014e8d6b4b62d8c11d32abb698c4616edab4ae950f5e7d1d25fd868b186e278ad1d9
TLSH
T1FC513E8819534E86E7BCBF338EF1228B3B3096B965C35D492074C4BC6BD275511D4345
MD5 SHA1 SHA512 TLSH

Submit Download

f4fcdd31-6143-43dd-a5ad-3525fe47cd6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f4fcdd31-6143-43dd-a5ad-3525fe47cd6c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

85e14550-8450-4f9d-9c42-c52ae48be614.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85e14550-8450-4f9d-9c42-c52ae48be614.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c8237a34-e56c-481f-a5db-05fd4418b6bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8237a34-e56c-481f-a5db-05fd4418b6bc.tmp
Size 1KB
SHA256 0e0018267ef9e79376ac34ded1bcaf5508dcfbedbac2b3db5d354dc226cd2a8e
MD5 371f77eedd76cefb752aaf39c9229a65
SHA1 59e9a11cd76f40a76bc4468043e7c374a267a486
SHA512 21f1860bea272dad307b0ed0269fe0845358d1ace0b61bcd33bcf4f022ff2fddec487920348b97c09911d15579d09e45a9a267a3828ee3741db1ce47b27fc242
TLSH
T172418DF3C3E8967E8D0156F0AA186E2BCE1D0A15431C3D5AC9E4AE1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

ec316de6-024f-473d-addb-b84939552063.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec316de6-024f-473d-addb-b84939552063.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23aa6699e0dabfd8008817660404af4e2ad0989a3e419d75b3c30fd6b4acddc5
MD5 2552e4bd4a8f6709545dfbb4906439a5
SHA1 6f61678ee30b1dbd2f4b8d400d16e5336723b2a9
SHA512 959e384252f31394de3dd10d71e6c86717e4cbd49c1b26abe37656628d1a67ea8ce443c69cbc6067e46503b1c59c7c5fdd567aa44da19ed85888435508377ca1
SSDEEP 192:sxRsgRVbP/fsys+Q7R72+zoA8p4x/g6+WNIYlac+gGwOkIgIJ:sxRlTP/f/s+y72jg/5ICs
TLSH
T12D32B6156E28A97B8CCBD21DBA657F13D2F91033A0945E48B6FC961C04EB6DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3075544ce67a60d0ed814e091f0b5ad2511bc89e2db004be5a2d112ca270631c
MD5 303181ee1a392ecf38e8a9c9ee84e44c
SHA1 1a96bc4efa39016fbdba0eefbf9ee915733a5468
SHA512 3187e49ceac7b5f9db0d4326d751eee253e40a4d9321fa67e816e00b41d17c54061a65ff0a176df260caeaac80bac8ac2bb56d15e9e1f23b35d4236b8cd1002d
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyLfir/BhBab5UpISPaK9v1lax/KYstVE:K8qEKLqKCIgKpeqUwKFmOYtOp9bPP
TLSH
T131912110347B0A10797E7A4D45B59B2A126131B23419B56FBBBC40A95E2FE1C8EFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

de318c03-a087-40cf-8059-9877beb3a401.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de318c03-a087-40cf-8059-9877beb3a401.tmp
Size 11KB
SHA256 8e480c384e39de13ca2c802b1dea6e3cf6dd85dab9665c48a6e4c69487b46c43
MD5 809d0f858954e1290a85c1805c100e2f
SHA1 b51fa7c559b1a78e255e4d5a2fd557f8ff9ebf05
SHA512 a5582db047036def6b14ef1875ea0d6b53b7f5e2524edb3e96079ccc0bcb3874ea697ffb1371aba55f5e7e7957fb730495edb5104181c1333bf56d4e0b34f645
SSDEEP 192:sxR5gRVbP/fsyswQ7R72+zoA8p4x/g6+WNIYlac+gGwOkIgDOJ:sxR+TP/f/swy72jg/5ICm
TLSH
T1DA32B715AE28A97B8CCBD21DBB657F53D2F91033A0901E48B6FC961C04EB6DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99646e05-43c3-4b4b-9049-06e4d603c88e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\99646e05-43c3-4b4b-9049-06e4d603c88e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a265b0b2-91d8-4503-b653-c1aeb76cd353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a265b0b2-91d8-4503-b653-c1aeb76cd353.tmp
Size 37KB
SHA256 9f53ff09001700ecfe2054a8c102ff55bcf3044f52fec44a855c2ee4c661414a
MD5 ac52f1f631aae8cad19129a9608ff409
SHA1 3a0dfaed86678a9d36ad7489697fa64ca5b6ebe3
SHA512 e6345a6a8a41d1b2490767efd02d5c4b2ec2befa140965c0019d11174765f12a2c72e737dfdbb077f9798a4d37a1ab1e653f53af3be33d55a860d77a2d90a2cf
SSDEEP 768:O/UxvxjgC+Ft3z1DSFajtUnqMwQi5BgK5/CwYclDA8Dea:DZj3+Ft3zXGVmBg8/dJA8Sa
TLSH
T17B03D036ECB49EB78CFA9644764A239BEFF45153C484089889ED2E0E06D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c16a2a18-198b-443a-a6b0-c61ec4d0f50d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c16a2a18-198b-443a-a6b0-c61ec4d0f50d.tmp
Size 38KB
SHA256 22d4b2a924d6531ee7b39e718a9675e53fa5a9986e93a953c382ceec77189d34
MD5 7751cecbed78a8125feaeb327b91e634
SHA1 31ba697c2c23bc3f727127ab429c56bcf4dad1ac
SHA512 3e85200271616d5002ea07a46e8fcc007e11cb08291c5f71eecc6d8b7b803c567d0898b2b286fdf9817fc8ef495ec4dae9603146895ac72bb8acea014ea460e9
SSDEEP 768:f/UxvxjgC+O3BvFeSFajtbMnqMwQi5BgK5/CwYcZ0lD:yZj3+O3RMuVmBg8/d6lD
TLSH
T1F103CE36BCB49DB74CFA9254B24A6397EFF86653D4C508A844EE5E0E068B5ED130B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eff06c55-8315-47f0-84ac-04ab62d491b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eff06c55-8315-47f0-84ac-04ab62d491b0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f015f12e-cf55-4119-838a-ba77d40a5ee7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f015f12e-cf55-4119-838a-ba77d40a5ee7.tmp
Size 33KB
SHA256 444234402667f31e3a8b4e61ac9573bb9f6c8e9eb3f490d42e6a7aeb9eed3212
MD5 628e02c041e426e02674c024f7886516
SHA1 dce5efc73e8e5620adb384a11a9a60e2a5a6e863
SHA512 cf7356cb1359b8814740c1503b506e8b923237b877c56cd296feed98213cfe92bd5e1f6f65845725417001157a870de163edc02dc187b656e56c8d5c8339f132
SSDEEP 768:zX3BvpeSFajtbMnqMwQi5BgK5/CwYcZ02sKS:zX3RwuVmBg8/d62sKS
TLSH
T13DF2AF32ECB08EF71CFE8254B2867746AFF46257D4D9099484DE6A0D019B8EE134BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff5cc08d-8513-4a19-b57f-f5c30fde182d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff5cc08d-8513-4a19-b57f-f5c30fde182d.tmp
Size 33KB
SHA256 7f8298c82d73d395dac644372f45b518b0b58e69bd623c57abce5fa400a1041b
MD5 2215b523217621e26f3db4a4db105730
SHA1 190890883fe55faa2fad25f57f7b91db2dbf4700
SHA512 36d3a7b7210beface60623fa810bdf9e896f338ccbf7004a9e33bb6d61896889fdd9889a4b9d55d916929cbbf45d0072ce9a3e7fef7cc81233ee3c0dafad7439
SSDEEP 768:pX3svpeSFajtbMnqMwQi5BgK5/CwYcZ02sKS:pX3MwuVmBg8/d62sKS
TLSH
T1D1F2AF32ECB08EF75CFE8254B2867746AFF86257D4D9099484DE6A0D019B8EE134BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download