6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-h40p38.htm
Size 34KB
Sample261002-l2pd3ayvay
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5716	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{E1DC9F67-4752-4245-81ED-A9A03D4F3A59}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3556	880	msedge.exe	89
PID 880 wrote to memory of 5716	880	msedge.exe	90
PID 880 wrote to memory of 4476	880	msedge.exe	91
PID 880 wrote to memory of 4476	880	msedge.exe	91
PID 880 wrote to memory of 4476	880	msedge.exe	91
PID 880 wrote to memory of 1924	880	msedge.exe	92
PID 880 wrote to memory of 1924	880	msedge.exe	92
PID 880 wrote to memory of 240	880	msedge.exe	94
PID 880 wrote to memory of 240	880	msedge.exe	94
PID 880 wrote to memory of 240	880	msedge.exe	94
PID 880 wrote to memory of 264	880	msedge.exe	95
PID 880 wrote to memory of 264	880	msedge.exe	95
PID 880 wrote to memory of 264	880	msedge.exe	95
PID 880 wrote to memory of 1528	880	msedge.exe	96
PID 880 wrote to memory of 1528	880	msedge.exe	96
PID 880 wrote to memory of 1528	880	msedge.exe	96
PID 880 wrote to memory of 2120	880	msedge.exe	97
PID 880 wrote to memory of 2120	880	msedge.exe	97
PID 880 wrote to memory of 2120	880	msedge.exe	97
PID 880 wrote to memory of 5728	880	msedge.exe	99
PID 880 wrote to memory of 5736	880	msedge.exe	100
PID 880 wrote to memory of 5728	880	msedge.exe	99
PID 880 wrote to memory of 5736	880	msedge.exe	100
PID 880 wrote to memory of 1328	880	msedge.exe	102
PID 880 wrote to memory of 4380	880	msedge.exe	106
PID 880 wrote to memory of 2964	880	msedge.exe	107
PID 880 wrote to memory of 2160	880	msedge.exe	108
PID 880 wrote to memory of 3808	880	msedge.exe	109
PID 880 wrote to memory of 3808	880	msedge.exe	109
PID 880 wrote to memory of 4436	880	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-h40p38.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffeb631c188,0x7ffeb631c194,0x7ffeb631c1a0
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,9824280489905913334,11404168444870297370,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,7586962557864822904,1714852663270737839,262144 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,13432871832239011629,2552634259835684808,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,11660987321555408766,4595510810657886099,2097152 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,2845975935356812947,9935964558122439744,2097152 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4428,i,13748064036942879360,213641181371922255,2097152 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4448,i,1539087336537127781,3585421700240749977,2097152 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16204208456118612126,8971118450087443351,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,9515239174423260274,18150851513776380869,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3898157638687871754,4049779004266542637,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3898157638687871754,4049779004266542637,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13166323312672377325,11271842632444776145,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,2445550136062642948,18142944268816619915,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4107696488840862805,15694396687080068713,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,2245651038522569471,5258650393755530026,524288 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,5284468245893586960,13555856949069938467,262144 --field-trial-handle=2100,i,17008580394184783635,6892047232403251366,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12b538be-fe2b-49ba-900b-0e705b1b5054.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12b538be-fe2b-49ba-900b-0e705b1b5054.tmp
Size 34KB
SHA256 10c571ba06a4848647a3baea8c57b4da1432feaa23633acf4fbfcb71831bd233
MD5 81f6893c8c73b978ffec77ffcce026ba
SHA1 8a3fee6c1f4da8bb41abb54043257e8e4a511c83
SHA512 4cad981570307fad6928109216f479d312a7c0f5abafe1c5f9171833035b5241e3c6020dc78deaab01c71543224b13881e921dab0754ce220c6e294e71e0bd95
SSDEEP 768:E/3jO0OySBt/9OA9at01j0iq00+Iair4YGHLw:E/3j84CHq00Nak4YULw
TLSH
T198F2BF71ECB49D73ACE6F285B30637465FF45613C6CE9A8089ED2A1E0147AAA1707C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5187cd4e-8689-4ccf-96cd-211c386f87a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5187cd4e-8689-4ccf-96cd-211c386f87a0.tmp
Size 40KB
SHA256 eeb46521de3e2c0e3a4b160490bad1e79b1a07986e34f6ebaef34aa537fa2483
MD5 46d5250f6fbc947f4c475c9d8e68b63b
SHA1 eea0715cdf1ec8e0819767aaa9820cf8e77fe525
SHA512 aacf25ce69bf62ee446488a91f633c8c818df1ac613e9dcc21a31c28a7804c06d7b7746b86b4b4034a17b61dbcfa565f3c08e226c73d15fbcb174a177b2c1fd0
SSDEEP 768:c/UxvxjgC+u3B70OySBt/9OA9at01j0iq00+Iair4YGHCz:JZj3+u3B14CHq00Nak4YUCz
TLSH
T18C13BF31ECB4AD339CE6F285730A2387DFF45613C2CA5A944AE92E0E06476AD1707C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c65e70-a2d9-493a-b514-5a6ef91f7fff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59c65e70-a2d9-493a-b514-5a6ef91f7fff.tmp
Size 34KB
SHA256 c96a1e62659b52e699d505f95165d0c30ffc6f98ac3eb2f3a164c61f17f259e4
MD5 310abff7fc27eab6c10a02e3fd1c0272
SHA1 fc4cf78da3ff6b46d39d42132a2dea1e8a75783b
SHA512 85c792c2128c7fa051cc7e1804df6de3cb6a4f2bab07fad03d5c2920fce9b90315f948c8dc7948c2ae4ac8539504cb2cbfb530b93223d0483629e3d1f39555b4
SSDEEP 768:N/3AO0OySBt/9OA9at01j0iq00+Iair4YGHLw:N/3A84CHq00Nak4YULw
TLSH
T19FF2BF71ECB49D73ACE6F285B30633469FF45613C6CE5A8089ED2A1E0147AAA1707C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

67ad1325-d9ea-4909-a24f-87fcdbc13bc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67ad1325-d9ea-4909-a24f-87fcdbc13bc8.tmp
Size 23KB
SHA256 193368033371409a39afa87dd11193169d3fbcdaec441d2adb2cba60276665db
MD5 0a7cada7133b45f7e22dec07c5ae1fdd
SHA1 b7e2534d7fc972daa5761c8f3f72af480ba3c744
SHA512 0b31b53d79d9a86b1cbcaf4c405192b0746a9a250fcbe4d83a8591cf6fa66dc882e5a2461d638d5944cb6b17851f03a051a8ee556e1405ea920995935183d856
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUjrondo:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0VD
TLSH
T177B2DA2B744CCB7F4FC04A9D9C196FDB6D9802C796588D8047FE994C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c91d6c5-3ae2-437f-b852-e5e534ad34fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c91d6c5-3ae2-437f-b852-e5e534ad34fa.tmp
Size 10KB
SHA256 98e44cb6b11d9e1d7bb10e12daecba80e3f95da8606e424ca3f7a62c98e706ca
MD5 811bb0f9de18828f3aee1caa8330f506
SHA1 aa1b2f513dcff51347865277faa9cbf80a334f8c
SHA512 a7a6984c106bb4e2afc2abae6c5bd235fb537d86a972d461d8ce910f18d7c2a30c8c4466c42a8721b6b896c859d8f54499e01e8599f96caa4c9f3b110ab43bf3
SSDEEP 192:sxRpRbbL/fwsljIsizoA8p4W/g6+WNIYocT8GUiIgD9J:sxRpNL/fwsljIsvj/5IIYiD
TLSH
T19D32C715AE28A97B8CCBE21EBB55BF13E2F9113360911F48B6FC862C15E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c2f317a58fb7868555a23ff8db5e53d9f4fbe9ff30f7548f4ed50ce092a2b754
MD5 3ad9a908cd38a133645f43341fac3052
SHA1 c7f94a23d57a270c908cc4a2a6b7c0d7fbf17a0b
SHA512 158cbe2590bd0c76a36243900fe6831a49ca11a48d47a8f9970f6974ea449b8f23cb06f6db5b3b4e3a19070d0a9bb91086360902836df9725e471f8daffcaea8
TLSH
T10C618447B7B4845EFF58C83065C90C933FB15E9E45A71FA327A8DA796C823A17354086
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 176abb732d9e45d8fb93902c5b9863d3f25bd72323be6d78788cb221ee532e8c
MD5 67ba1a3127b6e6d3e15e35a4b73f6b2c
SHA1 be6b889bc1abae15f8344469cbd7e4683fcae4bb
SHA512 b29b9c16332d57cc2754c8b00e74edeb8a699fa016fa640cea1cbf7351b71f3a3d06b6c7baccb34fc52635bce59b1a29b19ad69030e702c065e5cbd63025609f
TLSH
T14861A447B7B0845DFF58C83065C90C933FB15E9E05A71FA327A8DA792C823A17354086
MD5 SHA1 SHA512 TLSH

Submit Download

642a4473-beb2-4a35-beef-004ec4655a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\642a4473-beb2-4a35-beef-004ec4655a36.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2beba72f-4c04-4fb7-9dcf-d03f213f4b02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2beba72f-4c04-4fb7-9dcf-d03f213f4b02.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e3bd8fbe-2187-4e69-93c2-16a325ed5825.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e3bd8fbe-2187-4e69-93c2-16a325ed5825.tmp
Size 1KB
SHA256 915afdcd6c7e6b2503a99aaf8bb6ab77b4e3710ff24fac949dd1ffee022a60de
MD5 5dd35c97565f73b1f0dceaccfccd301f
SHA1 13cd00345bc663c5a95557c3e539c6aba68d88e4
SHA512 b250e3916c727ca282037244e337e848418638ffa530c3e6f22b87f4723bd53d58ee2c6c030a43a689368b8fcf100f1fed9d09405fb06638ad72c49e937a8a21
TLSH
T171419EF3C3E4966E890156F0AA14AE1BCE1D0915836C7C5AC9D4EE2B93E24B2E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

f3fdf8ad-0407-4804-80a1-de1cd57692c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3fdf8ad-0407-4804-80a1-de1cd57692c9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a72a3eccaa399ced6a7277ba5563ad2afad1712e2656bc09216aa5ff289090f2
MD5 c7cd222c3fb493546204ab31900a93a4
SHA1 79d745e6267f6f09a47080a63217e8e16b613adc
SHA512 6d6dfe035ed80420844de46b81e7ab173ef7786e0c363e5bccc48d8e3e2f93d05da82ae4c99301d7a081df2a0e59afaa1b0d4be44aa593b3457a7e44dec6d23f
SSDEEP 48:KU8IbKRaMjyF9IVKGIw2HIdKsE43yp6IvKbq0K:KU8oKRaCO9eKGIBHGKsEiq6wKbqV
TLSH
T158B10270723A0240387D760881D5E72F8A4232673524EA2B77EE4253DD7AE4A5DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a15ced8a-0425-4961-ae93-b613e37bb290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a15ced8a-0425-4961-ae93-b613e37bb290.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f51e6c8d-6cc0-4af8-bcc8-50948f2b342a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f51e6c8d-6cc0-4af8-bcc8-50948f2b342a.tmp
Size 10KB
SHA256 b836d2f6ba053f991de980500e22a7043ff33e88e013317de102265de0344ba5
MD5 0dfc8904e229c48e01bc2efcc38de04b
SHA1 7a37d79b0ee3b8720159c466dd1b91d99a79fa24
SHA512 0b7eea9bd4940d633e8027567cfb68d76fe23af225c3463164d9e4ec0fd89d9c698264f161dc102d77637fe14bd6948174fa17dcfa372eb3137cc3d600fb3917
SSDEEP 192:sxRWRbbL/fwss3sizoA8p4W/g6+WNIYoj8GUiIgIJ:sxRWNL/fwss3svj/5Isis
TLSH
T16C22A615AE28A97B8CCBE21DBB65BF53D2F9113260951F48F6FC862C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faa92a48-9a71-47b1-9755-be282ba1b5a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\faa92a48-9a71-47b1-9755-be282ba1b5a5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb4fe759-4e35-4f63-8d72-06dc7f57e253.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb4fe759-4e35-4f63-8d72-06dc7f57e253.tmp
Size 10KB
SHA256 505c1a51b8c47212355e41d309d8573f821ab45ef181211d0d8d4d4b574b6edc
MD5 c5bc18fc4a31d8ad5f61264f320aeaf1
SHA1 71ff7e84bd768f833cede3c9e54ae98c9fc5a099
SHA512 9c81cf68daeecf29bf554b11ed7881508c20e5f91bd92010e09870cd066a2e6ba4b24219ba498b54a6279b287be428bfbfdbf2ae876e63142b2c2e15a0323509
SSDEEP 192:sxRpRbbL/fwslj3sizoA8p4W/g6+WNIYoj8GUiIgDrJ:sxRpNL/fwslj3svj/5Isip
TLSH
T19632B515AE28A97B8CCBE21EBB65BF53D2F9113260951F48B6FC862C05E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

514c624a-d9ae-4d5d-bff8-1597e2e64d05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\514c624a-d9ae-4d5d-bff8-1597e2e64d05.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf881d89-dba5-4ea1-be3f-321047c5c19b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf881d89-dba5-4ea1-be3f-321047c5c19b.tmp
Size 37KB
SHA256 269588ca5fc6eb8ba3881e31816cd37f46dda63b8ef801bc09e7e1322446c983
MD5 caae27c302bca769340e56fac2666d2d
SHA1 9f8a371c918809fc2f2312f8d1ff0d88f0c7fc06
SHA512 c4609bcab3a5b1712d3a4336dd118706fbd278a18cb97c00a8f7869bfa78af2b756251b10884de4d69d331d4e1e60af5b7e3a1c2d82534870556d991bfb57198
SSDEEP 768:X/UxvxjgC+H3FVGOySR/9OA9at01j0iq00+Ia2CSHxRz:KZj3+H3FR+CHq00NaxSTz
TLSH
T16303C031ECA49D739CF7B384730A63979FF44663C6C56A904AED2A0E01876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7d77f28-5440-49a4-b9aa-682d26841014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7d77f28-5440-49a4-b9aa-682d26841014.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fd1a4c60-54dd-48a6-a7d0-8e761ed262b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd1a4c60-54dd-48a6-a7d0-8e761ed262b0.tmp
Size 36KB
SHA256 13878451b7253be07d3763d18ee3e9187c917dd2111f49538ea73f97f2d50a28
MD5 ea17d31a51a0b6991b69440960df3e85
SHA1 8fcadad1c6a27b68a73b902f3508fcd8359d09ad
SHA512 a8558565c68df69caa80631ba158e8a761117e24a202e939e85a6cbf718a5c1e16190776cb088f13e2454516d22874cbf91448852a7a4e5d540fb511efb16ae5
SSDEEP 768:gFQi3+wgPO0OySBn/9OA9at01j0iq00+Iair4YGHLw:Ti3e8aCHq00Nak4YULw
TLSH
T1F0F2AE72ECA4CA77ACFAB785F70A33469FF04253C6CA9A80CAD9291D01575ED1307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download