0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Academy-course-based-learning-management-system/Academy-LMS/application/cache/index.html
Size 131B
Sample261005-aramdat1e1
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{5CB218B7-AC76-459B-90AA-9B1B55B6FC4B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 5016	1936	msedge.exe	86
PID 1936 wrote to memory of 4744	1936	msedge.exe	88
PID 1936 wrote to memory of 4924	1936	msedge.exe	89
PID 1936 wrote to memory of 4744	1936	msedge.exe	88
PID 1936 wrote to memory of 4744	1936	msedge.exe	88
PID 1936 wrote to memory of 2824	1936	msedge.exe	90
PID 1936 wrote to memory of 2824	1936	msedge.exe	90
PID 1936 wrote to memory of 996	1936	msedge.exe	91
PID 1936 wrote to memory of 3848	1936	msedge.exe	92
PID 1936 wrote to memory of 996	1936	msedge.exe	91
PID 1936 wrote to memory of 996	1936	msedge.exe	91
PID 1936 wrote to memory of 3848	1936	msedge.exe	92
PID 1936 wrote to memory of 3848	1936	msedge.exe	92
PID 1936 wrote to memory of 3088	1936	msedge.exe	93
PID 1936 wrote to memory of 3088	1936	msedge.exe	93
PID 1936 wrote to memory of 3088	1936	msedge.exe	93
PID 1936 wrote to memory of 884	1936	msedge.exe	94
PID 1936 wrote to memory of 884	1936	msedge.exe	94
PID 1936 wrote to memory of 884	1936	msedge.exe	94
PID 1936 wrote to memory of 1156	1936	msedge.exe	98
PID 1936 wrote to memory of 1040	1936	msedge.exe	99
PID 1936 wrote to memory of 1156	1936	msedge.exe	98
PID 1936 wrote to memory of 1040	1936	msedge.exe	99
PID 1936 wrote to memory of 3492	1936	msedge.exe	101
PID 1936 wrote to memory of 2988	1936	msedge.exe	110
PID 1936 wrote to memory of 724	1936	msedge.exe	111
PID 1936 wrote to memory of 2940	1936	msedge.exe	112
PID 1936 wrote to memory of 2296	1936	msedge.exe	121
PID 1936 wrote to memory of 2296	1936	msedge.exe	121
PID 1936 wrote to memory of 2744	1936	msedge.exe	124
PID 1936 wrote to memory of 2744	1936	msedge.exe	124
PID 1936 wrote to memory of 1724	1936	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Academy-course-based-learning-management-system\Academy-LMS\application\cache\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff94b1c188,0x7fff94b1c194,0x7fff94b1c1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,1851763784525966083,8417163109546309292,262144 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,10200916414070899995,14637997905696897840,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17931859703953573291,16102359636774557937,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,8544656331282203687,2518930181078158902,2097152 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1523038726325291413,6232001668045863856,2097152 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8055644051157547757,1850957869873971348,2097152 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5209097584964288734,816564835416680583,2097152 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9962692229539832847,13359024499540543649,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,2577615920577886059,17608029985980519156,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,4403113838369702555,11192281583594017386,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,4403113838369702555,11192281583594017386,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5307015711311414441,15164747663615573220,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2979676804994155986,10696339313874881174,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,18290214006297213060,1906825847700087384,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,17519820652209460534,14978610547185932789,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,10485376737489831726,16154721317569886460,524288 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,6008087127798025096,9468358508108298347,262144 --field-trial-handle=2280,i,11074149733131213545,13600360005662206522,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2840a25b-6b09-4b35-8f2e-0e045cb9b987.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2840a25b-6b09-4b35-8f2e-0e045cb9b987.tmp
Size 8KB
SHA256 da255eff5e30183b3f9ae196fe830ec6f526c5eba4364105cef905aa68f54c09
MD5 8e4aad9ee6297f7c8cb392afe7c42fae
SHA1 45e87fca5991da5852ffba2afa77937da3d82dd7
SHA512 c48c532df02770265697234959386d3a8e0e11cdfaab3755cfaee831e2471d23354f9ec7bba339c8b970471f8a0ca61793b888ad199d033335cbf6f9d6f35782
SSDEEP 192:EONh6nnHGQmiUy2OQYcX5hQDP1yjjzorloQMctNfU6:EONh6nC4QNX5+Dtyz8GE/fU6
TLSH
T1DE02EC34ACB87CBB8EF36D45B48636139FA5216BE5842B84DAFC1E1C10D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f09fe2c-328a-4511-a73f-8cb57e95f09c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f09fe2c-328a-4511-a73f-8cb57e95f09c.tmp
Size 18KB
SHA256 a8bf2367cbf68b6c164d6eb5513ca60950a7882074cbbfc6cc87aaabf51a0cdc
MD5 f4e00d8e758549c3511a07b6719d153d
SHA1 7fa00aaad63fbecda387e59cbd624443a2ea19d5
SHA512 9ac2eee0413ebdea80166d847875d69054231fd99af0427b771f4e3a0ec1fb9e16b05043d75c89da9eb9b8639275efc99899290e99be7827430b26684313ac76
SSDEEP 384:qZcIhsNLtCi/QnqEQX5+Dtyz8G46XPX8VZh6DKhH7VooZ:IhFyvkDY54iPX8fYGH7Ou
TLSH
T1CD829F319CB8AC7A5DF6F5C6F54635039EF85163E2886B80D5FCAB1C00DE6A4131AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55993648-d91b-4dfe-86f3-0b28c43f5b5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55993648-d91b-4dfe-86f3-0b28c43f5b5e.tmp
Size 21KB
SHA256 4d825cfb394cfbcd6e7cfb78b17996640ed0da0dc198cfe2ba7a257998268830
MD5 d5b56f818fbe8ec1ffa40129b732fee0
SHA1 8e83a675e107996f0d6b07f72e4080d518b132c7
SHA512 a1da2e0553304a039d76f37d73fe10f9133974119349ee43c979e944574f664a809df8dd9931d74c284c25990f70adcc51a0f0f698679c06b1cbb1949f4f7433
SSDEEP 384:wiFiZcIszsNV8TUNTUlIltCi/QnqEQX5+Dtyz8G46XzX8VZh6DKhH7VooZ:LFQQcwgGyvkDY54izX8fYGH7Ou
TLSH
T168A27D339CA8DC7FADF6AA85F94631039EF45163D585BB80E7DC9A1C10DB1E8130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ce20121-aeda-4fa5-a5b7-83545e926802.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ce20121-aeda-4fa5-a5b7-83545e926802.tmp
Size 8KB
SHA256 0ec97f464fd4224d40170d80842e846240d642289e2d6ca715f9268ab54a5442
MD5 d8e2fcec94239d6295393831587180d7
SHA1 e84ce293a78afa58397b0119d082d004915e4ced
SHA512 3632dda246c61db5397cbd96d94be884490cdc0baecae00fccb7267d4f90935610eb102a2f4dd8fc0f47fc310ee4088f6b726c09d67300ade755ac43c6c77253
SSDEEP 192:EONm6nnHxQmiUyDmOEYcX5hQDP1yjjzorlo46XFXg3Mq5SFU6:EONm6nvknENX5+Dtyz8G46XuX8U6
TLSH
T197120B31ACF8AC6B5DE26995B08731139EA55127EA897FC0D6FC1E1C01DE6AC130DD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

2fac1bad-3d96-4f67-962e-34783b50a86d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fac1bad-3d96-4f67-962e-34783b50a86d.tmp
Size 10KB
SHA256 3bcd37e9ed31c978780cb0d98938a420d4c1e3c65cb2f0da4ac62c15e04b74cf
MD5 73e90730bea0e0e128cdd753beeda322
SHA1 ee021462b7fc379ebf5d5bf55b0476f668146f3c
SHA512 eff61ace42ce9b5cc7df36f85641c53e9e528e7741c80b43b3be5381af64ffafe9d1052f4693ef05902c8e476fc83f9a379f4a3a90ea0f097e1a7004a2aa2a71
SSDEEP 192:sxZ+RgWY/f1shSiIdpHAyHW6+WNGYYBkXaIg5uJ:sxZ+tY/f1shSLgyHbGfDs
TLSH
T1FD22C6516E28697B8CC7E20CBB15BF53E6F9503291D01E48AAFCC61C14E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fcd6346-b552-4312-b282-d6e9f1045320.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fcd6346-b552-4312-b282-d6e9f1045320.tmp
Size 9KB
SHA256 4164b22ab3c7012b175125644ceca4840ba13246f0f1f982f32113e2e63836e6
MD5 ac611a7f765b71da4635caf4d81ddad4
SHA1 4e26fd0f4c15d929f0f94fe74787aa9acd1eb924
SHA512 ed0fb545ffe03b2ce508bb478f9239c4a5f7fc9334db285b8bcef5177e35e518cb0882d9e17de6d6ce9351586fce5bcf6d8b3e7ec04faf4cbefb873b7285b510
SSDEEP 192:sxZ+RgWY/f1sqSiIdpdAyHW6+WNGYYBaXaIg58J:sxZ+tY/f1sqSLayHbGfd+
TLSH
T17922A6116E28A57B8CC7E209BB55BF53E6F9543251D01E48AAFCC61C14E6ADD221B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

325afd43-75e8-4965-9b56-308b2bd14e37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\325afd43-75e8-4965-9b56-308b2bd14e37.tmp
Size 9KB
SHA256 ad155c42ab64b59010e7f7b6c4b6f95a1c937b2a3d1eb74f4b5f401d0d67d7eb
MD5 f1a40626ccdd4035e37f19c64c465c10
SHA1 3a139587ede20b4b55b279f0d2aaab353448b28e
SHA512 f83968dbcc8bf8586a1d0c0988607cdf8b135eccea01d1557cd0d586a02a296ee54c3d23f9db23dcf2d75d7a18066620ccc6b5ed58c31a65f631714b8dbe52ec
SSDEEP 192:sxZ+RgWY/f1s+SiIdpdAyHW6+WNGYYBaXaIgrJ:sxZ+tY/f1s+SLayHbGfd9
TLSH
T1F512A6116E28A57B8CC7E20DBB25BF53E6F9543251D01E58EAFCC61C04E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

499a88b3-4421-4dcc-809f-2b591f98199d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\499a88b3-4421-4dcc-809f-2b591f98199d.tmp
Size 10KB
SHA256 0a6f098d1802e15aa46c218c766328f5d3169bb87ddbdae08aa8a9b1a78c688a
MD5 6231fc017d41739dddb1ef6e4749eae6
SHA1 a3938279483d0d02dc751a4a3baef35d665725c0
SHA512 07a70281f5b03a4af67fce8fd4d3c22db8e62668f1f38aa830ba595df3610a57ebf05f114e92e0c694c2c11a8a23fd616e5d3e426ffabef1cfdf4a29f472a13c
SSDEEP 192:sxZ+RgWY/f1shSiIdpdAyHW6+WNGYYBUXaIg5uJ:sxZ+tY/f1shSLayHbGfTs
TLSH
T19322B6116E28697B8CC7E209BB15BF53E6F9503251D01E48AAFCC61C15E7ACD221B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d786d64-902e-468f-96b7-9105408ab403.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d786d64-902e-468f-96b7-9105408ab403.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

579ecd09-7a91-4684-a6cb-488f5d00b0d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\579ecd09-7a91-4684-a6cb-488f5d00b0d6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 925b6b73d10ff69724035368992c58201b2dca7fc1c19ad751f46e37a84d12ee
MD5 c69d549930211a9c8fb29140de096366
SHA1 5e453556883ff506ef14cdd0f7950353e14367d5
SHA512 e3378ef7a2aa443640e95efc7e588ffa69d1b61a69433408c1862482da4a54b2600ff34ef3ff897082c49572ca4e970d87b5a4b186807c5af15ed8353f0dd993
TLSH
T123E020F808CFC21D611474C70774534E9381361B97C46EDD2F44C548B44584CA7D95B0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9f3598872ea79cabbfa3d475cf0a89d4e83f2c1c9641bd65e9670614b9130bbd
MD5 2a340f9e6ce872cd5c2256c980e06eb7
SHA1 c5f41cda150419dd08757e8e2c07e34912b5c348
SHA512 baec2f3fd928c87c7667b7504cdb5729887f9d39de94176cab93342a7ce1685cebb5de77b30e1327c27e0e24951ec8a5b0a14548c8a97e3b93573fe5924b5bf7
TLSH
T182514E8526614D94FB5E657CB3F2A1FB31B2F6B043831F0D3A64CA795B7675B808089C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f3ad4ccd5345fd977e6c9e88d4300a7b9bbf6185b1b1b3fa94719700cd0fa1d2
MD5 5ea30c60a35029590d6a85e9db8ab6fb
SHA1 8e19cc5b44349458dd3f6820ce7f0904af816939
SHA512 a1d581a6a96a624b18f307d157c596673292cffdc5b478ded0e6d0fcbd71c1141b03d088f3f217c863190f250e1ce607b858edb05ba6f57705bb203b260e8cef
TLSH
T14D515F4026614C94FB5E617C63F2A1FB31B2F6B047830F0E3A64CA791B7671B808048C
MD5 SHA1 SHA512 TLSH

Submit Download

d9340cf9-5247-471b-8c53-6718f138acb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d9340cf9-5247-471b-8c53-6718f138acb5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

15a89372-953b-49e0-91d9-35ddbea8ca60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15a89372-953b-49e0-91d9-35ddbea8ca60.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a9793db6-39de-4171-8883-4e66714a1508.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9793db6-39de-4171-8883-4e66714a1508.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b59a0cf9-c135-406d-8763-0e20573923ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b59a0cf9-c135-406d-8763-0e20573923ff.tmp
Size 949B
SHA256 784d914ed1ab8d652edec2543350493c5ec5db028b88c2cbaf4675c503d3627c
MD5 37edf9de85baf8a9c9825651d0e76129
SHA1 e5a12f9299c028cf99aa330a6079006ed7b4eca1
SHA512 e7f6359f7aefbf0f81025390a861790f43a2b9e31367430baa7b9225a9c7fe5a1539a9947081f30e2147673c84b5780e5641ddee710665fdebb8a12cc65b6732
TLSH
T11F115BB3C3D585AE891116F06A28EE2BCE2D060643187C1989D4EF2793F3475D10299B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4e9d117cdb2dfb9f7d9382f4b1ec2521256fd3e25368a7faff3115e1f8a84932
MD5 15e45f6bc062656c21279bc441beeaa3
SHA1 2a30e4b07c92dd1aab674e7997ca02a7a87186fb
SHA512 8a0ab46c87bf9d5f6a29b98458bd0bcdd761e802787e4d763f4d37194331a5d14bbe0ed304bc0341f9024ec776dd1d29ca2c74fe0406faaf012dbf5241baa2fd
SSDEEP 96:K0VCKOMq2z7PyT/95V89pgn7n8KTp718/v/ANvhAHKrXVxdU9RYf7fUKTR7dU/Xb:E9gPyT/95Vkpg7nbp71kv/ANvhAHKrXg
TLSH
T10AA1BE1175BB1A5438BE258D8574972A524132733218F62ABFFD04B69E2FE044DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a80a5ed1-209a-40b0-9bb7-a5bc1439364f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a80a5ed1-209a-40b0-9bb7-a5bc1439364f.tmp
Size 27KB
SHA256 aabebb6762e959c0b2514cd883fd315497b9f750de3f5fb3d16e8446b642424c
MD5 f61a93bdf8b5db90c99ca43ad00cbd09
SHA1 2c1c37e297f7307542a1522fb0b6bd763afdaf66
SHA512 90686a354512fdb236ac6701fc32ccb7ef0eb55d407031fe83b50b062a8d51903c038874f2deb50621ab3930ddb0ae2d45aab3f0f6c68def26f9ad7cb580057f
SSDEEP 768:S3yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXBropjHl:S3yYR7jWv3NpBu1ja/CL8OX6j
TLSH
T174C2E83B644DCB7E4FC01A9DDC5A6F9B2E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e45f1ddc-250b-456d-908e-d9f1d09f99de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e45f1ddc-250b-456d-908e-d9f1d09f99de.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e35aa584-58c8-4507-8972-192d8a121ae7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e35aa584-58c8-4507-8972-192d8a121ae7.tmp
Size 18KB
SHA256 1774e12a686445fc01fed12ff000c5b16d3c6f155d6d550574b3b50054c3bbf0
MD5 cdde3782d3189e32fe2261088f5266d4
SHA1 e9de4480fffe484203984b9cd193e248257e07d6
SHA512 d83b6058a5265e1f88de367e4ea7b64f5a77e92baf4a53356e7f700b66f57a95f96b2f93099ab34e0f60a6d523e3b01d0ee2b5e888dac8403585662e7c5917f0
SSDEEP 384:SZcIhsNLACi/QnqEQX5+Dtyz8G46XPX8VZh6DKhH7VooZ:gh6yvkDY54iPX8fYGH7Ou
TLSH
T1F8829F329CB8AC7A5DF6A5C6F54735039EF85163E2886B80D5FCAB1C00DE6E4131AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c2d8cc2-1255-4b1f-9164-28d28a26238b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c2d8cc2-1255-4b1f-9164-28d28a26238b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa9349075222a18d8c053d22c515abf78577afe10f1fca3e56d56d65b2cf0e4d
MD5 ab81626107f01ac982f54963ffc6ae55
SHA1 600364a02a268b5eac7fefc75c5caf79e31399dd
SHA512 f2cccac597f5a64933a19f72233c2dd4e0e6f0551547482b2dbc2133e532612a0d385f3e5253dc88a4c61ce8cffdb7c4e75edea11da63ec9e5777a9785057cc1
TLSH
T1D4412658B6EA1148B3B76E56ABF7A82D447BB9772F0BD49D00010E8F0A22B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3492-190-0x000002400A940000-0x000002400AA89000-memory.dmp

Download

memory/3492-189-0x000002400A940000-0x000002400AA89000-memory.dmp

Download