0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Academy-course-based-learning-management-system/Academy-LMS/application/core/index.html
Size 131B
Sample261005-aramdat1e1
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{D35FEF90-E7D6-4F73-88E1-B9C87313A329}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
968	msedge.exe
968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3772	2580	msedge.exe	89
PID 2580 wrote to memory of 2856	2580	msedge.exe	91
PID 2580 wrote to memory of 3856	2580	msedge.exe	92
PID 2580 wrote to memory of 3856	2580	msedge.exe	92
PID 2580 wrote to memory of 3856	2580	msedge.exe	92
PID 2580 wrote to memory of 4836	2580	msedge.exe	93
PID 2580 wrote to memory of 4836	2580	msedge.exe	93
PID 2580 wrote to memory of 4212	2580	msedge.exe	94
PID 2580 wrote to memory of 4212	2580	msedge.exe	94
PID 2580 wrote to memory of 4212	2580	msedge.exe	94
PID 2580 wrote to memory of 220	2580	msedge.exe	95
PID 2580 wrote to memory of 220	2580	msedge.exe	95
PID 2580 wrote to memory of 220	2580	msedge.exe	95
PID 2580 wrote to memory of 1496	2580	msedge.exe	96
PID 2580 wrote to memory of 3056	2580	msedge.exe	97
PID 2580 wrote to memory of 1496	2580	msedge.exe	96
PID 2580 wrote to memory of 1496	2580	msedge.exe	96
PID 2580 wrote to memory of 3056	2580	msedge.exe	97
PID 2580 wrote to memory of 3056	2580	msedge.exe	97
PID 2580 wrote to memory of 1440	2580	msedge.exe	104
PID 2580 wrote to memory of 2060	2580	msedge.exe	105
PID 2580 wrote to memory of 1440	2580	msedge.exe	104
PID 2580 wrote to memory of 2060	2580	msedge.exe	105
PID 2580 wrote to memory of 3048	2580	msedge.exe	107
PID 2580 wrote to memory of 2824	2580	msedge.exe	112
PID 2580 wrote to memory of 1232	2580	msedge.exe	113
PID 2580 wrote to memory of 4160	2580	msedge.exe	114
PID 2580 wrote to memory of 4660	2580	msedge.exe	122
PID 2580 wrote to memory of 4660	2580	msedge.exe	122
PID 2580 wrote to memory of 968	2580	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Academy-course-based-learning-management-system\Academy-LMS\application\core\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe6581c188,0x7ffe6581c194,0x7ffe6581c1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,9883971568887218480,12066777276778050325,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,6264362520523222525,17756826522506019899,262144 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,9943646575374625535,11910612130730055667,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16422118157923864313,5364574897083204720,2097152 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3653079349312702358,14759407743138432199,2097152 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2352,i,6527138616575738837,18093716311988312052,2097152 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,9895900599363135775,290876964768110393,2097152 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15852584180476855735,355137570691859556,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1318476792203505917,12119289525990665436,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,8991143127141004583,1789357385866984728,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,8991143127141004583,1789357385866984728,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,11057533492912562129,8404915320038424008,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,9068262333247624049,8196630012133512063,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,4084502659095911672,3144415135607382716,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,3980426686449975885,10395156131292319972,524288 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4588,i,12952597425592028225,9853156167623390233,262144 --field-trial-handle=2504,i,4514806110962051952,1071754102236560074,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a828cc7-71a5-4879-9ab5-b69c9031d0f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a828cc7-71a5-4879-9ab5-b69c9031d0f1.tmp
Size 18KB
SHA256 74a77141ca727672d20b73bb1e3d4e4e27622a09a2ec72501d527cbe8a5cf45b
MD5 1098b785e797f94e2d4762963d7f1cb5
SHA1 9163a7647a6336adde8429e0457613f8d2c7c844
SHA512 5f3c4a2ca7691e561885f3e4a99a2a46744d0f07fcbf4efb132f63fb975fa6b3fd300e88c8bf08957bcda137ce59555cfcdf19c6e29469f1330f08a8f72fb6ea
SSDEEP 384:sZcIhsNYEl3Y1b7ACuazIGm5B838RcXcioOVZh6DKhHXoS:6hfUcGLR0cioOfYGHX1
TLSH
T1A5829D72ACB8AC7A5DF3A545F5463A139EB88423E3C89F84D5ECAB1C00DA2541317E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7127e077-6828-4e3e-87a5-7e741a06b708.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7127e077-6828-4e3e-87a5-7e741a06b708.tmp
Size 21KB
SHA256 ad1a226597322c0d699658fe3168a0eb75a8905c51d77f47dfaa011dd7ec68a9
MD5 b7d19463f69728ee9e807a423957b3f8
SHA1 39240e7270b5c79a924f4a03986b1660c01ea619
SHA512 b6fcaf9e4fbcca285d9d77cb25c32144c6c30cfaa9f0eb8ef178b6e33b4aace795e9fadf4cd0acf63104d17c1f12db499f7ba7eac63283970df4cd46e5765487
SSDEEP 384:LiFiZcIGzsNI8TUNTUlIlEl3Y1b7ACuazIGm5B838RcXAKioOVZh6DKhHXoS:mFQ2VwgNUcGLR0AKioOfYGHX1
TLSH
T1C6A26C739CB8D87FADB7AA85F5453613DEB48063C6C5DB94E6D8AB0C00DB1981307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

0d6855ff-1a37-4afd-8db4-4b77074cbb20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d6855ff-1a37-4afd-8db4-4b77074cbb20.tmp
Size 10KB
SHA256 2beb5711b002cf9989677f76261b49d762e87e84fa7265e60e1e03dedad93cfe
MD5 93fe2e164943ca18115cd609f9f5827e
SHA1 50636c3198ef0a0a38ffb2e9676fccbb0cfeb18c
SHA512 81a32985e849104f8c24e8f38958384a4b5e12f01f0681bdbdfef31e3e78ddb2b825f25e5f135d84f4603dfe36072ea63fce5b839c6e427909cc082e759149dc
SSDEEP 192:sxZXR8Wa/fWsX5/5IdpHAHW6+WNGYapUlChEIg5IJ:sxZXla/fWsX5qgHbGGC
TLSH
T14722D812BE28A97B8CC7E21DBB15BF53E6F9543291911E48EAFCC61C15E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c2291ec-659d-442b-b053-99c68812726b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c2291ec-659d-442b-b053-99c68812726b.tmp
Size 9KB
SHA256 717da0e7ed1a7a494856c86d8bd42837abc52d8ee81359c1728c3a76ae87d753
MD5 f0d6b58315a536ac4dec0194db0e3caf
SHA1 5f402cede3973d0b60d704b17804fc50bcd2bb84
SHA512 f933a56df8cc6264207a60ef375acb166d13a44bed68de41d8e25b0b046a7694ef8fb6c13b5e5a6d8c61bd9f685b349b01a8983d225a832d95f41fa0c9eb6a90
SSDEEP 192:sxZXR8Wa/fWsM/5IdpdAHW6+WNGYapYlChEIg5iJ:sxZXla/fWsMqCHbGqY
TLSH
T18D22A612AE28A57B8CC7D21DBB55BF53D6F9143251D51E48EAFCC61C05E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d4b194-a48a-4ea1-9baf-1a3448bec027.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63d4b194-a48a-4ea1-9baf-1a3448bec027.tmp
Size 9KB
SHA256 f225543e92836fc70a22744ac0b0e5ed0a1657bdda33aa46dfb3f8ae51da38f6
MD5 209a1c38586947c0b98d2e882723c752
SHA1 c812eb6500bb0dc44cd778e41f69c108d6d9ead0
SHA512 1f5e26cdbc8c116f76f51138b827d5ab1b44052efaa653d8b8b1d0d21cd5d83e99051a754b00cdfd8ea4d899e0992faa6a422e93f93c52979f65785ce1c8d0ee
SSDEEP 192:sxZXR8Wa/fWsR/5IdpdAHW6+WNGYapYlChEIgrJ:sxZXla/fWsRqCHbGq9
TLSH
T18712B712AE28A57B8CC7E21DBA65BF53E6F9143251D51E48EAFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

658eccea-5950-431d-aa3c-bf835a96882b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\658eccea-5950-431d-aa3c-bf835a96882b.tmp
Size 10KB
SHA256 03ac1d5f9d280417f9e3d541a1727ddd14069c9afb14304d2fca3e340b0fbc6c
MD5 96296c2c6a611f62d12990fb4c5a56f6
SHA1 310b0632fee3df338e8620e126870b66634298e3
SHA512 764a6187fbb6a408a398fb9e40922ebe87d0f5ef435dddbe2175bb6436be7e7adc9bd553fbe2bec3b605d9acea506c1eca970427bf3626d760538a42d0e43dc9
SSDEEP 192:sxZXR8Wa/fWsX5/5IdpdAHW6+WNGYapalChEIg5IJ:sxZXla/fWsX5qCHbGcC
TLSH
T17622C612BE28A97B8CC7E21DBB15BF53E6F9543251911E48AAFCC61C15E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c0466ee-6942-457b-84ce-a1738f855129.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c0466ee-6942-457b-84ce-a1738f855129.tmp
Size 27KB
SHA256 3cf5ff47dfd7c64356c2a067d165faa42c4399e827fc27d26a9b367da7e8853b
MD5 1fc2ce9aba4ed54f70626beca90146d6
SHA1 c90e4b57fbf5ded9304ad0b8661153f3c567800a
SHA512 511ce53327a8539ceca11da8ee35d93490c902e26f3a6bddf37ce028a936d8ceef34653bacb097e5fcdfae0bfbcb516669716943bb292a83d0db567ea3d32e9f
SSDEEP 768:pbWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Oro4tfetmRu:pbWPcLKWvKeEeu1jaClLiF7F4tWtmRu
TLSH
T1AEC2EA3B640CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b08be03564a0bec4b6f742f3bf753c267e7fb1107fda1735052e0eb74a914124
MD5 fd443b2dbed87a77fcc3e1c37d29de4d
SHA1 8c2896424dbf8b3ffcc9a506c055962cfbb08684
SHA512 11f851fc7fd3c529151eef566d1a0c5c6ba6a96db7ffb3cdf859662ccdb4c308a471c67a7f449ee4c5d24ebf5eb6e3a5fbd018d5ab0abc911ec8f8fd30510ce1
TLSH
T152612E915A2B6B63F79876F1CAD984FB353F649F49933E5315A8EC3B5806353F200064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32792d4f5684174245cbded68b5c4902067b5311b0bb8a0207dc748a90959e78
MD5 2450abb6a195ee6476cc441bcfe9e47d
SHA1 4b7c65100152e6b00104f73e058e3a9b08c5cba5
SHA512 b2d1323531ab45370f7ec1b7ab6f2cfc61ec1d9b905f144fa8d7818267498787541cc160ce9f080210c17c3a8532fbd6f07c750e1cee4e26bc7042d775ace8de
TLSH
T152614E905A2BAB63F79836F1CAE980FB353F648F09933E1315A8EC3B4806353F601064
MD5 SHA1 SHA512 TLSH

Submit Download

4f4bccc4-5805-433a-8328-dce18aee3a5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4f4bccc4-5805-433a-8328-dce18aee3a5e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

a3335765-84f7-4d8a-8fc0-56ee378ee597.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3335765-84f7-4d8a-8fc0-56ee378ee597.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c443dc09-c3ec-400a-82c7-1788810029f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c443dc09-c3ec-400a-82c7-1788810029f9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ff3a3e8c-811c-49ec-85cb-b778009ee683.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff3a3e8c-811c-49ec-85cb-b778009ee683.tmp
Size 949B
SHA256 8731debb236370520899c09df36900dc431da5deef1e129c7d5d9eb592292525
MD5 5798e348f21aeaa2563726e7e1585de5
SHA1 0ea39d888e496d05a0bd9a4971d3d580c3ad4e08
SHA512 73a2f3015b510e540465c76ed7a263cfd9cc2b32e74c7ca28c4341d334edbcdb77c1f0bc2d80f0e562465394e4418cf2f6073269c7c283096caa4a4322e4c00c
TLSH
T1BF115BF3C3D596AE890156F06A24AE2BCE1D050642187D1A99D4EF2793E3475E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

fa942091-3104-4c7a-a21b-80e452acf8ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa942091-3104-4c7a-a21b-80e452acf8ba.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 9417beb728efa360643554ba31c1c35ce3456bb0000d9c7eddda43d5e80c49a9
MD5 b5f8cf2a494ca5a295b9746a1270acfe
SHA1 d1d3c2aaac9198386421af45fff00364ce732800
SHA512 e39aa00f858dd933cc21e3d5cf0c612a6d0ff333cb5330850e79b869a89247f065ad54977dc13c629e3e47363a8585e959c4ccc08d22a01851db2ca8ab6efcb8
TLSH
T1EC2186E093956085BE89AA45951E6413A0F12ABF210D59F62B2FC1F4CF4CC295B2F971
MD5 SHA1 SHA512 TLSH

Submit Download

3405d9fa-f4b8-44ce-ab12-aecd0c074b8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3405d9fa-f4b8-44ce-ab12-aecd0c074b8c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bf433b9c-adc8-4534-9c16-dcd9152c6e73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf433b9c-adc8-4534-9c16-dcd9152c6e73.tmp
Size 18KB
SHA256 8c3e182a49d4ee59e992c9821e7030b2fcd7a7503409b387130c04559fa502ec
MD5 8dbc7de9eae0f502b06666d08d575b10
SHA1 016bd842b188820dc22785191b29766441854315
SHA512 4954372cc56a2d2cf0daadff0a2d83862291e4a5b5e301bc7b089003dcd089575e09822e1c637200fbaba5bca04913496337582c90f3c8570442cf56e6832ae4
SSDEEP 384:hZcIhsNYNl3Y1b7ACuazIGm5B838RcXcioOVZh6DKhHXoS:phUUcGLR0cioOfYGHX1
TLSH
T16A828D72AC7CAC7A5DF3A545F4463A139EB88463E7C89F84D5ECAB1C00DE2541317E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d36c9545-d4d0-4a31-a8d1-fb3e792ee01d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d36c9545-d4d0-4a31-a8d1-fb3e792ee01d.tmp
Size 8KB
SHA256 064b582cafbdb78e648827b80a48e936af444aa7d8e5b53fdff12569da5ec97d
MD5 172b538169b9fa551eea9d573dce50ee
SHA1 4321defa2d94cee8ee133cbcc8403197f7378e7b
SHA512 bd33a2b5d82cd2e916bc37309561379ef36143dd28e943d1a0987be08950eac1a9b8c129d628ea0b1f10df0004c0460c484a4e4049035d562eed26cc66d3a0af
SSDEEP 192:aON86IE7QmiUyCDQTPuIGm5Njzor3EmNC7soPdU6:aON86Dt1aPuIGm5B83gsoFU6
TLSH
T17302FC35AC78BC6B9FF36D49F4872A23AEA5112BE5951F84D9E41B1D00D725C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2ac34f-582b-4a1a-b483-606f7bdce0a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee2ac34f-582b-4a1a-b483-606f7bdce0a3.tmp
Size 8KB
SHA256 238cc07933a1de6f242b36a557e35d39fbfacc37e20f74793ecf1fa5613852ce
MD5 0687bd5fc2a68ef1de3c662bd69d9f05
SHA1 eef2aff53389c35681150ae143028b80724484fb
SHA512 5f9bbc0dfdcc4fcc6ead1aeed17fc73ce9f5cb82081285249e00d3b14d6b6b7d59c3f16a461365172f311e60b13a1f8db4d721512c159a1836513de8047dbe1d
SSDEEP 192:aONx6IEKQmiUyCWlQTGuIGm5Njzor3EmORcXw27HojqlU6:aONx6DG1WEGuIGm5B838RcX5HoOU6
TLSH
T1AF120A36ECB8FC6B5EA3A544F4463923AD754227D7896F94D6EC2B1C00DF25C130A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b30b2651cb47fb7b72716f6045c5e09825ba61be9440380d010c1a2676a5c0ea
MD5 6c785a1f119e8490099de9d8fbfa4c84
SHA1 4eb46840ef17019a98ed2b68e123ccda42a7ea1b
SHA512 32dbb61de8c17f47ef492263a1422c9467ad85ffcf041cd14628b37af061c9cba167c96ba10316bb99ec6b5652a593674ea4969b86f46e838ebbf6697da1f190
TLSH
T11841245CB6F91108B3B7BE5A9FF6A96E487FB9372E0AD49D00110D4E0622B44DC62737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3048-187-0x00000152036F0000-0x0000015203839000-memory.dmp

Download