0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
academy/Academy-course-based-learning-management-system/Academy-LMS/application/controllers/index.html
Size 131B
Sample261005-aramdat1ez
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{997EEE21-711B-4302-B3AA-14C6899C0C70}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2024	4896	msedge.exe	88
PID 4896 wrote to memory of 4024	4896	msedge.exe	89
PID 4896 wrote to memory of 2068	4896	msedge.exe	90
PID 4896 wrote to memory of 2068	4896	msedge.exe	90
PID 4896 wrote to memory of 2068	4896	msedge.exe	90
PID 4896 wrote to memory of 3332	4896	msedge.exe	92
PID 4896 wrote to memory of 3332	4896	msedge.exe	92
PID 4896 wrote to memory of 228	4896	msedge.exe	93
PID 4896 wrote to memory of 116	4896	msedge.exe	94
PID 4896 wrote to memory of 228	4896	msedge.exe	93
PID 4896 wrote to memory of 228	4896	msedge.exe	93
PID 4896 wrote to memory of 116	4896	msedge.exe	94
PID 4896 wrote to memory of 116	4896	msedge.exe	94
PID 4896 wrote to memory of 4276	4896	msedge.exe	95
PID 4896 wrote to memory of 936	4896	msedge.exe	96
PID 4896 wrote to memory of 4276	4896	msedge.exe	95
PID 4896 wrote to memory of 4276	4896	msedge.exe	95
PID 4896 wrote to memory of 936	4896	msedge.exe	96
PID 4896 wrote to memory of 936	4896	msedge.exe	96
PID 4896 wrote to memory of 3700	4896	msedge.exe	105
PID 4896 wrote to memory of 3700	4896	msedge.exe	105
PID 4896 wrote to memory of 2292	4896	msedge.exe	106
PID 4896 wrote to memory of 2292	4896	msedge.exe	106
PID 4896 wrote to memory of 632	4896	msedge.exe	108
PID 4896 wrote to memory of 4588	4896	msedge.exe	117
PID 4896 wrote to memory of 3636	4896	msedge.exe	118
PID 4896 wrote to memory of 3648	4896	msedge.exe	119
PID 4896 wrote to memory of 4752	4896	msedge.exe	122
PID 4896 wrote to memory of 4752	4896	msedge.exe	122
PID 4896 wrote to memory of 2584	4896	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\academy\Academy-course-based-learning-management-system\Academy-LMS\application\controllers\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x29c,0x7ffb5ea1c188,0x7ffb5ea1c194,0x7ffb5ea1c1a0
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,12411254854828347095,1589546624568955046,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,813584155554156181,17682636258609264011,262144 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,15797999768376660327,12264011810343632217,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,16951618292103833535,2547728325435886975,2097152 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,134886491649115113,2226521014804897317,2097152 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,4110909145911109579,17533569825372354674,2097152 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,11626859035425022468,12404130052872641079,2097152 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12558858553661825154,11545733857406952233,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8203447144961813236,8578558453179051282,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11365622805701562719,17579847929613348783,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11365622805701562719,17579847929613348783,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,3230566030809654618,930456083481671041,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,9149032343289350321,1130247039538125928,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,7953670000597915588,5527907983159266257,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,17750644323406546869,11516892060624121471,524288 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,4210718078093101385,9419330943236339369,262144 --field-trial-handle=2308,i,2237693285699246470,7501524018977572469,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2fef8798-da93-4642-968f-6a8b8b3a333d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2fef8798-da93-4642-968f-6a8b8b3a333d.tmp
Size 21KB
SHA256 3fbd024d7d039898020c9735f3c8dd5e9b9ca23b7758a786492050cd8b3e4819
MD5 25ffbb997c940816d985058903daa94f
SHA1 08176b0476b25af478fe24700f2f0678b35591d4
SHA512 9f9f40f9b5e804ab1eea89728c000580f9262a0e9dbdf8101900ea44a993013bb60686ad8a8e5fbdfa4eb0ce702ad2850f329109b504b088de91f44feee3d171
SSDEEP 384:YiFiZcIvzsNT8TUNTUlIlHwZM2w2tOjTVRIOtr5bjqJ54VZh6DKhHcPoR:jFQLywgIAnwOTjqJ54fYGHcP2
TLSH
T1ACA26E739C689DBB6DF6AB41F54A3603CEB840A3C585AB90D2CC5E1D11DB1EC230BD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74451440-f651-4bd5-b627-294f4b744cb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74451440-f651-4bd5-b627-294f4b744cb4.tmp
Size 18KB
SHA256 ee5df7350f98260caa87fa8bff26cdd348b42d53d24e16105f8c202053911010
MD5 96e7fd2a7aaf6c9fa61ba240f39d694a
SHA1 44e86fd810a4ade1eb6a3eefc64ec2ab0446426c
SHA512 c9c828689f7e8c0f9f6c7cdc7802ac2bee81092a2700ab37971e5867f5b736a523f881d03cbbb62c4a9e6757354d36057ae67756a8f403c8e076378f56a47a09
SSDEEP 384:CZcIhsNBHwZM2w2tOjTVRIOtr5bjqh54VZh6DKhHcPoR:whjAnwOTjqh54fYGHcP2
TLSH
T1D8827E72AC785DB65CE6E541F58736038FB850A3D6866F84C0DC6F1D01DB6AC231BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97728276-5fec-46a1-a8fa-23334ae19f0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97728276-5fec-46a1-a8fa-23334ae19f0e.tmp
Size 8KB
SHA256 72e4256c923fcdfdb69f6f8a6bc963829812967e91d153fe6671f2abae3c77ac
MD5 b1f3e9c852146ced0ca5e6680ed7c35c
SHA1 3133c2ddc883fecbbc64e749bc4ab513797f3e7d
SHA512 118e5e8c09a949042579c757d884ca2c6f7001d51b573d9f35ea9745f4fee91e7d8aa0eff5e0150cedbbed09f7fb74ea6064d5f44e8e4d0357637c8b446fbb8b
SSDEEP 192:SONJ6ygpQmiUyX8tOCTVgKIOO+40YMzP5DU6:SONJ6lHltOCTVRIOtrzNU6
TLSH
T10802C735AC682CBB8DF3AE46F48B37139FE4117BD9512B84DAD81E1C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70fc4927-1f17-4a58-bab1-3ad9895265fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\70fc4927-1f17-4a58-bab1-3ad9895265fe.tmp
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

48bdf870-b515-4a05-8ca1-74a397ef3d83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48bdf870-b515-4a05-8ca1-74a397ef3d83.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

60270699-04af-4e4c-abdf-6b894c9117ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60270699-04af-4e4c-abdf-6b894c9117ec.tmp
Size 9KB
SHA256 7671287f3312398fd61c8c9d821ad13131992f121383c202472aa6bb40215164
MD5 b0b08330b789de754b878eeca4e8978c
SHA1 4a0cda06d01b3b11603f9386a0286ce5c67e45a1
SHA512 77ef575e2ad432e2a117fc981f364f89790429c35d05ff6d9c3a85c64405f803ba4017e577063d2223e6082ff90115a596b4afbcf6ca6bc00dda8e897693fbbb
SSDEEP 192:sxZMRhWM/fqsPpIdpdEHW6+WNGYRPR6wIg5lJ:sxZMKM/fqsPiKHbGmFx
TLSH
T1CF22B716AE38A57B8CCBD20DBB257F53D6F95432A1911E48AAFCC61C15E66CD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dda1212-1325-45a5-8b95-b4e4dba16909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6dda1212-1325-45a5-8b95-b4e4dba16909.tmp
Size 27KB
SHA256 cf19f28f4a803c49b8ecbe0b69610a0e7fb0e792c602ad67ed3c30e4ab820111
MD5 cd61d039300fd8684bc3e7444338a990
SHA1 559300e4ddc534f80b7e571e388d69dd9f5322dc
SHA512 5fa58288af29131b27073409c8ad1d077a82cea7da1457a9988d2b1bcd3ec3be49ca307ea4fd54b000d85f75f9b5e17111ad8a45ccd6afe216525ec1d95756ec
SSDEEP 768:F1K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Krok+X8vC:F1K9uzYWvcQWsu1ja0HL7Q3hk+X8vC
TLSH
T185C20A3F640CCB7E4FC01A9DDC5A6F973E9802D7A6588D5047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79cf733d-3338-4bf9-be87-0604b88374b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79cf733d-3338-4bf9-be87-0604b88374b1.tmp
Size 10KB
SHA256 a969e6e261f264f965b8a354197d793b63bbe893ddca35098697fdaef9cbcfcb
MD5 9e323a1bfd7e9620a178f83b82de7cd5
SHA1 bb4ee4b4d7c2b7e5dcd48fbdf820a125425bb6bc
SHA512 f5d01b852f09723a8a810be070c6db742b3479986f64165e4d466ea55d07ba51c9b2d6a4da2fea7ebdd940e4a891dcc6d0ce377ddffbeb3a3248309aa1abadae
SSDEEP 192:sxZMRhWM/fqsjpIdpdEHW6+WNGYRPRq6wIg5PJ:sxZMKM/fqsjiKHbGmYX
TLSH
T11D22C712AE38697B8CCBE20DBB257F53E6F9543291911E48AAFCC61C15E76CD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e8ed5e0-a188-4c54-b7ac-a00f67be4464.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e8ed5e0-a188-4c54-b7ac-a00f67be4464.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4d45c5572d93c7627a03aa6a51a4f901f2ac4f0555fb075c256e5e91599fe454
MD5 465d9b829caa995b1c3abf7cd88970ee
SHA1 bb50169e7939505c96eccf047995745b5fae105e
SHA512 4e4ba5258780c1f6a7b0a306206ca540060d0bdf34b05f014f22b288a74b1727427b95f26177cf07fd82af9298179de64f19e550a112eaabb9569e01e46a115b
TLSH
T1C361858A1740C0AFDB9863B051E70177FA35757805836FF2A999EB7A5726F1BD04C074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b280120c4abbae9806d40343488256f24e2775c8590211ee4350217902be248
MD5 cd792acd3d021953680dc8c084ddfe78
SHA1 0507eb2b7019fcc81d6591beea80f1f1dce8e1aa
SHA512 fc076c8282bf1c1af0701eb2c9c9cee7c819ac05e66ff37f1e8e7e710d42eecd032fba49690c4bffb20719da8b470a51662fbc13e28f23ae849a887db3b8a8ec
TLSH
T18661858A1740C0AFDB9863B051E70177FA3575B804836FF2A998EB7A5726F1BD04C074
MD5 SHA1 SHA512 TLSH

Submit Download

4feb96ec-2799-4dab-b47c-80d6e84f01c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4feb96ec-2799-4dab-b47c-80d6e84f01c5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0d2cd73e-e752-4b4f-b115-bf29e3e757a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d2cd73e-e752-4b4f-b115-bf29e3e757a0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

10c2f6a4-2bc4-4007-ab1b-8e6ee3e89255.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10c2f6a4-2bc4-4007-ab1b-8e6ee3e89255.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

21c37070-8c09-439d-95fd-2803200486fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21c37070-8c09-439d-95fd-2803200486fe.tmp
Size 949B
SHA256 d3c365d089a9d63bd86a22124007a939aea538c086cb05e70ba81e17fe03c350
MD5 bbe0f5f9e1056df76f25cc1df9edac81
SHA1 81ec686b5144b570e93a7bd79c536a86592da45f
SHA512 7e8a5d1d7893ec553dd1c9c31b2688a3bf9ac9f27a0aeaa4f6e75476e194b48bca8ad6859bc4d5e151cddbf1563ed15576fb4fcf5616be32d11cd9e48d0ca08d
TLSH
T102117DF3C3D585AFC90156F06A24EE2BCE2D0606435C7C1989D4EF6797E3475D10199B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f264469099fe143b4ff511f08c278eb37fb7de2b85684fd9d29880360c8d6a06
MD5 d2906b22bba743ef40edba6cbf860b25
SHA1 63e7c26dc72b9c49d9b9889fa2611ad6a5e490f4
SHA512 09380cb78eaffb73e4f5b1c4cd9b1295b39f976a19db037863efe18e133292c4f8bdcf7da68584637b19efa9da93d2e3ebfd8236a0cf503824d028f75e21c870
SSDEEP 48:K0mImXaDX5ZpCbBsxISnCK9n1NCxHSYE1XryLI5IIIVIpIzI3ILIkbI3ISIPISI2:K0mJIwKROuevqKg0nSIKXq7
TLSH
T14F913E20707B620038BD396985B4876F528231F3701DE66B7FBD14A28E2EE445EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b601891f-452f-4094-880c-902baff00d4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b601891f-452f-4094-880c-902baff00d4b.tmp
Size 9KB
SHA256 71ca3f779765029b2ce45f19ed6257b0b37ed10946dddf40ff7409910e192ef2
MD5 5271721a1c5be7b4ee1c025fad924506
SHA1 928d53ce9b82e9f279feefa0259cf75ca5dba7f6
SHA512 af6c465ff07d759ca4f18312c4cc21fef76bccd8e9810af159abfb1eeb25ccc9f2895a4dfdabd04301a1ff2b964f91d0a62d9fff125000cdebfaf98e4dfcc5c0
SSDEEP 192:sxZMRhWM/fqsSpIdpdEHW6+WNGYRPR6wIgrJ:sxZMKM/fqsSiKHbGmF9
TLSH
T12522C7126E38A57B8CCBD20DBA257F53E6F95432A1D51E48AAFCC61C15E66CD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaa7c754-86df-4add-93fa-c7fc7480593e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eaa7c754-86df-4add-93fa-c7fc7480593e.tmp
Size 10KB
SHA256 4983cb68a7ac648548f9daa811241ad51c25849c0215e8d53dd11185a78475cd
MD5 ab7543eefb09013605e7bd8da7cbdc43
SHA1 15beb8ba39cb5b5294d1c56909565fb9086945db
SHA512 aeb8f3a378ffe7330d7a954a6e14e49de26db47dd52e1672281edd9adcb40a0f3d7fe3368fd4cd0b39284f2ca4a377523dd5787ec2432d9f997360671aa414a8
SSDEEP 192:sxZMRhWM/fqsjpIdpHEHW6+WNGYRPkp6wIg5PJ:sxZMKM/fqsjikHbGm8X
TLSH
T1A022C8526E38697B8CCBD20DBA257F53E6F9543291911E48AAFCC61C15E7ACD120B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e0739598-2071-40d8-b248-95176b6adcc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0739598-2071-40d8-b248-95176b6adcc1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2bec177-487c-400a-8a3d-3c468d36311f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2bec177-487c-400a-8a3d-3c468d36311f.tmp
Size 18KB
SHA256 91adfe4e22ed11a3ea2a63a7b9a897cccd494ca2114952bf8d13e4eac3d89dbe
MD5 8e07845877297c81cd51b7abf517da98
SHA1 fdefc47f5ab56169e7581bef2605190c044fd3b8
SHA512 c1aebb5f76153adb2e35b19420136ee7d4ae38be9edb39a5d5a6d6fcd7b9f0c010c31371158a6acf27bd5aae747ec650dab01b98ae697124d73c2628492155b0
SSDEEP 384:XZcIhsNBWwZM2w2tOjTVRIOtr5bjqh54VZh6DKhHcPoR:fhSAnwOTjqh54fYGHcP2
TLSH
T11B827E32AC785CB65DE6E541F58736038FB850A3D6866F84C4DC6F1D01DB6AC231BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea70d741-0ab1-4c85-8db3-e38a797e04ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea70d741-0ab1-4c85-8db3-e38a797e04ae.tmp
Size 8KB
SHA256 6ef577be54fea0d25266c009b62d43d9a53d53757f97fc3a9020e91a38d73dc2
MD5 6691398e18d9945dfd678d3d33bc585d
SHA1 a0cd581a5e80a87a1295b2c5c4b9a4f2f4d9074f
SHA512 eb592032c17176ace939a27e71491f0c29e15fb77281b723c1c36670c915a52dc3739a47b89ecece1afd2596616b4b71151f7cd5b7e7b0c68c2e87d5d1b7970f
SSDEEP 192:SONc6yEQmiUyaG8vOCTVgKIOO+40YMjbj1EJ3UNqY4U6:SONc6zhtvOCTVRIOtr5bjqK54U6
TLSH
T110121931B8786CB75DE3A545F48B36138EA84167DA463F80D5DC2E1C02DF6AC230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

486ca7cc-5d8f-40d2-bfae-4192b453d089.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\486ca7cc-5d8f-40d2-bfae-4192b453d089.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 625c2a497723160f111f6b86aa8aa0a939b9c5580b5f9424eff0d825cee80163
MD5 201fe38500e68d91820629c97858d9d4
SHA1 9430ffb6d3db7742cc06185157590e543c760fa7
SHA512 4683eee1d6f418320c74e05292062886b9988aa58aac30ff4619dd0d6ae06cda2855bb9409f5340e7625d534ddf47971e4ce7b0b05355f76aadfb180a9443f57
TLSH
T120414A58A6F91008B3B77F1A9FF6A86D487B7D272A46D4AD10110E4F0A23B40C962B37
MD5 SHA1 SHA512 TLSH

Submit Download