0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
academy/Academy-course-based-learning-management-system/Academy-LMS/application/hooks/index.html
Size 131B
Sample261005-aramdat1ez
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{CD4BDCCF-1F96-4BDB-883C-6136E019A0EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 5740	2984	msedge.exe	86
PID 2984 wrote to memory of 2940	2984	msedge.exe	87
PID 2984 wrote to memory of 1292	2984	msedge.exe	88
PID 2984 wrote to memory of 1292	2984	msedge.exe	88
PID 2984 wrote to memory of 1292	2984	msedge.exe	88
PID 2984 wrote to memory of 5504	2984	msedge.exe	89
PID 2984 wrote to memory of 5504	2984	msedge.exe	89
PID 2984 wrote to memory of 6116	2984	msedge.exe	91
PID 2984 wrote to memory of 4968	2984	msedge.exe	92
PID 2984 wrote to memory of 6116	2984	msedge.exe	91
PID 2984 wrote to memory of 6116	2984	msedge.exe	91
PID 2984 wrote to memory of 4968	2984	msedge.exe	92
PID 2984 wrote to memory of 4968	2984	msedge.exe	92
PID 2984 wrote to memory of 1520	2984	msedge.exe	99
PID 2984 wrote to memory of 1520	2984	msedge.exe	99
PID 2984 wrote to memory of 732	2984	msedge.exe	100
PID 2984 wrote to memory of 732	2984	msedge.exe	100
PID 2984 wrote to memory of 5064	2984	msedge.exe	102
PID 2984 wrote to memory of 2076	2984	msedge.exe	113
PID 2984 wrote to memory of 5756	2984	msedge.exe	114
PID 2984 wrote to memory of 4424	2984	msedge.exe	115
PID 2984 wrote to memory of 2936	2984	msedge.exe	121
PID 2984 wrote to memory of 2936	2984	msedge.exe	121
PID 2984 wrote to memory of 2108	2984	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\academy\Academy-course-based-learning-management-system\Academy-LMS\application\hooks\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9e487c188,0x7ff9e487c194,0x7ff9e487c1a0
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,752542357162177222,4446626017790024110,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,13772641538557942403,9391535548725440366,262144 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,11593193622008908993,11906295218201655114,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5167573946007424869,13428283997098800534,2097152 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9481604680196241291,15205741753146384999,2097152 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,6629560281605505929,11153227827912201868,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,8467725333173701428,13275799703958862047,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1603407513278000644,11408327586433671066,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1603407513278000644,11408327586433671066,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,6965363283589257343,5590926340040755598,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,14493078366737688877,16084322590526166439,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14820354209151429158,5891845681643244975,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,4758192750801071876,18378907758222960670,524288 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,3957487596534849795,9512343588198601604,262144 --field-trial-handle=2984,i,10820448644972351717,16414446602459377730,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2527dcc7-2dab-42b9-a19e-bec5d546ef42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2527dcc7-2dab-42b9-a19e-bec5d546ef42.tmp
Size 26KB
SHA256 6ec5e5d17fe970686f844e80dd664bf4b7e8a528c9937266be87cc4e932f0c9b
MD5 865260946533f8cd6e47a69dff4387d1
SHA1 c5c0e84e346eba76325bac86912c5577201a46f7
SHA512 076386e419097e5cd243a0774615d5346f545ad54b42f5309ae04da0a238e0732dca4e2d4f2d16db2e2e23eeb135ea85ec10cff73cdf578e2f2ff33f686b0f49
SSDEEP 384:nKiFiZcIU/3sN58TUNTUlI4e5mgtNlBeK2fMBWCk/BEOJdEFCVZh6DKhH5gL/7Iz:BFQU/3AwgGk3BnzSEQfYGHIo
TLSH
T186C25B72EC98DABBECEA8B95A70A3A43DEF04163C68C9AC4D5D95D0D00D719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f79ce80-4d5e-44a4-b134-2707475ff970.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f79ce80-4d5e-44a4-b134-2707475ff970.tmp
Size 26KB
SHA256 e241f340559bcbebb4c63a3a4361f04b83b82d4f8b50f516004dad7ef357124a
MD5 4b023483a51ae0afec702d9e1a470ff7
SHA1 f20a593b1ff77520486d382ab629f230ac20d304
SHA512 2fecf7aa278d449eeb7e4234cfcac5064047a78ce3af9b4043d1c4de67222f3460d3e94bfec9b1b90e85a9aad797d903feff9ce0ccd5ae5f9435527ac2021567
SSDEEP 384:njiFiZcI63sNd8TUNTUlIm25mg1suvK2fMBWCk/BEOJd1FC7O6R2FeoggL/7IzcC:OFQ63QwgSOYBnzS1Q7TRyC
TLSH
T15AC25C72EC94CABBECEB8B95A70A3607DEF04163C68C9AC4D9D85D1D00D759D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

0c9bcc06-7bbb-4898-8da2-db0a2da3838f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c9bcc06-7bbb-4898-8da2-db0a2da3838f.tmp
Size 11KB
SHA256 9c9b94c42c1a55be5e01a48de5409ba4135fd5ac3cca1405195857a0b0a164a4
MD5 c8fc4e937966657cfd9e7ba10fc21019
SHA1 8bb8f0586eee64a7b64be49fa4114adbf315c927
SHA512 fb31a39f52258ad3d12533f476261f8eb6b407abb78dcee0156b79b9752e9bd89086f1567b12d6e1e95c78b35993b118c5150a5137fd15fcb1b89336ea0ac5f1
SSDEEP 192:sxZ/Rbkp/frsKQZZm2zodpHiFHW6+WNGYbIdvY2YIg5gfJ:sxZ/Kp/frsKOZmNCHbGFhYnuh
TLSH
T10C42C715AE28A97B8CC7D219FA55BF53E3F95432A1905E48A6FCCA1C14E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b795e3b-6e88-4643-853b-ee8a6ca607bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b795e3b-6e88-4643-853b-ee8a6ca607bb.tmp
Size 649B
SHA256 aed25d6738cb3a65c71ca2d68fda148e0ce39b4393b283542d4ec1fd9d4b905c
MD5 7d7bd5c214a2e5a7a5181447e38dc49f
SHA1 43c76adf54aaede45fe678582b8614c92be1e6b2
SHA512 34fbcaf7d3748b51ee17e48dcf1d921031c85c7f6d15b9aa583350aef60072f681bc3d770a1db46e79a685ae4650b64ce86bac66be99191229a1010fa974dbd0
TLSH
T1D8F02DB5CD26BC3B08FC1B2D10A44746F75113572780D88B3B3D810D8FB1A77864681C
MD5 SHA1 SHA512 TLSH

Submit Download

3a309f99-2bf1-4f6b-8b8f-c7f89b2730cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a309f99-2bf1-4f6b-8b8f-c7f89b2730cd.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e6d9ffc-d38c-4ff9-b8a2-c53e1a1f13e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e6d9ffc-d38c-4ff9-b8a2-c53e1a1f13e4.tmp
Size 11KB
SHA256 70492282771df7bbeff245790d2b1ede40846b593c02ab52a6930330007741b5
MD5 5c48a292b0d3894069d4ce42daf2292e
SHA1 7862758c13c182ed1ad670df07cd4b3a62ccb852
SHA512 a638bdc1ad1bafb0d65ca6ab4627e60f8dcfb23cf77a8109b5bbf27b6dd71609e4f21ed26a25059580538d7a2e27289ca2c5ef1d26eb56b60150147a3d1a0ea3
SSDEEP 192:sxZ/Rbkp/frsoQZZm2zodpHiFHW6+WNGYbIavY2YIgjfJ:sxZ/Kp/frsoOZmNCHbGFEYnjh
TLSH
T11542D715AE28A97F8CC7D219FA557F53E3F95032A1945E48A6FCCA1C14E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2c267ad3-511c-4544-ab46-7ebc3c1bdfb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2c267ad3-511c-4544-ab46-7ebc3c1bdfb3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

456596fe-a27c-4109-ab5f-e65f8be41d56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\456596fe-a27c-4109-ab5f-e65f8be41d56.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8728bad6-7ed6-4a1b-9d12-a93302472c5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8728bad6-7ed6-4a1b-9d12-a93302472c5f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e131cb93-726f-4ce0-95ce-470a065e14db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e131cb93-726f-4ce0-95ce-470a065e14db.tmp
Size 1KB
SHA256 3b9752654e6b17d5f8d3cf256b762736c321c6b187c738d934d4cfbfaa61018d
MD5 e01b7256985c70d8a952baf68750bb7d
SHA1 b53d576b1db77bbc4e02ddfbb532f7428ac18adf
SHA512 4285201eb3e64dfc9ce17e8a9d6c42ea4e202a13ac3e0254fc7315896a491c8c78aaaac0e81e56b5c39748bd3e7f2082438c3b4879b4ecb93a1503ede42833eb
TLSH
T1403180F7C3E8866E890156F0AA14AE2BCE1D0954432C7D5AC9D4AF1B93E24B1D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0fd84fdcf2b83d986465ce1872081927fd3907d513614873693319929e7c94fa
MD5 e8f8ec8a9905dacb005a3b06ef554ee5
SHA1 08cdab6670c054d35029b69cc99141fe31fcaae3
SHA512 595a3727ee46d34546e5e4b1d38efd00c28172b8a99bff7e8ac9378a27dbd330c77346bc0e767da163d5b7f664b045fceca4e9b8c102c3de71546107f5a7d8dc
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYH1l:OtfFvpopPxrB4RhfYVl
TLSH
T128B2351471BA121038FE790881B6972F064232733159EA7B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b136177b-52fb-477f-a795-b4cba23362ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b136177b-52fb-477f-a795-b4cba23362ac.tmp
Size 11KB
SHA256 42bfacc33999246c29f38cab8421acb3d4c3d2341dfbca821e500cc2832dd206
MD5 2b9c7200f924f0227c77b64bbf5df750
SHA1 9072de04b2cf89f3990239d36ed0ae32508715f5
SHA512 74b0492d265fd2b187696ede9651e7cffe6613f1e2833a5ec295bd52c0e44d056ebfbf6febdb5830f144d90085b3a855f2bd9f451ac37ad594491cb5520cdf63
SSDEEP 192:sxZ/Rbkp/frsJQZZm2zodpHiFHW6+WNGYbIavY2YIg5gfJ:sxZ/Kp/frsJOZmNCHbGFEYnuh
TLSH
T11942D715AE28A97F8CC7D219FA55BF53E3F95032A1805E48A6FCCA2C14E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9bcf4739f5c9ee87d6ec99ea8be575a06e6a50980ebe481e5a31f8d679c3135f
MD5 c6b3aad302380510657192ecd127c283
SHA1 72ff32c279b6ea440a165b092df4d82e328d8f9a
SHA512 16e84c901c125f971fa3a96a5ae66ebc29935abba7a7e1185ab69e71cf1ad4ec21a0e7557fbb2582bc9fdea4626d7fa41a73dc112f5ee4ff78d41d2192763643
SSDEEP 384:nriFiZcIli/3sN58TUNTUlI4e5mgtSlBeK2fMBWCk/BEOJd5FCVZh6DKhH5gL/70:GFQ4/3AwgGL3BnzS5QfYGHIo
TLSH
T124C25C72EC98DABBECEA8B95B70A3A43DEF04163C68C9AC4D5D85D0D10D719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff089b0c-9d15-48ff-93a7-82b9365fae38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff089b0c-9d15-48ff-93a7-82b9365fae38.tmp
Size 26KB
SHA256 bd56c3739047a294fdbceb90e11e2ba1a133a7db7ed1aca482941c026db06052
MD5 c2873e80a5cb6680c4a87cdeed783e76
SHA1 ab345ff879a7f6c29ff10b7e1325d4f21d250a55
SHA512 d0b662b39a6db969cd721843973669c05d468f761eac554feab75e8291f89f7f384e69ed6851e055c5bca1f259f80c88ece401aebe74a901afa91c4f8d8bd97e
SSDEEP 384:nkiFiZcIU/3sN58TUNTUlI4e5mgtSlBeK2fMBWCk/BEOJdEFCVZh6DKhH5gL/7Iz:/FQU/3AwgGL3BnzSEQfYGHIo
TLSH
T1A2C25B72EC98DAFBECEA8B95A70A3A43DEF04163C68C8AC4D5D95D0D00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5f0ce4f18535f4ad42949600fd6ab9d09791c3fff4ac500dcaaa74a5bc9bee2f
MD5 98ec225856a2e57ce981763d366ac018
SHA1 a1b7ab2db2c54c1122fe6fea327b8ed348e6a517
SHA512 6593da699cd7db4ab6686bce06cd0f8b4d79d5c5c4d483603aae6fcd55fafc1769888da601d92951e35918b460bc18c2ea8613e366412b82e36a42aa5612ae8c
TLSH
T10C410758A6E91148B3B77E96ABF6A86D487EB8772E47D15D10110E8F0673A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download