9b779a7d4f7ca702c05af2a65420e8c346ab42e12b43ecfd3a10b6a532d54f5e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bafkreie3o6nh2t34u4bmawxsuzkcb2gdi2vufyjlipwp2oqqw2stfvkply.html
Size 200KB
Sample261009-pj1adswtet
SHA256 9b779a7d4f7ca702c05af2a65420e8c346ab42e12b43ecfd3a10b6a532d54f5e
MD5 b7b74a621e9da167d6c490a9f6892d7b
SHA1 44cc83aba3728903f36e14063c6595a90acc6358
SHA512 7ae8099557d9df484c6461adcf3977a83bda0d71f3822b388e10ad7f0c126b0d3897628215fb42a18476a9ae835ce3976b8efb78087a05d2c312dc65cf0d07c3
SSDEEP 6144:JK1AetIjNnp8I1IEE2UUSsHwGuUQxqbfpnaOlNbM:JKaXjNnptYpUSnd7qbBnaOlNbM
TLSH
T1ED14538173C1BC9212475B76771BB2E9E52A4CD8B189488EF10CBC90F7BDA12FAD4671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{27C3FD0E-BF49-445E-A373-3D9FD2558A26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 5452	3680	msedge.exe	89
PID 3680 wrote to memory of 1408	3680	msedge.exe	91
PID 3680 wrote to memory of 5976	3680	msedge.exe	92
PID 3680 wrote to memory of 5976	3680	msedge.exe	92
PID 3680 wrote to memory of 5976	3680	msedge.exe	92
PID 3680 wrote to memory of 4384	3680	msedge.exe	93
PID 3680 wrote to memory of 4384	3680	msedge.exe	93
PID 3680 wrote to memory of 1528	3680	msedge.exe	95
PID 3680 wrote to memory of 2476	3680	msedge.exe	94
PID 3680 wrote to memory of 1528	3680	msedge.exe	95
PID 3680 wrote to memory of 1528	3680	msedge.exe	95
PID 3680 wrote to memory of 2476	3680	msedge.exe	94
PID 3680 wrote to memory of 2476	3680	msedge.exe	94
PID 3680 wrote to memory of 1136	3680	msedge.exe	96
PID 3680 wrote to memory of 5828	3680	msedge.exe	97
PID 3680 wrote to memory of 1136	3680	msedge.exe	96
PID 3680 wrote to memory of 1136	3680	msedge.exe	96
PID 3680 wrote to memory of 5828	3680	msedge.exe	97
PID 3680 wrote to memory of 5828	3680	msedge.exe	97
PID 3680 wrote to memory of 4680	3680	msedge.exe	100
PID 3680 wrote to memory of 4644	3680	msedge.exe	99
PID 3680 wrote to memory of 4680	3680	msedge.exe	100
PID 3680 wrote to memory of 4644	3680	msedge.exe	99
PID 3680 wrote to memory of 4184	3680	msedge.exe	102
PID 3680 wrote to memory of 2280	3680	msedge.exe	106
PID 3680 wrote to memory of 2724	3680	msedge.exe	107
PID 3680 wrote to memory of 956	3680	msedge.exe	108
PID 3680 wrote to memory of 4240	3680	msedge.exe	109
PID 3680 wrote to memory of 4240	3680	msedge.exe	109
PID 3680 wrote to memory of 4556	3680	msedge.exe	110
PID 3680 wrote to memory of 4556	3680	msedge.exe	110
PID 3680 wrote to memory of 2916	3680	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bafkreie3o6nh2t34u4bmawxsuzkcb2gdi2vufyjlipwp2oqqw2stfvkply.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ffbfe94c188,0x7ffbfe94c194,0x7ffbfe94c1a0
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,9703669432281544561,13524098766176001062,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11480296752381883121,11690236896493568234,262144 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,17222138136660739772,13134085995206046487,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,6503091895233824474,16719547804168770451,2097152 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,12641360309403793012,13310090463280240417,2097152 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,5318704956379239123,455733206022103426,2097152 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,13196271951606149478,13195351193435132325,2097152 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17554664460009881600,7915055520092132291,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11248646507126750319,9029359458133958518,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,346834617558887224,14935243176513636806,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,346834617558887224,14935243176513636806,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,1567450090240413021,10497204285520637611,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5632427157778554811,4685850687591250423,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,11630230927592077808,5252346832025038591,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,7403183840380375540,4138479844386194049,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,14778383431850626290,4644012785624161528,524288 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,2840799809516124561,15621251163972987161,262144 --field-trial-handle=2664,i,2033060916979171510,9540374161545956561,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64861e7f-bfb7-4b45-be53-3bb6841a6d3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64861e7f-bfb7-4b45-be53-3bb6841a6d3e.tmp
Size 34KB
SHA256 67a3b0f28d2414ddaa4faedcc5436c6d289db9db64132de62a4cba93db3e24e8
MD5 abd2cf8bb99c9e9e5648cd9bb683eeeb
SHA1 f21a11e9b7680957a64d4be96e74a5f1f401c666
SHA512 fb02addf5b8a9c22231b28b6f6afad7d2386ab366f599abd17efb9f20db54dac877011374c0485369f8db9f80b729bf8418096fbb3b7ea57ac5fefdf77524904
SSDEEP 768:bL3WU2f9c/LfOyEMbxyJugQVTJ7vvmeXRzxTT:bL3WLOWyEmxyJJq17vTzd
TLSH
T1E8F2BF31AC748C7358E7C2857646BA43AFF44263A5C91B88D4CDAF1E158B6AD170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e82b96e-d5b0-4d6a-9318-9cc4b35e7c10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e82b96e-d5b0-4d6a-9318-9cc4b35e7c10.tmp
Size 36KB
SHA256 a3d2265c039cfa9e21adcc5b7eccfdf274a6f6a93c156b16e59d4e0265b1b9b4
MD5 d238747e9128cacdb531626e8ee07c32
SHA1 38181c8b6e1d248e07c8f634686843de3aaaf9e6
SHA512 638fd067c6e78ed0e3f8fdfde79d5d4371e994c7ec8b1c93db78ab467207349283b1693d9f5928fbf61483bab4a3b2fbf3da234e761010434effb97c8690085c
SSDEEP 768:tFQ530wgox2f9c/LfRyEMbxyJugQVTJ7vvmeXRzxTT:853n+O5yEmxyJJq17vTzd
TLSH
T16FF2BE329C64CD779DAA8784B64ABA439FF40263D4D56B84D5CDAE0D114B2EC170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9008a96f-26a9-4485-bdc5-ec0ca81b645b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9008a96f-26a9-4485-bdc5-ec0ca81b645b.tmp
Size 37KB
SHA256 2e73f2001bbb8490dca7419aea9b8f349a4edab16f58516f892cc51b79921d19
MD5 45b5997393890521626ca7d042532b2c
SHA1 7264295fcccf101bc2fca9438d009c251bcb9178
SHA512 1be089280181f9027d2b640777e9ce65de9dd35b17e8b632118875f8b223483fa06595675489180e4f986948fff9996d612d8c0238a34640f6fc400df32a2f69
SSDEEP 768:p/UxvxjgC+k3RUf9c/LVyEMbxyJugQVTJ7vvmevEUSHtBk:cZj3+k3IOVyEmxyJJq17vqUSbk
TLSH
T16D03CF35ACA59C7388F793843649E787EFF506A394C62BA885DD6F0D128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fda7d6b-bff0-44af-a7ea-dc9c5904964a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0fda7d6b-bff0-44af-a7ea-dc9c5904964a.tmp
Size 105KB
SHA256 36138979757d4e71ef05f08e5474db36d940b11e0e5038b1bc41edf6d9480864
MD5 1ffead718e2d4a1c853bdde71605a629
SHA1 bec748fbabd1ff5b25bcc88b57845b8ef801ffa3
SHA512 2d9d536f4d1f11cec455a2c5b7bd5485bf92d28d29a4af0c14a218e58f3db936b6de9aa72bdb015a143ce31a5dcdb74cea83b1d9addd898b44e718cacc158e4e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

3d79b667-808f-4961-9ab3-25c4e5d801cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d79b667-808f-4961-9ab3-25c4e5d801cd.tmp
Size 11KB
SHA256 5bb1bbd9aa60a8700bfc87d321fcd56cce7c779e9e21835222c167478ec9e465
MD5 afac1b5594d8bd5320440a0a794107a2
SHA1 66e40300a03b21ed674c4244b7a0b3dfa45e0a10
SHA512 f3f9e8bc6556958425896d965eea1ba19fa0187d2626a2e45eb90ea7f19edb4ab2bf4672baec6078646febc558ba172b86d916ad672a87b8c8b5e607d6214365
SSDEEP 192:sxRYRKbe/f+s+4tzoA8p4f/g6+WNIYF98GtIgD9J:sxRYGe/f+sPgm/5IEL
TLSH
T14432A515AD28A93B8CDBD20DBB56BF53D2F95033B1951E48A6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71dcd6af-61a3-43f4-9161-c26ff4921e75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71dcd6af-61a3-43f4-9161-c26ff4921e75.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8264ad98-c3b3-4e5e-9b29-d1c4a8555023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8264ad98-c3b3-4e5e-9b29-d1c4a8555023.tmp
Size 10KB
SHA256 c58a4bbf47c458071780e89c3b054e441d5a80954ef60f4ba35a3681f06b0568
MD5 24adf06bbf6eba125fdbf3cfe20cdf33
SHA1 19a0cfee13cb885fcb64927a2e300a3d40449ffc
SHA512 72db16be4c1f9bf93e0c1db903dc0a8aac1a9925aedf6dff1bc68d5dc429113325355ed9d33ee03173fd699529d0209194d3ae34a72024d9df3442382c01e5f1
SSDEEP 192:sxRfRKbe/f+s/ptzoA8p4f/g6+WNIYFI8GtIgIJ:sxRfGe/f+sBgm/5Ids
TLSH
T191329415AE28A93B8CCBD25DBB66BF53D2F95032B1951E48B6FC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c54e36c-75f4-4c75-8d6e-c73a6323b125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c54e36c-75f4-4c75-8d6e-c73a6323b125.tmp
Size 23KB
SHA256 940f1b5e052a478121e8b1545a576f3e92ca0f3f63dbfac1ba2d41d343f0bb7d
MD5 0bcfe5e90f61bfa485236b3251508d71
SHA1 23c89336ccc3551040339e346023e210b592d17a
SHA512 06146024996a631bf0b7cec65b6108dbaacefd6fb70f86bc601585b53b47a5a9959492981fda5c52aa738127c3f4220c20708aa1a17b19eddaff5d41dadfd8da
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRncro+PV:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0V1
TLSH
T17FB2D92F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dab309da790487ee5d14d30b076f29422553d3b0b15075c9634b67c623627ba2
MD5 f4021093157ed44e0929ac2a7ea1a738
SHA1 a20de5086a37e61fc08c2281341c98a102f783b8
SHA512 b979d1459a0f4936311da9c0078034d534e40c987266393241569aa606250907bc06dc47e5e0e03a9daafb1d7b63a35c9eb921ab9ed734e8b42f9b1c29cc5a3d
TLSH
T188E020E985CCC62F534C64471378AB5C87C0365F9BD0A95E2704C5D4744594467C19A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 48bbdec5a29e0ec545cd77b541d66ad543302034eceede3fafa7aed0a4c2131a
MD5 75d601201c7e8017f8fda6e479bf7ef8
SHA1 68aeffb94bd3240da416ad98f0441a9c728eb41c
SHA512 e7a7ef17c96f22c08d22029dc8a5236001ae75e59d9ecb1967664907e9cecf8bcad04aa3e7d14df81ebd4295882da835698bcf252f052cc88b5c21c6f5201499
TLSH
T1245175455F649072F75E00B089ECFD8B3734A681548F1F0FB559C4FAABDE3E94266045
MD5 SHA1 SHA512 TLSH

Submit Download

bb12a286-02e0-4448-903b-e40a66ff6fa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bb12a286-02e0-4448-903b-e40a66ff6fa1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9b094160-6741-4262-b6fc-39e151bfb7cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9b094160-6741-4262-b6fc-39e151bfb7cf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de060264d81e3470232b51cd7e4979b35bf932f34d6ee93b716a66591f5703f3
MD5 82591a88e42179d6a0db5c3826d2169d
SHA1 5806561a97c1f37dcbcce0090fed2b0e31f14783
SHA512 db38f0f993201a7145d3ef1922f14a72c9a810acede64f7fee9caee63f85c98f2c3ac69782a6d55a5bf749335ae3b96a24dd7dde1ace993d0b5cb75a135dc54b
TLSH
T14F51CDF7C3E8873E891156F0AB147E2BDE1D0916522C3D5A88E4AE1FA3F24B1D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

f9767b84-7466-400a-8f5f-6bec6f0362b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9767b84-7466-400a-8f5f-6bec6f0362b5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bc0ee1b34dae0fd40e31c3912781ad410c179348e4b4638c18f3bd53d2c1e323
MD5 453d50f4f998240577596c5934023285
SHA1 dd64b506b1611d045f4fb41f98237de9d44fa7cb
SHA512 2aece693d7eea514ae800638050a54d669750d207c998e5e3d213183f971c54efceb38171a7dd8368aba7d5c2e395b818b33a91ecb0ac52c2d629aae231f1aec
SSDEEP 96:K8gwKBK+2FaKOIHwv2qIaGrn2NapyrKBSp0rdw4leGYu:izdTNu
TLSH
T13991C852B23B06803A7E7A4C92A9965F574131F3341CAA6B3BD951614F6FE048CFE8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d8bc1d6e-86a2-4a4a-84f2-a565e0f960cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8bc1d6e-86a2-4a4a-84f2-a565e0f960cf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8a7538c-928f-4b01-b5bc-5211c4a36f6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8a7538c-928f-4b01-b5bc-5211c4a36f6c.tmp
Size 10KB
SHA256 fd5d12df5da5cc0441a9a232e434e6eabc8dcdd1c0ea0690cd67822045261ee2
MD5 ea39b0577248bdaeed654dda5a9e8d1f
SHA1 ea97e9b592078898b5365ad43cc909b91ff88fe9
SHA512 262a75576d42d97118430be7e32054b60ea01f250e24839eb1422346a7f2423fae3117f2f54a07db0e8577491333156d98a2dcc310e5c9e37a7229a67b5cf7c7
SSDEEP 192:sxRYRKbe/f+s+ptzoA8p4f/g6+WNIYFI8GtIgDrJ:sxRYGe/f+s2gm/5Idh
TLSH
T1A932A515AE28A93B8CDBD21DBB56BF53D2F95032B1951E48B6FC861C08E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75911a56-8290-469d-8ed7-9f0866f76d12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75911a56-8290-469d-8ed7-9f0866f76d12.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c02e41f6-9eae-4780-8d2e-c18f9fc4aaca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c02e41f6-9eae-4780-8d2e-c18f9fc4aaca.tmp
Size 34KB
SHA256 4b960fe5d4b587afe8a470044573a47893939cc2409bb0fbfe68ad488caa0f5c
MD5 013cd7f0b00e3cb29536cc70660c46d9
SHA1 defc8a456f22e229d1ba5b30b469ea7565d64bb6
SHA512 a38878459dcf947032dad4a45a22f78225ca9cf437de93f19f4ea561a2ccbd7e16552484c9ea0c14f13f617c08432c40404acd162e6bac6df589caaf3d45d2b1
SSDEEP 768:mL3Jx2f9c/LfOyEMbxyJugQVTJ7vvmeXRzxTT:mL3J+OWyEmxyJJq17vTzd
TLSH
T1E8F2BF31AC74CC7358E6C2857646BA43AFF44263E5C91B88D4DDAF1E058B6ED170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85a624a2-e525-413e-afb1-ff01adb0a338.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85a624a2-e525-413e-afb1-ff01adb0a338.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download