29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b

Analysis

max time kernel
898s
max time network
733s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/10/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/index.html
Size 27KB
Sample261011-m3jqmsgf45
SHA256 29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b
MD5 5ad4f3206b65b951bc79e710f4eeb3f8
SHA1 2a5b2ffb50e02adca04949199a10ec101eafe866
SHA512 ad6c0b47c7b407305859ccb45bff14d734ab4aedf08bbde9361cb1a32cb9b8a617b2c90723d669fc7c8f8a297e7c861d9d2abc4cbaad16807bd7d761d34cad24
SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnEF+ggevsu5SwU:z5XX/seq06IfLglbyMai5nw0u0wU
TLSH
T132C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{C2328660-FBF2-41B2-8425-899A7851EC78}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3936	3400	msedge.exe	83
PID 3400 wrote to memory of 1060	3400	msedge.exe	84
PID 3400 wrote to memory of 656	3400	msedge.exe	85
PID 3400 wrote to memory of 656	3400	msedge.exe	85
PID 3400 wrote to memory of 656	3400	msedge.exe	85
PID 3400 wrote to memory of 3744	3400	msedge.exe	86
PID 3400 wrote to memory of 3744	3400	msedge.exe	86
PID 3400 wrote to memory of 4848	3400	msedge.exe	88
PID 3400 wrote to memory of 4848	3400	msedge.exe	88
PID 3400 wrote to memory of 4848	3400	msedge.exe	88
PID 3400 wrote to memory of 1192	3400	msedge.exe	89
PID 3400 wrote to memory of 1192	3400	msedge.exe	89
PID 3400 wrote to memory of 1192	3400	msedge.exe	89
PID 3400 wrote to memory of 2128	3400	msedge.exe	91
PID 3400 wrote to memory of 2128	3400	msedge.exe	91
PID 3400 wrote to memory of 1148	3400	msedge.exe	92
PID 3400 wrote to memory of 1148	3400	msedge.exe	92
PID 3400 wrote to memory of 2208	3400	msedge.exe	93
PID 3400 wrote to memory of 1020	3400	msedge.exe	95
PID 2208 wrote to memory of 3248	2208	msedge.exe	96
PID 3400 wrote to memory of 960	3400	msedge.exe	99
PID 3400 wrote to memory of 3820	3400	msedge.exe	100
PID 3400 wrote to memory of 4756	3400	msedge.exe	101
PID 3400 wrote to memory of 5672	3400	msedge.exe	109
PID 3400 wrote to memory of 5672	3400	msedge.exe	109
PID 3400 wrote to memory of 4864	3400	msedge.exe	113
PID 3400 wrote to memory of 5528	3400	msedge.exe	114
PID 3400 wrote to memory of 5528	3400	msedge.exe	114
PID 3400 wrote to memory of 4336	3400	msedge.exe	115
PID 3400 wrote to memory of 4336	3400	msedge.exe	115
PID 3400 wrote to memory of 4388	3400	msedge.exe	116
PID 3400 wrote to memory of 4388	3400	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb8308c188,0x7ffb8308c194,0x7ffb8308c1a0
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3335183935311155924,16004245975389307532,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,15976047031211771914,17911593329653538251,262144 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,10376171521531705831,1517956929887460378,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1072388470486369606,9077316355631202407,2097152 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,4629557658655247824,14791240763126279591,2097152 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,2704212253378079143,7255209108097638984,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,17682584998275040997,14266454379199965222,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,11276491378693579871,12636954112254555666,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,1220090360003665435,3456735326888789536,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,1220090360003665435,3456735326888789536,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,5193755220654339420,2725138353992862543,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10248409513682312196,10383147014874974575,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16801162700439697943,18359997633450595665,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,15120944838781487010,12533260870116388540,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,11975451329160130344,15974680644077728994,262144 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,5979428998273768629,10114542313901571594,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14304581502837070267,1506495339530890479,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,957301776512994168,3920417997900226,524288 --field-trial-handle=2188,i,15386562339439578431,8242244675304324602,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:14
  2⤵
  PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f3f23c7-4208-49e4-8247-4a2baa567e91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f3f23c7-4208-49e4-8247-4a2baa567e91.tmp
Size 27KB
SHA256 4a9675947cf4f33a242584bd8229325e8ff629d7e44bd9e87e13c044cb84ce8d
MD5 91f7c695bd78405c41320477a177176f
SHA1 2fd041b1212467d0055ae78b3195686f9082ebc5
SHA512 52a2fae822dfd9fd0e0367ad12a8af9733845a2578633c63c1386cfa120d01e935c82f2d482d782ae03efdab3a2980c9d167b138386b0c8780640fde068a923f
SSDEEP 384:nciFiZcIV38NN8TUNTUlIRXwqqsCOPbzWfg9Anf119Eiqf7822GfgL/7Izn:HFQV3ewgyqHx9Wiix22W
TLSH
T1E2C24B32DC64CABBECEB8ED9A78A7602DEE04113999C9AD4E9DC5C1D00E71DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4333ac81-7ae9-4831-abd4-5fd0a212d8cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4333ac81-7ae9-4831-abd4-5fd0a212d8cc.tmp
Size 27KB
SHA256 c2bbda86c2fa56e8ab01b113c5460e0f2c4db990129e1ea1cfdd5b9eff7fa5ef
MD5 0328997c71b68a83f0ee89c2c7eaa26e
SHA1 f78453bdd50a22751083eec4727193d0420dcee0
SHA512 85b271502ab42d0bfc92dc301ebda804e58601ea44509678e1931607cf01fdd76bdd098882f7eb48ae8b11525fd01cecbe6c29ced2aafdf78dd475b87cf51e5d
SSDEEP 384:nDiFFZcI938NN8TUNTUlIRDwqq1COPbzWfg9Anf119Eiqf78/2GfgL/7Izn:uF993ewgylHx9Wiix/2W
TLSH
T144C23B36DC64CABBECEB8ED5A78A7602DEE04113999C9AD4E9DC5C1D00E71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91344912-b876-4ef2-950d-3cb9552a3218.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91344912-b876-4ef2-950d-3cb9552a3218.tmp
Size 27KB
SHA256 db366bcdaacad404d8f509e8cb1c94fad20ecbe1ca87f09f319ff72de55f4e3c
MD5 20be97ebe64be36f3af0b139075003ad
SHA1 5185ed18924040685d16903d4090916c7fb87a7d
SHA512 ee3c53123e5b94d6b2d93c211f06b2ecc1db3fdbb4f43f8f0679489fa26f80c4af58b35517ca7bf76b93ffc19f8ea086d751a774bd3c466c72df985b40551a52
SSDEEP 384:nciFFZcIT38NN8TUNTUlIRDwqq1COPbzWfg9Anf119Eiqf7822GfgL/7Izn:HF9T3ewgylHx9Wiix22W
TLSH
T170C24B32DC64CAB7ECEB8ED9A78A7606DEE04113999C9AD4E5DC5C1D00A71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bbca96e-ace1-41ec-a516-0bf1acfcfad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bbca96e-ace1-41ec-a516-0bf1acfcfad9.tmp
Size 25KB
SHA256 d6646606fb9b2144053b1e9603e291cfaf89bf2ed262d20d12f6fdbcfe16e234
MD5 4bbc599f5390d7d869486e83371847c8
SHA1 d7558132c62ca7ccaaf217feca9efa7e1136b0cd
SHA512 a74f1b307a6e99cc445dd4da011205d6c08b48ed0994eb9d1c2ac5557931be651779a1df7f56d018201780b7319c1eecf10ab1b35a0fa0327b5ebf5a70758154
SSDEEP 384:nUiFiZcI638NC8TUNTUlIxBwqBlPgbzWfg9Anf119EoF7O6R2FeorgL/7IzPoS:vFQ63dwgwqPEx9WioF7TRmJ
TLSH
T1C7C24A36ECA4C9BBECFA8EDAA74A7A07DEE00153849C8AD4D9D85D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

3b7fc4b3-eaff-4e3c-bd48-8478566850ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b7fc4b3-eaff-4e3c-bd48-8478566850ec.tmp
Size 11KB
SHA256 6c114859ef301b701a765f147e2f04b32b67f159da93357c8c20994171e5938e
MD5 8acdf480279e76721e82e2158ffd0661
SHA1 366706b4d299818f298482c614186d844bcd03a4
SHA512 e9ee1a8e9fa30a24ced0081e6eebab30eff61c77c960073a46c5794257e2a96b079cbbb4f5f753d6d74909c7a26d73e86e96c4f648874edae51dfe15c914ecbf
SSDEEP 192:sxZ9jfR+kFOn/fuUsOhqNUozodpE9x/W6+WNGY0YXMyS8QKMIg5MgJ:sxZdTg/fdskZ2/bG5I6eE
TLSH
T1CA42D915AE28693F8CC7E619BA55BF53E7F95032A1901E48E6FC8E1C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9003b8ce-c434-4222-b77b-ca1914e97cdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9003b8ce-c434-4222-b77b-ca1914e97cdf.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99f10fce-be52-40b7-b90b-99849fb8b208.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99f10fce-be52-40b7-b90b-99849fb8b208.tmp
Size 11KB
SHA256 5cce4e6b52428e23a3a085fbb66ced5f29f5fa2dd8e34ec96ad65c53d746624c
MD5 55d2fb4ccc59f10ba54e3c012604703f
SHA1 0c27fb04d2a86b74ee6b65f7d9c125a36abab837
SHA512 32833d6afeee80a7b0b30722d2cb5c91fb7bad7ed321ed5d560bd430e131120136b73ba4470ed6ceffa390ad5df2f4e86996c09cc79c09eea81356589aea10c2
SSDEEP 192:sxZ9jfR+kFOn/fuUsOkqNUozodpE9x/W6+WNGY0YX5yS8QKMIg5MgJ:sxZdTg/fdsRZ2/bG5IDeE
TLSH
T1B642D915AE28A93F8CC7E619BA55BF53E7F95032A1901E48E6FC8E1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 c7570772f78d2fd060292ba8e923b0ec34c0785c95390e3df9e92bb811e9db6c
MD5 70794f4565d9dd596746d77a15c592db
SHA1 96f10d3bdb730205c6c4ba367eaf6dc5c053b4d7
SHA512 80c97de680249e65c0dbbd5f42014b581c417687cecb98f11f8a4f046554fca20d4b807c520394794bfc601a39dbf957c2ded7b2766b7e36cd17cf71abff2c61
TLSH
T13DE020D858C5C31FF31C78870394A74EC784261A92C3AB0D3740C98570455C5E2C1974
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 1b4b16fc544a4fd89951100b807072134669c8fdb78c1a186bac3377f962c83d
MD5 fffe15e8a83e6f0a2781eba221b61d3f
SHA1 96b2dd0af7de235b798cc645d63d2c56e7f609ce
SHA512 417c5436042ee45433f75c6e8e8d1f76e4d51e65f19005b381e88ffb4a351f220e1720abb9b3c69dc54d0b9122dd0167ee8f189845af87e9578857f26cde1e07
TLSH
T150E026F445C8C22FB34CB8C70278634CCB80361E92C27A1F3784C985B186A80A2C26A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 85ffa09953d6cc3edf29c0bdfa3c83dc738b21857e33d222ca3f6166ce86c4d6
MD5 5c79f8fc6a9406edb1fd4cffc5480b60
SHA1 c5fb9f5ca82f5a90a9e77b6b0aca3d2fa93749cc
SHA512 8453a46a22e72a48d50a81a9a719905f690c4c31d205b61374f10fe08916c506cb9fbc0993fcbb26fbb39a3e08ea9afe19973c70e7020578e5e791318201fa94
TLSH
T152E026C855C9C22EA3887A8B4368670CCB8026AE92E1692F1B84C5887086A40F3836A0
MD5 SHA1 SHA512 TLSH

Submit Download

231ed281-056a-4a81-ab22-9bc5ac5aa345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\231ed281-056a-4a81-ab22-9bc5ac5aa345.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8eb06ce7-dcc4-4118-ad3a-33f571c2dcce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8eb06ce7-dcc4-4118-ad3a-33f571c2dcce.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9445e781-7567-4152-82f8-ec5743f4dce8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9445e781-7567-4152-82f8-ec5743f4dce8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b6228349-f21b-431b-8f99-3f1d037faa15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6228349-f21b-431b-8f99-3f1d037faa15.tmp
Size 2KB
SHA256 11e748ff618141452deaca54f4b32152ce9c606dfe9dd0365d64f83446dce9ee
MD5 61b37b1aafdbfe74b52cc13624f25e6d
SHA1 2faa94265046ea171c9b7490b3b197dc60d41e83
SHA512 2df42242284066781db304ac87d3dd310db36a3951f20164ddb9a321b1fde8dd15baa73ee0545bcb63eab84f13ea4ea23dadc39fe01eae28029a2b04f0e240bf
TLSH
T15F4181F7C3E8867E890196F0AA14AE2BCE2D0915532C3D5AC9E4AF1B93E34B1E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

e742bad2-7082-484c-9209-7c7843e8fdfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e742bad2-7082-484c-9209-7c7843e8fdfd.tmp
Size 356B
SHA256 543439d688cde578b0ae4f58a10d2ea549062b8ca7b5585c5f245a2d0b9e3a52
MD5 687c7cbe56c5ea190a491be37427178a
SHA1 eb5477f51787c2423c3bca6a4ca5c466bf48249a
SHA512 a6781c438bcf4168f1c92efbcf33372bb1a45eb88f8899ec30a8e0b9aedb6d826d10920168bf0df3b3592507be41b0ebf6f793a2b64540fcb87c0810bdda17b8
TLSH
T134E0D89640BAF173102ECD760D547885A7799134226054A5DAD753BCA0C16F77B15039
MD5 SHA1 SHA512 TLSH

Submit Download

fc36f5b1-bd10-4d0a-aa21-0284b4775db0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc36f5b1-bd10-4d0a-aa21-0284b4775db0.tmp
Size 2KB
SHA256 63e9bec90522a0c4eef35a3c7a7b64ed3e21674283d0c03e2221570d812c9210
MD5 45f072580ae66db8381af6c15f543f90
SHA1 6df02e70e09e48c0c9cd53a0efc27a4a475dd143
SHA512 59e36199cadac5b793159d3eda7c6d86d915d07f654b089c9079a6be3ecec59eebc3db448b430b70c05cb1c4b6babc9d77d1b966d41cf948f4e98cd05e5d8465
TLSH
T14C41B2F7C3E8866E890156F0AA14BE1BCE1D0915532C3C5AC8E4AF1B93E34B1D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a40b7d67-d5c1-4c6e-9176-8bd1bcb26fe3\index-dir\temp-index
Size 1KB
SHA256 68aaf84691d5954d2c0d0bb8a2ded385f0496e3072b2c72265fefb4694eb2cf2
MD5 946a4f0d1f15a5b43f90563e18350f72
SHA1 c4b6bd2edd1d49a2a7952b307d0ec6a437d362ce
SHA512 c9072896c2854473584e67190b89c735c4e68bcba9a5a0596639075db57a84bb1fbb7dacee4845e5c7f7e779dbb34a94b3ccfbf81ede2895b2e5400e3b0dc31d
TLSH
T19C31984A5E424AE7FD905174143D186E2334E2CC17403A1F45BDA036FC97B106D465BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a40b7d67-d5c1-4c6e-9176-8bd1bcb26fe3\index-dir\the-real-index
Size 1KB
SHA256 cb3f59d981007ea651b8dcc743551300816c6541a0ddb4c107af3423a32b851c
MD5 264c3c98db50a1e9d2b409bc90b12822
SHA1 9f7bd63d92866dbf88ff68375b6d33c413fd91ab
SHA512 7d34eacde04b61f51a42bd068b1637606c5c9ab0819d240badbad4e62d9ec187d274322410e2bea3482353abb6a6f1ef9ec958d3e3961f84da35c53eea4eff61
TLSH
T16331A71744424B27EC4412750DAD5457333AE18803443B0F92E6E035FCC1B646D9AEA4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 279cf076da423c240adeb0b5bd25b20898fa96cdfb6685119c94762ce4d45fff
MD5 d842b640e68199ab96bd6770863f276f
SHA1 7ee9a87df70f8823ad7730ec087a4a62eb3dd3bf
SHA512 a2feea71c39d680af1edf6160c49d2a83e31440808aecda5d67af82b507046f419367d8583cf2306d197cc47fc3f3e9ddf30227cee4d027d7633cf7ce2635655
TLSH
T187E0C0F32DF31914AC9FD7DA14305A500141F955C841FD0F4026D7CB50B13143446C72
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 81b2136b9fdeb317cd55d1785d0b4d1051987efe92165b3332f2ba421fabc3c1
MD5 47388fa8fb9263434e522b6af61ab312
SHA1 fedde13c994a9b0188785c079793bdab1c59c4c9
SHA512 aef0f533e1b45577bb59556464b9d204f4dfb461f3baac37f02cf3958a786bb5ee283c4cd9319a50ccffde50e63dfa89e9ff0504da9277a3078a84a56d9fa6ad
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21WN:ir/+SvIrlfrljh9DdgslV9rnWVFw
TLSH
T1E6B2541571BA12453CBE291881B5972F128235B33119EA2F7FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cd3a5789-80b8-463a-98ad-041b2827725b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd3a5789-80b8-463a-98ad-041b2827725b.tmp
Size 414B
SHA256 27d66513095c1b65517aca4ddb7500a29fd1d07579d2c4a2f9ee9e006c92d003
MD5 6d12c41a5210090d576b850efce6b36f
SHA1 01752ecce5553ec6aac2d502532cf70bc20048ee
SHA512 aaaff34b6d561f1c38a4e050ee9e657bd406a161581709cf2550f38ea569fb4d161828a6177293893cb352e7123b081ae2d4d25c4886e401a8161c13f879d9d7
TLSH
T1ADE02BAAC821ED370DFC4F68A5904785DB51236B3A40890F3A3C910DCFB1626529AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

e7417208-40cf-454b-84ec-8e3072921c65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7417208-40cf-454b-84ec-8e3072921c65.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ed5f8638-7ab2-443d-b32d-0003b8bf495f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed5f8638-7ab2-443d-b32d-0003b8bf495f.tmp
Size 11KB
SHA256 ba42215fb0a46cb72fabbc9a547c4decc864bccdb62a0acddf737af85a24199d
MD5 df92a43d83d1ffcde533b5d8fb65f017
SHA1 8ceac2805a9440dddfe2027c05187362237c86b8
SHA512 0d280c5efa006564467c4d8d2ebafc98254a111216267933d48fdc2ba0f1a1fcbe685d23dbc1c55ca643576ae52102e8ecd4919f24321dc95de64d58d823194c
SSDEEP 192:sxZ9jfR+kFOn/fuUsjqNUozodpE9x/W6+WNGY0YX3yS8QKMIgjgJ:sxZdTg/fdsjZ2/bG5IFjE
TLSH
T1C242D7156E28A93F8CC7E619BA55BF53E7F95032A1901E48E6FC8E1C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6db0dc5-e997-4dc8-ab49-f0e93eb1e2d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6db0dc5-e997-4dc8-ab49-f0e93eb1e2d6.tmp
Size 27KB
SHA256 e0e11c3ee3c1b0f70c79a4dec205d641d8e581dc088e388db94f5818b337b3e6
MD5 7cb96386b0852c411ca6d319ef168b02
SHA1 d12d427f30ca11820f91de0b7ba13610ecd33d0a
SHA512 032b4888cb7f5f15de772575de8247d5a874fc7d96e148eed9d4126f955b4a999c86f089dd73a961c421d8256cf66c8a0d3cadfb8a518abd0474b6c421c42165
SSDEEP 384:nKiFFZcIT38NN8TUNTUlIRDwqq1COPbzWfg9Anf119Eiqf7822GfgL/7Izn:BF9T3ewgylHx9Wiix22W
TLSH
T1E2C24B32DC64CABBECEB8ED9A78A7602DEE04113999C9AD4E5DC5D1D00A71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-200-0x0000017F52460000-0x0000017F53460000-memory.dmp

Download