5887576619d16d5ede7fae0c4373e90575e87ca82c07e245d196df4c1cb52888

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUATRIFARMA.html
Size 1KB
Sample261011-w4793avybs
SHA256 5887576619d16d5ede7fae0c4373e90575e87ca82c07e245d196df4c1cb52888
MD5 bff6d8907887c5c9f1f55171e9ceb4b6
SHA1 dfde25c8266abc626194a441ed9e62deced1252d
SHA512 1c3f395d92b418912f63a175407680a46bed1199f9f17801dea1727d780a28604f6efecd9777e006b705c63e0b394b7e96f7068b1f9fd20751cfcfb1cc1a7ed8
TLSH
T12A415BDF894B48A67020B139B8E1BE17040AB58F5BF9D8A0B483E857CDC97CCC853E18
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{1CB418BF-3FF8-4950-8193-D86FA02DACB1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4168	2792	msedge.exe	90
PID 2792 wrote to memory of 2508	2792	msedge.exe	92
PID 2792 wrote to memory of 1124	2792	msedge.exe	93
PID 2792 wrote to memory of 1124	2792	msedge.exe	93
PID 2792 wrote to memory of 1124	2792	msedge.exe	93
PID 2792 wrote to memory of 4908	2792	msedge.exe	94
PID 2792 wrote to memory of 4908	2792	msedge.exe	94
PID 2792 wrote to memory of 2936	2792	msedge.exe	95
PID 2792 wrote to memory of 2936	2792	msedge.exe	95
PID 2792 wrote to memory of 2936	2792	msedge.exe	95
PID 2792 wrote to memory of 3604	2792	msedge.exe	96
PID 2792 wrote to memory of 3604	2792	msedge.exe	96
PID 2792 wrote to memory of 3604	2792	msedge.exe	96
PID 2792 wrote to memory of 4712	2792	msedge.exe	97
PID 2792 wrote to memory of 4712	2792	msedge.exe	97
PID 2792 wrote to memory of 4712	2792	msedge.exe	97
PID 2792 wrote to memory of 5736	2792	msedge.exe	98
PID 2792 wrote to memory of 5736	2792	msedge.exe	98
PID 2792 wrote to memory of 5736	2792	msedge.exe	98
PID 2792 wrote to memory of 6132	2792	msedge.exe	100
PID 2792 wrote to memory of 6132	2792	msedge.exe	100
PID 2792 wrote to memory of 620	2792	msedge.exe	101
PID 2792 wrote to memory of 620	2792	msedge.exe	101
PID 2792 wrote to memory of 2896	2792	msedge.exe	103
PID 2792 wrote to memory of 6080	2792	msedge.exe	107
PID 2792 wrote to memory of 3436	2792	msedge.exe	108
PID 2792 wrote to memory of 1800	2792	msedge.exe	109
PID 2792 wrote to memory of 1780	2792	msedge.exe	110
PID 2792 wrote to memory of 1780	2792	msedge.exe	110
PID 2792 wrote to memory of 2128	2792	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\QUATRIFARMA.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2c8,0x7ffdd5f8c188,0x7ffdd5f8c194,0x7ffdd5f8c1a0
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9235751089221441620,7521122700558524975,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5333150231260232913,8005857641817411857,262144 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,14276414656267858040,10253645005701289494,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,925441093119608907,14267745300983124813,2097152 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4992786165327376999,6850041767049655688,2097152 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,15719845696577902679,9874497895428997545,2097152 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,4221563943288458818,15975069651178734758,2097152 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4711488555880287153,8430621193613251960,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,5942267340040653899,14738888208882041490,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5698712061276549198,8921401614442186780,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5698712061276549198,8921401614442186780,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,12675796433064006674,17938267541197336447,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,18256564323437032963,5097491777037550009,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2756,i,5166623906526046843,9918909579923059181,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,1666546797494997293,6046026587362055716,524288 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,10058816619993507085,6873375374492710534,262144 --field-trial-handle=3012,i,7652860663931212482,2267161594111395028,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7660876c-2d50-4c91-96ae-4e8af03e75c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7660876c-2d50-4c91-96ae-4e8af03e75c0.tmp
Size 36KB
SHA256 18003897d4a98a59df7243b8ecfc70b516e58a568d33dc660415fa3f335b19ff
MD5 aab96e52f2de71e348d3710e8a6a19a8
SHA1 41a146cd560ac49b5cb8abdb89a747840be845bc
SHA512 084d491071a0badc5e89bbe98788577d0751c46f322e4f0a28c6cfc0229dcf2da1e26f7acad21f1599ae25952a40b66128301b896e14d72b5c7b94debf8c9966
SSDEEP 768:kFQD3dwg6hKnJOtcxDc9bsMSJz/Fn/KxTt:HD3Z9VQbs7JTUD
TLSH
T196F2BF739C9089A7DDEBAFC0B99A7612AFF44153D9C96954E6CEAD0C01872EC1307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7941239c-84de-4a80-ae62-731d7e7ce184.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7941239c-84de-4a80-ae62-731d7e7ce184.tmp
Size 37KB
SHA256 9d8812fa83c3beba727ab700b5f0a48ac0945b46b840610bd1a9558adc7bccbf
MD5 d541e1dbcf8add419a5dcc87f78465c9
SHA1 105628f1219a4e71e32cdae6b4a9b58f01120b74
SHA512 fe341ecc92c971a1362beeb4249fa2a234acd398e1e865e6e2a5793a02ce84746317c7b05c358a63240838e87a50f033a6eefb9aaedfda6381dded9960596298
SSDEEP 768:z/UxvxjgC+U3S9KnJFxDc9bsMSJz/FnnvSHXPyK/:GZj3+U3RDVQbs7JTVSb/
TLSH
T1B003C03AEC9058A7CDE767803A8AA657BFF44953C9C529A449DD6E0D07CB3AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8177602a-6de1-4854-8f1b-e85b9d7027c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8177602a-6de1-4854-8f1b-e85b9d7027c9.tmp
Size 34KB
SHA256 35336b7addb8e431cbea4b61f502a07e9c761dfe603d14fb310de37df2f48859
MD5 9b23c260fadeba6e468b30983003c200
SHA1 fa52b944a89999185de258ccb1141be3ba98f040
SHA512 81c375b01ec5c856a3dde3264f8b408eafa5ca06f682290f3bfb1a2eb2c7738581a8633e9b1e25f27a855a1dece345a69b5081049a5ef395fc105eb4f30afb47
SSDEEP 384:ZZcID38NCnfD+JjV91199fw7DJOtgzdvLcN9YkWwJJhoMSboCzfnFLj/KxTz8Llm:xD3AhKnJOtgxDc9bsMSJz/Fn/KxTt
TLSH
T164F2CFB2ACA059A3CDD7ABC0798676577FF48513DACC294495DEAE0D02C72ED1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

0d39ee67-31ad-49f4-869d-62156878aa6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d39ee67-31ad-49f4-869d-62156878aa6d.tmp
Size 10KB
SHA256 dfd15524653fd52846d35dfb6611dd665f4b86405439dff8b0f8ba34ff99f205
MD5 5d6623855cd76abfa519153966d56c7d
SHA1 65bd338a4da79c181864fb7714fe9f96fc4b3f23
SHA512 ce94b2971853852a12f13e18063281c53a36b281a4ea8dd7a9a13ba0a360885a7136ab7275fdd5f8e4b5cd1fd5780f212070af7b8ed97e94827002585fe3e9b5
SSDEEP 192:sxRhRMbv/fZsSozoA8p43/g6+WNIYtfRG7IgIJ:sxRhMv/fZsSxu/5Ixs
TLSH
T1E3228515AE68A93B8CC7E31DFB65BF53D6F9103260952E48B6FC861C14E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

146b18c1-3469-40d0-9027-76ed779e66fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\146b18c1-3469-40d0-9027-76ed779e66fc.tmp
Size 10KB
SHA256 26ae9a51244081db4ddbed773bc33b5b85f541c8c34e0a666f5e7340de76a40d
MD5 2c2d9bbaf5362781c9ea4df9ba8b88b4
SHA1 f5c7c19709afa7acee0140e2d6e232223f47f23c
SHA512 a53a0659c2f8d93901f9b27218aa81708e5d2bb89f43b95e6a2f9d036853444b2e132fc0e5cc438541a858886aca557c20345a0f3949b4fdc4b520d8d7fc41dd
SSDEEP 192:sxRORMbv/fZsqozoA8p43/g6+WNIYtfRG7IgDjJ:sxROMv/fZsqxu/5IxZ
TLSH
T1FC32A715AD68A93B8CC7E31DFB657F53D6F91032A0952E48B6FC861C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f7bad7b-88e1-424f-9b0e-70e1b1ff7609.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f7bad7b-88e1-424f-9b0e-70e1b1ff7609.tmp
Size 23KB
SHA256 dcc648cfddd7adb0190f58087ae9933bd43917de2ff3c55a40a263463e0290d5
MD5 efccb6733b6195dea2fb9f45cb61ba77
SHA1 3f742f062bb6ef9b7ffb73becd7562248fb3cca1
SHA512 39dac31aae17ec9027df798a294c713b15934ec365e1d0300f1cd69f01f79ef6c652ef4fe706f5bd70c6e14794903277a76f1d6d3e172feb1f9ae11a47ba3116
SSDEEP 384:dFIGx9efCtgmkFfk6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6W9G+RhDromLK:dmGx9sWgmMfk68F1+UoAYDCx9Tuqh0VH
TLSH
T17CB2DA3B644CCB7E9FC00A9DAD196F9B6D9802C79A548D4047FE984C03C77EB912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4247664b-c4ac-49e5-9aee-e1eb95545dd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4247664b-c4ac-49e5-9aee-e1eb95545dd6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7c889449-741c-4e8a-a57d-d05640df588f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c889449-741c-4e8a-a57d-d05640df588f.tmp
Size 10KB
SHA256 aa075e590f3711fc2fd84f3f4f2f2446dff742dc4ea06249081ac0ba8de881dc
MD5 af7eb0e3fd1e3bf5fc1f52686eaaa4da
SHA1 f39c5df30d249166e67cc258b7abce7f8ed55fd8
SHA512 7f37308e5e742039b587a1cf6699574a6af8ed159e59ebaf5965e4d9b857690cf04f41af02dbba5829b21f6a2fa8ffa13d127a348f03a43dadc0740d9e479eb2
SSDEEP 192:sxRORMbv/fZsVozoA8p43/g6+WNIYt8RG7IgDlJ:sxROMv/fZsVxu/5Iqz
TLSH
T11A32A715AD68A93B9CCBE30DFB657F53D2F95032A0952E48B6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3631ae282571e3ef28dc2c4212528f88cb882958cffd1f069935311ae54ed594
MD5 aae7c8aa4a90109c6e89befae423edc5
SHA1 b747f6dc7a3953f58e27efbfec79f1aff5f837ba
SHA512 b86888ff27b9c25a43846880eb2afb8085dd59748ab39e53685542de2ddcf9aad9958850a314cb3a599cfe43b3bf5922b2fd81ada0ea9021783ce5b4741a2769
TLSH
T1E0619342D172428CF7EA447E8DC16CD73B30E68098830E71B5E8C97AEE82369D9D606C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 148bf5601053142973d344a4f5788a7824db0ae7aaa767570417ba0796849ebd
MD5 68abcc5761f4aa103f6f317b24d47c1c
SHA1 7f508cd231ab962572b143af9afd63e9522925f4
SHA512 cd7ac1d3601f619674947eeda8c5d2133c9848e80a3b7b66322c7cbfaba6ec0a6cc5d3382e0f9337d753876719259950496dce346fc9ee4b542501d51737765b
TLSH
T1AE619342D572429CF7EA447E8DC06CD73B30E68098830E71B5E8C97AEE82329D9D606C
MD5 SHA1 SHA512 TLSH

Submit Download

653536d7-0db0-4572-ae89-b2e39a05a636.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\653536d7-0db0-4572-ae89-b2e39a05a636.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

398c0ce9-8e4e-4a5a-b234-c618922a5a23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\398c0ce9-8e4e-4a5a-b234-c618922a5a23.tmp
Size 1KB
SHA256 6da190019f3d24e45d9ac9f735b25826a20bdd5ccb7b725d0a8fd4f7f2309689
MD5 127345eccf4475d22aaaeb2514a2ba1b
SHA1 c726a582b2cdf58610fe29b398dcfefcc57e9953
SHA512 fbdb1e64ccd68d328ad5572cc908a0176808265addc54f2a292ad823c92bdd50cd2f3495f537938beabf50bb2ea87a86b557f28ed787efd83a76a4f6b43ca956
TLSH
T183417AF7C3E8867E890156F4AA146E1BCE2D0955932C3C5AC9E4AE1F93F24B1E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

899cf39f-d387-4aeb-86b3-32a70b2d62c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\899cf39f-d387-4aeb-86b3-32a70b2d62c3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

cd71f83e-4242-4c6d-a582-038e773d5653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd71f83e-4242-4c6d-a582-038e773d5653.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9b30aeed95008931b2a6c14fb7ea5f9ce2e50e4f44f6d7900eb60810895d1707
MD5 094aabbfcbfb534f9ddc3bd6b9f63a96
SHA1 f31a9484e5b078710bf5aace6016d5f8d6c7a77c
SHA512 eab0e6fba9cc3557198998a8866809da7738fa5640b762d87334ca10532e0ad1abf54fe68facb6abbbe4f92aae4cc79e2634b072c677e815f4e9f6cbabbee397
SSDEEP 48:KMyN4syo4ZTcr0Ia0ZKVw9CZRKJozE4qyDmhEAucc9TYvwIao9KV89O9RWtoX4cA:KIJmKqUqGdSK2YBmz6KQQ1
TLSH
T1E7911820713B4214387D3508B1E5ABAE578277A37174E62B7BDA40D78E66E480DFC4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ec2d33a1-7368-4df3-987f-3e4f6f4e80ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec2d33a1-7368-4df3-987f-3e4f6f4e80ce.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a99077ba-dc21-49ad-9d91-d6f8c9033cad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a99077ba-dc21-49ad-9d91-d6f8c9033cad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d97b195c-18bd-42a9-a2ed-229caf6fe4ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d97b195c-18bd-42a9-a2ed-229caf6fe4ce.tmp
Size 34KB
SHA256 c29ea8aedd6c6dcb55f366081e74398064236b4cf08d58d207fff4bd6ada49d7
MD5 259978fd5bd5951e25fca5a2773c8a26
SHA1 fdb143a7aa8741abb5d9af0f580f791b90966700
SHA512 5dfdd695e3306a609dc4848f3f3653cb1cbce0a194331be0c0098cd42aad31fb057129e13f9c4c59c40e604e30cc26adbceec8af88904a4eabda68841e5aaacf
SSDEEP 384:LZcID38NCUfD+J9V91199fw7DJOtgzdvLcN9YkWwJJhoMSboCzfnFLj/KxTz8Llm:TD3/hKnJOtgxDc9bsMSJz/Fn/KxTt
TLSH
T169F2CFB2ACA059A3CDD7A7C0798676577FF48513DAC8294495DEAE0D02C72ED1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd6961be-4b3d-4ee4-b62a-252e388d0550.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd6961be-4b3d-4ee4-b62a-252e388d0550.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download