1cab37e82c8221b617c908aa7d118c9cea17c6908fe13ef988a8eb0780fe9793

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
home.html
Size 235KB
Sample261014-11alvaby2v
SHA256 1cab37e82c8221b617c908aa7d118c9cea17c6908fe13ef988a8eb0780fe9793
MD5 a0d174c039e368046f4dddff15e22ca6
SHA1 25220cc1950dbd7a5d989ffdf5b319134a75f277
SHA512 d6e50bc2c4494a519aa461d6a8c04d5779245d0600a0bd72b213fd11e7b11ff8f7840c53b5e98a410f20217837743be945005652e34ba34a6923ee57e2f3e102
SSDEEP 3072:bFQp9MH5amuclfQEp9CHUm+O8iZlxaIzh3x3ipRbvIr+SkdIXIqiJRpZXvPrJ+j0:bFizI
TLSH
T10534EFE2FF65E073E88F79F0DC70ED9CC5869125491EC998F099B3782B482D96F42192
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{DE302CB6-7A71-4B03-8854-850B04BB740F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2480	3892	msedge.exe	88
PID 3892 wrote to memory of 4432	3892	msedge.exe	89
PID 3892 wrote to memory of 4468	3892	msedge.exe	90
PID 3892 wrote to memory of 4432	3892	msedge.exe	89
PID 3892 wrote to memory of 4432	3892	msedge.exe	89
PID 3892 wrote to memory of 5752	3892	msedge.exe	92
PID 3892 wrote to memory of 5752	3892	msedge.exe	92
PID 3892 wrote to memory of 5752	3892	msedge.exe	92
PID 3892 wrote to memory of 5224	3892	msedge.exe	93
PID 3892 wrote to memory of 5224	3892	msedge.exe	93
PID 3892 wrote to memory of 5224	3892	msedge.exe	93
PID 3892 wrote to memory of 5756	3892	msedge.exe	94
PID 3892 wrote to memory of 5756	3892	msedge.exe	94
PID 3892 wrote to memory of 5848	3892	msedge.exe	95
PID 3892 wrote to memory of 5848	3892	msedge.exe	95
PID 3892 wrote to memory of 5848	3892	msedge.exe	95
PID 3892 wrote to memory of 4756	3892	msedge.exe	96
PID 3892 wrote to memory of 4756	3892	msedge.exe	96
PID 3892 wrote to memory of 4756	3892	msedge.exe	96
PID 3892 wrote to memory of 3012	3892	msedge.exe	98
PID 3892 wrote to memory of 3012	3892	msedge.exe	98
PID 3892 wrote to memory of 1940	3892	msedge.exe	99
PID 3892 wrote to memory of 1940	3892	msedge.exe	99
PID 3892 wrote to memory of 5232	3892	msedge.exe	101
PID 3892 wrote to memory of 4388	3892	msedge.exe	105
PID 3892 wrote to memory of 2844	3892	msedge.exe	106
PID 3892 wrote to memory of 5252	3892	msedge.exe	107
PID 3892 wrote to memory of 3920	3892	msedge.exe	108
PID 3892 wrote to memory of 3920	3892	msedge.exe	108
PID 3892 wrote to memory of 4852	3892	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\home.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb188bc188,0x7ffb188bc194,0x7ffb188bc1a0
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,1371526944341899914,7059488513475225423,262144 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,16189453705712331212,18308630040323152611,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,9515220135297051989,7487712657626768468,2097152 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,9660837014780333919,764555625862303471,2097152 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,8732415091124686388,313209134374237050,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,4796271206975285778,5513287244994912957,2097152 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,18361344354161149540,14462358825676798245,2097152 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,5587683006894706108,7498421299589366572,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,13756672344135402560,6099655879274051316,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6680409745809139004,9821963387235836498,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6680409745809139004,9821963387235836498,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,17810130216944072231,13899823854345114087,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15805398204554761447,4899125526206300534,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9353268448216746004,12621649092731358881,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2856,i,11185478729649755540,6622403661257510834,524288 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2612,i,6985691510763151540,2610946941809620022,262144 --field-trial-handle=2628,i,9025406533310794975,9959059075376325555,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0164381d-0c1e-4fe7-be44-3f84a85c93d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0164381d-0c1e-4fe7-be44-3f84a85c93d7.tmp
Size 33KB
SHA256 c447a50fab7ee7ebd79310f82603a12ab19d86dfe23c51691384edfa8ed2878e
MD5 3d74ff8d48989e9251c7620957470334
SHA1 833f249f51cf9285b98c755a0e4a1bdaefe9c812
SHA512 47f60975453eb994ac889d0ad777a94b07fb8407f4be12fb0bf91c56f0a191bf50946b4fc33a9886f3efce41d59a465e4fe1a59722f9f18c6be4c186762115c9
SSDEEP 768:HV36XNqc7fZrKcp5XSwQs88uBkiT26ykJ5Lm:HV36XTtrTILNB7yQ5a
TLSH
T140F2BF34FC9499739CB2A282775B3B036FF05247D8C40A94CADEA52D02C73AE6747867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d730f5f-e924-4b68-92c2-3e8bb31e860d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d730f5f-e924-4b68-92c2-3e8bb31e860d.tmp
Size 37KB
SHA256 5485f6b00711a5182e408d0bf54ee561fe334c05f486a58985d6553e76c314b5
MD5 1a686d5e069252b860a9bdd07103a64d
SHA1 0ae7e31c4f7a4ef07de85a3a45d638d18fcee997
SHA512 f13f31b2854ce34275b32c3a323a2c5bdea8c38480824e46e92e814f06b6aff4ecc50712cc5c8407c9be10dd0825a4eb9af12c985b9426ec7bae2c281dc76aa8
SSDEEP 768:R/UxvxjgC+W3ga3c7fZrK6p5XSwQs88uBkiTCS/P84g:kZj3+W3gptrtILNB/Hg
TLSH
T13C03D039FC945863ACF3A3853B5A275BAFF05053C4C41BA849EE7A0E028B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d43c7ba-faeb-4bbc-a63d-6e97bf31ab24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d43c7ba-faeb-4bbc-a63d-6e97bf31ab24.tmp
Size 36KB
SHA256 95eccafa8649ce36fab41c07a6c31cfec3936b68f5b0dce07a8d374eea991c98
MD5 aaaa9126199237ea9c469493c7dfdf2e
SHA1 d116510d0cc0efc4c9742b45ce6518f270cb96cf
SHA512 3656c8f36f6dc342beb9e42530177688d840cf55c71c019aaa86a9d38f687c79fb943c75605af455b96c6d7d67314c6b7d90cba68ad3f4cbb62c3cf4dbb7420e
SSDEEP 768:hFdt3AwgLXNqc7fZrKYLp5XSwQs88uBkiT26ykJ5Lm:9t3kXTtrxVILNB7yQ5a
TLSH
T181F2BF36EC84C573ACB69785BB5A37029FF05257C8C40A94DBCDA92D02873ED6387C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

07631219-b68a-47ab-ad5d-a9cfbcdc1993.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07631219-b68a-47ab-ad5d-a9cfbcdc1993.tmp
Size 11KB
SHA256 668b57c707d2dda446fbfa8e6234bd5cdbcb870053982e4a1606376941b12ac8
MD5 9780c0f43ed3efdcd6f881a19b01a06f
SHA1 077ec6b6727207519ce08479cb2db9d924079b7f
SHA512 cb8f20876bbf8a017e8da5a05f1387e73afe48f9eb920a25d21cd4254e0e8fc248c474b3f936f8b8570ba46cf5d5d3df9142f22ea3c7f9825270249273e631fa
SSDEEP 192:sxRNGRJbrs/f3ws+5HRL4vzoA8p4F/g6+WNIYEGYc+GLPIgIJ:sxRA7Y/fgsGTY/5Iwts
TLSH
T1DD32A715AE28A93B8CCBE21DBB657F13D6F95032A1901E48F6FC861C14E76DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15aff640-d632-4f74-8399-4395c2a831f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15aff640-d632-4f74-8399-4395c2a831f9.tmp
Size 11KB
SHA256 edd15c3ab61bc521db0ec4b4a0806688ef0ef76d9e4a9c056b213437c26b80b3
MD5 fb6f3e112994c41f1d41d906a04b86f5
SHA1 1b93555bedc5284f7a850a57d504c786d181c757
SHA512 17c16371f10a52725d892458c7ea0cb5152b4a2343de592438f3def8a3f0fd4593c4b2d749ad66b9c5c0bc2676335242972e73f7b469436eb121908056d230a6
SSDEEP 192:sxRIGRJbrs/f3wsL5HRL4vzoA8p4F/g6+WNIYEGYc+GLPIgDGrJ:sxRD7Y/fgslTY/5Iwt+
TLSH
T1EC32B715AE28A93B8CCBE21DBB65BF13D6F95032A1901E48B6FCC61C14E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f4a707c-8e9c-47a9-8ea8-a9b2a7767743.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f4a707c-8e9c-47a9-8ea8-a9b2a7767743.tmp
Size 23KB
SHA256 afec7effd3f07bc4e1ca7743093a781573768c955142ea411667f3f2c99a8f4d
MD5 44d3fcf13534e936b8345a53b1b7fca0
SHA1 0909e88a23b38211b232be3e6385ba1f207b9aa4
SHA512 0f58c316644d48e8501f88eda993f27ce6e402a4acb4088768b456352c3623074ae2b683af979ba45316d399fcef61d1bc9237e5b151909fe0eb01f1f71a91f5
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRX6roJen:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0Vt
TLSH
T104B2C92B640CCB7F4FC04A9EA8196FD77D9802C79A588D4047FE995C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 d13f0515bf21f190ad63e271c2ccec768979b2f650f257632b03d515a666d5a3
MD5 57bbeab93cd9656dd458c72290d82ba9
SHA1 d7e562cd198d5b03efb2f4dfa5eb0e1e82131680
SHA512 209f3af7d99ed6bc607d6b0a16d0c708d7b0b34772cf81f352387baf3b2a58cfb6795ebb6100810863d134618855afc529080433dc6db8b39abea60409970cd4
TLSH
T15451314B97A24C25EBA2413D91E613CF3B7BD570655F2E020AA4C0B9BB4EB387224C56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2b5833832a47a8a3d96ffb797287bdef10f3411fe6abd4844fb9f1aff6e79710
MD5 c9a3688235a8f31bad1ac944da16a2c3
SHA1 274423f0ab406d6656c1e9f721e188e5a16c8320
SHA512 1f53a32ecc573c76b75c0923105e367d561b3deb65f838637908837715700641118b59d474e748c38f62b5f2a53c927b21ccb747f5e34bd5f459c1f544b83b61
TLSH
T14551534B97A34C25EBA2413D91E613CF3B7BD570755F2E020AA4C0B9BB4EB387224C46
MD5 SHA1 SHA512 TLSH

Submit Download

b7cd6a14-b76c-429a-97ed-58b5637f3647.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b7cd6a14-b76c-429a-97ed-58b5637f3647.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

690fa3be-7b3c-48e0-a04d-23740548abb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\690fa3be-7b3c-48e0-a04d-23740548abb1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a332f7c7-c57b-4c46-b0ff-06dbadc006df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a332f7c7-c57b-4c46-b0ff-06dbadc006df.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ac497aaf-5d78-409b-aba4-56db5bfe62b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac497aaf-5d78-409b-aba4-56db5bfe62b1.tmp
Size 2KB
SHA256 318bc3fa7dba668d08d5c722aff9f54d751a98f6e3993e1419e73d84894033ed
MD5 9bf0b99f3bab4ccb0c27e76a762b82a9
SHA1 71848b9550cb866cc917ecad56fd4a894dd315c8
SHA512 a62a9e7069db3b8e645bdd12f0f429bbffd052329eae3da73fe3164b8d33f7b7d2d40b5a6f1926c1675e07fb609682e7162af958b367937858062bfc4c551f3d
TLSH
T1F751AFF783F4877E9A1196F0EA146E1BDE1D0416432C7CA689E06E2B53F34B1E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

be826e95-2d64-48f6-8156-264430a3bbc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be826e95-2d64-48f6-8156-264430a3bbc5.tmp
Size 1KB
SHA256 fb037cc6a4657f905838db930fe58b5bb3309ef7505253b8031d869b9e337213
MD5 bf88b610baa7600a7d202c21ad69e931
SHA1 bac13c14c04f9b7fbc1b0f029e60f7e4a411052f
SHA512 84470298abc7978c17a59ea4d40e99d736bd3d98aa1bace08e239a78ddb77dd7c37483871fb52448c28e4f6e46a1a1246db5f15b7a38a4e7e9fbdfc22c5dbe22
TLSH
T18F31ADF3C3E8467D8A0156F87A282E1BCE2D0854432C3D56C4D49F5F93E18B1E28099E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 533460e79bc6c5f89e5b1af29d0c7d46c1ae554a61234962d9eb0879175c402e
MD5 102ac60af8ca52625fef00f0d5866c14
SHA1 be3a8a412957a1a7da7ecfa6054e059f57dae7ac
SHA512 08c9c72e1f94115defe44cf29469a702e9769ee274e19179395997aa0c9a96ad20e49089ee94f9538e1ea5a5eb9a1732adaabed507d0ea37e958b82feaf2f295
SSDEEP 48:KkYI/KpeEnyZaIij2XDxZZ+DJ8lIaj+K5LBV+truE0lTfyzLefL5hxmDBENIaLmg:KkYwKpeO6a1YgK92qCUYK5T
TLSH
T10591981433AF121138BE275941ACC6AB564231B33059E93F7FA852A68D6EF156DFCCC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c43f1194-244d-485e-ab5c-167b21f5b5b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c43f1194-244d-485e-ab5c-167b21f5b5b4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d290f3e9-0cce-4846-8360-a2e7e08bab94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d290f3e9-0cce-4846-8360-a2e7e08bab94.tmp
Size 11KB
SHA256 fc21748b857e3f750de2df7ff1363d15f551cd3b57dd872051f833ccc8886325
MD5 5b39b6121d343c9d3e821beb005d793e
SHA1 3151454ae6e96ede7f1d95abc894afafb9cbf7dd
SHA512 011952505e3fa59b3d3cca3512afe305491d03a1b7648288d133862a763cb3b43c67252d4a1d0603cfe883e95658c29d654d43125aca8ef87705c929c612bb23
SSDEEP 192:sxRIGRJbrs/f3wsLPHRL4vzoA8p4F/g6+WNIYE6wc+GLPIgDG9J:sxRD7Y/fgsrTY/5I+t8
TLSH
T14432B715A928A93B9CCBE20DBB657F13D6F95033A0901E48B6FCCA1C14E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b49f3103-b0f4-4931-ad5d-435e9e16bc2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b49f3103-b0f4-4931-ad5d-435e9e16bc2f.tmp
Size 38KB
SHA256 31198ebeb49b78393d4e5b74cb0d39696732cbcb7aaf62c39f758d613e69cb64
MD5 229c5a29b4ed7a0e3dab0a477f682c7b
SHA1 10d9140371a6909d1ed7db83cff605d970f0a205
SHA512 c66bd54ccbd072a3abadb0ffcafbac1cefb2341a03dfa7682c7a0a405083baeb51318f7eecc9aaca6ae7b1af86a0bf98b273db0bb63a48ad3701ade226915e21
SSDEEP 768:w/UxvxjgC+h35Xdqc7fZrK8p5XSwQs88uBkiT26WH:dZj3+h35XjtrFILNB7WH
TLSH
T1DA03CF39FC949823ACB7E286375B2707AFF05157C4C41AA849EE6A1E03873AD534785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7b94c88-47c8-4b20-96cd-5e0318eb9f49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7b94c88-47c8-4b20-96cd-5e0318eb9f49.tmp
Size 38KB
SHA256 6443a3e61d73c119254fb272784b8b877eb69a5a9638fb67b960f450d343c0be
MD5 3f89e5e2d45e10fe1a8284c1262c1192
SHA1 651ebd6e1ef13d0b98c0e13eec4a280bba7a5eab
SHA512 d41f91f23960bbaf7fb2ba41f2782ba41ea41267a0982900e1671608f41bfce5b234b6db818ecdd40757632ca0bef726c8abf77239ebd2f5c5691e7d7ed842d8
SSDEEP 768:V/UxvxjgC+W3k+0c7fZrKZp5XSwQs88uBkiTz6/P84g:4Zj3+W3kmtrWILNBQHg
TLSH
T1BC03C039E8949863ACF3A385365B274B6FF05153C4C41EA44DEE6A1E038B3AD5347897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9a9dec4-73b2-472a-86ef-2773171cb69c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9a9dec4-73b2-472a-86ef-2773171cb69c.tmp
Size 33KB
SHA256 014b319eb5d7a64d2a103073b3c108010dfda0807efa684e57d263734a9075ad
MD5 49c8533d0194becdbc8fa9b3d4bc6f4e
SHA1 31cbda98a9c303ee20b303aa8324b68b1c01ff0b
SHA512 97d60e0f0fd1c183a2cd1d1dd327a228cb37b665470cbbeca524208adf230933ae4c5cf869e924f6311a3dd16d1ad1f7f7fb6ba7d557d91cade5b89cee6b8185
SSDEEP 768:tV35XNqc7fZrKcp5XSwQs88uBkiT26ykJ5Lm:tV35XTtrTILNB7yQ5a
TLSH
T1A1F2BF34FC9499739CB2A282775B3B036FF05247D8C40A94CADEA52D02C73AE6747866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e9f6979-1ca8-4e82-9df2-1f40e306faf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e9f6979-1ca8-4e82-9df2-1f40e306faf0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5232-275-0x0000019EFF000000-0x0000019EFF3BB000-memory.dmp

Download

memory/5232-266-0x0000019EFF000000-0x0000019EFF3BB000-memory.dmp

Download