44e2aa34320ed276e04cf249d937f2967db91efaf11c8d3266390cdd9b00ad33

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kahoot%21%20Accessibility%20Conformance%20Report%20%28Participant%29.html
Size 144KB
Sample261018-w2n4eatsb1
SHA256 44e2aa34320ed276e04cf249d937f2967db91efaf11c8d3266390cdd9b00ad33
MD5 bc67a780baef8bd6fb135ed0ca2e3b90
SHA1 d3b3c1133a4ece8d36944c3b71f8c2190beae42c
SHA512 8691fe25a92c698d07d26ec69f6efe9ee3ec7aa10fc68c2efe569a6b02479ddbca7f4802fc37c8227b10df4233783d0763090c4f09036468f81adfb8afdf2db5
SSDEEP 1536:hZ3Ey8v9TL9kH10Fv2WYHj8dCg4jnFN1JJfZ/dP:h9yRL9kVQ2J8dCBnbFZ/t
TLSH
T12EE3BB9B60D52573123B80CB517B67D174E9A19BE2631805FEFE0AF98B8EED1314283D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{FEA24024-C370-4278-A5FD-44CAFC6AA2F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
208	msedge.exe
208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 1188	5900	msedge.exe	85
PID 5900 wrote to memory of 5176	5900	msedge.exe	87
PID 5900 wrote to memory of 1436	5900	msedge.exe	88
PID 5900 wrote to memory of 1436	5900	msedge.exe	88
PID 5900 wrote to memory of 1436	5900	msedge.exe	88
PID 5900 wrote to memory of 1080	5900	msedge.exe	89
PID 5900 wrote to memory of 1080	5900	msedge.exe	89
PID 5900 wrote to memory of 1848	5900	msedge.exe	90
PID 5900 wrote to memory of 1848	5900	msedge.exe	90
PID 5900 wrote to memory of 1848	5900	msedge.exe	90
PID 5900 wrote to memory of 5788	5900	msedge.exe	91
PID 5900 wrote to memory of 5788	5900	msedge.exe	91
PID 5900 wrote to memory of 5788	5900	msedge.exe	91
PID 5900 wrote to memory of 5812	5900	msedge.exe	94
PID 5900 wrote to memory of 3700	5900	msedge.exe	95
PID 5900 wrote to memory of 5812	5900	msedge.exe	94
PID 5900 wrote to memory of 3700	5900	msedge.exe	95
PID 5900 wrote to memory of 4476	5900	msedge.exe	99
PID 5900 wrote to memory of 2000	5900	msedge.exe	111
PID 5900 wrote to memory of 5536	5900	msedge.exe	112
PID 5900 wrote to memory of 2372	5900	msedge.exe	113
PID 5900 wrote to memory of 404	5900	msedge.exe	115
PID 5900 wrote to memory of 404	5900	msedge.exe	115
PID 5900 wrote to memory of 4480	5900	msedge.exe	117
PID 5900 wrote to memory of 4480	5900	msedge.exe	117
PID 5900 wrote to memory of 208	5900	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Kahoot%21%20Accessibility%20Conformance%20Report%20%28Participant%29.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc3840c188,0x7ffc3840c194,0x7ffc3840c1a0
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,15973744098563214012,209571021721737729,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,17804950647831205915,15893862232608127580,262144 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,4275256198924435926,4231743467415448207,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,10733084634913529159,12933687015364901621,2097152 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,760863187367420243,1918282438519625558,2097152 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1493169106452204503,8224323093098973410,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,12355051057763452572,18089720995336556054,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5758317341277735182,15546987647026406484,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5758317341277735182,15546987647026406484,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,4019822020324601317,7934660801771515190,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,7025133969957603195,1984542162779224547,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6591018886337066772,16015476285046587697,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,13384378327384595522,11360782451101263574,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10979283860523331460,2340252163407088889,524288 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,14064714906743409858,11214227164212818065,262144 --field-trial-handle=3036,i,5571790943109204757,7906273171736399540,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5d073929-2b94-41c0-99e3-18d5d7e63f21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d073929-2b94-41c0-99e3-18d5d7e63f21.tmp
Size 26KB
SHA256 3cc58b3f538fb759f9d1932fea174d400c3c0594e8bf759e91bdfde43a43cd31
MD5 36d8b0168a9771271a298583fb1cc690
SHA1 4bc5bb1d4def75c55c3113a3ed7b4646a1bcb797
SHA512 aa6e8af6b5e88163f293e1f3f4334888363fedb8fe260143e92cda65cad25116de2eba744bb3d92be32d9cad980dd834f7cc5ad2abd58eb2444503681794b688
SSDEEP 384:n2Z5iFiZcI63sNE8TUNTUlIm25mgOQu4K2fLBP7+ttARQaPHzolV67O6R2Feofgx:wQFQ63VwgS9cBP7+tt05067TR3f
TLSH
T12BC24C32E898DABBECEB8BE6A74A7607DEF44153C58C99C0D9D85D1D009B5DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f71d65d-893c-442d-ad1f-059fb752e89d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f71d65d-893c-442d-ad1f-059fb752e89d.tmp
Size 26KB
SHA256 69e14c70d3e42b654fe3ac976d582fd1ad9be25224413a540ab7686266f61a78
MD5 75a88bf1ea50c4f84ad4069ddcb806f3
SHA1 8c48f4824d6aca495a685a752c12f209e959162f
SHA512 e9ddc74b0039f5216ed843258370fbc28fb1909e45f0f70011782ab0c0a239835018f22ce6552657503df81986cd4d4114f8447b03973d92e489ddc845d396d1
SSDEEP 384:nLZ5iFzQkUSv/R3sNQ8TUNTUlI4u5mgJO2d7K2fLBP7+ttARQaPHzol96MTigL/j:NQFdZ3FwgoATBP7+tt05i6MTqLQ
TLSH
T179C24A36E8A8DABBACEB4BA5B74E3643EEE44153C58C5AD4DAC95D1C00CB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

08518f3c-a4e5-4eb7-ba44-4d9958cd4a1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08518f3c-a4e5-4eb7-ba44-4d9958cd4a1e.tmp
Size 414B
SHA256 e448e32e83222c9d800666da109886d7368b0e1e79c6153bae2baa8cd622f89c
MD5 2abbd7619482131193bd46c8ff01cc07
SHA1 b5679e28b2973330a69a83693a232e09f31da3d8
SHA512 b3c32f3123ef238c05d0aa8a89618d545c30478991a827d3784b10c80928ec89da5bd94b2ad358f658fe1ed8eac2b5fb07b5a472cf7f0b8d13f87ca02bec5824
TLSH
T190E02BE9D825AC370CFC471C91940686EA4103472A81954F3B3D900D8FF163A41869AD
MD5 SHA1 SHA512 TLSH

Submit Download

6a2a0207-5444-4f91-8e68-4477da3fb286.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a2a0207-5444-4f91-8e68-4477da3fb286.tmp
Size 11KB
SHA256 9b09c2cd179a7bb91de6c7820d39d48cb6b9a54f14f9f232e333279bd7aceb16
MD5 0db2d60b616f54645439028222240af5
SHA1 32ab18b0927ac67737d514fad98591ca09d21a2a
SHA512 d3425002e64042679c5829b688d3ec1371b541b8edfb2181da14db4aa32816ad1f0e297c7848ccd02117e0a96a1df126686fbb33d128c04653c3f2e133ac6f3c
SSDEEP 192:sxZKRNk+/fDsMQZZDRzodpH2HW6+WNGYbIt5fY0TIgjFJ:sxZKs+/fDsMOZDaWHbGFrYijv
TLSH
T13342B5156E28AA7B8CC7D609FB59BF53D3F95033A0951E48AAFC8A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9912985f-0c31-4af1-848f-f9c1b012e409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9912985f-0c31-4af1-848f-f9c1b012e409.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b7c16514bd47212ea98926a2cc6662292d958f6489c28cfadcbd01d5d14b18ab
MD5 1e80ddf6fae41585cc89db1ad2574250
SHA1 136024f67c454949f9c7e5731bc919c2664d628b
SHA512 5393e5ae5db502e8707afa75c70716ecafdf9c15bbda72cc7bfc36d1c2d0c63297fa158ddbf0b6f7fe0a5ca45914c62ade4fcc9a528cf82edffd8bd83fa71710
TLSH
T1CDE026D404C8C33FA34A758F026C5B4CC380361BD3C869CE2B04C984B405A51EBCB790
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

85121b20-2cb9-4f45-85b3-da3e781f9e28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\85121b20-2cb9-4f45-85b3-da3e781f9e28.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3012db55-b915-4721-84aa-6893db66fdfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3012db55-b915-4721-84aa-6893db66fdfe.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b8486b84-29f1-410c-ab54-475e635f3c22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8486b84-29f1-410c-ab54-475e635f3c22.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d15a12de-a1df-43d9-addd-252e95c6ad17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d15a12de-a1df-43d9-addd-252e95c6ad17.tmp
Size 1KB
SHA256 76ac1c5ccc0b91a04ad5e5e24f60a628cdc158ae37590a226709214df4f410f4
MD5 c3ecf068e76938cc9dc8d7578e9997b0
SHA1 e31744403f9ba2b8503a0329a537e82544e01263
SHA512 f3e2e9f03099ef805d1fea4a2c8861a7dd317efe3f3f8ffc1642fed5f7bb97e4e82b9ecb5638098d0f435409e64b85ab2e16df347a11dd6888bdb8c480769bb2
TLSH
T1C431AFF783B4856E8A0196F0AA18AE2FCE2D0515531C7DAA84E4AF2793E3471D041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b106d3ded5c69797a05c2276801b7cb3f5c15dddd2efc4e4dd732a0c394f289a
MD5 223f95d52016ffccee9fae0676e9dd83
SHA1 60e6150803f1954832264f6879c9628bb5a51609
SHA512 5c17b1bcf0f6308b62de8d26db94ae155b04c9aa5c2fc52cdcdd59f04d806019fa1bc08c57e8be84049869fd125b99dc91f13dc043e865dcd4ce1313aae547a6
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYPjY:OtfFvpopPxrB4RhfYLY
TLSH
T1BAB2211471BA021138FE690C81B6872E064232B37159E67F7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a1057e63-4b2c-4941-b00f-96c10128ee5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1057e63-4b2c-4941-b00f-96c10128ee5a.tmp
Size 11KB
SHA256 92eb2e2ee9dc787d18c619fc40f1900d98b4e9896cf5ba56d8fe07ded25ffac1
MD5 8cd288acc220b260199404f51d61a39c
SHA1 d9a1b79954965eb220835a8e4052b3ca5d76daf9
SHA512 e98d15b9c42498ea44087d4f66e4f456da83c82c0bfa99280e9fc88399da1028ebe07d6873da99967a038c423eec1d321e464b92a5b17f1f71c0d98d7d38a646
SSDEEP 192:sxZKRNk+/fDsjQZZDRzodpH2HW6+WNGYbIt5fY0TIg5ZFJ:sxZKs+/fDsjOZDaWHbGFrYifv
TLSH
T16542B5156E38AA7B8CCBD609FB55BF53D3F95033A0951E48AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d06e2b25-cc6b-4d44-9478-04b3aa474ae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d06e2b25-cc6b-4d44-9478-04b3aa474ae5.tmp
Size 11KB
SHA256 4cecc3f26c502e05cca184b4c08f7b208afcc4f5b31ef387b44b5aa888652967
MD5 a98da0589f20a85e268ea08f31f1bd58
SHA1 61e21b3b1aafff9da1a074acf8fcb6cbfceed791
SHA512 b09859170758008f89f50ddb41392e8cbd40c672f2c116b34e5032a3642e11cfe49859f93c7134b479c18020d48a6284f8da2a44446a0a2c62bd12afde5ecb82
SSDEEP 192:sxZKRNk+/fDslQZZDRzodpH2HW6+WNGYbIX5fY0TIg5ZFJ:sxZKs+/fDslOZDaWHbGFdYifv
TLSH
T19342A5156E38AA7B8CCBD609BB55BF53D3F95033A0951E48AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a11b09ff-cf90-4437-bb17-c4f4f3c44bd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a11b09ff-cf90-4437-bb17-c4f4f3c44bd7.tmp
Size 26KB
SHA256 34e63137611b9eb2ed725b9d2ec76c5fd9b8df22ae093d2bb07428d8fd4a1198
MD5 d70d54152f358bd0bfd3bb9fb44d17a3
SHA1 48c6df49650086904c0208f6d16a28c75809da69
SHA512 e346478cb0df590f498f0cdc0f2980d9c300e3646f211cf14ccee9c0edffc450880144cd821094bd37df31d4d8c61268a8ccd8389d22e92c7f0305dcb2f56d0c
SSDEEP 384:nUZ5iFzQkUSv/R3sNQ8TUNTUlI4u5mgJ52d7K2fLBP7+ttARQaPHzol96MTigL/j:2QFdZ3FwgoJTBP7+tt05i6MTqLQ
TLSH
T1CBC24A36E8A8DABBACEB4BA5B74E3643EEE44153C58C5AD4DAC95D1C00CB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2274bc6-672e-443d-9815-881102766e34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2274bc6-672e-443d-9815-881102766e34.tmp
Size 27KB
SHA256 4bc7ae2b8fbce3732075921b0aa3bb6f9c302a5fc45de2197b1e4a409d7689a2
MD5 e05a7818aa738c9d8079be178002c244
SHA1 d0190067f52c7b6ba1c91e07df01babc9a2fe198
SHA512 7450a7b5effd39b412618a024b7793384e5380c55b27478a1416814eb1c40aff4df0694d91e525e345bb5a1b8f467c678b8d1878be34acdc28863623470cb0c2
SSDEEP 384:nU9YiFzQkUSvksR3sNQ8TUNTUlI4u5mgJ52d7K2fLBP7+ttARQaPHzolE6MTigLL:YjFd93FwgoJTBP7+tt05B6MTqLQ
TLSH
T1D5C24A36E8A8DABBACEB4BA5B74E3643EEE44153C5885AD4DAC95D1C00CB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b366bfc0-ad4a-433a-b803-9786b5ecb289.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b366bfc0-ad4a-433a-b803-9786b5ecb289.tmp
Size 25KB
SHA256 35335c75512b81915dfa291b5059cc853307f6c88130a80728ca003d32d6b0bb
MD5 6e8fdcdc1cf01db9b5b9b4ef8449ba22
SHA1 f6d54444b4eb81807e32bffb40ec2c22d34b6e1f
SHA512 8197df11f8c029e105a7bff17ea6f242212c571804442eb9cbc139c6fe3784190462b31692fea90c27721d1c682ab8b05f3a68c798084727d1b7713c49d4e082
SSDEEP 384:n05iFiZcI63sNO8TUNTUlIm25mg5DnK2fLBP7+ttARQaPHzoFTc7O6R2FeofgL/F:0QFQ63rwgSU3BP7+tt05aw7TR3f
TLSH
T13FC24A36E898DABBECFB8F9AA74E7A07DEF40163859C99C0D9D85D1D008759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2aee429974cfb775e223d2d60b3a2f1010aa725c2dd7963fac00d7aa9b5fd8f9
MD5 39b9c1dc5edd946abeb7e85e98617d5d
SHA1 c08e5f0a495e65dbd8740c89b949342801740be3
SHA512 247212ff15163807f821770cac79327a1959bfa45a38ccd199eec4ce7bed820b71da9b97c755ffff0db876c59a8fcacf089ed40ecb4c489fab00dd7ae509252d
TLSH
T1C1410658B6E91148B3B77F5AABF7A86E447BB8372E47D45E00010D4F0A66A44C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4476-205-0x000002E0BDE10000-0x000002E0BEE10000-memory.dmp

Download