0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NM-Backend-master/application/config/index.html
Size 131B
Sample261022-w2qbgabb39
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{699D60D8-AE03-422E-AA53-0BC022BDE61A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 5680	5888	msedge.exe	83
PID 5888 wrote to memory of 1988	5888	msedge.exe	84
PID 5888 wrote to memory of 2924	5888	msedge.exe	85
PID 5888 wrote to memory of 2924	5888	msedge.exe	85
PID 5888 wrote to memory of 2924	5888	msedge.exe	85
PID 5888 wrote to memory of 1356	5888	msedge.exe	86
PID 5888 wrote to memory of 1356	5888	msedge.exe	86
PID 5888 wrote to memory of 2496	5888	msedge.exe	87
PID 5888 wrote to memory of 1652	5888	msedge.exe	88
PID 5888 wrote to memory of 2496	5888	msedge.exe	87
PID 5888 wrote to memory of 2496	5888	msedge.exe	87
PID 5888 wrote to memory of 1652	5888	msedge.exe	88
PID 5888 wrote to memory of 1652	5888	msedge.exe	88
PID 5888 wrote to memory of 5052	5888	msedge.exe	97
PID 5888 wrote to memory of 1692	5888	msedge.exe	98
PID 5888 wrote to memory of 5052	5888	msedge.exe	97
PID 5888 wrote to memory of 1692	5888	msedge.exe	98
PID 5888 wrote to memory of 5412	5888	msedge.exe	100
PID 5888 wrote to memory of 4576	5888	msedge.exe	109
PID 5888 wrote to memory of 1548	5888	msedge.exe	110
PID 5888 wrote to memory of 4832	5888	msedge.exe	111
PID 5888 wrote to memory of 980	5888	msedge.exe	113
PID 5888 wrote to memory of 980	5888	msedge.exe	113
PID 5888 wrote to memory of 1640	5888	msedge.exe	114
PID 5888 wrote to memory of 1640	5888	msedge.exe	114
PID 5888 wrote to memory of 2116	5888	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NM-Backend-master\application\config\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,7680028398064212359,1141861097449281117,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6637516390214145532,2053820515144217707,262144 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,6973817242337709762,4349313734792348811,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3031948613016890708,9308972622009898784,2097152 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8842948480177328406,5979139922588312967,2097152 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,3787346269527940643,15361457246037289131,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,3364679203499965321,2955466587857791267,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10001953592386334686,2172827123620204583,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10001953592386334686,2172827123620204583,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17261527622470088675,12478763415492053249,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10932476223293508883,17706920099547664393,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,16630553041738390836,16240129275400532395,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,15098184079959933605,8350160158198883220,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,12662945967021427898,626599320444671448,524288 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,18018123103158638143,12523258645548925356,262144 --field-trial-handle=2220,i,14264069511059888513,14610660323902903519,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38e47101-c6ae-49b3-9675-f069dd292440.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38e47101-c6ae-49b3-9675-f069dd292440.tmp
Size 26KB
SHA256 564f57056170b385166aa03c86391f3e49e83e2a5d0754e223a86060f759f683
MD5 6fac0cf7f9b6aa53d0222187504a4719
SHA1 3f865cd036decb3891ffaa663c4029b403849663
SHA512 a5a364ad452e7dc5608d0256b0959f469ec96120157f2d6638431fd09214098141883c36e8d7586a4a161081652041d08ec416a53775f78082a34314e7c495fe
SSDEEP 384:nsiFiZcI63sNE8TUNTUlIm25mg1AEK2flBVTPUVYSmk7O6R2FeoCWgL/7Izgow:XFQ635wgStKBVTPemk7TR/N3
TLSH
T14DC24C32D868C9BBEDEB8FDAA74A7507DEF04153968C9AC0D5C81D1D009B5DD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e3401e3-2097-4edb-9610-79aea332791e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e3401e3-2097-4edb-9610-79aea332791e.tmp
Size 27KB
SHA256 8380cee7338a232738e169b245e42a70f1291ba14a5e9c7ac1642f8077874ab4
MD5 5168756c5acfc4d7b04820b1909104ed
SHA1 00a11a202b288d13ef663274e3910f80bc372cc0
SHA512 8ebb72f3abefa91f2ebfe167f17af0ab0728f9244f6b968c11bcae50f618451eefdd37715f02d375c6bd26859fe8ec5da13661d0bdbcf472faa1dceceef59832
SSDEEP 384:nZiFzQkUSvWa3sN48TUNTUlI4E5mgaf3K2flBVTPUVYpmkvwQT6s94xbgL/7IzKN:wFdx3pwgOdZBVTPlmkvqs94ELZ
TLSH
T15DC24932E8A8D9BBEDEB4F99A74A3603EEE04217D6CC5AD4D9C90C5D00871DD930BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

816884ef-1700-4e93-85a7-8514f5412477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\816884ef-1700-4e93-85a7-8514f5412477.tmp
Size 27KB
SHA256 492fe012d7da2aedfdd08054893560b0fb92ab9e4439612b3bcefa24ad3737a7
MD5 772713850866c73f4173068b9e3d3b7e
SHA1 eca1ec09c62a6ce4136e25911a4503ba4648bdaf
SHA512 aab0f42c36f1fa2512ae9f7bb4094f224b44a6d53a6386e633a0b14aba9a52251bb739c45f4b35e061197bc97c826190602ff71741298217c2d0c2e989ffd7e0
SSDEEP 384:nOiFzQkUSvj3sN48TUNTUlI4E5mgCf3K2flBVTPUVYqmkvwQT6s94xbgL/7IzKIi:lFdj3pwgOFZBVTPGmkvqs94ELZ
TLSH
T1D2C24932E8A8D9BBEDEB4F99A74A3643EEE04217D6CC5AD4D9C90C5C008B1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d080d2f-1443-4c38-9ae9-85b2bd6c7ddc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d080d2f-1443-4c38-9ae9-85b2bd6c7ddc.tmp
Size 25KB
SHA256 f12464864bd79a1683d2c69ad28775b1276de613c88aad0b3a293418aa0f7c7f
MD5 904995c5f8861b5590ef8c0369f0f1cf
SHA1 5de784941d66b0b62e9de3ef8619414e51fa2d6b
SHA512 d20671da550bb0364c55d62ba6773764ee58e3c3527945e0bd4da272338460a526855ae7aa9ebdbcb14f8f29d1664ab7b87a04b6866959baae5054093e5f69e8
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5ZnK2flBVTPUVDmI7O6R2FeoCWgL/7Izgow:qFQ63AwgSWJBVTPymI7TR/N3
TLSH
T1C4C23B32DC68C9BBEDFA4F9AA74A7A07DEF00163959C8AC0D5C85D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

27685139-f930-4fcc-a383-77f54d83ff34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27685139-f930-4fcc-a383-77f54d83ff34.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

373aa279-3aa9-4374-8c8d-2686a0594e23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\373aa279-3aa9-4374-8c8d-2686a0594e23.tmp
Size 11KB
SHA256 21aa4941b4b3795bab17a7fd24ee19e0d348f47a560fd6e85be34787cfa87e23
MD5 2a0bdba7089481cb1ee17f26e2042f37
SHA1 f87a9bb7f9c1afbb5016be24a854471cb02169a9
SHA512 d9974e1f2e8bee81f9245a872632408d76d0543aa8197ba25c93daa8feb32a0c81b1bb4144d45a50d2d0c4196c7f20a4e34c2a856f880636125ab42f147662c4
SSDEEP 192:sxZlRJkq/f/s5QZZJlzodpHSHW6+WNGYbIntWWY1R3Ig5DKaJ:sxZl0q/f/s5OZJuyHbGFzY1l9L
TLSH
T1C442D816AE28A93B9CC7D21DFA55BF53D3F95032A0941E44E6FC8A1C14EBADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d701ae3-01fb-4728-82e9-52ba7c4f5f07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d701ae3-01fb-4728-82e9-52ba7c4f5f07.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

75c5ba89-5965-4287-892d-f6868d9e3cd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75c5ba89-5965-4287-892d-f6868d9e3cd6.tmp
Size 414B
SHA256 f1730ca2b38ea758d3aa94367b88c55e01fcea7a37b6861128b27eea08699490
MD5 352130b9910aa673a8da283fa2182e4d
SHA1 bcbecf00d9a32deb3864aab96ae75809bbe3e2b9
SHA512 989595739965e65b49a0354bb5a4e780fffbc6db5be7b1521e449c1dceb6342f9ca4fb6233fd27f8d77bf733f1abe35b686970d7936b1d1762e318f2f52a49dd
TLSH
T1D5E02BE5C915FC3B18FD471850940642EB41135B3A80998B773C810DCFF163B81868AC
MD5 SHA1 SHA512 TLSH

Submit Download

8e4fd189-8f50-4d03-874c-b4fd0aa456ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e4fd189-8f50-4d03-874c-b4fd0aa456ce.tmp
Size 11KB
SHA256 f821afc03f939c411905b1262e9372c5832aca4edb614db35d560f399c04b051
MD5 1cedf0305356d253c7d0097ae7934614
SHA1 6c378369d999cb01709e4f7eb2358774a9c14715
SHA512 b958b7fb3b3e8a43adc9d5e30089eee1a5f20a267ccdfdefbc4aa6947f24899a2792fb40055e977ec72303c9d43c1baf7d6c2d81906a687dc92c70ad810dbdb6
SSDEEP 192:sxZlRJkq/f/sIQZZJlzodpHSHW6+WNGYbIttWWY1R3IgjKaJ:sxZl0q/f/sIOZJuyHbGFNY1ljL
TLSH
T1E542D716AE28A93B9CC7D20DFA55BF53D3F95032A0945E44E6FC8A1C14EBADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 14aa245a941bcb1a6b2f5915335e5b05d8c1361fa9db876f481bbff3258ffd3a
MD5 69614216c09346a59aae97e0c7a2844d
SHA1 e9392044465f1978eb116366d25c9902e1391b41
SHA512 bba30dbe82411786cf16cba62500a40c2f7f9bab84d48616e37c5d6746f95fa88ecf13ec926683ddd840c734bd68b9baa9fb2145227b7075444a7c070cd77894
TLSH
T126E07D8816C8C23FA21B644B01AC571DCB80361BD2C4A95E6700C6847007040F6C67A0
MD5 SHA1 SHA512 TLSH

Submit Download

f1855194-aefd-4c8c-9959-1880f1f18a5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f1855194-aefd-4c8c-9959-1880f1f18a5d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7d84a38c-2160-47a7-a71e-8bad58453d18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d84a38c-2160-47a7-a71e-8bad58453d18.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

951c6643-4227-496c-ab9a-bd0a16d52062.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\951c6643-4227-496c-ab9a-bd0a16d52062.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a41f5668-2c67-48c6-bd97-341db26c39e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a41f5668-2c67-48c6-bd97-341db26c39e9.tmp
Size 1KB
SHA256 af703832cd6e9391cf082023263da660f0ace4912710df3f25a2bfa9be0a9d62
MD5 ef6a9fe3b87be0438b9892d370376130
SHA1 66c1213d7d888e3a997ffc1aa9441ea3fc766d11
SHA512 f4b0c9b62c14e995a77450f80981ee6816b2501682d40a595e9babe608a539b1365ea1c1dc891ce905d6aab3da51bf8c408d826961e74652bcca08bca19fe40f
TLSH
T16F31AFF787F4856E8A0196F0AA18AE2FCE2D0515432C7D9A84E4AF2B83E3471E04165B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 31eea2746e13f4a77edfbcab3c3c4eaa012a80a4e0476455b84a63710495a133
MD5 a78eefbb2643da0e14c746d12c635c36
SHA1 aab434f5c43f5cc57741326abfa733ad97631e61
SHA512 d638a81073d55f4296af6caabfdd5449f8305a97db9ea3757c28711df08b308d2e684c0d5c4c76304ac10b0e6aa255b94cf6de22d759aff058d17caf41458a41
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fR:OtfFvpopPxrB4Rhf4TR
TLSH
T10FB2121471BA121038FE790C81B5972E464232B33259E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b27c2e3a-43eb-4bff-8bc6-3f20993cdba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b27c2e3a-43eb-4bff-8bc6-3f20993cdba4.tmp
Size 11KB
SHA256 5adea95b3e198afe172ef5e45c2e9eb858e911d4ee8e0d747a829015805647d3
MD5 1c6326e3f63d2804e3f51b8534dc2b7c
SHA1 df973f3d1aba4dfdafb5c663cab4b85b45570910
SHA512 8f65faa2acf3328af2f093453c3bd974778af5443de02724211aef17736fbca549a92cde8a00a793324b91ad2ea1cb399ca27510aa7b54f9996bf233ac6f7e7e
SSDEEP 192:sxZlRJkq/f/sTQZZJlzodpHSHW6+WNGYbIttWWY1R3Ig5DKaJ:sxZl0q/f/sTOZJuyHbGFNY1l9L
TLSH
T19042D716AE28A93B9CC7D21DFA55BF53D3F95032A0941E44E6FC8A1C14EBADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abccb163-7b79-44c5-be61-d7dc9e7926e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\abccb163-7b79-44c5-be61-d7dc9e7926e7.tmp
Size 27KB
SHA256 da81327b4311af6a08467cc6d8f17863488ced4fb1839ecb3d394f03d99dcf00
MD5 72cd328ae2473032811cbd75f385111d
SHA1 402af6f1c22b8fa7089c54f6ca16bb85772928aa
SHA512 236c89c184437ac655e4bdb0e0b9e9586263a267ef5046ef87bef8fa29d1ffd42e2d354bfd601c859052aec9fd256a6e84b6998930408c7efb2e3d49983c102d
SSDEEP 384:nWiFzQkUSvj3sN48TUNTUlI4E5mgaf3K2flBVTPUVYqmkvwQT6s94xbgL/7IzKIi:9Fdj3pwgOdZBVTPGmkvqs94ELZ
TLSH
T1F1C24A32E8A8D9BBEDEB4F99A74A3643EEE04217D68C5AD4D9C90C5C009B1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e7a60db3acbf75c1e52d45f312c4e42789bd03d4f76baff6d2515a69250586d
MD5 d8b3eadb304e7291c32081b75d42c335
SHA1 8b3725b02651ac8836b7a87478809a25347a0ae2
SHA512 dd7ab52032d38d332bb42f55cb3816ed1c6d4723036c442f52acf928f328dbcf0526d93c63e37b148c1677a17301ead6a2d5c458489f0c359b0e9d1abe9f5f2b
TLSH
T1C3410959A6F91148B3B76E5A9BF6A4BE487B79772E07C45E10010E4F0722B40CCB2B37
MD5 SHA1 SHA512 TLSH

Submit Download