1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf

Analysis

max time kernel
148s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 15.3MB
Sample261023-3kshtsv13l
SHA256 1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf
MD5 632ae2b84ce5a7ae5c51dea5d5b66de6
SHA1 62d8d66952166c8c32de54aef13ab57bb7b6afa1
SHA512 f17fff1ae50d99b2454429bdb5ec5d39b9d5d9ac133297a5c8e16ca3451d35e3a95305c3c0588c0ea72eb8ced419ca62f0d42bf067e99f305088fae011688361
SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6D7gQdGxw:0
TLSH
T1CCF6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{3A4B0F30-9BE8-4D4A-909C-C313E07DB81E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4796	4732	msedge.exe	84
PID 4732 wrote to memory of 1744	4732	msedge.exe	85
PID 4732 wrote to memory of 5108	4732	msedge.exe	86
PID 4732 wrote to memory of 1744	4732	msedge.exe	85
PID 4732 wrote to memory of 1744	4732	msedge.exe	85
PID 4732 wrote to memory of 4968	4732	msedge.exe	88
PID 4732 wrote to memory of 4968	4732	msedge.exe	88
PID 4732 wrote to memory of 3552	4732	msedge.exe	89
PID 4732 wrote to memory of 5100	4732	msedge.exe	90
PID 4732 wrote to memory of 5100	4732	msedge.exe	90
PID 4732 wrote to memory of 5100	4732	msedge.exe	90
PID 4732 wrote to memory of 3552	4732	msedge.exe	89
PID 4732 wrote to memory of 3552	4732	msedge.exe	89
PID 4732 wrote to memory of 6068	4732	msedge.exe	97
PID 4732 wrote to memory of 5840	4732	msedge.exe	98
PID 4732 wrote to memory of 6068	4732	msedge.exe	97
PID 4732 wrote to memory of 5840	4732	msedge.exe	98
PID 4732 wrote to memory of 5104	4732	msedge.exe	100
PID 4732 wrote to memory of 5636	4732	msedge.exe	105
PID 4732 wrote to memory of 5208	4732	msedge.exe	106
PID 4732 wrote to memory of 5548	4732	msedge.exe	107
PID 4732 wrote to memory of 2212	4732	msedge.exe	108
PID 4732 wrote to memory of 2212	4732	msedge.exe	108
PID 4732 wrote to memory of 2220	4732	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffd7808c188,0x7ffd7808c194,0x7ffd7808c1a0
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,14353476695142044277,9976080338210989404,262144 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,16133647510434965350,2361808356277703181,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,6500972805657239752,13283685385164875572,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,12979370073958351263,9225390400487883596,2097152 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,8192824937738926295,17698843258091145611,2097152 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5943519677258342519,15655284248318834718,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,6306536131924651587,1713010353040256556,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2876200517543386597,5173649859731758459,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2876200517543386597,5173649859731758459,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,3313746172142374419,8299315356448451051,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13874426888402644202,12663232689559162647,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3319717333443998141,16375177328669089424,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9878652924455706916,10393513940133225634,524288 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3476,i,8129778668435591671,13044760159660617851,262144 --field-trial-handle=2096,i,9111279177498154118,13065164053883172109,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1502274f-282f-48c1-9247-a736e8eba56d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1502274f-282f-48c1-9247-a736e8eba56d.tmp
Size 26KB
SHA256 9b81d2d10acb23c9aa1677183b02982bc41422a9762bf79f6ed959e532d286dc
MD5 47b05ad06297ba48537f455730868f43
SHA1 f0929c433493227e9eb61a90cda630e0e2a4da1d
SHA512 a53a0e582569f1eda4b053d37bc1119647af3acbdbe6542bbf820398bfaad8db034c01a4e7db9a1c028f6f1e77fa126ccf69f0a4c64a6ccc8825f3d9cd334d47
SSDEEP 384:nviFiZcI63sNG8TUNTUlImkrjh+zI7thfPF9TJVhnrXD7O6R2FeoAgL/7IzhfoD:6FQ63Fwg5VbF9TJVhrXD7TRz0
TLSH
T1C4C24A32E898C9BBBDEA8BD5A74A7957DEF0416385CC9AC4D9D81D1D00875AE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b1d10de-faba-42a6-ac1d-8fb422103567.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b1d10de-faba-42a6-ac1d-8fb422103567.tmp
Size 26KB
SHA256 b01026a0a5657beec072f77bf9a028849928c3cd9d6802c40c7b52c073fb3c2c
MD5 f68fb803421ab75c07497e0d61584258
SHA1 5a5454b0db3a58fc8666683cd54d3cca129cd394
SHA512 ce059b3ec50d24f59e30da80b344d9ada8165737a2fbe959b267a3ccdfa0af06a23616e8328317ae720fb1b1919cfe2f147db65f0fe6990128748171f6e38f26
SSDEEP 384:npiFzQkUSvM3sNy8TUNTUlI4kBjh+wbjathfPF9TJVhnrTD2IeMtUfgL/7IzpIIu:AFdM31wgp70F9TJVhrTD57UJLu
TLSH
T1C8C23A36E898DEABEDE68BD5A74A3643DEE04153C5DC9AD8DAC81D1C00C71DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7df77d59-1e05-47e9-a5d2-dd853c878e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7df77d59-1e05-47e9-a5d2-dd853c878e4a.tmp
Size 25KB
SHA256 89dcd7b10bc4fe5967b167f2b5b8b1aa2ff299634cb4b7ddd197d85d1ded34ed
MD5 7de46d03e634eb4572fe3a49450ab8a1
SHA1 8ea9a847e1e7eaabe80e5c88fb1d6dde042b157e
SHA512 e3137ad4f46ae413c88c08f71cfbb47f6c3b54a2373d3a677dc4e87f184648bb7070ae3956d297f5c41380ae9b84e598a692a3419a3214a9f2adb070a74494f0
SSDEEP 384:nqiFiZcI63sNl8TUNTUlImkrjh+mCAthfPF9TJVbd7O6R2FeoAgL/7IzhfoD:hFQ63Gwg5SiF9TJVbd7TRz0
TLSH
T1B0C24936ECA8D9BBEDEA8FD9A74E7A17DEE00163859C9AC4D9C81D1D008359D030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86766b33-1c47-4731-8302-374cc7be44dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86766b33-1c47-4731-8302-374cc7be44dd.tmp
Size 26KB
SHA256 6ba77f7851a74e928e9424990b22a7f065f517a5c942318dc5fa55f8b943596b
MD5 234081740d7807717de8448abcde956c
SHA1 1810a7601d1105d77b2deb78fcb71e660fd26fdb
SHA512 e89135534464020ca8f699265f6769c3d33cc3e9bbd250afb486e7b204fcd284033e0f79f923bf14a241b7bfed4d9e311146865ea394008175ce138f06f4a141
SSDEEP 384:nGiFzQkUSvM3sNy8TUNTUlI4kBjh+qjathfPF9TJVhnrTD2IeMtUfgL/7IzpIIls:tFdM31wgpP0F9TJVhrTD57UJLu
TLSH
T1D9C23A36E898DEABEDE68BD5A74A3643DEE08153C5DC9AD8DAC81D1C00C71DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

2d76e549-fc2e-4028-9cac-d7d70cab202d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d76e549-fc2e-4028-9cac-d7d70cab202d.tmp
Size 12KB
SHA256 500bfc47a4a9a5d53953b05239b2f6cd1a7f5a395cd4ca4280617228d52ea80b
MD5 1424dbbf373a896dd8cbd4cef1019a71
SHA1 e85743c29037caa90754809db5bec8b3643d10bf
SHA512 ef296328c2de4f8d98abd1dd77eb2ad39cbb23be886dff8968a9735d27db0f6297c07d66bf01dcea0a6355680bd035f1dd89ea07b636d1c5eed2fd6e874f603a
SSDEEP 192:sxZFR1kr/fqsHqXQVazodpHVHW6+WNGYC33g/rUDIg5xFJ:sxZF8r/fqsKXW1HbGoyjv
TLSH
T1B742E7156E28A93B8CC7E219BB55BF53E7F91032A0911F48AAFC8A1C15E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

879766ab-7f1c-4d1c-9fce-94a2c95e0dbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\879766ab-7f1c-4d1c-9fce-94a2c95e0dbb.tmp
Size 12KB
SHA256 cd1908e9207bf984aa3832cc8c826f09cb5913598600420863392e4885f98ae9
MD5 7af1e2d24ebd6c423c1f94cf8c29b750
SHA1 eb95fc55e4088695055f40d7419c2edb4bc94d6e
SHA512 aa924ee34fb09f0cc8e0b58e33974cdeebbc5b29da0511c031b656032be986beffd90ba47d196447bf0a1b2762a4ce3bc9e2def611b77bf5cd5cbc28eda7f7f0
SSDEEP 192:sxZFR1kr/fqsHtXQVazodpHVHW6+WNGYC3Wg/rUDIg5xFJ:sxZF8r/fqsNXW1HbGZyjv
TLSH
T15042E7156E28A93F8CC7E219BB55BF53E7F91032A0911E48AAFC8A1C15E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00a43f26-46b2-4735-bb21-69b74af96c0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\00a43f26-46b2-4735-bb21-69b74af96c0c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7c0df12b-f6c5-476c-b7c1-8f252007adcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c0df12b-f6c5-476c-b7c1-8f252007adcc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dc7cd9d8-9a53-48ac-93e6-9b65ede7409e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dc7cd9d8-9a53-48ac-93e6-9b65ede7409e.tmp
Size 1KB
SHA256 c99393d00ba50e3432d09b8e1b85a7502a1638192da135d2b2a1a414c5af8592
MD5 d1c81a4ab3b3e55e03f77b602dceca5b
SHA1 37e23c60bdf0e5de5c0cea585814746c0b0b2d3e
SHA512 7f4bc39dcc14253ed664d679ae67c86b107ff1ae786ac39c267bc29bd1482182fb58282449b57665acf77d866a406657fff86091a055b9d29bc4f75da64386b7
TLSH
T17331C0F783E5865EC90196F0AA18BE2FDE2D0515432C3D5AC8E4AF6BD3E3071E14265B
MD5 SHA1 SHA512 TLSH

Submit Download

e2a046d6-191c-485f-b8a1-c848eecacedb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2a046d6-191c-485f-b8a1-c848eecacedb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3dc32a6a36821b8c3893cb7c9ecc196d521c69268eea4c9c424005cb680c3314
MD5 196e1b3ce18457e0aec356cce2295d63
SHA1 68d204ff3bae8afbc9101658058fdc77cb918ce3
SHA512 314501d6f502ebabbbd0ffc56ba5985d1268c6ccddd86b6564ad0a77f741fb9be0a6ee1bbfa22552bd1227538300f27324392ecacb48bad21fcb91c7d461294f
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQi:yjNB/XORbkJNlzjk517HNRZhDjl8
TLSH
T1CBB2001571BB0650383E2D0881B4976E9A4271A33068EA7B7FBC04A6DF6BE055DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ab1a24dd-5bb1-4203-8161-7581a313775f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab1a24dd-5bb1-4203-8161-7581a313775f.tmp
Size 27KB
SHA256 d13fe99a73ba75fa1d443f1e6be9e39c6546b620562039b35d66d9769fa83419
MD5 dc5907c3ed19db2269ae1de9e987d2c8
SHA1 b6c8ddf5ffac8bdcd8b60d6d25aff2e39f43402f
SHA512 5b570bd05ef0580abeb132ec1bbb0e96bdbfaf868405ef32b252d5422736c6ce2294593765ee00a63b05e95d91df1a28e5e513a20b9e5bab9e19d422b6561b86
SSDEEP 768:d8+S3v9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcwLle4ZvWrohMYd2:d8+S3v9WvhLvbu1japwLQ8vtKf
TLSH
T1B7C2E82F380CCB7E5FC01E9D9C5A6F9A6D9802C7A6588D4047FE994C03C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8362d6a-ed66-49be-9141-f8f43e150629.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8362d6a-ed66-49be-9141-f8f43e150629.tmp
Size 11KB
SHA256 477787d99c4012c65e9b7b87ec00e15cd1ec980065a6ec2cf19c85d204cfc82e
MD5 e9ea5b18561bf672934a56fc403f33a0
SHA1 fe68c79a4a01e6b8549f668a8d857bbc4a773e5c
SHA512 8c0a4097c0f5d6b0f1a9223c13695df082cf356ac0a0a615c70cd0eb4dcff16616e21b2f045cbabfb6c44ab7d01f75a0d1c12d98199f1dbf4f94ddc2508953d7
SSDEEP 192:sxZFR1kr/fqs9tXQVazodpHVHW6+WNGYC3Wg/rUDIgjFJ:sxZF8r/fqs/XW1HbGZyjv
TLSH
T1E642E8156E28A93F8CC7E219BB55BF53E7F91032A0901E48AAFC8A1C15E77DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d111c182-080b-474c-8f8c-e6a018593318.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d111c182-080b-474c-8f8c-e6a018593318.tmp
Size 414B
SHA256 e52972a82c621329f8d5faea6bd5e34b77cd9c21b4aeda8dbf0b2ebf51898a64
MD5 d81c58ce0b6ea90d54078b75fec3cec5
SHA1 6e0401414759d8686b9f9fb60b47a12a927d0029
SHA512 f94ad1b81e86de8ec63213ca12f16e455f7f48aa40b67d0b05584e5c2f8025fd5e896b73d8f43ff17a546ab427cbd1d3cfa3f100146342d7f309f519fa9faa4b
TLSH
T189E022AACA65EC6B18FD471960644346EB5203477B90484F3A3D81088FB8637878797C
MD5 SHA1 SHA512 TLSH

Submit Download

fa4c4ca4-aa5c-4d1c-bd32-add1103626e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa4c4ca4-aa5c-4d1c-bd32-add1103626e5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b872b467-14e3-452d-a844-da3c51ff7db5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b872b467-14e3-452d-a844-da3c51ff7db5.tmp
Size 26KB
SHA256 438fe8a3181aaf39d9464c5c2318de3f93e3d67a8983b4702720b3292eea2a2f
MD5 0ed3a407868ead91fb3776ad069d0d02
SHA1 774bcef146ae5e67ea478128b81484e0f47b7bcc
SHA512 44ee3f461255aca4464e7d179f38aa7709c78a7c52b62841856358da76297522e9e7ebef1054f7de783bf7346611fd33329856ec37951e13e02eb86a8e9d748e
SSDEEP 384:nEiFzQkUSvHV3sNy8TUNTUlI4kBjh+wbjathfPF9TJVhnr0QD2IeMtUfgL/7Izpi:fFd131wgp70F9TJVhrrD57UJLu
TLSH
T1B1C22A36E898DE7BEDE68BD5A74A3643DEE04163C5DC9AD8EAC81D1C00871DD130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 71729c0fb2a30297233e3759c759b67ef4596945acbc86a087f5b3a743c3eea7
MD5 578c9e0d9eaf722027add9bf26081517
SHA1 7cc16953fefb4df545cca86eb53ca703421d3689
SHA512 e2dea6a864d55a5eaf0e3c47938a15b7d1e146aef482933ee6254e3ebc42e3d4f30a41d716a1c1d04ab034f067986f5105b4895f2e4f2a9f2c42b4a0b040be63
TLSH
T133412A5CBBFA1144B3776E56ABF2A86E487E79772E17D44D10110E4E0A32B40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5104-195-0x00000204673B0000-0x00000204683B0000-memory.dmp

Download