aba8919558314f152e806bbd3ac687490d7afba13a4bc4b0b0acdd98de6928df

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NiceColorPalettes/reference/nice/palettes/package-tree.html
Size 3KB
Sample261027-dbpcdaxy8j
SHA256 aba8919558314f152e806bbd3ac687490d7afba13a4bc4b0b0acdd98de6928df
MD5 eb09f4b40e390ce01b2cdcd2e720f0a5
SHA1 538beba4098c8f740d517fd601e29f251beae755
SHA512 0a3febc1509a4366ca51d7dc13a9e08d91b178dfeaae2cef8656ee95e31a0b305f7bfb6ff714a74ef8ad706bd718c9e62a44c8b55d29c391b8fd4d0db36ca74a
TLSH
T1918140260D8AB962024317EA7DF94364B5F38633D6B97D0072FCD266B681FC84F0686D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{4021AF1A-9171-44EA-B175-6788623FC4A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 3416	5464	msedge.exe	84
PID 5464 wrote to memory of 620	5464	msedge.exe	85
PID 5464 wrote to memory of 2428	5464	msedge.exe	86
PID 5464 wrote to memory of 2428	5464	msedge.exe	86
PID 5464 wrote to memory of 2428	5464	msedge.exe	86
PID 5464 wrote to memory of 4548	5464	msedge.exe	87
PID 5464 wrote to memory of 4548	5464	msedge.exe	87
PID 5464 wrote to memory of 2616	5464	msedge.exe	88
PID 5464 wrote to memory of 1904	5464	msedge.exe	89
PID 5464 wrote to memory of 2616	5464	msedge.exe	88
PID 5464 wrote to memory of 2616	5464	msedge.exe	88
PID 5464 wrote to memory of 1904	5464	msedge.exe	89
PID 5464 wrote to memory of 1904	5464	msedge.exe	89
PID 5464 wrote to memory of 6088	5464	msedge.exe	98
PID 5464 wrote to memory of 2824	5464	msedge.exe	97
PID 5464 wrote to memory of 2824	5464	msedge.exe	97
PID 5464 wrote to memory of 6088	5464	msedge.exe	98
PID 5464 wrote to memory of 4856	5464	msedge.exe	100
PID 5464 wrote to memory of 5688	5464	msedge.exe	109
PID 5464 wrote to memory of 5112	5464	msedge.exe	110
PID 5464 wrote to memory of 6140	5464	msedge.exe	111
PID 5464 wrote to memory of 2964	5464	msedge.exe	113
PID 5464 wrote to memory of 2964	5464	msedge.exe	113
PID 5464 wrote to memory of 1720	5464	msedge.exe	114
PID 5464 wrote to memory of 1720	5464	msedge.exe	114
PID 5464 wrote to memory of 4476	5464	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NiceColorPalettes\reference\nice\palettes\package-tree.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd0e73c188,0x7ffd0e73c194,0x7ffd0e73c1a0
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,794876290138570407,17146125915845872307,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,8069418785366921183,1041645602955320217,262144 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,9505993950179461442,11434429220104147471,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11724741426352088945,7561310099290331311,2097152 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5973816150198249853,14362931206728147187,2097152 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,13176264167910113322,18103410825305192159,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17025248048873316939,5872911361518935056,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,17329146184228025332,7549692443941905174,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,17329146184228025332,7549692443941905174,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,2728090220218372837,7900041540681904373,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2473125612386443403,8794670183953262197,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8060069409543985477,5875327155680587495,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,16768851498722589132,12404773136136588702,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13807888609739454564,15791073065448687392,524288 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,10506674648441507536,11439662699845886667,262144 --field-trial-handle=2432,i,13536087170976993562,18335110389870385970,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44362055-d9c2-4e0a-b44d-c9d2371e2095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44362055-d9c2-4e0a-b44d-c9d2371e2095.tmp
Size 25KB
SHA256 498086162f908bae1963647f663d102b70d426fa7991a690b42ce9e8ac61b225
MD5 529f406b0c4a266d9d692b7baabde319
SHA1 d6fc8937edbe377540612b122b9c16207156f68c
SHA512 1c98c49d39bf876423e41bd64f42ffd7e83ec78665650cce1fb9c32b74e8a30b0ca968997b73e75fe3d66b1ca360580e1b2d8ccad244c626e65d38af4cbe0425
SSDEEP 384:n8iFiZcI63sN08TUNTUlIm25mg5anK2fMBVvrWfVIsa+VYWzgL/7Iz/oB:nFQ63FwgSRQBVEIhgLK
TLSH
T198C23976DC98D9BBECEB8FD5A78A7A03DEF01163859C8AC4DAD85D5D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

00590ca0-426a-4b0e-b1c6-ab1648300ab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00590ca0-426a-4b0e-b1c6-ab1648300ab2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1e4f1abb-7c27-4ec8-8b36-7a48daa594cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e4f1abb-7c27-4ec8-8b36-7a48daa594cf.tmp
Size 11KB
SHA256 4fca038bb50d7021265717cd6b8aa72b6bbf27e71bcd363e4f3a163163498267
MD5 0f55f7d8b327f05f3b0e6b398cc0ded9
SHA1 85fc798611f98b8614a6315b2278d83229c713c9
SHA512 8379387b233a05ba5d2c17047a1fca102523314506d51a08136aa13d65b76d2697c57e20c774b702da1c024b6dbbe44cbb1af1b8a16fb49dce7836121dcbe609
SSDEEP 192:sxZpRNko/f1sTQZZ3TzodpHJHW6+WNGYbItEhYLIIg55xJ:sxZpEo/f1sTOZ3IpHbGFOYoH7
TLSH
T1D942C815AE28A93B8CCBD21DFA59BF53D7F9503290951E44AAFCCA1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30f61992-a8c5-470d-b5d2-be4a1762dbe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30f61992-a8c5-470d-b5d2-be4a1762dbe7.tmp
Size 414B
SHA256 474b5e518fd6a4c3383dc07cea958dc0c40d284790ac191b6b92db45e1df44f0
MD5 278e42dac6461a221224f809d9691c4c
SHA1 b6192bb15e7aebfafea4e503df7270bb243ee833
SHA512 837dd031b0c3ead05d2e1ec1c5ea3fdf5855b9e93a2f51e828d2a03a99496e7383b3a28db4e66919d452707b4c723534ce3c005dff19c7c64d5a6cd8e0233d6f
TLSH
T197E02BFACD19BC3B0DFC1B1850580645EB9113473A81848B373DC11D8FB173691C696C
MD5 SHA1 SHA512 TLSH

Submit Download

659cc18d-49de-47d0-96b4-479fb2a2a167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\659cc18d-49de-47d0-96b4-479fb2a2a167.tmp
Size 11KB
SHA256 ae32f5b184c8fb19e6da0616a677eb0ab4d18ad2628b3da43747630753d36e84
MD5 6722873ec5eb43b5acac076fa6c81641
SHA1 ad6a3bc775d4f3cae6f7ad6db0f33866fd52387e
SHA512 ee92030b34d1c0183bad65fa5d61309d20598051a8195733e2217f2482dcc39f4ea35ac3feaad5528a7dac4e1efd93216b4ac9139dfdadbb7311c1bd92c9a949
SSDEEP 192:sxZpRNko/f1sxQZZ3TzodpHJHW6+WNGYbItEhYLIIgjxJ:sxZpEo/f1sxOZ3IpHbGFOYoj7
TLSH
T17B42C815AE28A93B8CCBD21DFA59BF53D3F9503290955E44AAFCCA1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cbf47d04355b3df6ebbf44ba146fd49703e208f74b7dabc0dc4079153fe63544
MD5 0ff69398343521cbebbb4b6b0323507a
SHA1 d08b05f17fd81cac13e8312ec36bb10e6c6a7b1d
SHA512 642a53f3fcf8a8630bbaa5baee286369dd855de3695aac28fbbf029dbc8aa96b0a041d9f714863af462aa9d34491775610559ac2d88b8239e549694a9c283d40
TLSH
T16EE026D945DAC32FA308A667477C930C8BC1365F92C0BD4E1B0CC598B586440E7A36E0
MD5 SHA1 SHA512 TLSH

Submit Download

ac1e3cb3-2f9c-4ad6-ab6c-e40cb53edcdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ac1e3cb3-2f9c-4ad6-ab6c-e40cb53edcdf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3f119476-0180-4e63-97c4-478e17c04cb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f119476-0180-4e63-97c4-478e17c04cb7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b716085a-f3d0-4550-899f-a6e73eab7f93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b716085a-f3d0-4550-899f-a6e73eab7f93.tmp
Size 1KB
SHA256 1da9b8a945130fe6e47c30f017488f7e7ad3d5613d60cde6b70774603bcf0533
MD5 44a984182a0c663b4b0eac3aee3081c4
SHA1 9b4dbf715d61eecb1ec1ca85f2b78a0d0660b5bc
SHA512 743b73b22534fec4d1a617e9cf0df036b71a7f2545b8d2628529931ae64920235c702d1cd829b4b3a0f7398859c82a680bf4218c6b31491e2635c34e1b01f7af
TLSH
T1A631AFF387B4856E8A0196F0AA18AE2BCE2D0515432C7D9AC4E4AF2793E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

f6f56deb-ac7d-4c45-9c1c-769e4c84e259.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6f56deb-ac7d-4c45-9c1c-769e4c84e259.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3262ceb6b5ec9d579936629e9ce95761e565efd0f3d4c1a6199677083f60186f
MD5 142127203d298b458de3f9cb53c521fe
SHA1 97bbc631a0e719fd0727b09fb523cd3e47ebb058
SHA512 376b94090c99469017a5d40647840a4f970439bce280da8450f3d9de4d7a703282b5afa41a04468793300e3ea778508f8958c3341a9fc3095efd61bede24f224
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vc:OtfFvpopPxrB4RhfEzc
TLSH
T120B2261471BA021138FE790881B5972F464232B33259EA3B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bcb490d6-5be6-4d92-9b07-6c49f156fe8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bcb490d6-5be6-4d92-9b07-6c49f156fe8e.tmp
Size 11KB
SHA256 76412bf52e14abc0d7ef0e1bea6d39c2c7e620eb0fb48b759551073032b4842b
MD5 43801abee178523d2d867e4a1830a6e2
SHA1 e1c66dc4ae1f35544ada4b47dfe81b00d3dd1a1f
SHA512 e7a9c2f486a09dba07ed2e0c82409fbd2d357a2701ed962957966e29e1cba31af9248b9c225d63541be8db26a801fc4cd014a92bf857033c2bec97527915e484
SSDEEP 192:sxZpRNko/f1skQZZ3TzodpHJHW6+WNGYbILEhYLIIg55xJ:sxZpEo/f1skOZ3IpHbGF0YoH7
TLSH
T18A42D8156E28A93B8CCBD21DFA59BF53E7F9503290951E44AAFCCA1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1634be2-5000-4527-9955-cff57bb255a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1634be2-5000-4527-9955-cff57bb255a6.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a93ed410-d73a-4732-b759-08a70f5b4b2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a93ed410-d73a-4732-b759-08a70f5b4b2f.tmp
Size 26KB
SHA256 7c92771911d7330d5e08d14c5b4d587a50b3a1023df15f1332a34ed5ae31c88d
MD5 0c823cedc5db3aa7cb7c6787f0660cb8
SHA1 f8a63c05bd7d7232882c5c08a3913b3f25217207
SHA512 43f52eee6d7cae7d61871310d90e224f3af9251fc6953005a42573adee17328929e2cd352f0edb9608f27f57694f8b2c268ed648f0e72a76d3efea23c2454137
SSDEEP 384:neiFzQkUSvV3sN08TUNTUlI4l5mglokK2fMBVvrWfssivaTZcybto9gL/7IzgII/:1FdV3RwglNdBV0ivaTZcIoaL/
TLSH
T16EC24A32D8A9D97BEDEB8AA5A34E3643DEF04253C98C4AD4D5CD5D6C00CB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6dd7e5d-90f0-4b1a-8899-483eaf2fb9e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6dd7e5d-90f0-4b1a-8899-483eaf2fb9e5.tmp
Size 27KB
SHA256 1c9e2fe8edd5c03ea2caab8fa69dbc1ef73f2383c4dbfe27295f75dcfa59fab3
MD5 906f6e6978266e9663f5e7f7028a3247
SHA1 ef7e83e97ef59427596a851ceea7ad67be6b30bd
SHA512 1015e394dab847572659130777fd268de4acd8d1c10a7f43fceb9544ce5658ca5d07c1097352a0dc78d2662cdbcc9dd7a9304041f84e031d4c36f1a8fae82f95
SSDEEP 384:nqiFzQkUSvPQY3sN08TUNTUlI4l5mgWokK2fMBVvrWfs3ivaTZcybto9gL/7Izgr:hFdl3Rwgl6dBVvivaTZcIoaL/
TLSH
T15EC24A32E8A9D97BEDEB8AA5B34E3643DEE05253C98C4AD4D5CD9D5C00CB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddfbd6ff-f19c-4650-84a7-430ecae9d570.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ddfbd6ff-f19c-4650-84a7-430ecae9d570.tmp
Size 26KB
SHA256 ec7f436373f1cb5def26a511ad6eee0c620483283cb131f9931928e1ad205321
MD5 3678bc7972a7f1a700b5551ce041aa86
SHA1 f5c8eaef098e69fe19e712cb8d3314208eceeb56
SHA512 18018f6730cd486175a02e61abf364387b887bec9178f07482d157aaf5a29932db4ba318964fbf151c1f8fbdecdcfdf13efb3a1d42f1bfc249d5be5d00824fff
SSDEEP 384:n1iFiZcI63sNw8TUNTUlIm25mgvsRK2fMBVvrWfsJisa+VYWzgL/7Iz/oB:8FQ63hwgSjqBVxihgLK
TLSH
T11DC23932E898D9BBECEB8BE5A74A7A03DEF04153859C8AD4D5DD5D1D00CB19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f69181db-77f9-4349-a231-813efdcec669.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f69181db-77f9-4349-a231-813efdcec669.tmp
Size 26KB
SHA256 cbf7f763244ef7b00c11a84bd02d38537370d23e41fdaed1a1485d9322a43d14
MD5 bd60ba1cc2e0211e2f775ef46c321ca6
SHA1 5676096f3274b52176de1bf4d199d1e1e6b112ff
SHA512 540dd9e330b595dfcb0f5626cdc2313f5f890408d470763aa73b52fd13780c2a652f2e6c7d83d625298e4b6851c15117388785b4c887e1e44083e6f37bddf5ae
SSDEEP 384:nFiFzQkUSvV3sN08TUNTUlI4l5mgWokK2fMBVvrWfssivaTZcybto9gL/7IzgII/:MFdV3Rwgl6dBV0ivaTZcIoaL/
TLSH
T185C24A32E8A9D97BEDEB8AA5A34E3643DEF04253C98C4AD4D5DD5D6C00CB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 77b4f6b7e26fd5d5af49f9ec73b00fff1c60d7ebdcf07634dc90e5e50dd72a4c
MD5 92417d29ffae722fb4c1d5fe0b428420
SHA1 4e610858907a32b5df708fb333afde32f3638365
SHA512 8a4431159528b7ba329f7a0221909442fcac471b3f265e2e7a734aef4d54b1e098fa5d24524fd67498232db1c2db1edf1d22dd6c6fd698b8545a05bff1b75ce6
TLSH
T137412A58A6FD1118B3B77E5BABF6A82E587BBD372A06D05D00110E4F0622B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4856-203-0x000002032DCE0000-0x000002032ECE0000-memory.dmp

Download