hxxps://na[.]eventscloud[.]com/ereg/index[.]php?eventid=877385&categoryid=6019657

Analysis

max time kernel
148s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://na.eventscloud.com/ereg/index.php?eventid=877385&categoryid=6019657
Sample261027-qj3aesdf46

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{D7FC4638-4B12-4FEC-84FE-6D0348F52934}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
352	msedge.exe
352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5592	4300	msedge.exe	82
PID 4300 wrote to memory of 3884	4300	msedge.exe	83
PID 4300 wrote to memory of 4888	4300	msedge.exe	84
PID 4300 wrote to memory of 4888	4300	msedge.exe	84
PID 4300 wrote to memory of 4888	4300	msedge.exe	84
PID 4300 wrote to memory of 5924	4300	msedge.exe	85
PID 4300 wrote to memory of 5924	4300	msedge.exe	85
PID 4300 wrote to memory of 4152	4300	msedge.exe	87
PID 4300 wrote to memory of 5992	4300	msedge.exe	88
PID 4300 wrote to memory of 4152	4300	msedge.exe	87
PID 4300 wrote to memory of 4152	4300	msedge.exe	87
PID 4300 wrote to memory of 5992	4300	msedge.exe	88
PID 4300 wrote to memory of 5992	4300	msedge.exe	88
PID 4300 wrote to memory of 5584	4300	msedge.exe	95
PID 4300 wrote to memory of 5668	4300	msedge.exe	96
PID 4300 wrote to memory of 5584	4300	msedge.exe	95
PID 4300 wrote to memory of 5668	4300	msedge.exe	96
PID 4300 wrote to memory of 324	4300	msedge.exe	98
PID 4300 wrote to memory of 5912	4300	msedge.exe	105
PID 4300 wrote to memory of 4156	4300	msedge.exe	106
PID 4300 wrote to memory of 5548	4300	msedge.exe	107
PID 4300 wrote to memory of 1768	4300	msedge.exe	108
PID 4300 wrote to memory of 1768	4300	msedge.exe	108
PID 4300 wrote to memory of 352	4300	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://na.eventscloud.com/ereg/index.php?eventid=877385&categoryid=6019657
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe37c3c188,0x7ffe37c3c194,0x7ffe37c3c1a0
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10219554749234258197,4804697983220843853,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,12575593765081035098,6456352107794883518,262144 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17971742836611584554,2343013413339084215,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13719036990748624268,15528645587512466406,2097152 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,450818879985247402,9807280469797392281,2097152 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,16533860890999320667,10723501505332011546,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,5235344973689772102,4593661570177626714,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,18291796517645100132,12633618804268424177,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,18291796517645100132,12633618804268424177,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6040573986154504045,10414843816497923526,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,11068596308087687793,8034358715029949687,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1041490883307546584,14005595349095508825,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,16734126171098002978,6969414287387571145,524288 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=788,i,14082077313399757026,3383323557820136385,262144 --field-trial-handle=2320,i,8740627471215575576,4824120580924680443,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

525942ec-1460-4869-9c40-fcd043f0e81e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\525942ec-1460-4869-9c40-fcd043f0e81e.tmp
Size 26KB
SHA256 1ee158f94c95e9bd1a283c386397e567acc4024a3cc39d58e5da7fcb02e299a8
MD5 c2ce04fa3a753a3cdf2ab50c058a502d
SHA1 cef53f65e0ec571f443475258253e8edff493c98
SHA512 245a8dfb2f778c0a04a107caa359efefb67d43025097e2be1f7fc2177b47eccfc0270e7c5b62e19bfb098e09ca5a756b9c55b3cc0877e30d4a1f341539e1789f
SSDEEP 384:nniFzQkUSvS3sNT8TUNTUlI4knE3a+bMut4fYBT0SRCPuRfvaTZcmH1gL/7IzOIG:iFdS3+wgATDBTbCPcfvaTZcmHQLN
TLSH
T105C23932E8A9CE7BADE68A95B74A3603DEE04263D9CC5AD4D9D95C1C00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bc83b70-961c-4192-ac53-a37ca979694a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bc83b70-961c-4192-ac53-a37ca979694a.tmp
Size 26KB
SHA256 aa309736b357d1ec325da44604814c2c11bd117338a3e1ff0ef26658d87ab45a
MD5 73cf87db7debc848f8499023e1f9bf09
SHA1 db56e3e511e6573b00b38ba5001edb22e6eebeb3
SHA512 1ab22253d26b673ef099c0fcfe119ea8b180e3e6d99ab96194a5bd64b58784a7e4836ffd8d27406e080bfc3ccfc415dff29db96784cfa41908bab817da5be47e
SSDEEP 384:nJiFiZcI63sNP8TUNTUlImkrE3aN/mt4fYBT0SRCPumf7O6R2Feomh7U8gL/7Izr:gFQ63OwgOmWBTbCPJf7TRN42
TLSH
T1F9C24A32ECA4CD7BACEA8ED5B74A7613DEF44163958C9AD0D5D85D1C009B5ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8946d196-ae3b-49f0-9a04-70e1c52409a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8946d196-ae3b-49f0-9a04-70e1c52409a9.tmp
Size 25KB
SHA256 29039099fcb3e1eaf1f127edd97867ef6e4ec85affef820ab1aa61e184b529aa
MD5 180438441b59df1bcdaf4e30020fb53f
SHA1 1dc382983b71b2e2e4a90cb4e5ffa4963b4ad4ed
SHA512 206bffc5ba64eb8fb0a25247e9dce830431650595bd30aa05a226b4d23726521959b086e364b9df77d8ae5a9398c28ee721731101db04c1ce766a2a8b6f5fd5b
SSDEEP 384:nTiFiZcI63sNm8TUNTUlImkrE3a+d3t4fYBT0SRn37O6R2Feomh7U8gL/7IzQod:+FQ63jwgO1JBTbn37TRN42
TLSH
T11FC24B36ECA4CEBBEDEA8F86A74E7A13DEF40163A59C4AC0D9D85D1D009759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a90bea09e212134dc17388b25f224d71e49ca39dcc69bc19702622e77398e31
MD5 1b78c171c4c68630e5b7ebb32c84e785
SHA1 91cf5dd71c41350998b7d2281087fdcfdebe69c1
SHA512 ea0518551e5ebe409c443be54112086677308fdab24beab120e4553deb487efb00bf47a7a850d5952ae98f894136b4b665897af533998d21b0bdebe2ab6f9313
TLSH
T130D0244CF5FCD054D413103FC3304F4033C5C5545103F001C04433550C477030754050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5edd90b1baeb2e089f20776064e97b90615f17d249e44b7a9c0602ff76486d0a
MD5 9d29809c2652c8f7dfc1714b2ac1a04f
SHA1 28fb378c24d9aac9ca93b7f2fca1fbc0a530d7cb
SHA512 c345ef3a531aa93d7824ddea36d18622a1570ee297cad7b5d96e1ae939f7d3707f43de0eb45199d3a54bf405be219fdbc9945a0fd027f574d395ff53007aeedb
TLSH
T124D02B48F9F88054D402103F82604B4033C581545103B001808422650C867020A54050
MD5 SHA1 SHA512 TLSH

Submit Download

09bf86c4-b84c-47f8-b4d9-224674dab33b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09bf86c4-b84c-47f8-b4d9-224674dab33b.tmp
Size 12KB
SHA256 58033217ab2d6e8265b19aa223821d992eff2e029711ad136076c6b71d284f24
MD5 ddcdca2125947fc061f1248afb97172a
SHA1 12375e96635bc0eb1bef89ed3b08082342347dae
SHA512 1df3dace589a578d7ae302d9ea5e61efeb853d1749c661137bb2b4247fff2ad394f4f3124c9d504203f1be139b24af01cf44c9a9356b27da04cb73cd15666b7f
SSDEEP 192:sxZNRzk3/fEs6re1sTzodpEsHW6+WN24//YMWqY06PTQIgjtXJ:sxZNa3/fEsqelhHbd/TQTsjt5
TLSH
T12042C8166D28AD3B8CCBD209BA55BF93D7F9513391905E48A6FCCE1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

225e19b1-6cad-4828-abe7-f4e56f99ae6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\225e19b1-6cad-4828-abe7-f4e56f99ae6d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9c5e89be-eca7-4fc2-bcb0-ef5db5bc15fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c5e89be-eca7-4fc2-bcb0-ef5db5bc15fb.tmp
Size 414B
SHA256 441d9ee8d94d69cf61fb0ae915de31d879a9c540733eb81b29433a0424a72fdb
MD5 57e98427de08bbb3a5c79e0d236f4ab1
SHA1 f4adc4019f7c946192632053d6adf71c8bf85a85
SHA512 9814e36e024f8b62eb44c4f6b8a8820366e476503491184fc055e3139fb677512b866373a082bb5a8902db1f89da4f2b0cd617501a93df05757dee25e18e10ec
TLSH
T112E0E5AADA35EC2B09FC075895504A4AEB45535716D0555F3F3D81098FB4A3B4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 10c6558f85fdbf2921c098411738f3f7bb469fbda677d1cce9f01597102c984a
MD5 25bb27c6b479273481579e1aba282e81
SHA1 b9be70c79d3fed2484b705f628321e2a7a2d868f
SHA512 09fa685c3e6aea0630f0261725c3aca4bf9ea28004bb9bf977a74791aa1d3076cc07a7f445905e73a05414d32fcea1f4652372a2fcd4988e7f8f5ddcd480a4e1
TLSH
T14B714D0512ACBC92EBAC06728AC152E3B5346B90D28BDD7D0D98C4B9F743F1D425E76C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e87674614337b7f58c856911f29d0dfb2a118df1ff458d736c5e19b2d2251eb3
MD5 6fe5e22ac4389aaa73fa066a4fa37209
SHA1 2870de3b3c27d0eb9f9b71f9f6fef7b94f51e641
SHA512 0a961c7340e0a25dd360d0452d9fe12c6b4b6a276ace00d325cd029d0814224fc728a6d61decd44ed39e1105d55b69f529c6f7cc8c8770ab46b64f0b68f65bb0
TLSH
T1E3615D0506AC7C52EB9C0A739AD092E3BA246B90D18FDD3C0D88C438F743F1D026E768
MD5 SHA1 SHA512 TLSH

Submit Download

68bc7b17-a47e-40d9-adac-f1da3cfb3be4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\68bc7b17-a47e-40d9-adac-f1da3cfb3be4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05a44d94-026a-4cc9-8832-7b67956b162a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05a44d94-026a-4cc9-8832-7b67956b162a.tmp
Size 2KB
SHA256 b816c012c4a2497148d39c677535097871e6d231a9cf5699a5f0390b1a9ba3ca
MD5 bc9aa50a1f4a0b6e124f34c4b0096935
SHA1 5b38634668be53d4428f036f406a30ece16d86c2
SHA512 cf4d6d9084a97e2cbf5932fbedb4f03516452f1af1bb39a967e81e68c3de74cf00bc1f979a99bb3fe7f7ca298a40b017d074b5cdd5d41e639647ef2798fb0f14
TLSH
T1A5419DF743F4866E8A1192F0FA18BE1FCE6D0514932C786AC5D45E1793E3461D141A8B
MD5 SHA1 SHA512 TLSH

Submit Download

502254c9-e731-47bf-98fa-533e41335433.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\502254c9-e731-47bf-98fa-533e41335433.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 113a43bf3dd61b8f66c672b3c9abd6f895adbcd1268cb29f8f512f02f6ffe5b6
MD5 cc0957303669ee76338f877c4218a014
SHA1 2f2e0af36fd1eea770e44de723e668fcd38abfff
SHA512 e2796f5c35b4cecc562054ede27c3422d9e3740c109d7e302a0bf36b3ae358391021e1a8de3cb89e06bc7411bcbe32146370c96c02add0d30140660318a0c81b
SSDEEP 384:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeDdERN/rviDuRlJ1lnKVl+HYHUFDTGbG:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9Wey
TLSH
T18EB2141171BF0240783E2D1881B4972E9A4272A33178EA7B7FBD10A6CE66E045DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ba4e0bba-d023-440c-8ba0-626fd313ef3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba4e0bba-d023-440c-8ba0-626fd313ef3e.tmp
Size 12KB
SHA256 515c8db039721812de69955a93058f6d023ed4474ef3abcd43866377c16f6bfe
MD5 8d28421039571f69d22b64058014c6d0
SHA1 fa968da59a29abe1b6bfef878162511cf2c43b10
SHA512 ce66af3abf999a1120c07432779b34cf9547ccf14e1fce5de5a04093dd442e0d854e6dc4830986dd3bde9315e355d08e7f0b8882f726c140eabd51cd8fb5ce40
SSDEEP 192:sxZNRzk3/fEsLe1sTzodpEsHW6+WN24//YMYY06PTQIg5gtXJ:sxZNa3/fEsLelhHbd/yQTsmt5
TLSH
T16142C8166D28AD3B8CCAD209BA55BF93D7F9513390905E48A6FCCE1C14E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc8c0a3d-7973-4370-9c54-239c16d68862.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc8c0a3d-7973-4370-9c54-239c16d68862.tmp
Size 27KB
SHA256 7d1b5dcb49680e294d80daed458d514d3f94f855042fe386914af89cabeaef98
MD5 9217895182cee47cb799687b981fb073
SHA1 1693099e4ed9d69389b232984a5edda771f2f12e
SHA512 f4e103f707c874293f86c8f0d5d6710176997cda1bea8407e433889f62e329dd3f0768c69d9c1e95dfadeb9ae4edfbb4ac5038515ff5eeceee66704917464e99
SSDEEP 768:HaaazDVWvZTyo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdLLlCQcmMroWP8:HaaazDVWvZTyou1jasLLwVmXWP8
TLSH
T145C2E93B244CCA7E4FC01A9DDD5A6FDB2E9802C7A6588D4087FE984C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd6f05f9-77f7-455d-8c62-1fb2cdfdbdae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd6f05f9-77f7-455d-8c62-1fb2cdfdbdae.tmp
Size 12KB
SHA256 cd47e02589bec6d75dc676167e26a8b9eaa0b9e972268ac7a64db0447ca6d199
MD5 4fda9e8ac3bc5ec895603446bb8a2d9c
SHA1 777eb8710780f6647908c9f1c3e01c4e51c3899a
SHA512 59d36acea6c959dc34f016e97988e13353e4f24810a892fdd693c69d7425b7ee0901d611627b5a5f70f41f93239257085a2d9aed814811b3a9722143936bf5e0
SSDEEP 192:sxZNRzk3/fEsAe1sTzodpEsHW6+WN24//YMWqY06PTQIg5gtXJ:sxZNa3/fEsAelhHbd/TQTsmt5
TLSH
T1A242C8166D28AD3B8CCBD209BA55BF93D7F9513390905E48A6FCDE1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa14519d-8035-4d11-8130-04cd5e966810.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa14519d-8035-4d11-8130-04cd5e966810.tmp
Size 31KB
SHA256 0c5347790479731485a91c7cd5b6cf1cba9a968cd05d81632cb52bbf201ba95f
MD5 bb751f51f07c44a1302b191fe02c4226
SHA1 ced2e334c9f86806d22b022a0546ce8140c56ef9
SHA512 31f70392bde15eeff1bf5d9f5f95d82437ffe5877feff47e83b7a445d806a757fe6ad81b674fbfb1b09bce9cd0a72a641be4cb3f409bb5105325fbee92651b02
SSDEEP 384:ngiFzQkUSvAv3sNT8TUNTUlI4knE3aXgMut4fYBT0SRCPuSfvaTZcmH1gL/7IzOp:7Fda3+wgALDBTbCPVfvaTZcmHQLN
TLSH
T108E2B3F2A8D78977D99E4B93A77D2E0299FCC113B4885A94B7C85C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f717fbea-0213-4cff-a8a4-5003d95dfa91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f717fbea-0213-4cff-a8a4-5003d95dfa91.tmp
Size 26KB
SHA256 34944f042059be890079a5b21a84c6d656f7fac99f12a208042addf1b786c412
MD5 295df3c9d476cc0cde42d36e6bdc9102
SHA1 170e7a1f2b98a064c5242351e7173da575df7120
SHA512 62c85fb324613f492fbb983cdfb9d45816197b6c5d02fc7f672d3b9ed28b0a024b9fcf19f698bf8acd3e2ecd882b785538ad9dac8ec4d4a1ee4f79974939de3a
SSDEEP 384:neiFzQkUSvS3sNT8TUNTUlI4knE3aXbMut4fYBT0SRCPuRfvaTZcmH1gL/7IzOIG:1FdS3+wgAsDBTbCPcfvaTZcmHQLN
TLSH
T17DC23A32E8A9CE7BADE68A95B74A3603DEE04163D9CC5AD4D9D95C1C00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9a51a8fc36b3a7b9b7e2801773122ee9733ebd5497acca6441b1909d8763cb1
MD5 6d3650e02ee849c6fa2d2525f200fa5c
SHA1 8845f9dc946f324e1695bb824dcc2b80d18cd4e9
SHA512 6a7c50ed9dbb53c312e52098468a639b157e03b1b894889d6ce346039eda70f16adec01c10f68d12dbcdb21211fd3c0dc8c2c72633d03404c4a9e9324b449c06
TLSH
T1CB41E76CAAFE1148B3B77E5AABF3646D847F78772E0B945D10110E4F0A22B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/324-256-0x0000029B476E0000-0x0000029B486E0000-memory.dmp

Download