b2f7da08e594d563f9520d70e9f2b70d42cb939fdb0e94d0075665af77c8355d

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReadMe.html
Size 28KB
Sample261030-2sg7dssvct
SHA256 b2f7da08e594d563f9520d70e9f2b70d42cb939fdb0e94d0075665af77c8355d
MD5 2b19f6c393dbabc61f57e9b4da2dc6e8
SHA1 7b498d78a7a7470336ce6a20d07d0ed46a924158
SHA512 32c2f231383f386783b300cd2b7f19b567f09412b884407474aed4d07db4fd31940bf3f567030dd9bcf8d58680ef655603448e252f3ab216db76c140497039d8
SSDEEP 768:ZfjnIAke1hS/eZpSOOgZM+l17jhzQTJyJiJgP64HZHNtyy7:ZfjIAvgGZpSOOgZMG1jGTJyJiJgP6ENR
TLSH
T186D296469AC05B50C77302499B56F22FEF34C0DFB2484686385EC24F6FB3967486B68B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{40B0C244-3CA6-4CD8-9DD8-AD3D08F63958}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1208	4244	msedge.exe	89
PID 4244 wrote to memory of 3580	4244	msedge.exe	90
PID 4244 wrote to memory of 3628	4244	msedge.exe	91
PID 4244 wrote to memory of 5612	4244	msedge.exe	92
PID 4244 wrote to memory of 3628	4244	msedge.exe	91
PID 4244 wrote to memory of 3628	4244	msedge.exe	91
PID 4244 wrote to memory of 5612	4244	msedge.exe	92
PID 4244 wrote to memory of 2444	4244	msedge.exe	94
PID 4244 wrote to memory of 2444	4244	msedge.exe	94
PID 4244 wrote to memory of 2444	4244	msedge.exe	94
PID 4244 wrote to memory of 3512	4244	msedge.exe	95
PID 4244 wrote to memory of 3512	4244	msedge.exe	95
PID 4244 wrote to memory of 3512	4244	msedge.exe	95
PID 4244 wrote to memory of 5088	4244	msedge.exe	100
PID 4244 wrote to memory of 5088	4244	msedge.exe	100
PID 4244 wrote to memory of 5444	4244	msedge.exe	101
PID 4244 wrote to memory of 5444	4244	msedge.exe	101
PID 4244 wrote to memory of 1928	4244	msedge.exe	103
PID 4244 wrote to memory of 1728	4244	msedge.exe	114
PID 4244 wrote to memory of 5212	4244	msedge.exe	115
PID 4244 wrote to memory of 5544	4244	msedge.exe	116
PID 4244 wrote to memory of 2756	4244	msedge.exe	118
PID 4244 wrote to memory of 2756	4244	msedge.exe	118
PID 4244 wrote to memory of 632	4244	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ReadMe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe55d3c188,0x7ffe55d3c194,0x7ffe55d3c1a0
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,898529774494167531,3937107249787330389,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,5461430120839262588,16594156661811565000,262144 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,10506033155477982802,1767906133101387680,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9819334583583317319,7327283833512892849,2097152 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7931772410287497456,12593016249054436697,2097152 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9525308799101791140,2992305219787331746,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5397280562584967657,8215834234264992400,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,17456382200522660133,6598226566351427332,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,17456382200522660133,6598226566351427332,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6030811060492534313,9027980932918618505,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,16619607480427173431,7703537950961359138,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17831058468321492132,9170760960454534464,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,8061168970924185896,10841271760251859382,524288 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,2265230320876189057,5300578521731976910,262144 --field-trial-handle=2292,i,8063457095854879502,5428851698313680587,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53638a7a-fdfb-48a4-b9cc-402bb9b74423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53638a7a-fdfb-48a4-b9cc-402bb9b74423.tmp
Size 26KB
SHA256 f8acabff34efa26f2bd86adf282f5a5987dbab1b05f39aede53c7d1e2761aa95
MD5 6cf8b978b26c31993eb1aad967f2cb3f
SHA1 3a7671d3090019627595f7fd831630cc64e455a3
SHA512 3c689610efb93a1b27d2770af944776c035ad3ad18da75dd5247777f65e3cee75ccd0cf4ca8ae0390631b4e2acdbbe2c1ba5e1a58c6dcb35b1d601050943e261
SSDEEP 384:ngiFwvFwPasuA3sNe8TUNTUlI4zaKMcMPwzfvBCT40HnzTiGmAk7f65KfgL/7Izz:7FwE3DwgFr8BCbXiGmAkD65Op
TLSH
T147C24932D894DA6BACE68BD5F71E3683EEE00263C9C89AD4C6DD5D1C008B5DD430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84513d02-5156-4244-9ae6-d4dd022b34e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84513d02-5156-4244-9ae6-d4dd022b34e9.tmp
Size 25KB
SHA256 433e8eebe6dd817bef0492369e9951e2d72cb99c515a2734c4deeb04099a7a15
MD5 9f6151f2b980a4d6c0600f56cee72733
SHA1 0b7a16a0bddaef16b047321747f02ab6a63f0cdd
SHA512 29c0cdcc788430ade088e50bde1f71a7cad71b9ee38dda52e51d092c2037a18f11a82238850f5c34ad3354e6100555ebd78bb2fe14e41526b557ed1bb2251a02
SSDEEP 384:nwiFiZcI63sNg8TUNTUlIm2aKMiV4wzfvBCT40HnuFDsa+VY1wgL/7Izaof:LFQ635wgcePBCbOFDhguY
TLSH
T1E6B24B36EC94DABBE8F68FD6A74A7603DEF4026395DC9AC4CAD95D1D008359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

047b28fb-1611-4e6f-9731-c2f938958e69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\047b28fb-1611-4e6f-9731-c2f938958e69.tmp
Size 11KB
SHA256 e110867bc6dde36b310a372643245d00ad35a65e7b484791609fe9e714b486aa
MD5 6c48d184a28c15882af66d0aeb759564
SHA1 badb7fd533d325ab3116f445c34067993bf0700f
SHA512 762406723da1ae2c4fc7915fc9795c997406224e31e5ec5c4cd18c565ead3a74b95063cf3a60ca419f36d1f80356e7aa35502bd393be0861186a5abfc5890f3f
SSDEEP 192:sxZBRiskR/f8RsVaQZLY83zodpHXHW6+WNGYor9CSNqIg5ctUAJ:sxZBIR/f6sIOTc3HbG+SUutZ
TLSH
T12742C8156E28A97B8CC7D219BB55BF53E3FD103290911E48AAFCDA2C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8feee98b-2237-4071-bfba-1f090a89bc8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8feee98b-2237-4071-bfba-1f090a89bc8f.tmp
Size 11KB
SHA256 df45022aa0b669c5303cdcce911effafd371c8374ce48130210285336f8a88a9
MD5 865def123efaeac5388d2e7db41e42e5
SHA1 ec0404aff2186956b76dcd3b2969aaa33216a9f8
SHA512 429bfac27b6732ef1e0d382685c815ad1f3cf79de179dcda3cfd91b176c9de5df6fda9097d0773028a388bfd7309f867550fb4504c7cf41f88e3e526f8edf0f8
SSDEEP 192:sxZBRiskR/f8Rs2QZLY83zodpHXHW6+WNGYoU9CSNqIg5ctUAJ:sxZBIR/f6s2OTc3HbGDSUutZ
TLSH
T11942C8156E28A97B8CC7D219BB55BF53E3F9103290911E48AAFCDA2C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b291235-53f3-4fc3-bbc8-bfc985bc7a25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5b291235-53f3-4fc3-bbc8-bfc985bc7a25.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5f0417cc-ffa1-4822-829b-661145fa79e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f0417cc-ffa1-4822-829b-661145fa79e8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

acca0431-0396-4b01-8548-19d83e634be4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\acca0431-0396-4b01-8548-19d83e634be4.tmp
Size 1KB
SHA256 3eee5795271b7d81760b01ee164f3f6f6562c6d1eac1662282084c9ce68d7990
MD5 f881144ae85617a8c91bcf78cdb4d32d
SHA1 103c5aeb3b5c5fb6afc9a118d60eeb7fefea34a7
SHA512 be3b087e2f9185a729929a2018d7c45c5ac0034350fa64b57d907c85a4d4c7502e9a6c186150e0c34553bf2de1a2620e3d06434547b92eacd8edb81543a49f04
TLSH
T167318DF783B4856E8A0196F0AA18AE2BCE2D0514431C7DAAC4E4AE2B93E3471E04165B
MD5 SHA1 SHA512 TLSH

Submit Download

e9834406-9439-4aa7-a563-f46f35439607.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e9834406-9439-4aa7-a563-f46f35439607.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 57b00f1e2afd68a323b345c1c5113fb20b3ce469a9bad64563a4c278311f46ca
MD5 b44188bd0270a2e84ce0b770aef8c95b
SHA1 782e5c3b9cdd31535c7f6afbf8637ecdd7d8261d
SHA512 8bb71bd9b7df0c5fae491cadb223c86c6583cbab130df9a794c7492e7631a1c24b6c4b4213661a115156196ba1eddb86a1399acea071a6418fa2c3671d00c8f5
SSDEEP 768:SL29ObJffppdNlrtONqq7+agMIdMZWC2Beot6a5g6hY:SL29ObJffppdNlrtONqq7+agMIdMZWCF
TLSH
T18DC2225571BB421039FE295C82B6972E164231733119EA6B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a24b0e73-68a8-4c60-8c55-207bfbc66b7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a24b0e73-68a8-4c60-8c55-207bfbc66b7b.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d738a7d4-ddb6-4622-a2a6-dec823ec508c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d738a7d4-ddb6-4622-a2a6-dec823ec508c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e31ab533-45c8-450f-808e-95c4f1d77cae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e31ab533-45c8-450f-808e-95c4f1d77cae.tmp
Size 11KB
SHA256 3c870cb82d1dfff387775ef030fa862d9bc71ab5901a4ad082dc14c468dc872d
MD5 86cdac12528b9bdb0692b0f1e82803b6
SHA1 7b0ad961dd6a319487229b1e9d2e2c22a913f8b0
SHA512 c931d05f98f7022deb54f33a8c66b11a73b630b5ec4d066727927f17c2018b74047f370c8bffe9b9c745e84cf0da3dd6cf664b2ec8ef2d290403ef2f8b932c72
SSDEEP 192:sxZBRiskR/f8RsjaQZLY83zodpHXHW6+WNGYor9CSNqIgjtUAJ:sxZBIR/f6smOTc3HbG+SUjtZ
TLSH
T18C42C7156E28A97B8CC7D219FB55BF53E3F9103290911E48AAFCDA2C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e63ab1e4-f4ac-439a-9b4d-fcd16c5f054e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e63ab1e4-f4ac-439a-9b4d-fcd16c5f054e.tmp
Size 414B
SHA256 32ca71e1a5a5ddc5e2cf59ee31d6c3cfbeaca68228fddcd48a4c2bfda8e00e59
MD5 7ba6df0a631ef70571961db4bd2a296c
SHA1 9a5ff4ddf78ce406373afd8e5dd06be5b82e9374
SHA512 259c1bebd207ab0a896145d3c673a85076bfc356418f651a0dcfc01b72a7e503f1f2d80b52994c4638920fb3394fe9db7870bd5320dfa494f70c6e656ec28f5b
TLSH
T153E02B6AC815EC3B28FD0B7950540346E70423676A40A94B3B3DC5088FB0A37418586C
MD5 SHA1 SHA512 TLSH

Submit Download

b32d1a51-97e8-487b-a1d1-37933f5118ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b32d1a51-97e8-487b-a1d1-37933f5118ac.tmp
Size 25KB
SHA256 7fdca6183a859ceffbc57678f494a95437794ef6166dac998745273ecf28a259
MD5 05caf9f63738cca27975502e20ff0e68
SHA1 f05d738fa97ca5bba72f9d6cb337f0c31bad663c
SHA512 e06121674c9391155ff798446fb971c9df48194a0fbe198eb4c58e85d82ae6a2721af7e9b4a3ad65931e0a1189026bd3cb6a4e65e0083a4719c865442d9f826e
SSDEEP 384:nciFiZcI63sNy8TUNTUlIm2aKMMbMwzfvBCT40HnztiGsa+VY1wgL/7Izaof:HFQ63TwgcIrBCbZiGhguY
TLSH
T1D6C24A72E894D9BBECE68BD6B74A3603DEF4426395CC9AD4C6DC5D1C00975AD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bffaf093-0a13-4c8a-823a-61170afb2dc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bffaf093-0a13-4c8a-823a-61170afb2dc9.tmp
Size 26KB
SHA256 53106659a098989dfea51090e9dda07a168f0f1ea85313f2421fa8de9f0cf4c6
MD5 ac11a917e9604bdf67e222057fad7b65
SHA1 c45b2b13754ee054386cc6685b85c9bc8cd9a0d2
SHA512 2f96b37d3f6f87de2fadab217984359e06cfb24d549652aabaff75072118f0ced86ff194b968f152cd6f3098b6d908bb46f8dd69107874700160c08297511696
SSDEEP 384:nX3iFwvFwPasuvee3sNe8TUNTUlI4zaKMcMPwzfvBCT40HnzXmGmAk7f65KfgL/Y:XyFwrh3DwgFr8BCbbmGmAkD65Op
TLSH
T13BC23832D894DA6BACE68BD5F71E3643EEE00263C9889AD4C6DD5D5C008B5DD430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9af7d2c-c878-4563-8aba-a890af2c9300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9af7d2c-c878-4563-8aba-a890af2c9300.tmp
Size 26KB
SHA256 595833b5081a51873426ea11ef339336d613c8f3338f0f4d2afcad6a86a305d6
MD5 2ff0d18ca3c222d605fce86f55793bf4
SHA1 8a3c0da865d2a9db8b535baf39a3e74303154f56
SHA512 93a7796a7648c0b5c802f17fc7f2f37f9396051087aa64811e0a91297e3ccc3f684ea2c9b31ab17ddacc4a79edd5a9b60d8500f64adaa3db701d03865410ef3c
SSDEEP 384:npiFwvFwPasuA3sNe8TUNTUlI4zaKM6MPwzfvBCT40HnzTiGmAk7f65KfgL/7Izz:AFwE3DwgFB8BCbXiGmAkD65Op
TLSH
T189C24932D894DA6BACE68BD5F71E3683EEE00263D9C89AD4C6DD5D1C008B5DD430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1920c46d743cd1febf64b055cd9aae5a2112feb45711792a7c88e8e6ebba06d8
MD5 1b60cd3fadbcfb4d45316b65a851699d
SHA1 a95fbf77824237483bdbe5e6383c7f8b2c1c3790
SHA512 35ae9ca6133cffbb253dfdf45b2fddb566115d3cfb4583a100b4661f511f27938afa6ef19928722fea21a6b5820e361a6a6afed208df9b50ec02788626b70337
TLSH
T1A8411A58B6F91148B3B36F199BF7B85E447F79372E06D49E00110E4F0626B44C962733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1928-204-0x0000027680000000-0x0000027681000000-memory.dmp

Download