a7319a45d6966ad6fa4db11b4aeb7b183f4fd76295b965034b4fefd1ae918611

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f-o-lqEmA0CM_ltq5xEDAAIAAAA.html
Size 1KB
Sample261030-pg778aef33
SHA256 a7319a45d6966ad6fa4db11b4aeb7b183f4fd76295b965034b4fefd1ae918611
MD5 6f5f6bb640792d68f7462de7f1e3f48c
SHA1 112c1de161f9008477854b6b94b3dd46840299ca
SHA512 43715572a2b19700cbbff2214075c7ddacd7b04d5a6b8c3f0ad01d57293d970abf087bec2797c7ebe1dd1d6117644f6288b04f2ab9dbb5d83cbb0896f4445da2
TLSH
T13E111257E445AC3ECA1413A0CED9FA4C1599720FA8C5DD1CA4F0B9E84630A9F6C8667A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{7D8840A4-F73A-4268-AB9C-983461EF0BEC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 452	5008	msedge.exe	84
PID 5008 wrote to memory of 2068	5008	msedge.exe	85
PID 5008 wrote to memory of 4092	5008	msedge.exe	86
PID 5008 wrote to memory of 4160	5008	msedge.exe	87
PID 5008 wrote to memory of 4092	5008	msedge.exe	86
PID 5008 wrote to memory of 4092	5008	msedge.exe	86
PID 5008 wrote to memory of 4160	5008	msedge.exe	87
PID 5008 wrote to memory of 6008	5008	msedge.exe	88
PID 5008 wrote to memory of 6008	5008	msedge.exe	88
PID 5008 wrote to memory of 6008	5008	msedge.exe	88
PID 5008 wrote to memory of 2008	5008	msedge.exe	89
PID 5008 wrote to memory of 2008	5008	msedge.exe	89
PID 5008 wrote to memory of 2008	5008	msedge.exe	89
PID 5008 wrote to memory of 2448	5008	msedge.exe	93
PID 5008 wrote to memory of 2448	5008	msedge.exe	93
PID 5008 wrote to memory of 2448	5008	msedge.exe	93
PID 5008 wrote to memory of 3244	5008	msedge.exe	94
PID 5008 wrote to memory of 3244	5008	msedge.exe	94
PID 5008 wrote to memory of 1268	5008	msedge.exe	95
PID 5008 wrote to memory of 1268	5008	msedge.exe	95
PID 5008 wrote to memory of 3332	5008	msedge.exe	97
PID 5008 wrote to memory of 3332	5008	msedge.exe	97
PID 5008 wrote to memory of 3332	5008	msedge.exe	97
PID 5008 wrote to memory of 4324	5008	msedge.exe	96
PID 5008 wrote to memory of 4324	5008	msedge.exe	96
PID 5008 wrote to memory of 2504	5008	msedge.exe	98
PID 5008 wrote to memory of 5056	5008	msedge.exe	102
PID 5008 wrote to memory of 5544	5008	msedge.exe	114
PID 5008 wrote to memory of 1856	5008	msedge.exe	115
PID 5008 wrote to memory of 2036	5008	msedge.exe	116
PID 5008 wrote to memory of 4052	5008	msedge.exe	118
PID 5008 wrote to memory of 4052	5008	msedge.exe	118
PID 5008 wrote to memory of 5960	5008	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\f-o-lqEmA0CM_ltq5xEDAAIAAAA.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffcb301c188,0x7ffcb301c194,0x7ffcb301c1a0
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7032386649473754642,5198900426368081736,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,2654615907179377075,6274080076500145651,262144 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,9455892310356178243,12965382132321475240,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,15287641692839685373,14927656059500563663,2097152 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,776872154405510540,7139892551957441980,2097152 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3500,i,2029429630791733790,11314285274310621604,2097152 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13018736216149331135,5428070819764074719,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,14705005748821469144,16306772425304174222,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15172909815301247283,17227355574004737255,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5724,i,1877588275857570463,4924305627931196830,2097152 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4483739674693268039,12116212996916788284,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,4541813916183641666,12932986974162456327,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,4541813916183641666,12932986974162456327,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13873154414495492044,9157906570950457307,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,6768800030065487112,10799694337576388259,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,5627072514913494201,16442013038191669623,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14559532422229945181,5770493904192876531,524288 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3648,i,11479037435694674452,14592792742600302996,262144 --field-trial-handle=2820,i,10699799627397590526,7453786068062478995,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c767eed-3d04-4bfe-b75b-ae556f3a8428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c767eed-3d04-4bfe-b75b-ae556f3a8428.tmp
Size 27KB
SHA256 4be43f291b793f9f629028c25d81de6ca1197188cac2c6e2e4f9731ad70ae2fe
MD5 bd881b114430b6e02d50fe7a96ec51f8
SHA1 4947d0775dd7bd9ffe47ab204727fc2c92273d0b
SHA512 2b9e25f02f5ca5fdc20b21ac0ca91acfe80faeffe900926cf8fd4320293deda514c5ac47b1918a73c39f7b852f007f7cce4c982afdf9d2448747e53d6cfda189
SSDEEP 384:nMiFzQkUSvGGsNk8TUNTUlI4G5mgA+0K2fMBxrN740kHO2IegL/7IzB5IIlv:3Fdr9wgIytBxN7df5yLN
TLSH
T183C24A36E899D9BBEDEB8E95B30A3683DEE00253C99C4AD4DAC91D1C00DB1DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37b253b0-b94d-4c1a-8ff3-3e1e8afdb5f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37b253b0-b94d-4c1a-8ff3-3e1e8afdb5f5.tmp
Size 25KB
SHA256 4f953afe67de600c28869dafb2d342cf5bd3322146608e42fc3d52e2a6f1b9d9
MD5 7678094607f496699094a9df16455e41
SHA1 246185fac73acd65c718b02b0f21f9d6c23b0fc0
SHA512 471a9270f585f7e5a43b2b52fd4f943da33f24e95fe13efb4b1f6c83afad01cfd8c576feb1495be236020ef1f632248c2c311bd1ca2aadada93b897bfd7c84b7
SSDEEP 384:n0qiFiZcI63sNb8TUNTUlIm25mg5pnK2fMBxrN7JG7O6R2FeoKgL/7IzmoJ:0hFQ63ywgSeQBxN7JG7TROe
TLSH
T10CC25C36EC99D9BBEDFB8F9AA74A3A47DEF00163859C49C0DAD84D1D009759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50fb5f01-9ccb-404c-a3e0-45c470044013.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50fb5f01-9ccb-404c-a3e0-45c470044013.tmp
Size 26KB
SHA256 2aaa9ab4da7f318982a6ddbaea50e177f33f677788852a4036ecfe4ff5a7ab8e
MD5 ebb6361f1992a220a20ae6c550ad11ac
SHA1 4bfa9febff4031b590d97d292237ba7da2033d14
SHA512 62aba38a4f261613d63bd2a91e5f7666896338e1d363965854fcab8193945d8d162ca52aafe1c1f0db05ef70af196a5f5edd777e2dc16699926248d6fa47c25f
SSDEEP 384:npqiFiZcI63sNQ8TUNTUlIm25mgTDBK2fMBxrN74QkHO7O6R2FeoKgL/7IzmoJ:phFQ63NwgSYaBxN7Jf7TROe
TLSH
T176C24B36E894D9BBECEB8FD9A74A3647DEE00153C59C8AC0D9DC5D2D009B5AD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bd8eb7b-f2c2-4524-9ff3-f82329315659.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bd8eb7b-f2c2-4524-9ff3-f82329315659.tmp
Size 26KB
SHA256 631b861f642b542058efc264dcdb9d68e4f3fba5069ce49fab2349025c26ca04
MD5 fa722feefff32c5989a021e63eb203d2
SHA1 e75462eb128ab0ef204fe6fcfc2580bbbc1e2a38
SHA512 c86c0142d7255d414b54a473eaf09b1ef538d60c8bc21889482e190b0c202254d839b970d517e2395966a9ec724220f27ee0fea7888ec0bad21d3139bead7d71
SSDEEP 384:ncqiFiZcIksNk8TUNTUlI4J5mgq+0K2fMBxrN741kHO2IegL/7IzRoF:chFQk9wglUtBxN76f5W+
TLSH
T121C24A36E894D9BBECEB8ED9B74A3643DEE40153899C9AC4D9D91D1D00DB1ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

40d13ece-841d-4e9d-b963-cfd7bac18946.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40d13ece-841d-4e9d-b963-cfd7bac18946.tmp
Size 414B
SHA256 e8727265e57e421c54423c7d4085a389030c20295a339380586227220d49624e
MD5 d769d859be37be4418578237403496a0
SHA1 c8cb2b9b9010e7378b575a83f01e7f4f5c8a992e
SHA512 34ce66aacb764876a5f355fe5737d0556c9b58598bd8490dd9f4b9a21fe7ade69149e67c492d5c7e732ebd949c783955df0427cb3d3ee889b60df9f7c731848e
TLSH
T1E6E02BE9C815AC3B08FD4B2C50541685EA45036B2B81898F373CD11D8FB163A458686C
MD5 SHA1 SHA512 TLSH

Submit Download

70e4a397-4e4a-4111-974f-0fb6c71b4f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70e4a397-4e4a-4111-974f-0fb6c71b4f6a.tmp
Size 12KB
SHA256 ab4777fa8754d90f353ede6e67c828991b5bc42086a383d3e692b0c28fc77b71
MD5 fe3244ed26d44c3d36916701e96d572b
SHA1 f09e4f2dffe7c4b074798ef9e1913ef3ff521d4f
SHA512 d4d87a64df5f7a15e1c65cee9f8e5e8f4762c21a9aa129104532c8a5ccb711e735b92068d8ce75a8228a0d7412cef315a0f90ff1f20ec04c2e02eb172e2fce59
SSDEEP 192:sxZ4RT92/fbsNQZZd5zodpHXHW6+WNGYbIaCxwYV6Ig5MhJ:sxZ4j2/fbsNOZdy3HbGFuYcur
TLSH
T19E42D6156E28A97B9CCBD61DFA55BF93E3FD1072A0941E44AAFC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ea71d11-2fcb-4b04-996d-9ed070749594.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5ea71d11-2fcb-4b04-996d-9ed070749594.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

786011ee-612c-4366-b8ac-65d70b5e7002.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\786011ee-612c-4366-b8ac-65d70b5e7002.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9dcca0f9-82d3-413c-9098-3b30cfaa0e90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9dcca0f9-82d3-413c-9098-3b30cfaa0e90.tmp
Size 1KB
SHA256 c87dec1d81eb4fd547673fc61c605e5ab99b15b296b38847c0c239d77ccf74f9
MD5 0203e3a4f919991cabd0876eaae00179
SHA1 f4d540f467f56188f8d7a754a2cd5f649156050e
SHA512 a53c71c7049318d6130e7f67ffd029992f858fa7dfa327566d63129fcb3352d9f9a923f04c92c898ebc8a6db99af5331b6eaf258fbec8503463a2fae2202d8e4
TLSH
T1E541DFF783B4856E9A1096F0AA18BE1FCE1D0515431C7DA988E4AE2B93E3471D14176F
MD5 SHA1 SHA512 TLSH

Submit Download

ad9abe2a-0368-40fd-bd2c-78ce8e683b29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad9abe2a-0368-40fd-bd2c-78ce8e683b29.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 199ec3f1ffc0297abe479c45aa4652495dfeccff821a63f2375f2fbbd7b2cc18
MD5 067146af95dbcde74711308d53c40a83
SHA1 a03ae4df015e764d9960b5b038c031b01650c59b
SHA512 7c7064b34400d2a59dfd81475eeb28daafacaea3f7f88e08d9069f203545e68f4c568db0798f4e04594382c4f90ac2c6f5ef15c1334e74c60bff63baa3b95497
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIL/C:OtfFvpopPxrB4RhfIDC
TLSH
T14DB2101571BA021138FE690C81B58B2E064232B37159E62F7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b3e6f2c5-e2e8-4a5e-9cfe-481cef2e29e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3e6f2c5-e2e8-4a5e-9cfe-481cef2e29e6.tmp
Size 11KB
SHA256 f9b812c22f5ca9082bd351262f60860d5542e13fc08cf6bbf195e20a516556a5
MD5 6fbb746cda2bf46f655304d99d3a711c
SHA1 d83b9b263294b71ddd69ab4570be145791d5932c
SHA512 459ff3c7f6e505c14f76f2ca5d37aa810a4349868680d107f4ad8ac96b5d035d0523b7aa9de3f83ba4994c908b86a5022e5b9f9a538de5f5eac68443ef89cd29
SSDEEP 192:sxZ4RT92/fbslQZZd5zodpHXHW6+WNGYbItCxwYV6IgjhJ:sxZ4j2/fbslOZdy3HbGFfYcjr
TLSH
T1A042D715AE28A97B8CCBD61DFA55BF53D3FD5032A0941E44AAFC8A1C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d36c4a38-de59-4da4-84ac-2caac36de171.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d36c4a38-de59-4da4-84ac-2caac36de171.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3eb9210-4420-4a05-917d-080dbd9cad09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3eb9210-4420-4a05-917d-080dbd9cad09.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fdb37711-2722-47b9-804f-253266e91fe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdb37711-2722-47b9-804f-253266e91fe6.tmp
Size 12KB
SHA256 16259866a111c218bcd7d0d0d4a27eb3e77c7782c595616b0a32411b6e0f3503
MD5 1e2b45e5368706fc6e28530851441d67
SHA1 52cd1579630ee9a3170339bb4483daf0c59774a8
SHA512 5a055f7652fe828550533f6b0b8fb86e199f06401bb5e2f7f39f5812cdf7a9eae36f838c06bca40bacbb13a76e8ceca25d239b5af052fb344c1c98f446951951
SSDEEP 192:sxZ4RT92/fbsYQZZd5zodpHXHW6+WNGYbItCxwYV6Ig5MhJ:sxZ4j2/fbsYOZdy3HbGFfYcur
TLSH
T11342D715AE28A97B8CCBD60DFA55BF93D3FD1072A0941E44AAFC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e44ba343-acd6-4330-a464-040e06d7322e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e44ba343-acd6-4330-a464-040e06d7322e.tmp
Size 26KB
SHA256 65095fd6dbcc2133bff22c7c93aa026d87ab80e3f3fe94b197c29e045b690bcf
MD5 cab71a0b162930721fcab64b1ee8830e
SHA1 17e916139796925a13de6a30bc86c7449311418a
SHA512 9e03772c00bddfd98b613c1f0b9a8f308b2701290b05b268c29ddee99280f8dc80883f50d5a93071460276ef3305fd1570e3364d637bb71aa13a7d3abaede242
SSDEEP 384:nZqiFzQkUSvxsNk8TUNTUlI4G5mgA+0K2fMBxrN741kHO2IegL/7IzB5IIlv:ZhFdx9wgIytBxN76f5yLN
TLSH
T16DC23A36E899D9BBEDEB4E95B34A3683DEE00253C99C4AD4DAC91D1C00DB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4d61100-bc49-44fc-8dc9-f71259683d2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e4d61100-bc49-44fc-8dc9-f71259683d2a.tmp
Size 26KB
SHA256 de0ef443b9f9965fee780fa998b13db8f696ab71c494d6b80f3d6be248a2cf4b
MD5 9df8afa544cee6de3e04ce495a1a7e0e
SHA1 8a732353a8073420a4d0eed414fdb5746c09d199
SHA512 0a805643eca80e55f4eacad5268bec35ac2eebb30f1521f565f1101f31d4da969ef43df4d4a0eb66b9f3fc1d3238fef4f14c799a790aee2816a2dce8e9086e65
SSDEEP 384:ncqiFzQkUSvxsNk8TUNTUlI4G5mgA+0K2fMBxrN741kHO2IegL/7IzB5IIlv:chFdx9wgIytBxN76f5yLN
TLSH
T18DC24A36E898D9BBEDEB4E95A34A3683DEE00253C99C4AD4DAC91D1C00CB1DD070BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9febd0bf032957fd1ce4ce5989617a77a584aa3affd136cbd5ec4af2e31d1099
MD5 67215ff6568b9898a42399a7bb8da5f7
SHA1 8ae9425714e1062d703b0e7de2e9b3b1c69dd004
SHA512 17dcaa32df5a9aaa4e944a19ac36246118a3f1618e3df106efc7baf6053d75c161456f6bf12a0f39b3d49884344d5e668656376ccd16562aad5de660e986b9b2
TLSH
T101410958B7E91144B3B37F569BF6A96E487F78772F0BD4AD00010D4E0A67A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

9d8c5582-675b-44b7-986f-336767523d2d.tmp

Path C:\Users\Admin\Downloads\9d8c5582-675b-44b7-986f-336767523d2d.tmp
Size 30KB
SHA256 260c0bd8217600819ff81fcccd1c7c2400629cd55ac05a92eb0e3b5f85aa67a9
MD5 6807f562507eb37e3e0b3aa314794241
SHA1 454f4c82069b817c0a1a0b5d72933acce4152179
SHA512 c4689a82e50f152202e8b26d0243edc2711c82d34b84b4b596ee72e4f8e973ea8b2493d5889e756343358b9f21e74f7499ebb1cbe075d1631c4d7bbae72e2ee2
SSDEEP 768:wp3RvFX5EYXyec6ibQW2/hkuQAOFBM405LfGZWhYxGkT:wlTX5E6yec6ich5kWGMF5LeZnMI
TLSH
T1DFE2E12A27E0F3CED135C432940904E6735A72F2EB2126E5DC6DFA283DD24C5A56A256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preisliste Ebersp%C3%A4cher Heizung Vertriebs-GmbH und Co. KG ab 01.01.2027.xlsx.crdownload

Path C:\Users\Admin\Downloads\Preisliste Ebersp%C3%A4cher Heizung Vertriebs-GmbH und Co. KG ab 01.01.2027.xlsx.crdownload
Size 385KB
SHA256 75a00340237f961da3043390e24d06a13b37062f33c6ee08b7e6585a2cd877e4
MD5 6b66c3b61b9bf3fc1d777cfe806246ba
SHA1 81f80f8ba35ce48bb7096358e034c53da1a26242
SHA512 8f036b347378355ee4a9b5880fb92df884e35f17261d7e4f87c20f80d5a07d05ff59144e143b92c187bd55da660c3a9e53d441a34569571b4cb41f9791fc5302
SSDEEP 6144:2xyOXoL9RSJSnVJsnvsgZMC8SqhG+lb0eU0CUg2FjDSRVlr26uua:2x/XoL9RSSnVJOsBbdC79RXyL
TLSH
T160842332A504A35ECA911EB6638D30E0371D21F8648650D1FDFF9BAD3DE2880D63E693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5056-212-0x000001BC0C5B0000-0x000001BC0D5B0000-memory.dmp

Download