hxxps://review-lgr[.]at/LastReupdate21

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://review-lgr.at/LastReupdate21
Sample261030-t741psex4m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0A0E5FE7-5077-4DA5-8B82-D3A9417A525B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
376	msedge.exe
376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 4068	5404	msedge.exe	86
PID 5404 wrote to memory of 620	5404	msedge.exe	87
PID 5404 wrote to memory of 1428	5404	msedge.exe	88
PID 5404 wrote to memory of 1428	5404	msedge.exe	88
PID 5404 wrote to memory of 1428	5404	msedge.exe	88
PID 5404 wrote to memory of 4712	5404	msedge.exe	89
PID 5404 wrote to memory of 4712	5404	msedge.exe	89
PID 5404 wrote to memory of 2488	5404	msedge.exe	90
PID 5404 wrote to memory of 5644	5404	msedge.exe	91
PID 5404 wrote to memory of 2488	5404	msedge.exe	90
PID 5404 wrote to memory of 2488	5404	msedge.exe	90
PID 5404 wrote to memory of 5644	5404	msedge.exe	91
PID 5404 wrote to memory of 5644	5404	msedge.exe	91
PID 5404 wrote to memory of 4136	5404	msedge.exe	95
PID 5404 wrote to memory of 4136	5404	msedge.exe	95
PID 5404 wrote to memory of 4136	5404	msedge.exe	95
PID 5404 wrote to memory of 2576	5404	msedge.exe	100
PID 5404 wrote to memory of 1424	5404	msedge.exe	101
PID 5404 wrote to memory of 2576	5404	msedge.exe	100
PID 5404 wrote to memory of 1424	5404	msedge.exe	101
PID 5404 wrote to memory of 3644	5404	msedge.exe	103
PID 5404 wrote to memory of 412	5404	msedge.exe	112
PID 5404 wrote to memory of 5332	5404	msedge.exe	113
PID 5404 wrote to memory of 5520	5404	msedge.exe	114
PID 5404 wrote to memory of 4260	5404	msedge.exe	116
PID 5404 wrote to memory of 4260	5404	msedge.exe	116
PID 5404 wrote to memory of 720	5404	msedge.exe	117
PID 5404 wrote to memory of 720	5404	msedge.exe	117
PID 5404 wrote to memory of 376	5404	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://review-lgr.at/LastReupdate21
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffec040c188,0x7ffec040c194,0x7ffec040c1a0
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10942313683344009436,10476411170429731940,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2583943781941324164,4933979339825628257,262144 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,7807465323426589873,7755733654756116331,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7289040069327132357,17245860192390172360,2097152 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15468455004738199849,14282534628090105788,2097152 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,9098063103210270102,531166452430972540,2097152 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,11724691001531108656,3562900274224804104,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,1609160466293228755,6870192702600217820,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15560480295762101613,16580867458510871168,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15560480295762101613,16580867458510871168,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,14831256172901669760,7349160849666304029,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7035592218985675123,18342406972214901767,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7122995184783064702,7124014152801158275,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,3091438401180248537,9961962644403367509,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,1193292397230848131,10617827363072751994,524288 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5396,i,7108566991189714632,9750796135469932873,262144 --field-trial-handle=2336,i,200664563838139310,1715843386859151844,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b63ca0f-ea52-4943-aef1-7f6ef1f4d8f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b63ca0f-ea52-4943-aef1-7f6ef1f4d8f0.tmp
Size 26KB
SHA256 7fd0756cbcb2c03b6742d9affa0ebc5b17e58059d66dca29c72add37f64bc484
MD5 c44acd20d5c1d6226461e9ab6fb03907
SHA1 5aa5875d6e114245d569b6a7f9887e8bd82edaad
SHA512 7ba65130f5a81c0db47c32cef6b2bbb29c1aabb689afc5c3e8fd8a49145e552785c72e2c4b4589e702fa2bbd23c714a5c050a200c80ca48c0b33b7c40a27c2b7
SSDEEP 384:n4iFzQkUSvj3sNv8TUNTUlI4UaKMQzPjwzWfLBCh7SUZ4mY5u9iq2IugL/7Iz+IF:DFdj3qwgQ2OEBChf+mY5miq53Lu
TLSH
T199C24A36DC98DAA7EDEB4ED4A74A3643DEE04263D99C9AD4D6C92C1C00CB1DD034BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b4ecb67-fca4-41c8-9121-e254e9e800a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b4ecb67-fca4-41c8-9121-e254e9e800a1.tmp
Size 32KB
SHA256 3794f6f03ec94a3376f482030889ecbebd3e306f3c93f9096cac733684a41d16
MD5 a44722f34771e051e644c7e2a5322dc2
SHA1 5697cb42714411e09b9fb6cbab735f0a2fa12d9d
SHA512 4cc9f7dac5a534b8e7b8e0eab7e54a1d42e5f08f2c15096d14b66d2d66e6f5db7e35ece56578a095089bf1a2265d11383da61b02a2a06052104fabef8f447e9d
SSDEEP 384:npiFzQkUSvmi3sNv8TUNTUlI4UaKMQzR+BjwzWfLBCh7SUZ4mY5uQmq2IugL/7In:AFd13qwgQy+BOEBChf+mY5xmq53Lu
TLSH
T183E2D3F298D79977D89E4B93A77D2D0299FCC113B5889A94B7C91C1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64471d47-bee9-4888-a355-c4b2fbe3b7ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64471d47-bee9-4888-a355-c4b2fbe3b7ac.tmp
Size 26KB
SHA256 426dc0bcbeadfda61b7ddc45770b5d53cd45c251d4fc68eff096b9c35f9e2a2e
MD5 f109eefd1ade3d3921c0e5f603534a9b
SHA1 ea27dd873bfa17ed0d909d4dbd64e7ab68b8fe9f
SHA512 0a4d081bdc30d6ff042f73f9d4d1960d4527dc409b066b5042835271dd13851db2aafb0f7f23ce85610f71c962c0c9f9a93e3eac0e94a00b725cb01f61a95543
SSDEEP 384:nciFzQkUSvj3sNv8TUNTUlI4UaKM+zPjwzWfLBCh7SUZ4mY5u9iq2IugL/7Iz+IF:HFdj3qwgQQOEBChf+mY5miq53Lu
TLSH
T132C24A36DC98DAA7EDEB4ED4A74A3643DEE04263D99C9AD4D6C91C1C00CB1DD034BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

1129cdf6-41e1-425d-ab92-9bddd090f6aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1129cdf6-41e1-425d-ab92-9bddd090f6aa.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90257119-17dd-491d-a767-7233afad2c9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90257119-17dd-491d-a767-7233afad2c9b.tmp
Size 414B
SHA256 722b916a7fef97f641abc0310ebd80be76558d852e2a7465a086c05b70ad9ad7
MD5 069c95545d669adc2cc744ce7d5234eb
SHA1 8c947ce5bd5e7dd635abc624d5009726fa46c780
SHA512 8f832a8b5fb1d0976e9cf6205d5708b4bc59f9d01e7f7e08242609fea587ca0fcc5913794dc1bea7ca4a4fd7567cf1cb955beb80b53d840af70382e4209df64a
TLSH
T15CE022AAD825EC3B08FD0B78A4980645EB00232B2E509C4B3B3E81088FF56374186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

961a245b-53a1-47dc-8112-1cd2c082d913.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\961a245b-53a1-47dc-8112-1cd2c082d913.tmp
Size 12KB
SHA256 86773d9488094bc834de8735a1b98261a68a7c9fd41d7800a31c89d565e09e97
MD5 9f3e8a9aedc4c98b8fe3f2691f97e518
SHA1 5fff9fe6f64398472ee734aa82c912f98a14c709
SHA512 65e09f8c74ec96ba8e391922262031ee1f3d4466c2bc2a43de647209877675464b441d2c3e56e2ff4a87259898fe3e93899e97690f37138624ae92a91dec2b60
SSDEEP 192:sxZORnk6/fPsKuQZLT8szodpih/YHW6+WNVb2c/YoVH58SV+EIg5AtMJ:sxZO+6/fPsKuOkv0YHbf/bGSVj6tw
TLSH
T19642DA556D28697B8CCBD219FA55BF63E3FD503290D11E48A6FC8A1C14EB6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 63aaa5ed3dd313441bedbfab52cef8c7b26f3356ebdea2315362822632431090
MD5 9d87ce8b35d32ba41f6070b0ad431da4
SHA1 0e165ccbc92c34221db22baffecb3a646389c432
SHA512 bb5acd1dc28333a2cad6b9770f69f14c11c28786e92ba54a72d1c5fce99c31c16e7c76f85f66c867a248cc4dfa9b2c93acaec1aafcd83b1811d6e5daa0edda1f
TLSH
T1A1E026E458CAC36EE34EE4CB01FC631CCB80261AD3C2690EAB04CEC5B205448A7D3AD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a8b69305fa10f96c9a5b3ea0762674940e249239f3ed51e51b13a80ba183a646
MD5 ee05bda7b287aca32be653183aae1540
SHA1 58d4c7e0b4e83fb0d7cdfdcc2bfe3197282cfbb4
SHA512 914a22e84b726fd49721f08b4d7a4104b2e94838a7365770dc14af0f807eae5462bd322a0e73283622f54a4d54afdbd35e07e3c56accf3ec69d0cda54919c7cc
TLSH
T1EA613DA45658D4D9FB987271A7EE11CB323895A8BB931FE718A4F87C5C0E36ED16C0C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ebd71b19b530e4132ab8e177cbf930b641dc33d7ba8e2c517a3dd12d1ace2d77
MD5 ed0b5c06f55be2f44ce6f1b8ca483489
SHA1 c504c27dce40b75d3b619c784827f8bd572e36ae
SHA512 9712cf9823400c07e8af1ed4c2200038bb0bd5c5762af467bc759a00f92e9a8e5aa7518007e9453a15cac4571610c7732c69e627f2eadd1815f77d207f159794
TLSH
T10A714DA49559D4D9FB9C727197EE108B363895A8BE432FE71860F93C5C8E369D0BC4C0
MD5 SHA1 SHA512 TLSH

Submit Download

55fce075-d242-48ba-a9a5-c94c452bdb96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\55fce075-d242-48ba-a9a5-c94c452bdb96.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

17e659aa-6eb8-4edb-8620-4f73c51ce082.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17e659aa-6eb8-4edb-8620-4f73c51ce082.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

70d6c863-0a7d-4663-baaa-9f402ece8a56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70d6c863-0a7d-4663-baaa-9f402ece8a56.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

dc4e85b4-e354-4153-8514-319728107b03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dc4e85b4-e354-4153-8514-319728107b03.tmp
Size 2KB
SHA256 5c8119728d785c87a5e812d34b858ce28459f23eecc87dc1650522dd92fc84dd
MD5 c8f5294f0c2531ccf7307802f5bd27c7
SHA1 2d223efe45e89b76c5916961b132f5a00bfc9050
SHA512 ff0bb9c05b1140e79fd21129fda4f5e92ceb4781c395e8b7792f605b00f62e7a37e70db5f39c916fbdbc0d8e7a4d7781210ca228d6a3f108bd414009972ab996
TLSH
T1C341DFF383F4856E890196F0AA18AE1BCF5D0519431C3CAAC9E4BE1B93F3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6e266dc71a27ce9878b766389eb86f5c2c192b97195bc2372f7023f3fd46143b
MD5 2e06acae0c81fd137fcbc291faf6eae4
SHA1 2f823b55a5b0752ddfd057a73bdfdc6e28aca699
SHA512 5bb193cbf81f08df0884849a3c78209e96acfebdb349873191832ae691ead652dbc31d159ed273bd611e7adb00531fcbf70b5611938f523c1897b99894107196
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgS:ST/2dXOJhJlpfnpp3tNXVrN3aJhl
TLSH
T122B2115571BB021039FE291C91B69B2E164231733119E66B7FBD40B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a504092e-982d-4944-a921-9d321e43eb9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a504092e-982d-4944-a921-9d321e43eb9a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d5a17366-f3c3-4328-80a3-7c8203907c05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5a17366-f3c3-4328-80a3-7c8203907c05.tmp
Size 12KB
SHA256 011948e5b945ce95873b0abbbd5da9908f1f2895f4b85d50391300c081d4f567
MD5 e33c95d99842e03bcd938d57efa2a732
SHA1 327f834783e9c60fb0d79a0976ce54eee4ca036c
SHA512 9428860809c35636aa1ff46b237ce17d16cf1e29fb4a4040ad5b95379c3642b94ab2e0a01b681930a607a5045cc42f58cb7f497fd2c7c5e4df5e81a61e690907
SSDEEP 192:sxZORnk6/fPswRaQZLT8szodpih/YHW6+WNVb2c/YoH58SV+EIgjtMJ:sxZO+6/fPswEOkv0YHbf/gSVjjtw
TLSH
T17B42D9556D28697B8CC7D219FA55BF63E3FD503290D11E48AAFC8A1C14EB6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e12be47d-96af-41a0-bab9-1d1609144bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e12be47d-96af-41a0-bab9-1d1609144bd0.tmp
Size 12KB
SHA256 e55112b984fdff64c060f1ca12f7e691b16c2251a32f9cc19054f771e75f61b8
MD5 bcaa83e36dd23b09b7d0b4b2d19e1ced
SHA1 a3fd5aa7c8781ad43ecfd56508aa97418b25398f
SHA512 a2398f22ea9e661bb1e7a085827c90449df207979dbe45ef0ae6b3bfbc8097bb58a8c3666b4957395d9e5d545745542bf78edad3ed240ce6f39de73a0b7c5762
SSDEEP 192:sxZORnk6/fPsKRaQZLT8szodpih/YHW6+WNVb2c/YoH58SV+EIg5AtMJ:sxZO+6/fPsKEOkv0YHbf/gSVj6tw
TLSH
T15E42DA556D28697B8CCBD219FA55BF63E3FD103290D11E48A6FC8A1C14EB6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 29ce06fe7c5c03752ddff49d16cee04054197d2528a24a2259270ec0ab32bd43
MD5 84902e8c515ca98e79770cb2e8c2fab2
SHA1 2abc1686446505655712ff6922d8d32998839b0b
SHA512 72ddc94b409bb27dbb4b38b18fbaab5440eb60bcecf51aa9448059ef290523963855b8fbe3ddbfe18e48eaa7f78f539757d64a12450b3ea9ea4de3f738437b9e
SSDEEP 384:nUiFiZcI63sNU8TUNTUlIm2aKMizX4wzWfLBCh7SUZ4mYpFKsa+VY5agL/7Iz6o5:vFQ63BwgcmHEBChf+mYpFKhggq
TLSH
T16DC25A36EC98D9ABE8EB4FD5AB4A7603DEF001A3959C9AD4DAD91D1C008759D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe53801c-295d-4b39-ade4-88a1b5f24caa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe53801c-295d-4b39-ade4-88a1b5f24caa.tmp
Size 26KB
SHA256 64e6afeea3d75a8950182193477f989e613ebb8d30e56ef265e586f20c103cb7
MD5 8281d004bd6587ed93e5519a5423c99b
SHA1 60dc4ec9ce5b719a57214fd8a09a46b5e529e919
SHA512 428ec8cb62c50129f151d7617ad3c999c2104db56fcc3a21a4777e3f553c8325f031507f5f67cb68238564f2c8b0e2e0bbf5d4ebe9a3d200df075a0c09fa947a
SSDEEP 384:npiFiZcI63sN78TUNTUlIm2aKMvzrQwzWfLBCh7SUZ4mY5ukiqsa+VY5agL/7IzJ:AFQ636wgcxvEBChf+mY51iqhggq
TLSH
T1F5C23A72EC98C9ABECEB4FD5AB4A3603DEF44263958C9AD4D5D91D1C00DB59D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b731d587d521a6eb62071a61b7fbc9cc117f1a7fb6655127b32ced2b42483e25
MD5 d2e6125bc352c499c64a984fabe74a37
SHA1 2284902a0eb09b1ae4a9f72c5bdfbc6391f37d41
SHA512 e541a5c845011a9e8b4f452151bd619250aae074d88888a50109ed1ee4d30feabefac0463c84af9aa1300af5abf342552eb65b02567e5f1e7881e27a32aa6622
TLSH
T183412D58B6FA114CB3B37E569BF7A86E487BF9772E0A906D00010E4F0A21B40C961777
MD5 SHA1 SHA512 TLSH

Submit Download