hxxps://shared-review[.]heya[.]bio/

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shared-review.heya.bio/
Sample261102-lezxaaay7r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{5137990E-BF42-4E71-9FE5-FD499B5C34B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	msedge.exe
536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1164	4600	msedge.exe	85
PID 4600 wrote to memory of 4620	4600	msedge.exe	86
PID 4600 wrote to memory of 4900	4600	msedge.exe	87
PID 4600 wrote to memory of 4900	4600	msedge.exe	87
PID 4600 wrote to memory of 4900	4600	msedge.exe	87
PID 4600 wrote to memory of 1240	4600	msedge.exe	88
PID 4600 wrote to memory of 1240	4600	msedge.exe	88
PID 4600 wrote to memory of 2244	4600	msedge.exe	89
PID 4600 wrote to memory of 1292	4600	msedge.exe	90
PID 4600 wrote to memory of 2244	4600	msedge.exe	89
PID 4600 wrote to memory of 2244	4600	msedge.exe	89
PID 4600 wrote to memory of 1292	4600	msedge.exe	90
PID 4600 wrote to memory of 1292	4600	msedge.exe	90
PID 4600 wrote to memory of 4428	4600	msedge.exe	92
PID 4600 wrote to memory of 2856	4600	msedge.exe	93
PID 4600 wrote to memory of 4428	4600	msedge.exe	92
PID 4600 wrote to memory of 4428	4600	msedge.exe	92
PID 4600 wrote to memory of 2856	4600	msedge.exe	93
PID 4600 wrote to memory of 2856	4600	msedge.exe	93
PID 4600 wrote to memory of 1044	4600	msedge.exe	96
PID 4600 wrote to memory of 1044	4600	msedge.exe	96
PID 4600 wrote to memory of 1044	4600	msedge.exe	96
PID 4600 wrote to memory of 4544	4600	msedge.exe	98
PID 4600 wrote to memory of 3984	4600	msedge.exe	99
PID 4600 wrote to memory of 4544	4600	msedge.exe	98
PID 4600 wrote to memory of 3984	4600	msedge.exe	99
PID 4600 wrote to memory of 1724	4600	msedge.exe	101
PID 4600 wrote to memory of 4576	4600	msedge.exe	104
PID 4600 wrote to memory of 4576	4600	msedge.exe	104
PID 4600 wrote to memory of 4576	4600	msedge.exe	104
PID 4600 wrote to memory of 2768	4600	msedge.exe	111
PID 4600 wrote to memory of 716	4600	msedge.exe	112
PID 4600 wrote to memory of 4328	4600	msedge.exe	113
PID 4600 wrote to memory of 4656	4600	msedge.exe	115
PID 4600 wrote to memory of 4656	4600	msedge.exe	115
PID 4600 wrote to memory of 536	4600	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shared-review.heya.bio/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe9671c188,0x7ffe9671c194,0x7ffe9671c1a0
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,11817123583572564052,15362536386949009170,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17478879921801123105,2074065651919748441,262144 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,17840966379222092938,11204906637704215355,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,4737897416293822910,16709278946037613268,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,16704167791442946934,14705816952897735390,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2290484807053507346,670016342035062012,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15958094779577691541,17582357422399818383,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,5749633456711996483,8402387206589008327,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,14339756608640782535,3166862751023030986,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,15493134784952019719,5479307484161273848,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12716449277189802505,13076721946807531932,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12716449277189802505,13076721946807531932,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6208,i,9456337251631400576,5093625523325925250,2097152 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,770639813061962503,3066817310597951483,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,12340324021108469436,13996898762701463604,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,13203710303616942238,15146188384766498543,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1040,i,99832275088821926,11690286418907525086,524288 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,105932042036713905,16885869876104974309,262144 --field-trial-handle=2224,i,9921061890086250791,899962966399865086,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0abd2279-f4a7-4ebd-a2aa-d55919c0aacf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0abd2279-f4a7-4ebd-a2aa-d55919c0aacf.tmp
Size 18KB
SHA256 32eea17e017b2b877dc0237af2a8e7e3d67c7236ef39863199627f0b5d38e913
MD5 0c1cad6d9d7e805c535e9d211e32d340
SHA1 dac1acbdb96ec82b6d3c32ab2020e83161b268ba
SHA512 aaa912c90ee43da6962ce942be82f5513098a0cdbaac44d2365f5c1a3caa6ea103a30ab237c61c063bd40f391163e7408353ecb8fce00c537874f0153c20b0ca
SSDEEP 384:zQkUSv0sNCUDjqE5NZ9BGYX5Ejl83sIXHOJH7vBEj1IIlQ:d0lEdfGYujToHOJH75EBLO
TLSH
T185829F32E8796C3B09E3A655F04E3A13DFB4A12BD6D82B50D5DD5B1C01CE2C8234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f7b80aa-6fa9-41dc-a651-72d52b73d9ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f7b80aa-6fa9-41dc-a651-72d52b73d9ea.tmp
Size 18KB
SHA256 6c7f27ca9ce61f251a20c8262f9ffddcedcb4b9657f1a8eccd39989ec3f86df1
MD5 4f35bb7ba564910f085258f61f1b9c5a
SHA1 6f2258b954f9f0757f1f6b5c8bc7d8feba2c17fe
SHA512 a35506f9270fda2f66e0d5ea21247ca7dfbde18260cb7604153783d3fe3127f1672d90c541fde3da9f258a04365888f93d94d85269256a3d88bc4e501c686a66
SSDEEP 384:WQkUSv0sNCU+jqE5NZ9BGYX5Ejl83sIXHOJH7vBEj1IIlQ:20wEdfGYujToHOJH75EBLO
TLSH
T161829F72A8796C3B09E3A655F04E3A13DFB4A12BD6D82F50D5DD5B1C01CE2C8234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27b634c0-bc27-45b7-a00f-9721d7970db9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27b634c0-bc27-45b7-a00f-9721d7970db9.tmp
Size 8KB
SHA256 b723e9c585b65f22affa333c97df4f142c2f5fbd1757c51b56f03e6254e99784
MD5 2055805c0769e8991207f4f0b4ba535e
SHA1 ffe6d40e6c6da3e7cb87c327c45775b4ae17eb19
SHA512 4da63c6a27a7465fdc956d3fb1920f5f21ef5ebf83c48073b555b0563b76bde747e7a169c33f72d14d7d491f4c736b763654c3b4ab8a7f0e6e819428d86302a1
SSDEEP 192:LJONI6DphmqQmiUyBYq8wGYX59ezKCpjzor33Ikk7in9U6:lONI619ZRwGYX5Ejl83G2U6
TLSH
T14502DA35F8787CBB5DE36E59B44727139FE5213BAA946B40D6E81B1D00DB64C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f77583e-9af9-4830-8ebe-06d93038bd49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f77583e-9af9-4830-8ebe-06d93038bd49.tmp
Size 8KB
SHA256 f09057ae9999f5e9ca199fcf68be840f38a05992f6b82d2d438c3a307ba746da
MD5 759b1c6027d2a2ca3271fa145e7d3280
SHA1 ef01d426800016d8a22f5808ab9016e8598e9d46
SHA512 2245eefbc2b9e245a30ac2a3a2f3c9ae6038a8ceded9023cac5f4ab82d6f367a5e9b51641dd878d8f2815d935c96da5b8920394b8d5571e28a51770d0c8d0708
SSDEEP 192:OJONo6DphFqQmiUyIYfwGYX59ezKCpjzor33cIXEE0kIIiRq5BU6:kONo61qOfwGYX5Ejl83sIXHVJU6
TLSH
T148120B32F8B8BC6B1DD26595B08B36139FB4512BEB847F50D6EC1B1C02DF698134A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88d32538-fa2c-4656-9210-e1b6ae21c129.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88d32538-fa2c-4656-9210-e1b6ae21c129.tmp
Size 26KB
SHA256 865f4c60270a5078ad9e58d5c2412230235396ebec3c78a7ca1ebc4f270ba494
MD5 5e13ade6af51282f5972346389de2416
SHA1 bcaa16cc9022045f291e1f713d873741b130f7ec
SHA512 3361d9bec79e2684aebe4185d31b4e56283f8241255aa8d0944f7b434c85fbdf24adf1bdc9da1fe9e9a894b77d66180a630b35b8c9838b4bf30f5fd52d07f458
SSDEEP 384:BiFzQkUSvAzsNn8TUNTUlIl+jqE5NG9BGYX5Ejl83sIXHMJH7vBEj1IIlQ:oFdcGwgfEyfGYujToHMJH75EBLO
TLSH
T134C219F298D79C3BD9AE5B43A33D2D039EBCD027B5946650B788491CCC8A1BFD34A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

12b218b2-82a8-41df-8e6f-77eaa8ede907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12b218b2-82a8-41df-8e6f-77eaa8ede907.tmp
Size 10KB
SHA256 abdcce0e81f94cc922416b5c032c0e2faa95e5555e20016a14bf61f256817011
MD5 c0b12fb0c2fc7d3a059c14cf55897e22
SHA1 1f65a8b7258e8181e27f940017a2edb6f5a2d1cf
SHA512 71c4aad08e29502d13eaaf62e0ff04c33f8361204183ba60f2aaa4345aef2a5808bed142712a163f8999c644e61c1beca13f00c0539371b2d0f91ac7547915c3
SSDEEP 192:sxZnRxW9/fUsQlIdp6l/JHW6+WNRZK5/YgH2X+QIg5VJ:sxZni9/fUsQW0Hbw/k1h
TLSH
T19E22C8266E24A97B8CC7D31DBA15BF13D6F9203251951E48AAFC8A1C04F7BCD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a6cda38-32d4-4c1f-b46e-33c1a288d57f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a6cda38-32d4-4c1f-b46e-33c1a288d57f.tmp
Size 27KB
SHA256 e5aaf74f7a4d57d5b6b2bd87f9c59dea9ce9d0d8006fd2c4ff66301887c8ee75
MD5 32e0408fcb5ecb6d47a504d6e46a5eba
SHA1 62581eeac9291b88dac4bae5261511c6ce5100bd
SHA512 fe9ce1c4a445f905406b60eb1a933d4544ef131b9c5d95ac505ce9c16cc56017d0742b22951129776a6fd473f732e3f36a3b3c6cf067bea6e453770e4d559e7c
SSDEEP 768:Q9ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz/ro1Q34:Q9ichfPWvPZplu1jan+LKgzsy4
TLSH
T166C2FA3B644CCB7E4FC01E9DDD1A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e9e4fc1-8478-401d-959d-fdb693346792.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e9e4fc1-8478-401d-959d-fdb693346792.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2f60a3f53683c0d96f89d96a6698c202f8158c90f6a14aa857234d40d09b25d6
MD5 4e0402b58ec22df3f098b78389c7ea9d
SHA1 e0d7f43b6b5f116938ab08ada6bee0a37ca4e6ca
SHA512 9982b06c2e99aa7205109a88331a3d0e2497e48edcadb272f271b9b0923859f5f001cf88399e939d9c70b25da6528866f993116e52d05a8807df1ef47b46d8b4
TLSH
T10861D8E4D59142EDF7F8437DA7D13B877A78B4D8B1836D2300A2EC7B540E759A682074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8bb9cfb21b0a26902cff7777953dbff3d5a9f13d9706bdaf1df6559cf0f798a5
MD5 cdafce753de9bc29ef4bb997470aa0c5
SHA1 7d59ad7e95acefa3a582d892af3d59b504d2c3b4
SHA512 d001732cee43d2e9d568f93bf586786a4da2e604f907b82ed4a1188cf3f0bbc9f0bd8e6f7714b0512244371843f96240a4a42ae451ad8c563ae329f66b458571
TLSH
T1576109E4D58182EDF7F8437C97D13B877A38B4D8B1836D2300A6EC3B540E759AA86074
MD5 SHA1 SHA512 TLSH

Submit Download

e7582036-8453-41c1-8642-5c362a852cb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e7582036-8453-41c1-8642-5c362a852cb4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

06202dee-1c13-45dc-8dfa-fe24fd39ea93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\06202dee-1c13-45dc-8dfa-fe24fd39ea93.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

0f684073-c31f-4acd-a41e-a3b4dacc7f04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f684073-c31f-4acd-a41e-a3b4dacc7f04.tmp
Size 2KB
SHA256 4ed5303c33f7f7e28291195bddd7d5ae88feee351befbcde8467054bc555e0ed
MD5 fc1a622226dd35b150dbdfdf9893531e
SHA1 fd09fa4a2f1cf14b38f3876f969c8b1ab3b45be8
SHA512 262c3fb76f5f9bffb75090fa03d747f0e710d1e68eb01acca4ee727c8f7ea64c3bf64a02e194b9738059cfadac3d3d189933ab3c71d0d655c92f566bc66b16c3
TLSH
T1F0419DB3C7E58A6DC81296F0AA24AE1BCE1D0906421C3D1AC9D5EF1B93F2471F15165F
MD5 SHA1 SHA512 TLSH

Submit Download

a871d752-e04e-4138-ae8c-11669fea839a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a871d752-e04e-4138-ae8c-11669fea839a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c7228d0a-1013-471f-a95a-5f089f654466.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7228d0a-1013-471f-a95a-5f089f654466.tmp
Size 10KB
SHA256 b12d57d01950daee5c0518941254888a097783803bbe56e1d387b04c0299b256
MD5 9657327010aa7026019bcec44752fd75
SHA1 8b693de1138652355d690303a0ce3bb021d78b20
SHA512 c4f5d37dbe28ee759c36070e8374d2fcf3b6c7e7782b961465bd94f64f431777dae3bbbbe72e07383aaf593241d5df8f74ddbf26a9232209b944d64e67594e08
SSDEEP 192:sxZnRxW9/fUsylIdp6l/JHW6+WNRZK5/YgH2X+QIgrJ:sxZni9/fUsyW0Hbw/k19
TLSH
T10022C8266E24A97B8CC7D31DBA15BF13D2F9103255951E48EAFC8A1C04F7ADD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3f54104-69c0-448c-87b8-273777c51c97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3f54104-69c0-448c-87b8-273777c51c97.tmp
Size 10KB
SHA256 91d9cdeaaa7ff06f6f0e5a1b9d8ce48795969a8a89646f61830c5b1ef45c999e
MD5 d880176be6fe4d94706728e65502e7df
SHA1 6a21c9229e20e9d94353b545d8070c1ef14455fc
SHA512 f50ec6b71cf2ccbcc95fcd88a84b19de836e25aec78b7f68e02856f35894443f980370b1d6514a314646c39468a71d4525f37817010b4ba6aaea38caf145737a
SSDEEP 192:sxZnRxW9/fUsElIdp0l/JHW6+WNRZK5/Yg81X+QIg5/J:sxZni9/fUsEWeHbw/Y1H
TLSH
T19C32D9266E286D7B8CC7D31DBA15BF13E6F9603255911E48AAFC8A1C04F7BCD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfa7cbbf-32f4-4568-82f1-51c9ad35b917.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfa7cbbf-32f4-4568-82f1-51c9ad35b917.tmp
Size 10KB
SHA256 5f5bb64de26d487828e2b84792ec01017d7023ddd693669cc9c5d832427167fb
MD5 69bcd900d5e2a8c2f356cf19b44ab563
SHA1 a91b999f2f362344f096be0da3d706d1b08aa88b
SHA512 85e4d91ccad80d40a25fdcfb487acea1b2f1fbbb226f387fd0f33a7a25fa214f03a9d604981b3c19e3a1df7198cbb4fe9748a01ff7a28877915aa2227e04716a
SSDEEP 192:sxZnRxW9/fUsElIdp6l/JHW6+WNRZK5/Ygx2X+QIg5/J:sxZni9/fUsEW0Hbw/W1H
TLSH
T11022C8256E246D7B8CC7D31DBA15BF13E6F9603255951E44AAFC8A1C04F7BCD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fdb1cb5-a00d-43c4-a7ed-1c977733e2a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2fdb1cb5-a00d-43c4-a7ed-1c977733e2a3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ed31ac5d-46fc-4360-9312-fd2d7c929c1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed31ac5d-46fc-4360-9312-fd2d7c929c1d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a08f3fb0e7588ab5fe87aec0bb905ef6a5d9d9fde490ed6cef68346af8ec3f62
MD5 3b3c3ecf7b041f6dfefb98f9698b3a8b
SHA1 58914892b2bb9eff8750d515022eb778be1cbfcf
SHA512 55b743dcd4b7874b49243f3d5efc6b242294ddd0cfc63b8b8d880e89de6a93c83bb0d7b86b90e39d9a64d048d580fafb1c91898a229825cf2734841a19e6a940
TLSH
T15241186CBAFE1118B3B77E569BF6A86D487BB8371E06D49D00110E4E0A67B40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download