b9d5d206956c2c90d53179568f106b716eb9f29847d1069d25274bd54f2fed6b

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17aG-BvvYO-xd8puBqWdWrOBeZhHNRyxK.html
Size 383KB
Sample261102-vddgbsdx7m
SHA256 b9d5d206956c2c90d53179568f106b716eb9f29847d1069d25274bd54f2fed6b
MD5 4341a629910b2efc9ece634ddc41a2e5
SHA1 9eeb6a164e0845ee3678aece4cf668755bccf57f
SHA512 3cbe31ca3d35b90950352b96baa8c45bd96f0d6992a48c85b2f8455388c088bd80179915231a0f9c853e62f48ffc779eacf4d198fab06bf2488ccae72986be6d
SSDEEP 3072:7R2s6qKXQavXLpnqBbuGteBl4dv/+Aeza6kJgSLHtxvZxCmL1TVr:8s6qEQavXBqtdka6k2SBxRxVlVr
TLSH
T18B8429D271012CF2DF27A9E2904B460E797E207FE0894578B3FCCEA11FD99A6152676C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{6168E3B5-6CFB-4A8D-A134-3D1110EB9AFC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5108	3412	msedge.exe	87
PID 3412 wrote to memory of 4204	3412	msedge.exe	88
PID 3412 wrote to memory of 1068	3412	msedge.exe	90
PID 3412 wrote to memory of 4204	3412	msedge.exe	88
PID 3412 wrote to memory of 4204	3412	msedge.exe	88
PID 3412 wrote to memory of 1540	3412	msedge.exe	91
PID 3412 wrote to memory of 1540	3412	msedge.exe	91
PID 3412 wrote to memory of 2720	3412	msedge.exe	92
PID 3412 wrote to memory of 2720	3412	msedge.exe	92
PID 3412 wrote to memory of 2720	3412	msedge.exe	92
PID 3412 wrote to memory of 3904	3412	msedge.exe	93
PID 3412 wrote to memory of 3904	3412	msedge.exe	93
PID 3412 wrote to memory of 3904	3412	msedge.exe	93
PID 3412 wrote to memory of 2160	3412	msedge.exe	95
PID 3412 wrote to memory of 2160	3412	msedge.exe	95
PID 3412 wrote to memory of 2160	3412	msedge.exe	95
PID 3412 wrote to memory of 980	3412	msedge.exe	96
PID 3412 wrote to memory of 980	3412	msedge.exe	96
PID 3412 wrote to memory of 980	3412	msedge.exe	96
PID 3412 wrote to memory of 1820	3412	msedge.exe	98
PID 3412 wrote to memory of 1820	3412	msedge.exe	98
PID 3412 wrote to memory of 1260	3412	msedge.exe	99
PID 3412 wrote to memory of 1260	3412	msedge.exe	99
PID 3412 wrote to memory of 2608	3412	msedge.exe	101
PID 3412 wrote to memory of 5796	3412	msedge.exe	104
PID 3412 wrote to memory of 5796	3412	msedge.exe	104
PID 3412 wrote to memory of 5796	3412	msedge.exe	104
PID 3412 wrote to memory of 5060	3412	msedge.exe	106
PID 3412 wrote to memory of 5892	3412	msedge.exe	107
PID 3412 wrote to memory of 1152	3412	msedge.exe	108
PID 3412 wrote to memory of 4128	3412	msedge.exe	109
PID 3412 wrote to memory of 4128	3412	msedge.exe	109
PID 3412 wrote to memory of 4260	3412	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\17aG-BvvYO-xd8puBqWdWrOBeZhHNRyxK.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ff806adc188,0x7ff806adc194,0x7ff806adc1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,17570704758291021399,9335424573144984688,262144 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4763199944976116744,12991672916264595475,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,11264745753070133250,6051672712277664034,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,18439142562828483893,9093742489456851193,2097152 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,17482317853615573094,18215345514906967276,2097152 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4428468684593129934,1990683549428623803,2097152 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5684263651356724014,15948024951450275163,2097152 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11147045149645120362,16626859216138468198,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12957037907685816825,5108387280841815230,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6531297055863771425,341180632690672195,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6531297055863771425,341180632690672195,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6184,i,2307364729132123033,12376320072675900606,2097152 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,7067005368062188119,6870279357206052570,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,17805433588076012654,18043966184738516487,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,8069601794203320387,16495707840358854625,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,15682261219854647132,11149852338429535362,524288 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5436,i,16580151762622258541,6724901097684611685,262144 --field-trial-handle=2400,i,17104650129777919324,8072553999102998188,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f426d83-e4e1-40e1-aaaf-eb92177a57dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f426d83-e4e1-40e1-aaaf-eb92177a57dc.tmp
Size 37KB
SHA256 4ab5f2d8f00a84af59e307c2414f485c15b4cb25d0d94b5ec5abead5a6f195da
MD5 347480a3e29b46d1679f05867c3a799f
SHA1 7046c570210f5594c3ac5a02165506d6fdd49524
SHA512 14c3cbe26c957e5000e52e42f247cdb63f0a7a90f1873a8687625ad455b4a560bc8637a951864b1a8b46d3e3a2c92238c9f9b39901cc70799c2bf4234d97c59d
SSDEEP 768:R/UxvxjgC+W3kAoc7fZrKuXp5XSwQs88uBkiTCs/P84g:kZj3+W3kctrXZILNBpHg
TLSH
T1C103D039F8946C63ACF39385365B275BAFF05153C4C40B9849EE7A0E028B39D6707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fbfdb0b-1c28-445f-ac8d-af02e07e8961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fbfdb0b-1c28-445f-ac8d-af02e07e8961.tmp
Size 33KB
SHA256 b07dd00e11c7845da7348db6a320ef6641403003544c1096533eeb79ef5f1a2a
MD5 23eff83a7cfaf0c6e2719e5afa75914b
SHA1 8751f6412fc83ec306892026eecf6d6e06c873cb
SHA512 e5986e684ceb1a77f5bb90ac43a85209e180c967c2d95fb3d3b9f3c8fad9f9cad10c4894134d8ba28afa1aedff2c84480f4ec39c77cdb8545af7564592c28f8b
SSDEEP 768:Hx3lnVCc7fZrKuRp5XSwQs88uBkiT2KYm5NYsC:Hx3tvtrX/ILNBPYkC
TLSH
T1B0F2B079EC905C63ACA257C17A5F3B06AFF05247D8C40B54C9EEB61E014B79DA38B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

209554ce-f613-4e01-b2d8-8b4f1dc0a56f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\209554ce-f613-4e01-b2d8-8b4f1dc0a56f.tmp
Size 33KB
SHA256 bfaf49d0972e5876e4739d039a16a4b000ad33bed694d3cc3aea1ee61ac12abf
MD5 125301e21458a87bc7f2bba70510bd73
SHA1 5aada3a71977b1fa896a16ea1cecd7e39a737b01
SHA512 3c8408851f23319e172ac11befa9a85d878329d69eb5f4b4c518376e6fc44e0794a631d6e2cb24b00d65260c1cdbd890e630c5def9dc17b2414087671c45bc77
SSDEEP 768:mx3mnVCc7fZrKuRp5XSwQs88uBkiT2KYm5NYsC:mx3gvtrX/ILNBPYkC
TLSH
T1CDF2B079EC905C63ACA257C1795F3B06AFF05247D8C40B54C9EEB61E014B79DA38781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365c72e7-d2ee-4be9-b8dd-b552776e8990.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\365c72e7-d2ee-4be9-b8dd-b552776e8990.tmp
Size 38KB
SHA256 d9b2d90400330d957bd547e0c5ce07364b48c44ab73db11a61c29860d160713a
MD5 0c614073702e3571a0b8fa2de4b78dfc
SHA1 1f787ed36681a0f3845d790545b2908ffddc2d2f
SHA512 4a79c686f4d431b0420a731a601155fc5d6d8a2ff1047e9b617a9d5acd44eb32d0a87fb6b648c630f6cd1768f75d91a8a70a3d019961091983f3e81b24dc3f9b
SSDEEP 768:2/UxvxjgC+Q3VnFCc7fZrKuRp5XSwQs88uBkiT2KVIl:rZj3+Q39ftrX/ILNBPWl
TLSH
T16F03C039F8946C23ACF293817A4B3757AFF05143D4C40BA84DEEAA0E028775D534B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d384cae-2409-4865-ac55-9b71e03c4710.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d384cae-2409-4865-ac55-9b71e03c4710.tmp
Size 36KB
SHA256 ba4341ed2b4a4e23441b421d6e554f9365c8c6e6a74eb232a609546380aef409
MD5 5be5c9468cf939993bf42e974f501777
SHA1 279fd2e698110d72e071ca768f373e6ce7db7fb6
SHA512 405d0baac24e4a31f0dfd53cf6d7f4b34bb47e738b632efd57e1cd2b9be5da7ee9c9c33fbe24cb705b2016467a2be27c1a81646811f2358b8137387e43ea5524
SSDEEP 768:fFwu3QwgUnVCc7fZrKupsp5XSwQs88uBkiT2KYm5NYsC:Wu3LvtrXpyILNBPYkC
TLSH
T199F2AE76EC809877BCA24BC1BA5E3706AFF05297C8C44B54CADEA51E014B2DC638BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

0a17a0f9-ea09-4a3f-99f1-e6659ccc0dcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a17a0f9-ea09-4a3f-99f1-e6659ccc0dcf.tmp
Size 11KB
SHA256 e2205f2b8e3acf8e86b41ae3b43d9f78b86545586b8e4872c3ac3307d474487d
MD5 3084f37ba961542ed1e0e53f79478de1
SHA1 b22d4f6973462b99d1d55323dcd16231db39a60f
SHA512 be33b6098a5cf4d5a189fce49a3f5bb7205360e0b7cc0d09e842da2db22a7621a1908f1db8eee09668d8b616a03f51e4a2fa0c2eb986d7e2511b972f466434b6
SSDEEP 192:sxRKRRby/frseHRiBzoA8p4e/g6+WNIYEG8vG1IgDMJ:sxRK/y/frseBX/5IgM
TLSH
T16F32B615AE28AD3B9CCBD21DBB557F57E2F95032A0901F48BAFD8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40d57ac9-2582-445b-a0d2-bc1461caa91d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40d57ac9-2582-445b-a0d2-bc1461caa91d.tmp
Size 23KB
SHA256 9a7f87e580873bba64d127b7e6ced1235da9bad9741404ff251099715eca53f0
MD5 c7c483274d60aa66ad8f7fd87974966c
SHA1 284f5875c0525f2a1a31f373bc3f13f33e12420e
SHA512 43cb89836ddaac413d38944d6cd4aec0300e661640933e4a35f5f133833087f34b9b000d3a88b3b85606964932769f0daf7315587a7a8dee495a2d32022653ee
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXVroJew:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0V/
TLSH
T17BB2D92B640CCB7E4FC04A9EAC196FD77D9802CB9A588D4047FE995C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bd14a53-ab55-443c-9806-bc493835a940.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5bd14a53-ab55-443c-9806-bc493835a940.tmp
Size 11KB
SHA256 cb580905cd68984120411996ec9912e012eaaccc0bcf54e15dbf05597346e6cb
MD5 d98d8181da7f88a692b6734bf09a5407
SHA1 728c6a157864ff0842a774873cd078b65f3d35da
SHA512 7f135f8b00a0cf2b44df866684d14f714cb7f8888fe97342a8dd15285171e3cab935887441019b08d1c76b3038f84a5093de24499fbbe5545c4f16b0baab204b
SSDEEP 192:sxRFRRby/frsyHRiBzoA8p4e/g6+WNIYEG8vG1IgIJ:sxRF/y/frsyBX/5Igs
TLSH
T11532B715AE28A93B9CCBD21DBA257F57E2F95032A0905F48FAFD861C14E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e527478-fde3-41ba-9771-0b8f580734c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e527478-fde3-41ba-9771-0b8f580734c2.tmp
Size 11KB
SHA256 b504d5650cd24b30a4b6e3b1ff1a39baad01ce38e16ec428898b8afd038ba2b2
MD5 94fd34b0794426515b7e1cc9c280fc75
SHA1 bb5c5b7ac4bdb731574cf5a7b09c55bf0620a961
SHA512 f334f90c83bfbc243180feb4e622134d39aa96a0b97190bbe24f2f4cb1053e6052baff12929e7c20b78b6aeddbbb40729c7d712b3674538d3c4a5f345a4651c6
SSDEEP 192:sxRKRRby/frsqHRxBzoA8p4e/g6+WNIYE5MvG1IgDuJ:sxRK/y/frsqgX/5Ih2
TLSH
T12B42C715AE28AD3B9CCBD21DBB557F57E2F95032A0902F48BAFD861C05E76CE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93206ee4-4abc-4bcf-9223-cc8482700130.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93206ee4-4abc-4bcf-9223-cc8482700130.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

93d5c09f-653f-4ae1-a4c7-282193805aa8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93d5c09f-653f-4ae1-a4c7-282193805aa8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 8ab128b3873aadff8fa0424a1932822b5a3ca95ef35948a3b55cf50b419d832c
MD5 66c0ce5ab0f298f092a97859b96a19b0
SHA1 f68d5228576380db6c7c2736f2793fd3e8c9e636
SHA512 e9631b14c84bbf5f0b019845f6984bab44055aae5b837fd390c467a9661ccc2593daebce3d322a76dd6056b38e561c36b9c8d7c0ff3d537dc04e9a6d81d3563e
TLSH
T1C8411D40994332C3F7F4C67144E61E8F3E34C84999238EC23CA4EDB99B4270C975025B
MD5 SHA1 SHA512 TLSH

Submit Download

3a2a12ed-18eb-4c77-a545-d2022872eb8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3a2a12ed-18eb-4c77-a545-d2022872eb8d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2af1b72b-650a-4bc1-b116-7fa7907b3d5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2af1b72b-650a-4bc1-b116-7fa7907b3d5c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

61c605c0-4807-44dd-b5ae-ec1a95b3131b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\61c605c0-4807-44dd-b5ae-ec1a95b3131b.tmp
Size 4KB
SHA256 24dfe055e963b1c8c1d17e36f91757a0ab222b69681f1d891f655891d597cbb4
MD5 8ba2ebb051fda35644cb9a1edc1620e2
SHA1 8fad87f9a5d544aa903e68f9622289837814fab3
SHA512 a568f7d328e0558b6d7503afeea80aab0a3785a424d1ccdcb81daeeb9e0a735510d274f2c5d7fb4de9e3e6c36e2aa8d244ad1639a96a41b17915c5a17c2adcfe
SSDEEP 48:YALlNOOgo1gJhrgMVafo7gmgCCjhhnONzs7Ur/zEsidzst/tsN8so/CKs3NsU6sk:DUObydHVaaiZjho/z2o/Gk/sPFd9NwMs
TLSH
T18A919BF7C7E4867E891156F09B246E1FCE2E151A423C3C5688E4AF1B63F28B1D24169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f06435c-2592-4300-b335-0372e4a297d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f06435c-2592-4300-b335-0372e4a297d9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 58af5345086a4c5bcdbd431014d9e81ba923cc3788c437fc22bee3b95459bd4c
MD5 92d4fe8d396a208f80ca52a131c70090
SHA1 138e883935b0a5cc82665ed2928e9e6ee83c13db
SHA512 e8b5b3176a149c40c00daf77365f196e415715c2b713009600decd59da817b4ef46cc5741ddfc89f86a10e1a3a4e4aba258284c2fba4378aff39c5d7e8474ae5
SSDEEP 48:K0Mb6G02aDbqpyIS+DK9a14Dx8TYRi6AyL6lI064I5bkjUISs5K9Q1K5xipYb8co:K4b6KIYym9SKekBNuK+4aB
TLSH
T1BF9147593077425039BD288C46B49A6A168231B73218F96FBFBC44658E2FE540CFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b98f5713-91c4-48fe-8bcf-7041689bf672.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b98f5713-91c4-48fe-8bcf-7041689bf672.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3285197-345e-46bf-9b37-8c2ea59bf5ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3285197-345e-46bf-9b37-8c2ea59bf5ac.tmp
Size 38KB
SHA256 da934b5fc19898aea241116dc3a86e01647c1d61623d210e78614eff9379d8b9
MD5 bb83027c12db9ad35b17e38b6a35385b
SHA1 9ff7362d4adea32f558fcfa706e90c68927a9dd8
SHA512 66d3c255495e6f375f79ac3f9dfbd59a712358103514cfaea26c2ae85e3201bbec13ed0941194485546926d421f77c65aed1648d726dcde3351907f413d6f874
SSDEEP 768:o/UxvxjgC+W3EsMc7fZrKugp5XSwQs88uBkiTzK/P84g:1Zj3+W3EctrX+ILNB0Hg
TLSH
T17A03C039E8946863ACF2D381365B274FAFF05153C4C41B944DEE7A0E028B75D674B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9efc916-323c-47a1-8bb5-71ebc9e383a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a9efc916-323c-47a1-8bb5-71ebc9e383a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download