749e998df02b426772dd42e77af79690dd8e52ac52fcbed28bdae257359dfd7e

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
category/decision-tree.html
Size 770B
Sample261107-phackscz4m
SHA256 749e998df02b426772dd42e77af79690dd8e52ac52fcbed28bdae257359dfd7e
MD5 4c6db0ec2ecd72020ed67c8572e85f07
SHA1 a1912e1f9475e70c18987b02ef76b410511f9ab7
SHA512 5dd66ad533c4f5d65f0993f597bc5ea519ebe052a7fc5e7f30d5385dd326fabee37a14709eee5f46b307a79fb375488fb160012065fd99d69cbaea76e00266c6
TLSH
T17601F1EE699DA2123321E268CDECBF40627302AED600DC8290054CAC51A055785CED7B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3332	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{E05499B4-7802-4AFD-B5B3-40085CECDC8F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2576	4968	msedge.exe	89
PID 4968 wrote to memory of 3332	4968	msedge.exe	91
PID 4968 wrote to memory of 4868	4968	msedge.exe	92
PID 4968 wrote to memory of 4868	4968	msedge.exe	92
PID 4968 wrote to memory of 4868	4968	msedge.exe	92
PID 4968 wrote to memory of 3820	4968	msedge.exe	93
PID 4968 wrote to memory of 3820	4968	msedge.exe	93
PID 4968 wrote to memory of 4808	4968	msedge.exe	94
PID 4968 wrote to memory of 4808	4968	msedge.exe	94
PID 4968 wrote to memory of 4808	4968	msedge.exe	94
PID 4968 wrote to memory of 1780	4968	msedge.exe	95
PID 4968 wrote to memory of 1780	4968	msedge.exe	95
PID 4968 wrote to memory of 1780	4968	msedge.exe	95
PID 4968 wrote to memory of 6072	4968	msedge.exe	96
PID 4968 wrote to memory of 2600	4968	msedge.exe	97
PID 4968 wrote to memory of 6072	4968	msedge.exe	96
PID 4968 wrote to memory of 6072	4968	msedge.exe	96
PID 4968 wrote to memory of 2600	4968	msedge.exe	97
PID 4968 wrote to memory of 2600	4968	msedge.exe	97
PID 4968 wrote to memory of 1148	4968	msedge.exe	99
PID 4968 wrote to memory of 5876	4968	msedge.exe	100
PID 4968 wrote to memory of 1148	4968	msedge.exe	99
PID 4968 wrote to memory of 5876	4968	msedge.exe	100
PID 4968 wrote to memory of 5488	4968	msedge.exe	102
PID 4968 wrote to memory of 1416	4968	msedge.exe	106
PID 4968 wrote to memory of 1424	4968	msedge.exe	107
PID 4968 wrote to memory of 2656	4968	msedge.exe	108
PID 4968 wrote to memory of 2724	4968	msedge.exe	109
PID 4968 wrote to memory of 2724	4968	msedge.exe	109
PID 4968 wrote to memory of 3348	4968	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\category\decision-tree.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffec671c188,0x7ffec671c194,0x7ffec671c1a0
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3735062058453604816,15125690503400770230,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,14315885978747927365,1893280883908868017,262144 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,9980362135951281099,9326677279395619067,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,8602405540845540429,13510667201388028420,2097152 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,10403785847314062403,15695939274142559443,2097152 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4396,i,14875594830313900001,14906677419615670342,2097152 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,6123391312474001200,2962940511384718597,2097152 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:9
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,13205052978408767913,823445560359728050,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,5974679386463188266,13936759517439995850,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6840812481282782017,3503107902510767093,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6840812481282782017,3503107902510767093,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,2108460331749476026,11284651787729514367,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,17350257158205830490,5019156641641301906,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,3039984755639560143,10016714434039213613,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,18150657125026709042,369495371516368381,524288 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,16516370139363646968,7059883010064887543,262144 --field-trial-handle=2396,i,7502878402013346969,1313479075954966626,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

228b37ab-2157-40df-ba71-8a6e992016cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\228b37ab-2157-40df-ba71-8a6e992016cf.tmp
Size 34KB
SHA256 7ebd377bdd4a53e8fa354ca342de66f6ca6511201ece47213ae7903bfcadb62a
MD5 d05529817ba186bb85080624c20ffbf4
SHA1 28977fe915eeb92eb41fe7501ee5eafe7fd57ab3
SHA512 1f948b9ab0b6c0da1f70a74dcaf15a3f79706772fc290b7077c114a00dafbd795b8c213d938056e4a77716546f0765f82d09245ff2f3c49840314c3fa29c3af5
SSDEEP 768:pN3BQnf9cE0qzgyEMbxyJugQVTJ7vvmeXKE75EkXPLA:pN3BC3pgyEmxyJJq17vEk7XPk
TLSH
T1F3F2BF71A8658C338DF2C285B249B687EFE44263D9C90B94D8CD5E1D01CB7ED274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69becf0b-efb8-45d5-ab4b-9fdb9d59132e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69becf0b-efb8-45d5-ab4b-9fdb9d59132e.tmp
Size 38KB
SHA256 58bb8309727c721861cdad8681ccd7445f123e8af40f3d9772e67c0f4867d47d
MD5 a0ad44cdb50bca74c4c2c87ea1c34c43
SHA1 cb0ffba105a3b8374e8db17c9f912836affa6314
SHA512 c43a95be99a4547a627c6593a62e3377219b3f0e83b82fb6e755acaf8f5304a79c833ce5a90dca7b3d270bf7ea81cdbcd94ca119c9388d05c28286c90225a4a4
SSDEEP 768://UxvxjgC+k3cJf9cE0qzCyEMbxyJugQVTJ7vvmeOKSHtBk:SZj3+k3E3pCyEmxyJJq17vLSbk
TLSH
T12803C036A8759C3399F693847249E387EFF502A385C62BE484DD6E0D06CB7AC530B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f0a1a09-9e73-4c04-81fd-1f6435139ab3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f0a1a09-9e73-4c04-81fd-1f6435139ab3.tmp
Size 34KB
SHA256 8f3a18a0aad227cbf5c1a1cb49c0dbd0931e33010862a2fb0e8c813271b15b3e
MD5 281154095e5c84018c3b8a294e65c3a1
SHA1 8e2cb1a1e972c219a3175805baaa2d54d235b5ce
SHA512 d24659cabd513540020ddd2dc2e1edf31f43f53353c07b16787d58a7b417768171cfbaeb445e0f976a316e41b196d0d3ae67ac7a664f9a2e23852b406ab08f44
SSDEEP 768:yN3WXnf9cE0qzXyEMbxyJugQVTJ7vvmeXKE75EkXPLA:yN3W13pXyEmxyJJq17vEk7XPk
TLSH
T1FAF2BF71A865CC738DF28285B249B7C7AFE4426399C90B94D8CD1E1D01CB6ED274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

0dd1628f-716f-4abb-846a-a5a2cdfbfcc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0dd1628f-716f-4abb-846a-a5a2cdfbfcc9.tmp
Size 10KB
SHA256 4043f25410264d7fae9757680155fc799050b9848442b04d8be572e56c4c5aae
MD5 9f3f807f609bf5ca91cbfb212e90e901
SHA1 a092ab2da2926db1b0f4b72fcf26fc5451392af4
SHA512 a4cf01ded3ba502a5309f9c3ae96ae26c2ac3045f45819d04da96ebcf03bde40afd9293da508108e2ebc8730326a44d89fb7fd60278bfc5702a8a2381c7d2816
SSDEEP 192:sxRZRIbj/fXsok/zoA8p40/g6+WNIYF5rMQG4IgD6J:sxRZAj/fXsokWt/5IIq
TLSH
T14132A615AD28A93B9CCBD20DFB66BF53D2F95032A1951F48A6FC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

154bfc8b-4094-426e-9cc1-71ee7d634131.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\154bfc8b-4094-426e-9cc1-71ee7d634131.tmp
Size 10KB
SHA256 7ba403429e18b4db6e275fb746323afa0849d5b0b7b877e8476d1c70913739c4
MD5 c75caebac195ba2b1e77f7188c753459
SHA1 f6d61876b708df231b47ff86d6dd517fcd218193
SHA512 e915fcc57b4638b7ace6bc9237e26f8c22ae7328ae95806c56b834737aad7dd9b12878d39c7495add83563330411dfb9434ee19a34ef3017a89869e7e728bc5f
SSDEEP 192:sxRZRIbj/fXsMk/zoA8p40/g6+WNIYFQjMQG4IgDgJ:sxRZAj/fXsMkWt/5ITo
TLSH
T15D32A715AD28A93B9CC7E20DFB567F53D3F95032A1951F48A6FC861C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c6f19c9-ff30-4dca-a600-b2ce95a2f77a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c6f19c9-ff30-4dca-a600-b2ce95a2f77a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8820f330-a95b-4f26-9e96-2e5fab13ef32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8820f330-a95b-4f26-9e96-2e5fab13ef32.tmp
Size 23KB
SHA256 500deb86aa568084fcb2e32dd587734597d33af182e086bb570e90bb818f109f
MD5 da36f995d3391e53c474c5e5c9e8a232
SHA1 16b3e8e176c5601540ebd21f85845c1a7577c716
SHA512 25916e2aca98f225ae7c86262dcd71e115c942e71ffc167012c56610017cac4323d87a92981e19227ee550b1b954ef4742499ddfe08a1420a361b1d46b7d0f4f
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRn9ro+P0:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0VL
TLSH
T190B2D92F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE990C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8e03e60731955d9e1ff999960a46f8e5e29af39229c38169e42646da3027ecb0
MD5 6128ad2161bcc58ea916d7f8d56fc59f
SHA1 acdc47332411c6bb467a8ce39b48a53349ac8f15
SHA512 75c7bd32a253715f3db22fc90fd89b7a93a44e4ca4e53958452a84b8f998dbcae30ca2900b664b76657c449c8fd8c72af30aa929c1c43609919d8b9bea1bcf2d
TLSH
T1E361968E2AA04012FF7870FE89D1BEE37E34A5C755873E1236D7DAB5586736C1C54148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 095a2e5547f120e08dc350c1f90cc65b831f23ab2e07d0eadd24e2f6c5b89535
MD5 4514ee8ab135ef64f6decdcb6d9a4869
SHA1 f1380ba83735d22541d7524e5856d75833341a22
SHA512 39fde297af35fd53d141b6fd64654e29e9bdf72906cb7019c945b1e08294f8f7890f72cd056e9a3c6851bf02bfc1f5c47b1280eb8dbba5ca752ad33cd31f4301
TLSH
T17761748E2AA04012FF7830FE89D1BEE77A34A6C755873E1236D7DAB5586736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

a7490d37-734d-43c6-ae41-34e125a51447.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a7490d37-734d-43c6-ae41-34e125a51447.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3a5900eb-3e94-4c83-b015-b160f02b8de2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a5900eb-3e94-4c83-b015-b160f02b8de2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8b06e1a5-2cd9-43d4-9425-db1e11e5e4c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b06e1a5-2cd9-43d4-9425-db1e11e5e4c4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e55d6cc7-575c-453b-8cd2-3e8513159f9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e55d6cc7-575c-453b-8cd2-3e8513159f9e.tmp
Size 1KB
SHA256 357d4d41b1c53ec338d12818f671f0b730a27162cce7330de8cedafdfe3c2862
MD5 a17ff8f29571463cd0f8d51aed20f56f
SHA1 d97a462ace2912d749b50fcfc34bc7716e9b4dc8
SHA512 8047fd3880a389f05732d0af46f1b3a6293becb95180bbe7050e9612a03de8557359b5a93e213ca994c6d31eb56d4c57d2632416e6ba8e8710736e94cb0b564e
TLSH
T1E131C2F787F4957E9A0196F0AA14AE1FCE1C0511431C7CAAC5E0AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e43b86d6970ad7d25601f5406f6b45d9cdd4c668559227b5e4d8830f307ea6d3
MD5 45353ac74554f29fd15213e6dd545456
SHA1 91c613ae37257f033887bb805afc0e7be6d067d8
SHA512 3ece50a5adf6b19912bb0a0b07d55ff84ea17851b4397f8e08f799b1753720f0dc2ba0d432922b99304e93ad26aa0a2a51b637544c83c8f536afde8552012164
SSDEEP 192:sxRCRIbj/fXsRk/zoA8p40/g6+WNIYF5rMQG4IgIJ:sxRCAj/fXsRkWt/5IIs
TLSH
T1C632A515AD28A93B9CC7D20DBB66BF53D2F95032A1951F48A6FC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bd368248-ca9c-4897-a007-1bbb2b10d9ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd368248-ca9c-4897-a007-1bbb2b10d9ae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1884b3f-b000-47db-ac9d-127775d35eb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1884b3f-b000-47db-ac9d-127775d35eb7.tmp
Size 37KB
SHA256 4cadd5127865f84d431e70e8b355068c5458398dfcab09b77f45d7b8440958a4
MD5 31abb227fd38f88883222946119db698
SHA1 8e51dcd6765a37dbf62775692654ba9415db84a8
SHA512 f6ff93cc8edec4f94f03b6cb60719274b2d39d5ac1cec80d58945b4f99566ec1f3bd596e0a94d19bd2380ae6d01c750174746214b48bbed787917cab8bf986cd
SSDEEP 768:p/UxvxjgC+k3dCf9cE0IyEMbxyJugQVTJ7vvmevbSHtBk:cZj3+k3y3nyEmxyJJq17vdSbk
TLSH
T18D03CF35ACA59C3388F793843649E787EFF502A394C62BA495DD6F0E168B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2f0d94b-2a90-4f1f-b98b-7be1b9cf3068.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2f0d94b-2a90-4f1f-b98b-7be1b9cf3068.tmp
Size 36KB
SHA256 fff78d09fb8e7b5f6010d61b793658a89a3c1cb0675c052bce4fb4396fae1f25
MD5 b8db2d021c10dd0da0b81162f0a11463
SHA1 acbc713498451c8aed7ba40d8865609546b846e8
SHA512 d14005dea15b6978121f8925ed8ef6affb1cb113413edf242badc00f2fc5a465da6a8684633cf9cf9e157e41264742cd82f7f937ab38cefb259abf104012f0b2
SSDEEP 768:ZFdl3pwgrQnf9cE0qzcyEMbxyJugQVTJ7vvmeXKE75EkXPLA:Fl3jC3pcyEmxyJJq17vEk7XPk
TLSH
T16CF2BE329894CC379DF68784B2497687EFF442A3C8DA1A94E5CD5D1D01CB2DD238BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71f3682a-8942-40bf-af9d-81d90396fac6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\71f3682a-8942-40bf-af9d-81d90396fac6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download