993835335d2df7002d5cdce1d20808e35afb239ab80fc270262404b69ed2fed2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6s-helper-script-loader.html
Size 237KB
Sample261107-tyb9bses3p
SHA256 993835335d2df7002d5cdce1d20808e35afb239ab80fc270262404b69ed2fed2
MD5 4d2ad2cb392cff2091407205a6733b85
SHA1 ab67f70a51ae8877382043cd99ac77baffff0012
SHA512 d3c8a9fd3155942e64a5b0f223a063f3bf873fb8de55058586bdfbc10fcf318f05b8c9c39ad4ad447f9b4062554cf0e5688cde20912f8d0574d1f56209c03908
SSDEEP 6144:21UMazgFnlTE3t/n80NB4G9p+H2WSM4MgwB9WhmMbbTfBNWGGZUA6EoiZuKJJbIR:IUMazgFnlTE3t/n80NB4G9p+H2WSM4Ma
TLSH
T1F834E7B1B135A03E062B5ACAF571AB18E39BB21BEA5555F5C93FC2B482C3CC4F653058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	camo.githubusercontent.com
37	camo.githubusercontent.com
40	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{9FD7BDF9-21BC-4304-81C3-BF9B64CD7B15}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2444	1840	msedge.exe	88
PID 1840 wrote to memory of 5744	1840	msedge.exe	90
PID 1840 wrote to memory of 4808	1840	msedge.exe	91
PID 1840 wrote to memory of 4808	1840	msedge.exe	91
PID 1840 wrote to memory of 4808	1840	msedge.exe	91
PID 1840 wrote to memory of 2904	1840	msedge.exe	92
PID 1840 wrote to memory of 2904	1840	msedge.exe	92
PID 1840 wrote to memory of 1296	1840	msedge.exe	94
PID 1840 wrote to memory of 52	1840	msedge.exe	95
PID 1840 wrote to memory of 1296	1840	msedge.exe	94
PID 1840 wrote to memory of 1296	1840	msedge.exe	94
PID 1840 wrote to memory of 52	1840	msedge.exe	95
PID 1840 wrote to memory of 52	1840	msedge.exe	95
PID 1840 wrote to memory of 1104	1840	msedge.exe	96
PID 1840 wrote to memory of 1608	1840	msedge.exe	97
PID 1840 wrote to memory of 1104	1840	msedge.exe	96
PID 1840 wrote to memory of 1104	1840	msedge.exe	96
PID 1840 wrote to memory of 1608	1840	msedge.exe	97
PID 1840 wrote to memory of 1608	1840	msedge.exe	97
PID 1840 wrote to memory of 5856	1840	msedge.exe	99
PID 1840 wrote to memory of 2232	1840	msedge.exe	100
PID 1840 wrote to memory of 5856	1840	msedge.exe	99
PID 1840 wrote to memory of 2232	1840	msedge.exe	100
PID 1840 wrote to memory of 5388	1840	msedge.exe	102
PID 1840 wrote to memory of 5528	1840	msedge.exe	106
PID 1840 wrote to memory of 5480	1840	msedge.exe	107
PID 1840 wrote to memory of 5876	1840	msedge.exe	108
PID 1840 wrote to memory of 2856	1840	msedge.exe	109
PID 1840 wrote to memory of 2856	1840	msedge.exe	109
PID 1840 wrote to memory of 3792	1840	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\r6s-helper-script-loader.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa63fbc188,0x7ffa63fbc194,0x7ffa63fbc1a0
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12290565650100774184,1832892035601500076,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,13838316307271648213,16085430628677665456,262144 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,7713013283895484342,4154759407973652201,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,16875591212087695073,17516582570694620193,2097152 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,9688904981881687272,17660263309479350386,2097152 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,4863011938538590162,1428947029512464146,2097152 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,7562782721186414230,17073117569351011875,2097152 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13050732240976360777,8092452598153405396,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3398325841004592729,12830057856059091551,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,4788032439745884921,6754881794269642985,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,4788032439745884921,6754881794269642985,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,944969753236516135,8067510689156823765,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8236833000188377642,1014412456501293621,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13550943020561886645,6207174463503271120,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,17857195887836384485,17172587836778686476,524288 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,13915472721980059434,10573739050769235579,262144 --field-trial-handle=2576,i,18261488776510654134,6698953612538175249,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20e1d9ac-398d-4fea-bde0-d03e4a2431bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20e1d9ac-398d-4fea-bde0-d03e4a2431bc.tmp
Size 36KB
SHA256 20458586536b41b99d3cbee5d6e00f596a7fa9a0928e4fbabba2731c6a87eb8b
MD5 3a591ac3015865e24e8f2e022bd4e911
SHA1 0e95be580c351e7b4add6aea9853b7a43696c4b3
SHA512 4a023e70021c3458fa00790fddaabb37d91d655d46e98cb8158a2afe22342f5093c8da4881c77ceb72be31de36347eaef4d4ce4b379b08036df3b07ab48ee17e
SSDEEP 768:pFda3LwgPi96cZ0rfZWoYoDYoPsHOBw4Ot5AEl94BHYjHME75EPL0:Va3EOBVa5AEncHYjskc4
TLSH
T1A403AE79DC90C9379DF79B95F60A3246AEF18193E8C15EE0EACC682D05871DE138BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e010e4d-f418-4c70-92de-a804daf7c620.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e010e4d-f418-4c70-92de-a804daf7c620.tmp
Size 38KB
SHA256 1b626f7ddc5f9388ed83e6fd7404d70860fa8055e0dc561c52267020ea890ab5
MD5 4e65dcbbbcd309b89e31145491451026
SHA1 4fb15649a3432d6f63343b2810daf476dca5dc6e
SHA512 5f27f7a3f49a91e1b73b502a599aa5f4e8ebfb802b5f716b079ed838d98863dabeeb0fd41d9270f4fc38f764b872eddb4a0374aeede645f06a44df1b277a278d
SSDEEP 768:z/UxvxjgC+b3ujcZ0rfZWoYosBw4Ot5AEl94BHYj//AFTN/:GZj3+b3bBVa5AEncHYjHAFB/
TLSH
T11903BF38ECA59923CCF7D785770B334BAEF19463E6812ED489DC2D1E0A8725D5307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

0932b387-5dba-490a-9554-c13d0ea0461e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0932b387-5dba-490a-9554-c13d0ea0461e.tmp
Size 11KB
SHA256 c578a9f9447f1261ec23846c90953fdc583d0a00675f9d7a8a9ee768bd24424d
MD5 c8bda57034fb99df844c78005df0127c
SHA1 9b52c05a091228d566c9a137f825146935a683d7
SHA512 37d665d1d244366d509a9b37dcff7f6f7539a0ebc9f78001d53cf2f5781feb5d7a0fbcfcab20c084978e000691a245de35d70b6daf89979808aee38d0b6938d8
SSDEEP 192:sxRzRxbY/fPscKKzoA8p47/g6+WNIYijn2GGpIgDQJ:sxRzHY/fPscKHK/5IQQ
TLSH
T16832A625AD28B93B8CCBD219BB65BF53D2FD5032A1951E48A6FC962C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42ad6bee-61b1-48ae-a789-f2763aa0072b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42ad6bee-61b1-48ae-a789-f2763aa0072b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

862afcf0-e573-4f67-ad54-4ec4b8267771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\862afcf0-e573-4f67-ad54-4ec4b8267771.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 8e142faea46ca3d3520ceb1c0e147a4c046450973887665ad2139e114d8cef3b
MD5 74fbafa9f668dd93265d9b3da938fad2
SHA1 3b85246cf72dc701c9c6e5165c6c0e8574f3a973
SHA512 0466deab16b48094f080e6a76ea8f0af8d6d0f2f13992b34cb784e976b96f37aa2f07bfd344f3d45de24caf2b59f9d1741334355004873b6460c4daa3306ed8f
TLSH
T14D51D9805AD0B05DF38832B28FD46E833AFD858826C34ED10794C4B7A857B6512F477C
MD5 SHA1 SHA512 TLSH

Submit Download

cd1579c1-6697-4858-bae9-0edefac40946.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cd1579c1-6697-4858-bae9-0edefac40946.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0f8a4bd5-c851-423e-bfd2-a67bce6fc9e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f8a4bd5-c851-423e-bfd2-a67bce6fc9e3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

4828fb20-f8fd-4cf6-ae7e-1f2ddf76e293.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4828fb20-f8fd-4cf6-ae7e-1f2ddf76e293.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

afc47e7b-2cf2-4061-982a-a00eed5091cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\afc47e7b-2cf2-4061-982a-a00eed5091cb.tmp
Size 2KB
SHA256 8f0ee3bfb21e35eb862f41fdee50b5967a7e876fa2871f22133a3a64a05b1bff
MD5 e61528e5cca322c1ab927ef6ead29185
SHA1 804528885402388e317400b2ce25888c1f2b5f63
SHA512 eadff987ffaefc2a1fd033f2a70ce875afce8c0f40ceacc2003706724590060667e7486b13c8f896581c3357396348b1163a9f8ac4a0de5ebc74323c8610267a
TLSH
T1DC516EF787B4467E9A1196F0EA146E2FCE2C0516832C7C6989F0AE1BA3F2471D14175F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7532d5d826dbc2b7f7b3498497b42c2cb5e29034de2e8b2e402c3475024542b5
MD5 aca0ae9d50f9455fbde6f07e7dca06cf
SHA1 0b9d302a171b06f29c3c4a9add1d88b4d12fb36e
SHA512 2ce4dd60b76fc02c7ab34569545c46d88c851a9c14f42c56cd1df56417d9cdfe6168550fc42bcaed2ab626644ed3c25b908e4b58c946da3d4802e09f83772003
SSDEEP 24:KEsles3sys6Bs/EsmsCsL/sysn1s6ISsOsLKpsEhBsYsL1bsUsbSds1jsQzsCs48:KUoIvK1+cTy58IvKd2MnyxgI/KpOEU
TLSH
T11991F361343B1240383E351895E597AE4B4171637078E96F7BEE50A68E3BE084EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ca51e309-220b-416e-a92a-3d0fd016fea4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca51e309-220b-416e-a92a-3d0fd016fea4.tmp
Size 23KB
SHA256 76b765bc502fcb238e1609e628a563638cc3dbad54a0d58652ef548ac65f3913
MD5 e970b60bf6bd208612713b2642acfd49
SHA1 7a33bf282635b3e58f303fc20fd8406142a7034c
SHA512 8781fb54b366fd851ec10c3b5862ef1e4e0de74f650bdbe9ecc4eacdd30fcea1a686c04215390d026b5a4ceca0636ff47aa03b64327e4ed73bf49ab5e114ef9b
SSDEEP 384:XLMDmVifCtgvdFfnvKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVC69lLRRTrohZD:XIDmVoWgvHfnv8F1+UoAYDCx9Tuqh0Vl
TLSH
T17AB2DA2B640DC77F4F800A9DAC296F977D9801CB9A588D4047FE994C02DB7EB921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbac8c37-f804-4728-be88-bd10aaba2477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbac8c37-f804-4728-be88-bd10aaba2477.tmp
Size 10KB
SHA256 09a9b18224830aa2f81566cbd22a8fd544772f3de920ccb5fb81afbe5f12e0f2
MD5 12c17619522f4b8c2ec4054efc515e2d
SHA1 e2d013c10858b240ea4d5263192851af57418c67
SHA512 3cfc605cf24a8119b0ae3f2ab586d47a2aaa9bfb0781e04aeca08868b5f479a37409df3a067a49296117d471d46980aa4d458894cc10c5e6ace9c290959f3fad
SSDEEP 192:sxR0RxbY/fPs0KKzoA8p47/g6+WNIYijn2GGpIgIJ:sxR0HY/fPs0KHK/5IQs
TLSH
T11F329515AD28B93B8CDBD219BB25BF53D2FD5032A1951E48E6FC962C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de2588a9-8ef9-4dae-9453-811b598eae15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de2588a9-8ef9-4dae-9453-811b598eae15.tmp
Size 11KB
SHA256 45ae96c63814dfdf606ec3f38077f7e8334a6284da0c9bac198d929b730faa87
MD5 c7101dacfe0bff35f2481699baf3998c
SHA1 75ba0784bf50b316063fa55336bc42a5296d05b3
SHA512 f689115e7cb1f1405f4a65faedf20cfa547ad496bd5c1dc8c8f9f7da279a04992669ece4e0b0f3a32c14398e7a7747e598d38d01126b930620cda7fb7feb3638
SSDEEP 192:sxRzRxbY/fPsgKKzoA8p47/g6+WNIYiNd2GGpIgDyJ:sxRzHY/fPsgKHK/5IAa
TLSH
T1B932B729AD28B93B9CDBD21DBB157F53D2FD5032A0951E48A6FC962C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b35896b5-e5ea-4ea3-b70a-a98e8f3ac7a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b35896b5-e5ea-4ea3-b70a-a98e8f3ac7a3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c602600f-0d17-4de1-a783-78bc0ff5fa67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c602600f-0d17-4de1-a783-78bc0ff5fa67.tmp
Size 38KB
SHA256 c88dc7c3c60a6459f56593ee146855ae16531aaff23af7b5e47ab11a54d70867
MD5 b5d0a2ddce7ba051e782d47267e15786
SHA1 d4dd5fd7a7aae5dc696c39a12d49a2f021164210
SHA512 7112d928ca3c481c3a76e0a0fb268213e27067fbd4f82eb05920f11a37187b010c7797028a92689ead44b516f073213de900bd047cb2962dc0d13c0b23580182
SSDEEP 768:h/UxvxjgC+b3kYcZ0rfZWoYoDYoPs9Bw4Ot5AEl94BHYjeMAFTN/:0Zj3+b3MBVa5AEncHYjrAFB/
TLSH
T17503BF39DC659923CCF69795760B334BAEF584A3E6812DE09DEC2D1E0A8725E130B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e22a619c-1f74-4300-85b9-0b4a290aade3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e22a619c-1f74-4300-85b9-0b4a290aade3.tmp
Size 40KB
SHA256 00ac62ac639e4509ffa0f87d38a41cace28278cdf03aa69e6f07d43a588073dc
MD5 025926e062f3b43d6eae70ac47cb0b25
SHA1 6eba3a56f054b491463a7e31d6ed9d69f011f7a1
SHA512 45b72cb87da61f14181586df879ddcacbe2148583652ef307190e2b6a4e570c402ae532ca9491c7412a6a4a4a9d23c6bc7e5b09d9985fbf29a11f38e6b748e7b
SSDEEP 768:h/UxvxjgC+X32iK6cZ0rfZWoYoDYoPsKBw4Ot5AEl94BHYjHME75EqS:0Zj3+X3PBVa5AEncHYjskvS
TLSH
T19313C038EC6459238CF7E794B60B3347AEF59453E5C12DE49CDD691E0A8729E134B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef7ee87f-4afe-4c7b-9fd1-48ba367c6f0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef7ee87f-4afe-4c7b-9fd1-48ba367c6f0d.tmp
Size 34KB
SHA256 c624bd995628f3a377cd14b929ea17f9a9c155d2420209abd33a8629bbfcd655
MD5 a2abdca426d363eeed90acbaae225463
SHA1 2956a616208a1b65b7227dd4ef62639cf6ca0202
SHA512 7d0ca8d45011d2d3e1e251107e59f6ddd4c4f2ca81918c021c17db06f76cd36c3a2a076ecc4c43a0d4f88f9ae182092fefb2cfd4592855cad5376c718e70900f
SSDEEP 768:Wr32i96cZ0rfZWoYoDYoPsKBw4Ot5AEl94BHYjHME75EPL0:Wr3IBVa5AEncHYjskc4
TLSH
T199F2BF78ECA199238DF39795F20B3647AEF1D153E9C11ED0E8DD691D0A8729E234B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bdf632b-7938-4498-be80-647187ad67bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7bdf632b-7938-4498-be80-647187ad67bf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff97b128-47ec-49cb-a878-44576e3ab30b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff97b128-47ec-49cb-a878-44576e3ab30b.tmp
Size 34KB
SHA256 3e31f141fa01744ee86d8af3bcd30208617bd53e984a133d5f1a2314f143d313
MD5 4d2cc0b3f5e73df0e5cbccc978f9d8f6
SHA1 1bcdf3b2691dc9633fb9c550c920518dbf1fdbca
SHA512 88e07ff44228203452c5dd0650834efd0346b33f71e78a7d2fff9783e18714b7030aeba0bbcbec3192bd452d7dc16415ddb56600eeed57058626e0623dbbb159
SSDEEP 768:Wr3zi96cZ0rfZWoYoDYoPsKBw4Ot5AEl94BHYjHME75EPL0:Wr3JBVa5AEncHYjskc4
TLSH
T178F2BF78ECA199238DF39795F2073646AEF1D153E9C11ED0E8DD691D0A8729E234B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download