42bc0e89c86b7d1e47f166e04c4edd3b1e0979453d652844469dde10f2897e73

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ts-metrics.html
Size 774B
Sample261110-ppln7aay3s
SHA256 42bc0e89c86b7d1e47f166e04c4edd3b1e0979453d652844469dde10f2897e73
MD5 610df1b11398a4bbd24efac2be74a36e
SHA1 7d6bc25f16157c167717f9223216782d54cac602
SHA512 0c7dc95ab28f1b74de363a785fee2d0ebe375774356f27195369d262aa8a8f973f5bc40e39af687b3c53ca7acd79c7c1cef329c974f49ce86fd20971946021dc
TLSH
T1100189F77B90622DBDA10A966988D3A072CB0990746970E4E0E09106DDC0947FD321ED
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{706E24AD-231B-4726-8CDD-5B7433D3959E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2532	2940	msedge.exe	89
PID 2940 wrote to memory of 6012	2940	msedge.exe	90
PID 2940 wrote to memory of 2884	2940	msedge.exe	91
PID 2940 wrote to memory of 1468	2940	msedge.exe	92
PID 2940 wrote to memory of 2884	2940	msedge.exe	91
PID 2940 wrote to memory of 2884	2940	msedge.exe	91
PID 2940 wrote to memory of 1468	2940	msedge.exe	92
PID 2940 wrote to memory of 5096	2940	msedge.exe	94
PID 2940 wrote to memory of 5096	2940	msedge.exe	94
PID 2940 wrote to memory of 5096	2940	msedge.exe	94
PID 2940 wrote to memory of 5228	2940	msedge.exe	95
PID 2940 wrote to memory of 5228	2940	msedge.exe	95
PID 2940 wrote to memory of 5228	2940	msedge.exe	95
PID 2940 wrote to memory of 6132	2940	msedge.exe	96
PID 2940 wrote to memory of 6132	2940	msedge.exe	96
PID 2940 wrote to memory of 6132	2940	msedge.exe	96
PID 2940 wrote to memory of 3724	2940	msedge.exe	97
PID 2940 wrote to memory of 3724	2940	msedge.exe	97
PID 2940 wrote to memory of 3724	2940	msedge.exe	97
PID 2940 wrote to memory of 4780	2940	msedge.exe	98
PID 2940 wrote to memory of 4780	2940	msedge.exe	98
PID 2940 wrote to memory of 4780	2940	msedge.exe	98
PID 2940 wrote to memory of 940	2940	msedge.exe	100
PID 2940 wrote to memory of 940	2940	msedge.exe	100
PID 2940 wrote to memory of 2320	2940	msedge.exe	101
PID 2940 wrote to memory of 2320	2940	msedge.exe	101
PID 2940 wrote to memory of 6048	2940	msedge.exe	102
PID 2940 wrote to memory of 6048	2940	msedge.exe	102
PID 2940 wrote to memory of 6048	2940	msedge.exe	102
PID 2940 wrote to memory of 708	2940	msedge.exe	103
PID 2940 wrote to memory of 708	2940	msedge.exe	103
PID 2940 wrote to memory of 2008	2940	msedge.exe	104
PID 2940 wrote to memory of 3640	2940	msedge.exe	106
PID 2940 wrote to memory of 3280	2940	msedge.exe	110
PID 2940 wrote to memory of 5968	2940	msedge.exe	111
PID 2940 wrote to memory of 3260	2940	msedge.exe	112
PID 2940 wrote to memory of 2540	2940	msedge.exe	113
PID 2940 wrote to memory of 2540	2940	msedge.exe	113
PID 2940 wrote to memory of 4940	2940	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ts-metrics.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fffbe63c188,0x7fffbe63c194,0x7fffbe63c1a0
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,6140266450071122027,12129723931481377609,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,4095370137710457861,3416149673661107910,262144 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,16185337450968700706,17858227775383284640,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:13
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,15176841140630260868,18232649192590534385,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11509319086070744031,5884677322685257345,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,8974338715039616507,9308951399058282816,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,4328247774589536918,2896657489291216899,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,1989979133585928140,6774287688905810632,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,15396396673242511526,13619008357876078613,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,2917386021202265856,3879826659581958460,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6048,i,10764386140914539083,17845429889723567327,2097152 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11193863222529213279,15554223725340937169,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11276906206636262007,4253758390392329526,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,3888604310979201326,2946724164686587858,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,3888604310979201326,2946724164686587858,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,403525434023868777,11814548990830394396,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,5489937107964013641,11314280302227697427,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,14142292578870591628,8181193148961659062,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,13979724280668816293,15670146218736834370,524288 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7224,i,15671904196222062775,10291849259429809434,262144 --field-trial-handle=2472,i,8978562550302372496,6831173831064205792,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21f063c1-fe09-4c44-aeac-b79374ba5273.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21f063c1-fe09-4c44-aeac-b79374ba5273.tmp
Size 37KB
SHA256 cdd375bccf45830870bbb90965d971e36f8042fef5f76e26e1d0c97c0656db83
MD5 38be3b913f299d5ee55b822115860930
SHA1 0822956b05ba26345a8238fe22fa8cd27f0f8d99
SHA512 b0fa910f830e1abf0cf6c672ea2395c5888738834430520896a006ef93dc2564eeab789fea7df7b4dd9ca14e4551afee8a6998c7ed165b8cba6a8e097e6f8ff4
SSDEEP 768:h/UxvxjgC+i3AC9TOf7foKJYe1ELsAvC8/YM5LSHrkw:0Zj3+i3Kf7f1Ye1EQujYES4w
TLSH
T1A903CF31ECA49C775EF2A7C8774A5717EEF8812395C02AA486DD2B0D15C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d2e2b63-1198-4fd6-9429-f1e2ed5abce5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d2e2b63-1198-4fd6-9429-f1e2ed5abce5.tmp
Size 38KB
SHA256 07ec0ed67b36acb34ae6a0ceae21fc0249076ff21b53b3f34ce797ee20f44fd6
MD5 3356e2cae1a7c94513d33cefd84177a4
SHA1 737ab8528d4887e081d1b0bb4e0c191638e04d8f
SHA512 e165f5a2d76f4df31235789122d92fbc64cdf32e86df28a4091441a3228e13644235d2a22d7b94fcb3022d2a907d4a7e2603f50d556ddc8bee6fc09bb96ca2e4
SSDEEP 768:B/UxvxjgC+i3nu9TOf7fTfqtHyJYe1ELsAvC8/YNXuSHrkw:UZj3+i35f7fTf9Ye1EQujYAS4w
TLSH
T18903BF32EC649C735EF2A6D8774A5707EEF8822395C46AA486DD3B0D05C73AC630F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45cd67dc-b8ef-4051-8be5-4caa76e8d770.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45cd67dc-b8ef-4051-8be5-4caa76e8d770.tmp
Size 36KB
SHA256 921f27ae74ad8d12e5695b47daf63209785b1893263315f4e374e3b4cd9b8d89
MD5 c7e885cbb7650ef817cfc096f7b90aa2
SHA1 875096b5e84593aad13cee9b1c20f7ec97828b0f
SHA512 66831817550a99662ea107296420548581c27dd116f3e4450b9b39a82d951465373b21b53dda459f0f07e2a79cbbf6fe5c1635316a3821500aff4bdb6e040731
SSDEEP 768:GFdw3iwgw4A9TOf7fTfqtF7GJYe1ELsAvC8/YEXuoaTZcaHJLW:Ww3hQf7fTfc4Ye1EQujYn9Lpq
TLSH
T195F29E72DCA4DD776EA59B94F74A2B07EEF08113C5C45A54E6CD2A0C00C72ED238F86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56815fc8-174b-4a5f-b439-e16434b3c1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56815fc8-174b-4a5f-b439-e16434b3c1c9.tmp
Size 33KB
SHA256 4a3b8ef5ef3c0e9dfd22f2d8c02927ddf130c978bf04de2c3f10b0bb769ac906
MD5 f53282503c373d56d77ef8757d76dda8
SHA1 db424128717a4f10449a3b4462ecad286f73b9ee
SHA512 edbc8d8fea52870d826b89cc2a8e3161e8519d1f4a1f9c9f9f259cfcc0843eb9bd92e36acafb31172f8199b774cf1c2011d5efc5893c2af9ea4333fa43ee2ecb
SSDEEP 768:cV3owA9TOf7fTfqtPyJYe1ELsAvC8/YEXuoaTZcaHJLW:cV3oIf7fTfbYe1EQujYn9Lpq
TLSH
T1CDF2AE71EC65DD771EA19694B74A2B07FEF48213C5C81B94D6CE270C01CB6AD238F86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

672300a9-9ea4-41d1-8267-eed67e57171a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\672300a9-9ea4-41d1-8267-eed67e57171a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c2ac218-553b-4ea8-abbe-92e217f230f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c2ac218-553b-4ea8-abbe-92e217f230f4.tmp
Size 11KB
SHA256 cf68a1857f49f72d8c68c808cc309be27fb18144a17531a00d55cec094030128
MD5 19b0233636483f898da9ec78ab577263
SHA1 c2bdfb508d9476b257a70250ed21b34458ed7fa2
SHA512 1746dbfffe70bf6676d40de513054a26cb49285c687aa28d537b474656c325d8802d85d91e203a8dff87a7677b8e834bfc4aebba08da1be79213caa7bccdc642
SSDEEP 192:sxRrRvOO/feQsTqrVi3zoA8p4e/g6+WNIYx60qU6GjIgIJ:sxRr0O/f5sTeiez/5IHUhs
TLSH
T1B532B515AE28B93B8CC7E21DBB66BF53D6F91032A1951E44E6FC9A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 91514d68c9d4df227af3a579b5d70e3af813c4763055361698dec15f01619e73
MD5 2fd0826e4a4370b8171b0da393236db7
SHA1 6cf8892f83455561158bc770c6aadd3e73cefed6
SHA512 a175cc9baeea9d6768836dc8e1117fd6b1d1ffb6941525172d14f7c8171fb7f3b83700bb0a8c86b2bb29cb327b1946c4068ddf849ea5479bf8189cf2dd491269
TLSH
T1656195BE596C8956F75805338CD26C873AF4B3C1408B2E1307B4E5BEE897751A1E805B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec6b127c29b0a3cfaa67c1369b7e22e66ab415480b46945cc7e97da916063a22
MD5 9c374206194a77d4d26c1ae279294987
SHA1 f3a1f109500fff1c51a5bee85176ba9edbe7c5bd
SHA512 fbecf1e3be776f84a9411065e3377c5f542601b64f5773439f9c7f291ab0d547ee6739497d941f926e2ddf109695c75bf86a825b5ec3d860936081242b2c24ae
TLSH
T10C6184BE596C8955F75804338CD22C873AF4B3C1404B2E1347B4E5BDE997751A1E805B
MD5 SHA1 SHA512 TLSH

Submit Download

f587a205-7bcb-411d-ba27-b2fcdc6e4ff6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f587a205-7bcb-411d-ba27-b2fcdc6e4ff6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

16df2914-7809-4985-aad8-3f4cb776c9a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\16df2914-7809-4985-aad8-3f4cb776c9a9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b89dbfcc-c303-4c63-be58-80c063e40538.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b89dbfcc-c303-4c63-be58-80c063e40538.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c4b9ee9c-0c88-457a-9b90-0fe00fd00446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4b9ee9c-0c88-457a-9b90-0fe00fd00446.tmp
Size 2KB
SHA256 0c3d6d063e40866982fbbddaaaae477e46f2978cd9a7247a15265a68586105f4
MD5 d0047d28074fe3e86ce2365684dd3e8c
SHA1 020a76a8a6c2bc808f7d13a1504f684170f05574
SHA512 6f93d3cbe32c26ab89c84d9bdc092fe19f2fe6b0c556654426fcad7ae1a7c1b6742b7a5e0bd2246990b690b57499d9bb3298b92edc067c852dfe9f24b56eee87
TLSH
T11741BCF387F4866E9A1196F0AA14AE1FCF2D0525431C7C6689E0AE2B93F3472E04175F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 8c1702182135852afa77d7349f2d85773aa1f11228783699ea8279d27cb4a428
MD5 7314394052bfcf9cc038c7e1bd82c990
SHA1 44f0e5528f9798aff5105d54799a568639ef3a7b
SHA512 2dbee793dd5f39f05030e2df666fc3f7a6b32a322a46db60a56daa1458abb37255f0400077d848cc175fbd4d73e57cd230930ae3b8b4b975adbef5e703ab22ca
TLSH
T12951B151F126061039FF650941E5A65B568232777054E62B7FE890BD8E2BE009FFC8DD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b50fa2ba-29a2-4ad3-bd26-cb1d9e72adbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b50fa2ba-29a2-4ad3-bd26-cb1d9e72adbd.tmp
Size 23KB
SHA256 3ec7ce318471bdb6295bfac5300403135938171befe9967c266630f2790ed53d
MD5 ee26a0abaefc0afe9dd76538cc675a2f
SHA1 bec445227cff079d998240614253d209fb7ab543
SHA512 623c619fb500b03e0f681e0711b31cdb348a2c087cbb070c7c0cd4ba74dbe6143751a3f852376b7301b1c5b296656915249a27b98148e4f35c8077c26f3b93c5
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMSrowsM:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0Vy
TLSH
T11FB2C92B644DC77F8FC00AAD9C196FDA7D9802C796548D4047FE994C02C77EE922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d206507e-f533-4054-81d1-4d90c568b36c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d206507e-f533-4054-81d1-4d90c568b36c.tmp
Size 11KB
SHA256 45251689d5329b211a6683464b071053ca4b26d909829c4c26feccb21e4f6335
MD5 fcd669a2cf6d56df7256b6fafd4fa2dd
SHA1 39933fadb8c0db34d39be0471100d9c1a5b06f71
SHA512 527165747c6344b76b7c8199f2bc263c3875e72a2921aaa92ffa2438fb81b1e6ac0d6432308ca8d80fa9e87ca02f78cd18095b85708939c88708343a2a64be90
SSDEEP 192:sxRwRvOO/feQsWqrVi3zoA8p4e/g6+WNIYx60qU6GjIgD6J:sxRw0O/f5sWeiez/5IHUhS
TLSH
T1B032B515AE28B93B8CC7E21DBB56BF53D6F91032A1951E44B6FC9A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3152314-31b3-44c6-8fad-4abee1ea9947.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3152314-31b3-44c6-8fad-4abee1ea9947.tmp
Size 11KB
SHA256 342f4c221a33adc7801e845ae6474f46b745a410581d89090c3851b88f38c0c9
MD5 f34d22eb17ad0f81b5da6962191272a5
SHA1 9ad21b8ca62b68083e21d4238e6dc0323f5cdda6
SHA512 245e4b9de9394617d5b563bb86a8093b3961c6749c99b3f941a92212d21a1a7df2db4273612579459322aaf56c08b094556aa55a888fb2b2a436b4f9fa633fd0
SSDEEP 192:sxRwRvOO/feQsBqrVi3zoA8p4e/g6+WNIYxIGqU6GjIgDgJ:sxRw0O/f5sBeiez/5ITUhA
TLSH
T1C632B415AE28BD3B9CD7E21DBB56BF53E6F91032A1951E44B6FC9A1C00E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd873b36-f359-4b2f-bcb3-9e810843b230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd873b36-f359-4b2f-bcb3-9e810843b230.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

838d413c-6b40-44cc-b8d2-88a0d4cd1ba0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\838d413c-6b40-44cc-b8d2-88a0d4cd1ba0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f109a395-1faf-423d-b413-aac7a3d51b26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f109a395-1faf-423d-b413-aac7a3d51b26.tmp
Size 33KB
SHA256 27109f4133fc5744de40da4f45f1a569a265f5d3628b123562b2060fd1c6d888
MD5 6b4b7c40e92d572c4db725c3411c733b
SHA1 f6a787fbf7810af3d141e4650724d3054a6e1e3e
SHA512 c0a3d7266ef3317b0e97ff3a148df0a4b9a73cf68d1852a703bf4abe45df681646d80158785baa7c1026967f2d6f7cf36b3968ec0b5da06d89d83c87a6cadfe9
SSDEEP 768:XV3/4A9TOf7fTfqtPyJYe1ELsAvC8/YEXuoaTZcaHJLW:XV3/Qf7fTfFYe1EQujYn9Lpq
TLSH
T166F2AE71EC65DD331EA196A4B74A2B07FEF48213D5C81A54D6CE370C04CB6AD238F86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d379b29-b362-4b9a-a2d8-ca6dbc60a075.tmp

Path C:\Users\Admin\Downloads\0d379b29-b362-4b9a-a2d8-ca6dbc60a075.tmp
Size 1.5MB
SHA256 5d0c0f0ff22bc82bb40cb5667b386e291a6ebf0ff1a399c388d67173b603758a
MD5 52912295389bde5ded6d785a2a227688
SHA1 71fa47567c70eea070dbe00ecccc439f44245b2f
SHA512 4c06c922dda714ac9a7bf15e94f15b372ad4d52a568bc2ad90e8e24c6601caceb5d0613d6b0ef3f68d50886ff7150456a0519efaf2b66ac5f3276f625db1fd16
SSDEEP 24576:IrRsN/wnqHBtDUb5vjq76z9YhOjW41pv4crP5pazDM6l5hfvAwGj1XbmuL26:IrW/0CByb5eeJiL48crGfP5NojZLzx
TLSH
T1636523415017DC46CD1F2131A66F2FC136B24070556A87F2FB3A528EBB8BF1C6E61BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026.11.10 a TS Metrics.pdf.crdownload

Path C:\Users\Admin\Downloads\2026.11.10 a TS Metrics.pdf.crdownload
Size 1.5MB
SHA256 5d0c0f0ff22bc82bb40cb5667b386e291a6ebf0ff1a399c388d67173b603758a
MD5 52912295389bde5ded6d785a2a227688
SHA1 71fa47567c70eea070dbe00ecccc439f44245b2f
SHA512 4c06c922dda714ac9a7bf15e94f15b372ad4d52a568bc2ad90e8e24c6601caceb5d0613d6b0ef3f68d50886ff7150456a0519efaf2b66ac5f3276f625db1fd16
SSDEEP 24576:IrRsN/wnqHBtDUb5vjq76z9YhOjW41pv4crP5pazDM6l5hfvAwGj1XbmuL26:IrW/0CByb5eeJiL48crGfP5NojZLzx
TLSH
T1636523415017DC46CD1F2131A66F2FC136B24070556A87F2FB3A528EBB8BF1C6E61BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download