b36f29f20fa7d29e2bff6a03c12f6ff8adf4336c4b189157095482ea58d98223

Analysis

max time kernel
900s
max time network
748s
platform
windows11-21h2_x64
resource
win11-20260911-de
resource tags

arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
13/11/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 19.5MB
Sample261113-wbk9tset21
SHA256 b36f29f20fa7d29e2bff6a03c12f6ff8adf4336c4b189157095482ea58d98223
MD5 f16490d10dc6cf2c2321144b2df6be1e
SHA1 7dccf2de573ebb0f95179fd7c4c3d9b64b19b5d2
SHA512 20d3bb5d4e77f1e0108b0dbe3f5d4f8144fb791c728c902aae36441607d5d2854cd51549402fac8ed90193bc4bbd76b7c8a10158e6c15dc23dbb2e9b17cf53e8
SSDEEP 49152:ZehpCrdOboVyTYp2xnuCHpjtxsJM+QAFId+Qi4WMEAccJ:Y
TLSH
T1C927B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{8905B9BE-EC21-41D3-8D69-09D714D5DFBE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2996	5064	msedge.exe	78
PID 5064 wrote to memory of 3896	5064	msedge.exe	79
PID 5064 wrote to memory of 5028	5064	msedge.exe	81
PID 5064 wrote to memory of 5028	5064	msedge.exe	81
PID 5064 wrote to memory of 5812	5064	msedge.exe	80
PID 5064 wrote to memory of 5812	5064	msedge.exe	80
PID 5064 wrote to memory of 5812	5064	msedge.exe	80
PID 5064 wrote to memory of 6032	5064	msedge.exe	83
PID 5064 wrote to memory of 6032	5064	msedge.exe	83
PID 5064 wrote to memory of 6032	5064	msedge.exe	83
PID 5064 wrote to memory of 4768	5064	msedge.exe	84
PID 5064 wrote to memory of 4768	5064	msedge.exe	84
PID 5064 wrote to memory of 4768	5064	msedge.exe	84
PID 5064 wrote to memory of 2444	5064	msedge.exe	87
PID 5064 wrote to memory of 2444	5064	msedge.exe	87
PID 5064 wrote to memory of 3060	5064	msedge.exe	86
PID 5064 wrote to memory of 3060	5064	msedge.exe	86
PID 5064 wrote to memory of 3740	5064	msedge.exe	89
PID 5064 wrote to memory of 5540	5064	msedge.exe	90
PID 5540 wrote to memory of 5720	5540	msedge.exe	91
PID 5064 wrote to memory of 4828	5064	msedge.exe	94
PID 5064 wrote to memory of 5392	5064	msedge.exe	95
PID 5064 wrote to memory of 1792	5064	msedge.exe	96
PID 5064 wrote to memory of 1200	5064	msedge.exe	97
PID 5064 wrote to memory of 1200	5064	msedge.exe	97
PID 5064 wrote to memory of 2160	5064	msedge.exe	99
PID 5064 wrote to memory of 2160	5064	msedge.exe	99
PID 5064 wrote to memory of 2904	5064	msedge.exe	100
PID 5064 wrote to memory of 5192	5064	msedge.exe	101
PID 5064 wrote to memory of 5192	5064	msedge.exe	101
PID 5064 wrote to memory of 432	5064	msedge.exe	102
PID 5064 wrote to memory of 432	5064	msedge.exe	102
PID 5064 wrote to memory of 4660	5064	msedge.exe	103
PID 5064 wrote to memory of 4660	5064	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffcf685c188,0x7ffcf685c194,0x7ffcf685c1a0
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,3629743431799800376,9821698913947842374,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,14094370630591037625,434994387148106679,262144 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:2
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,9022282616280633719,1243714365163044634,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,7728530779345397220,12692410007043276316,2097152 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,10501846800017111981,2228799685441207878,2097152 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,1784752284194266596,15018859821906125913,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3458151698245281824,8941251742464373380,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15745508894011332350,14144409147449620327,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15745508894011332350,14144409147449620327,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,14435438719413025567,11604139576029135177,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1116
    3⤵
    PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,3972504281865241694,18140245195264729518,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11739222676219272300,11482271535180998390,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,13662262873893863073,14468251865071959258,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,12464667712580531472,2495900493249288962,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2848,i,278820680750208074,792077562883114275,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4300,i,16308562151661072321,15282057724729685057,262144 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2720,i,10990991192320877797,4990700274696174665,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10479451476515015569,5472244427775569068,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,5113380049774764376,18415488035964305753,524288 --field-trial-handle=2044,i,5151254191778986721,9503003998425084388,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c632f24-8254-42b6-bfab-a147a43e77c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c632f24-8254-42b6-bfab-a147a43e77c5.tmp
Size 27KB
SHA256 dc3efe3eb081f9b2c02dbf5f70f8486e52920f9b62101bcc23305160c1a72cdd
MD5 28db794abacb9d649e9abd8e7440053e
SHA1 66c6fb1c03c313c85cfe39fe781e668306b62a31
SHA512 5b01629447012b3cbf0b935f93e9311d92bc4453caae6fd42bdd9012ecd014e0a0df0e3525d2aa5d7a25d62b9b7222628fe99311fded71e7401d769b8edee7c1
SSDEEP 384:njiF3QkUSvj38NLV8TUNTUlIRywqefbbzWfg9l7INKdS+PHH7vBES+gL/7IzHIIi:OFJj3QVwg9nzx9l7IYdS8HH75ESGLi
TLSH
T156C24A36EC94CDBBECEB4E95E34A3A03EEE05213999C9AD4D5D95D1C008B1DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 47e7c098cea33041ecfa38c9c594b68824f0f1bfec80f2262ee0a1d400b60b96
MD5 2843d1dbe73036b85b6028be7caacedc
SHA1 b8e54fe92c674f2551dc8c06180b48786b7f6719
SHA512 6070d4c1f08320b4636c8647c92b2dcba4211fe51aca09c88a3c33be621b920b3f36c7aa89e7f6948391c3467c6622f7935a7ea180eb8ac7c734222b261c996c
TLSH
T1B3D02B1BBAAD03A0E11331390637420030C4E1404803101C8450032238C16A100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

6499340b-0cb6-4438-a1f2-4e88fc28076e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6499340b-0cb6-4438-a1f2-4e88fc28076e.tmp
Size 12KB
SHA256 9bc1a216cd7e607cb3ad9784f11701fdf8af8fb82aeaac3908f3a675c6144332
MD5 30c2d7f0b3968e2e33e898d6a4a6a35b
SHA1 af8b8ce4f29927a7f0651ecb497b1f8ec9eac730
SHA512 e39b75ff4f0b47f7fef1ea98297022e7570c86954616736deafd8c29923788260633644227a52ba67fa67cacd118cac2509af5087c869e37bf1dc0b82a8ecdc7
SSDEEP 192:sxZyRIFR/f2s6qhzodpEo/W6+WNGY0YXene+dIg5dFJ:sxZyUR/f2s6fV/bG5IDIfv
TLSH
T1A742D7196E28A93B9CD7E209FB15BF53E7FD1032A0811E48A6FC8E1C05E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a87b3b8-a925-4808-a65d-79e446521a7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a87b3b8-a925-4808-a65d-79e446521a7d.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 9b58459ebdf4eec1fb40253db3736faf301cb635509db301840e9fe1a3465773
MD5 7898cb5e7ebcc99ae97559af67334839
SHA1 04dfbfcd7215efd5948cb3650b3e29769f55b175
SHA512 2f88151d943c0e2ed99b871327eb37622dbfb7ff9157b2c98942c59d3734fa14150b546f0e6adb387ccd6cccc2d42ed6a041f16fe2a0828726b19db31075ccc8
TLSH
T1E6E0268824C8DA3FA31CA4C741BDA34D92A2361AA3C06A1E1704D4C47042890AA8A691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 295c7ace4512e2e63c2e9fb90dc2038273a45a00573467c1403ddd5484ff4533
MD5 79b8649f9029d19dc5b0c4978564b5d5
SHA1 8f0619d92738ed5418d130488699e9d706dda14d
SHA512 a1b49fa450516ce3a891535aa10e4bc9d2afdc0dd8c2a8a0cf123a638c3c830e2a0ae6bfaa66fa5b9484c7dfa9be80dc5219162de874487a9691fae53a79f1d0
TLSH
T1E3E0268846C8C22EA30C7A5781AC534CD2802A1FA3C0691E2704C4C47002880E6A2B9D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 3c5db99f0be6fe11bf43702830bcea0bead08f0b2db3870fa5e7f79f6f4d3da0
MD5 9aef7f12384693e536edfbdfd8ef9fa4
SHA1 0c5d31d5d12d454b8825589d177845eb8651e49a
SHA512 b547624396305253a9c16ef21bfa94a96f82734f1132050d2903bf001ced4a2ec3886aade5725e2dc95d89ee925aaa578b239dbe07461c384dab4859861f3465
TLSH
T1D9E0268805C9C62EA32C648702FCA34CA2A02F5BA3C07D1E2704C8C47002C80BAA3795
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ce563163e3f0c59d6a93587cfe6bf7748d548e5fa234ec426948f02a2073d416
MD5 de5626ae6d21c015b5c373342bccddaf
SHA1 c116661fc66643285feddb8c9bd505eb27d2e8ad
SHA512 079faa277c2c051a78689cf8bcbb42058355ea6521b88c416b137966d3699d1755233cb82119e2ae924bc1efa7d919718d52237091e0ea8a952e1a5c85dce0ee
TLSH
T19DE086F405CFDE2FA30C664741AC675C8290375AA7C86D5E6718C8C871829D8EB96AD4
MD5 SHA1 SHA512 TLSH

Submit Download

e01c323c-b1d0-49a2-9f0c-aba8c767b3dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e01c323c-b1d0-49a2-9f0c-aba8c767b3dd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

692d8c00-9c5d-496b-90ad-c03697c12d7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\692d8c00-9c5d-496b-90ad-c03697c12d7a.tmp
Size 1KB
SHA256 ed252da6d467ef5f347388f3e1281fb7b117daffdcf687d7403a8db7226c5156
MD5 e00a411a7ad38fab66964bc2f2763cd1
SHA1 523c542e5a20edaf56926e3df2d535a8a804866f
SHA512 0a29ba5fcff09ad7cd014113263ef1d5a262bb95c2951f6fb4c46d2dabd64fb812936c2db4e5be5cc8f5c6cc143791b51790a04d4754a3a2e8e1dc9cffce8871
TLSH
T1CC2191F783B4856E8A0096F0AA18EE2FDF2D0511431C7DA9C5E4AF27C3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

8e71bac1-9a3c-427b-ae4f-c0b940b29f47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e71bac1-9a3c-427b-ae4f-c0b940b29f47.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

8fdbfac6-c545-43ef-ba98-a36569161cce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8fdbfac6-c545-43ef-ba98-a36569161cce.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c478183d-940e-44d4-a77b-dbf804067d08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c478183d-940e-44d4-a77b-dbf804067d08.tmp
Size 1KB
SHA256 531fad829b18e5a2083a7e937f06de293c26a29818d41564423c8df5b673ee98
MD5 0ed73202a71fa9d6f00cc7898ce99479
SHA1 c1209ab1bb55e75b4f760bce38b9b4710404b1a8
SHA512 44149ba8c588dcce56e230a7bf0d70ad4f08369f7e7de77e5a477b6925bb11465e13437d27813280dcb2d1615e8b5123dbe922c197089f6121bd87654e51bc6a
TLSH
T1A1318DF787B4856E8A0196F0AA18BE2FDE2D0511431C7DA985E4AE2783E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc8bd27b-5ff8-4af5-84c1-380369189d0c\index-dir\temp-index
Size 1KB
SHA256 b7644858cb4979f6c673233f01ccef004d5046705d34def2134329625e167862
MD5 b0d24e40839b58f8a55ddfa8a5a89bf8
SHA1 58e15bb4b449393b3f1a9fe1d0590a995b398052
SHA512 1b9ee50e924fe888b2be40b11334c11b4a1c7f2df4ac3fca2cfcb6a6ad209cbe812a7c35148f85524eca0657abca2a11b0c18ece238d61e7dc0176b0dec40ad3
TLSH
T1E541B6878D029FE7EC98027014B8185A6338A1CC03947D1FE1BC9039BCC63146C99968
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc8bd27b-5ff8-4af5-84c1-380369189d0c\index-dir\the-real-index
Size 1KB
SHA256 01438dae56d16fdd7d98a8d489d8e402eab1b06c31f5ba250ac17b324e707d34
MD5 edfe9ffb638be1c6d3f53c0418e4b932
SHA1 0cc9ac0c0117eef36b9113ddb7b6177722f44ed9
SHA512 b05299050ce1b8d7430558773f14be1d9b322f2675da7d124e43ef73db880aca43162ffc84cde1a193daea6af7689a14fc85207e6d3db8ea9e852a112774a00d
TLSH
T1894142565C524B6AEC80127209ED58573379E18813543E0F92E69139F8C2BA87D9AAA4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 2d9e755d0aba63e472720e5d037ed649a2e355d94350e0ba80aaf4cc8dfd9a5d
MD5 1c3bfbdf3fa7ee705c7298decfb23d17
SHA1 d5c2b5efdeb45358dd3d2b02bd377616786c16c0
SHA512 d97243e1cd4393e8412604379071cf7d169d646694650570b20f2228cd2e05cfe1d09c8cbb40ced44f6f255ff146d75019341b88358c1792a912e2fa59e556e3
TLSH
T187E0D8BB2EE63918FDAB93D5243264B50640BA54CD51AC4E1019A6C715B13503456C75
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 d51504c2ae8a400965f01416bad3d4d744276d35caa4c64938eb446f0e37c101
MD5 7df56b378609e74a63315c7a651ada6b
SHA1 578f034fdb6c833622382303d1683dd7bcfa9510
SHA512 a48da8b833e075ec48665c6b330fe1408dcb812f565b0c9d4c31fdb866b2cfeacbca3d2a1fb8d57aa856138857f0e248b5560669a30673d17f1f5cac17446c5f
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21Wz:ir/+SvIrlfrljh9DdgslVzBvoDRFvPS
TLSH
T185C2B61531BA16553CBE290C81B5972F128236B33169E62B3FFC44A68E67E085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

af4142b6-ccb4-43ba-8224-d0581cc19e05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af4142b6-ccb4-43ba-8224-d0581cc19e05.tmp
Size 11KB
SHA256 9e73630a845e76f27981060022eacb5a5639a0f9a105b4b0aa720ff06754df70
MD5 04aa963dc1592cd99302ed8788fc455a
SHA1 953d8fd8c57f88b373e1c6a391bcc118c2eb1829
SHA512 6833fb4e84e9ffc94738864bfc24ccf2d8e6e7db7cd556d90494c36d7d3b09b8b67acf2cb27a771041a54e0636974e67de01b7d7429c39013f28185a58b0bc86
SSDEEP 192:sxZyRIFR/f2s0qhzodpEo/W6+WNGY0YX3t+ZIgjFJ:sxZyUR/f2s0xV/bG5I9ujv
TLSH
T1A742C6556E28A93B9CC7E209FB15BF53E7F95032A0812E48E6FC8E1C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3557ce1-fc41-4799-94f4-3437bab6d650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3557ce1-fc41-4799-94f4-3437bab6d650.tmp
Size 414B
SHA256 9d7a27f20ea0210d1ac185b1f08556e1602667414113be2a60d221e64c011cc5
MD5 238706e088ab9b588f22570f95e4027f
SHA1 a74fe4507b299bb6c2fa22025842f71b05b21233
SHA512 9b74d60829192e6f9c1e07f05a0da5f9cc22de84ed2368f46275be907e648eaad4fb89684db25e9db508dad3ed9e878443394bcf748f2e1322397739951dfd2f
TLSH
T12EE02BAAC823EC271DFC0B19A0506781D751136B3A40490F3A3C960D8FB163A429EC1C
MD5 SHA1 SHA512 TLSH

Submit Download

e5ff90ff-c100-4a0f-9088-d9e08c7732fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5ff90ff-c100-4a0f-9088-d9e08c7732fa.tmp
Size 12KB
SHA256 c6156fe2114218f0c94ceeee5e3adb41a7a044e86254591fc04973924c454e80
MD5 b72d03458e6f1b2900644693a05fc4bc
SHA1 5a6ebf9cb010ed01df66eb6d9eefc307561d72f9
SHA512 0ca8979ea02fe86c900778ba12378c44d931aa117740da4990db14fa5289e86daef9297ec41e5f475a10ea2bc2e7c74a220b871263834b2476625dcc2a6235cf
SSDEEP 192:sxZyRIFR/f2sOqhzodpEo/W6+WNGY0YXKne+dIg5dFJ:sxZyUR/f2sOfV/bG5IXIfv
TLSH
T17242D7596E28A93B9CC7E209FB15BF53E7FD1032A0851E48A6FC8E1C05E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f300e875-ee08-4ade-be8c-f88aa2d50498.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f300e875-ee08-4ade-be8c-f88aa2d50498.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a75626fc-5ef4-478b-8e52-fbbf94f04920.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a75626fc-5ef4-478b-8e52-fbbf94f04920.tmp
Size 27KB
SHA256 8ad99a9fd9cd12341b97feddf047e49df069ef3128be1f11002da9619f296201
MD5 814189999055848b3aeb985df7e67e8b
SHA1 0d1c10d0201301e60276846c8774c3a2cbc75750
SHA512 1fb678c2a3b177a125afbf9310005873271838377a3fce0ac795452e3b67dbbfd157faf30e429091ff3b2ec655bf98a61645e35fe87e69f4c81d692e317a45c6
SSDEEP 384:n6iF3QkUSvp38NLV8TUNTUlIRywqefbbzWfg9l7INKdS+9HH7vBES+gL/7IzHIIi:xFJp3QVwg9nzx9l7IYdSwHH75ESGLi
TLSH
T18BC24A36EC94DDBBECEB4E95E34A3A03EEE04213899C9AD4D5D95D5C00CB1DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c039ee26-579b-4c36-bb5f-b1c214ba8e92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c039ee26-579b-4c36-bb5f-b1c214ba8e92.tmp
Size 25KB
SHA256 c827205f93502c201410c6ca7ce1adb35e04a3631b0c60fcb5eccab9b8f763cc
MD5 0882b7667f6ee5bd04c25852ed7f307e
SHA1 32c67357330c5f02dec0dcc0c9926b20a3986a38
SHA512 d48912c88958f6ce300755ec67455c9db446bd45924f3f8f4214e658bde591baeb1423f045fa7b975a53be943588dc85c40f87f618fdd6eb6c8d8ce5a6456e8a
SSDEEP 384:nKiFiZcIA38NLV8TUNTUlIRswqefbbzWfg9l7INKdS+PHR4RgL/7IzAo7:BFQA3QVwgznzx9l7IYdS8HRR4
TLSH
T116C24A76DC94C9BBECEB4FD5A74A7A03DEF44113998C9AD4D5D85D1C009B19E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c09fd6f7-363d-41b7-9380-573739c060ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c09fd6f7-363d-41b7-9380-573739c060ce.tmp
Size 26KB
SHA256 15646e36543f123f961f8a2afa04242e4b04baeeeae1526932a69d2fb8873e03
MD5 f8d7803e23d7ced7e438bc9b4a0bb3fc
SHA1 af3cc75491d37e0c2f99ddc2e02abc4105f03823
SHA512 5cd90d4b9584f0dcd3afcb009647637a2d0dd5a6644bde7dfc57df99affa1e89ff32a7ee7cc89763d2fb1c04a935b3feafe68747f673cf6f4be3dd38dc581136
SSDEEP 384:nIiFiZcI638NnV8TUNTUlIxBwqOBYbzWfg9l7INKdS+zH7O6R2FeoOOgL/7Iz3o3:TFQ63AVwgwdMx9l7IYdSGH7TRHy8
TLSH
T195C25C32EC94C9BBECEB8FE5A74A7A06DEF04153858C9AC0D5D85E2D009B59D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d03f24d1-038f-4ef5-a1f3-1fea84378fe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d03f24d1-038f-4ef5-a1f3-1fea84378fe4.tmp
Size 25KB
SHA256 132e4803ccf9a6fd42727b38436236ea6847fd2e69955aaf7e5b496739655a63
MD5 e3affa259fa51e5123aecf465e02dbc8
SHA1 283e9f21e5b90d39a0b3f3a7fbfe63f23c9f6313
SHA512 60fcb0b6a7ea694faf1fce7bb516579edb80484ed2e00458f197e1100bafa9475b2876de6880b2c3118a2dd825a583a126eb3c510f200e115ba4549cea77377e
SSDEEP 384:nTiFiZcI638Nne8TUNTUlIxBwqBgNgbzWfg9l7INKdOY7O6R2FeoOOgL/7Iz3o3:+FQ63AewgwzNEx9l7IYdOY7TRHy8
TLSH
T16AC25C36EC64CDBBE8FB8FAAA74A7A07DEF01153949C89C4D9D85D2D108759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa9cdac0-7796-43f6-a08d-e8d1876fe4d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa9cdac0-7796-43f6-a08d-e8d1876fe4d8.tmp
Size 27KB
SHA256 1c726306e9a57a1263e3a4956b2366a27073e884649a581f8ab7c63e965d6d6e
MD5 82d29be0c08362a981fe4bce71fd9518
SHA1 08d7aa90af81ed6a58d84b57f1d41695501160be
SHA512 24fe1d957273cbe215e9b3bc22e5a8a8c4cf9fbf490fd1faff7dcfd8aeaa261e70ca0e85d92677d07eef8072a9c6d64ce3a259b637e27a0a5516791366e786fa
SSDEEP 384:nKiF3QkUSvj38NLV8TUNTUlIRywqefbbzWfg9l7INKdS+PHH7vBES+gL/7IzHIIi:BFJj3QVwg9nzx9l7IYdS8HH75ESGLi
TLSH
T152C23A36EC94CDBBECEB4E95E34A3A03EEE05213999C9AD4D5D95D1C008B1DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3740-205-0x000001D067980000-0x000001D068980000-memory.dmp

Download