5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-143791-qn3zhj.htm
Size 194B
Sample261002-e66etaxzcv
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{725DFDD2-8AB7-4EC0-B80F-ADC1C1636BFA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 884	1392	msedge.exe	86
PID 1392 wrote to memory of 1368	1392	msedge.exe	87
PID 1392 wrote to memory of 2072	1392	msedge.exe	88
PID 1392 wrote to memory of 2072	1392	msedge.exe	88
PID 1392 wrote to memory of 4940	1392	msedge.exe	89
PID 1392 wrote to memory of 2072	1392	msedge.exe	88
PID 1392 wrote to memory of 4940	1392	msedge.exe	89
PID 1392 wrote to memory of 4312	1392	msedge.exe	90
PID 1392 wrote to memory of 3716	1392	msedge.exe	91
PID 1392 wrote to memory of 4312	1392	msedge.exe	90
PID 1392 wrote to memory of 4312	1392	msedge.exe	90
PID 1392 wrote to memory of 3716	1392	msedge.exe	91
PID 1392 wrote to memory of 3716	1392	msedge.exe	91
PID 1392 wrote to memory of 316	1392	msedge.exe	94
PID 1392 wrote to memory of 204	1392	msedge.exe	95
PID 1392 wrote to memory of 316	1392	msedge.exe	94
PID 1392 wrote to memory of 316	1392	msedge.exe	94
PID 1392 wrote to memory of 204	1392	msedge.exe	95
PID 1392 wrote to memory of 204	1392	msedge.exe	95
PID 1392 wrote to memory of 4968	1392	msedge.exe	101
PID 1392 wrote to memory of 3104	1392	msedge.exe	102
PID 1392 wrote to memory of 4968	1392	msedge.exe	101
PID 1392 wrote to memory of 3104	1392	msedge.exe	102
PID 1392 wrote to memory of 2896	1392	msedge.exe	104
PID 1392 wrote to memory of 3020	1392	msedge.exe	118
PID 1392 wrote to memory of 5108	1392	msedge.exe	119
PID 1392 wrote to memory of 3264	1392	msedge.exe	120
PID 1392 wrote to memory of 1776	1392	msedge.exe	123
PID 1392 wrote to memory of 1776	1392	msedge.exe	123
PID 1392 wrote to memory of 1088	1392	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-143791-qn3zhj.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff84a39c188,0x7ff84a39c194,0x7ff84a39c1a0
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,18370670268213184379,8786118451191056748,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,3316956529816821371,7688046815838013185,262144 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13428824924270160316,14159756357913807823,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15680566517497008549,15642848512822043780,2097152 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5104663774061867363,17632731310242697662,2097152 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,16348780541861992026,3024556655594840993,2097152 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1553683629049673585,13461016246185992378,2097152 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,630074008249816024,4389569494890157146,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,257992670959436841,1061534975336152323,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7873252961442485945,9713685247699475927,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7873252961442485945,9713685247699475927,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5559510821114296889,11209383327915282977,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15804141718351923832,16232329832377557553,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9721999320452380927,14342496703769191391,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6479326508159479457,2438354772924579765,524288 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,16919900707215188961,2675044760498366710,262144 --field-trial-handle=2888,i,15639530758917924222,11233770399061487195,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5448b382-7750-4ca1-b12d-c7c758c9ee95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5448b382-7750-4ca1-b12d-c7c758c9ee95.tmp
Size 18KB
SHA256 60ae969373819b8f8e147bafdb693930dc8bbf017e85c0de40b0b8c97f6088c1
MD5 1ebc06cb6246086c1e4e902471e30120
SHA1 38f182c2894b494e03f123f2256a24b9dc462cf6
SHA512 be71d3278241cbdfdffb640948e24e3a4fca614503e288c226030d914b0539a4418391ecd8aad4c0cc8247c2f63558074b9aa0e7168a905296cdbb6645e97506
SSDEEP 384:uZcIhsND/RgZFFTHX58EAOrnftgOIwZOyWoXop:Mhwq97aDOrnfXsGXG
TLSH
T114827D32AD78AD7A5DFB9144F54732038FB89027E785AF90C1ED6B1D01DA2AC030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7acbd90c-cc9a-4eae-9edd-437b9ac1729f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7acbd90c-cc9a-4eae-9edd-437b9ac1729f.tmp
Size 8KB
SHA256 711882dfe0f1be61b07c2f7027c16c24f3460ee3201347a5152d7f9e4fab9a77
MD5 38f930f59387388947081a4185f41a09
SHA1 2ebc8b56b48677b3dfb4a579fcc8256dbde057b8
SHA512 3a53afb0deab8054f3db4c6591df61861baee20a9b3a49a018e8a62952a6e2366814f3c5a4236b08bf4a872576bada501fa5c4309700bfd1d73b6ea5236b9239
SSDEEP 192:1ONw6wlDgQmiUyWsW4X58gZAOKmyDlNZUU6:1ONw6kgCW4X58EAOtykU6
TLSH
T16C02EA39B9B87C7B9EF26D05F58727139FA4102BE6516F44CAE81A1D00D739C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81b74335-c817-48de-8c66-468244bb20ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81b74335-c817-48de-8c66-468244bb20ec.tmp
Size 18KB
SHA256 012f42de156d2dd8ca6a04b7b45cfa3107958cb3bbafd2016f64cab5be4421a8
MD5 4acad913567cf5c4db7926bb294007ef
SHA1 67f9cce5e7a54a6ccb23b51df07f3ea57e67e00b
SHA512 200218ca5a66c9a3cb123cd77618f5583ff79357369f75766bac8759a3dc603005e8beb2b643d9e0de81dc07b2fbac569f57b84423f2da51cd9dee392bc069d1
SSDEEP 384:dZcIhsND2RgZFFTHX58EAOrnftgOIwZOyWoXop:Fhbq97aDOrnfXsGXG
TLSH
T1BE828E72AD78AD7A5CFB9144F54732038FB89027E789AF90C1ED6B1D01DA2AC030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88b8b1ee-191f-412c-b3d9-40036f1c963e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88b8b1ee-191f-412c-b3d9-40036f1c963e.tmp
Size 21KB
SHA256 e0d3bce27fccda1f3e36a7ac3b66c011912cc830dae873a4f70563d7672c8b0e
MD5 2c6d0fcc873098de9176bd48f960d563
SHA1 860738c28fa5d6d86348abd625895633204485ca
SHA512 b225d3af9aa44845b2432a42badc7de9c9853a14176f20a71d47aa5aeb997ee763613e72e114c2327e716af9baf271187fee4356b5a4d99fd19423cdde356720
SSDEEP 384:3iFiZcIMzsNd8TUNTUlIl2RgZFFTHX58EAOrmftgOIwZOyWoXop:yFQwowgYq97aDOrmfXsGXG
TLSH
T15EA27D339DA8DD7FADFB9A44F54A32038FB85067D685EB90D2DC9A1D00961EC034BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

21f3b112-12ce-4990-a6c4-7d7b79641a63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21f3b112-12ce-4990-a6c4-7d7b79641a63.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33a27085-00aa-494d-9f26-28bf311382f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33a27085-00aa-494d-9f26-28bf311382f2.tmp
Size 9KB
SHA256 2bcc2aec0904a048e64b9ace272fc66217fd901f47e1139ed537333b07075cef
MD5 7183180bec160ed5363725648f174b7b
SHA1 5e9549ec72036d60fd24255e95f483992625c3d2
SHA512 58abd8d33fd392926d275afb4b0f1b74b5eb380c79c7b8aae3eeae5c6a75ba1a3b8a03c9c11c3298b1bc17ef7288d43cce593f0d0b1baf7c1d6d00777b7dade1
SSDEEP 192:sxZaRUW9/fis5SIdpdssHW6+WNGYrbS9IxEIgrJ:sxZaB9/fis5b/HbGB59
TLSH
T1E712B8526E28A97B8CCBD20DBB15BF53D6F9503261941E58FAFC961C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d52fc14-defe-4d4f-a0ae-23d6d3228d61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d52fc14-defe-4d4f-a0ae-23d6d3228d61.tmp
Size 10KB
SHA256 13ced285deb45f8e588758c65d86655cd14f47c2bd2923522a05d5184514a815
MD5 55ed2cad70a106726ce4a1d52992b9f2
SHA1 e7bc3fbe8143bde1ab579912138dde7dc3d380b1
SHA512 af36dc2159ef401e0e0aa1ed2459adf62ea6d650a8f4bbea47e7b1bffdd4f2584b5e9a47e030918c7fd6dee38d353ba2ae07e1213be3bb9094a77d8498ec2aa8
SSDEEP 192:sxZaRUW9/fisuWUSIdpdssHW6+WNGYrnS9IxEIg5fJ:sxZaB9/fis2b/HbG/5f
TLSH
T19922C9526E28A97B8CCBE21DBB15BF53D6F9503251941E58B6FC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 aa7b89cb61a16cce7c41e12969afe25fbfb4c1eafd7e1aba66259f5c1d865112
MD5 4ba15abd854f6ff648a9c439a07c7afe
SHA1 ecb1453f1fed7af6251e9c1436fe84cbe7bf9175
SHA512 1fddbf857ba7955fe41a8363cf6da74e544e0419881e4fb01806cc11116d07e0a9c7fe794aaedd644b55313b914aa7182c8cc7d8da1766213253383b0b61cc15
TLSH
T1F951D78D92702354D7AD7033B6E11183FA7AA9B167935F523195C9B98B4A374B10903F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cf692733d0ac75733cbc3f86b3f9c3f114541027d5bdee47ba77a33d2aacce16
MD5 fc19d649970148a0e4dbaa41c611930c
SHA1 ed43a9f154bda2b6dc03645a767278cc0ac3fb3d
SHA512 174a2c8886874760dfc8861e7f09ed8d292d17fff331ed49313bec463667835fc968bdb308e62ad5033421931c86e5d4c3b6a988c9cc75489b26c71b9b00d0d4
TLSH
T1E951D78D96702354D7AD7073B6E11283FA7BB9B167935F523095C9B88B4A374B10903F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

64474618-25ef-464a-8f82-c7242bbc7295.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64474618-25ef-464a-8f82-c7242bbc7295.tmp
Size 949B
SHA256 3874a0825ab795648ee0a78cd9334f9a7b1fb5bda65a0bcc13224ca87d23ee7a
MD5 0546137532ca897bda7d6312b31e0b7f
SHA1 e9e4cce82a99dbb8b482e03d094c8e4f27667e23
SHA512 be93e48cbb3b1052c260ba82a12a591e49343b5b77ad7bf43c0d732b50f86f6bb03e879829922717af3bcea64bf4cd0694b1ef1a69f3e9b78fedbca38da5de0a
TLSH
T1FF117DF3C3E585AE890516F05A24AE1BCE1D0605421C7C1985D4EF6B93F3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

c6171737-68d3-45d8-9adf-365ebf9cd51b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6171737-68d3-45d8-9adf-365ebf9cd51b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

de10753f-85de-4b1f-bc64-848775d7e2c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\de10753f-85de-4b1f-bc64-848775d7e2c2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0f79115eecf1aba42c9adcd074fdb705cd3bf4162c0fbf16aec20dbc51ac9030
MD5 522c8ead0cfc362a401c586497818636
SHA1 850e7cb8ebea4ab4ce7a11253b99c1cf8e601c42
SHA512 31770a65642e9ced08d2001b7eaedd59acaa222843422eb6bccbade668b488cbc2e8ea7fda61fec5f42ef53c001275cf9b68cb80b868638ae51ecfd5ec262ea5
SSDEEP 192:sxZaRUW9/fisulSIdpdssHW6+WNGYrbS9IxEIg51J:sxZaB9/fisGb/HbGB5J
TLSH
T19622B8526E28A97B8CCBD21DBB15BF53D6F9503261941E58FAFC961C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6491b061c72d0b26243d7d52bd95a17e4deb0027eef7e52d74ca942c4534f90e
MD5 dd2c2305f2851e723ff32207d7cbe3df
SHA1 8fabee94ab430cba939d6f611e10ae95574f44cc
SHA512 73076acbd74e43f9cae0bef894ab07c996de8a2a7b81c756012865ff135e96c789bcb9782d02b34d79aa20a2424e52b25df0865f5c6add2bf534f4bd8b608cbd
SSDEEP 768:Ziy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbWroR7l:Ziy4J/DWvbtBhu1jajiLm0btVl
TLSH
T1E0C2FB3B684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 52d027a8493e357186be2a95da9d739a1619cb01658e95781e7b00e66a426472
MD5 2ee971e4eeacde667430a31983026a2a
SHA1 b6d203dfbd3f04512b54b8e0ac1b1d5d712edcc9
SHA512 c55ef39850479c0e743d2d5e31ec3647ba04a93aa93392cbe1baa90fa23e9ef2349210c51139b56ee9c17a824b43cee911ee936c16093b0cf1c4202e3205953b
SSDEEP 96:KIDCKs0+u/+KEUqed2Ku8BycK7yCe7aHbJhh+bxwl57+KBL5F+NT7Y1m:E5xdhxfj+
TLSH
T17BE1F45231B7060038BD258C8175975E524232733019FE6FBFBD44A59E2BE489EFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3eed99a-01a8-41cd-8404-9404c924871a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3eed99a-01a8-41cd-8404-9404c924871a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dd60f484-4cbe-47a0-87e9-c1c0bf056c6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd60f484-4cbe-47a0-87e9-c1c0bf056c6c.tmp
Size 10KB
SHA256 6f9e6eaf8ceaaa0bca699dcbe51256e8c92bd987158176f20901d3892c65c203
MD5 2c597a502693a47bc2f2b88601e97e74
SHA1 b97ebe958acfd86d1f633ab42e0f0beaf343acbc
SHA512 302dc8abe459e19745162eaac44b1493808097237cb12e86cb76f222847ff08abd686a23e5d1b304dcebc86dbecc2ed7196f5a60a00b9e8b1ddd94cd7e1f87c8
SSDEEP 192:sxZaRUW9/fisuWUSIdpHssHW6+WNGYrlS9IxEIg5fJ:sxZaB9/fis2bNHbGx5f
TLSH
T1EC22C9526E28A97B8CCBE21DBB15BF53D6F9503251941E48BAFC861C05E7ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c3f522bb-b32b-4f40-bb31-3237e09e1dcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c3f522bb-b32b-4f40-bb31-3237e09e1dcb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d087a0b6-ee96-45ad-8674-d2cbbb2d2c01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d087a0b6-ee96-45ad-8674-d2cbbb2d2c01.tmp
Size 8KB
SHA256 f1c8f69ec78082c3648a60d8e86df38fddfaace022425247f222c7d3eb5f24ed
MD5 7a88e7027676c14be0ed52a2b1aa312d
SHA1 5cb909d5ee2082e5c77787bfc7b46fef76e15dcc
SHA512 74c8d7cf93654671676e089871c2d02b47b9f18ac3e9e5c00355bc8e1148bc063e3e948d76113c428b88e8961a60ef287e546bc95d5c6c5aed95c9fa45554f45
SSDEEP 192:1ON+6wlD8QmiUy9sB4X58gZAOK65vejqwU6:1ON+6kMHB4X58EAOr4fU6
TLSH
T1A4121A36B968BC2B5DE2A544F48731139FA85127EB49BF90C5EC2A2C01DF2AC534B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08edb5eb-bc02-4d16-a132-f3b3836dca0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08edb5eb-bc02-4d16-a132-f3b3836dca0c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a51345ec454af36d2ed14092fd7c50d047513e45be3b567a46a9c7588f8c9ff
MD5 fba2408f04040be6603608ac27333a78
SHA1 c6009936d210e8f92be33fb2aa332861024f00fd
SHA512 3fb7c1e3119fcbce981fe4915ee64acb6d9b162a27f2dbae460ff79974c8e5b9acd671cc08439226181bcfef20f1a958fc28537de9af49e3d1aba0c41d1547c5
TLSH
T1A8412A5CA6E91148B3B76F4AABF6A86E44BBBD772E06D45E10010E4F0A66B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download