af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-ru6e98.html
Size 214KB
Sample261002-gpf5psac99
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{E57094C3-6F84-4706-80BD-7801793384EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 3624	3652	msedge.exe	86
PID 3652 wrote to memory of 1592	3652	msedge.exe	87
PID 3652 wrote to memory of 4128	3652	msedge.exe	88
PID 3652 wrote to memory of 1592	3652	msedge.exe	87
PID 3652 wrote to memory of 1592	3652	msedge.exe	87
PID 3652 wrote to memory of 4556	3652	msedge.exe	89
PID 3652 wrote to memory of 4556	3652	msedge.exe	89
PID 3652 wrote to memory of 3384	3652	msedge.exe	90
PID 3652 wrote to memory of 3384	3652	msedge.exe	90
PID 3652 wrote to memory of 3384	3652	msedge.exe	90
PID 3652 wrote to memory of 4956	3652	msedge.exe	91
PID 3652 wrote to memory of 4956	3652	msedge.exe	91
PID 3652 wrote to memory of 4956	3652	msedge.exe	91
PID 3652 wrote to memory of 3848	3652	msedge.exe	93
PID 3652 wrote to memory of 3116	3652	msedge.exe	94
PID 3652 wrote to memory of 3848	3652	msedge.exe	93
PID 3652 wrote to memory of 3848	3652	msedge.exe	93
PID 3652 wrote to memory of 3116	3652	msedge.exe	94
PID 3652 wrote to memory of 3116	3652	msedge.exe	94
PID 3652 wrote to memory of 5024	3652	msedge.exe	100
PID 3652 wrote to memory of 2452	3652	msedge.exe	101
PID 3652 wrote to memory of 5024	3652	msedge.exe	100
PID 3652 wrote to memory of 2452	3652	msedge.exe	101
PID 3652 wrote to memory of 2104	3652	msedge.exe	103
PID 3652 wrote to memory of 360	3652	msedge.exe	116
PID 3652 wrote to memory of 3712	3652	msedge.exe	117
PID 3652 wrote to memory of 2104	3652	msedge.exe	118
PID 3652 wrote to memory of 1836	3652	msedge.exe	121
PID 3652 wrote to memory of 1836	3652	msedge.exe	121
PID 3652 wrote to memory of 1376	3652	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-ru6e98.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa2243c188,0x7ffa2243c194,0x7ffa2243c1a0
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,10648241555553550048,14864731522274690154,262144 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,760081722371737814,5756368062704627751,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,13055711194935035490,10421582191112519027,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11112460933169086796,9485154395264735972,2097152 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9003171467609839903,14525184262688484943,2097152 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8516201559398412343,10774777189281519406,2097152 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,502574158108952655,2518962392689592177,2097152 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,914604458219230143,7425054022299316515,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9624541068666673654,4820152812448162999,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10970981196746296876,4313618317985053099,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10970981196746296876,4313618317985053099,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6388114349764402396,17997573990557849076,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,12191465036721995142,6540877301716211493,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,15978072403624705480,17681331905172024424,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3130569982856864010,1630244158015653807,524288 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,6610196810792987502,17346574286131565525,262144 --field-trial-handle=2248,i,1025232962865131705,9953740684035676549,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2971db91-26fb-4332-98c0-020e593db970.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2971db91-26fb-4332-98c0-020e593db970.tmp
Size 21KB
SHA256 796d45a433f324ba7b6a972d3564d0a7f13c5260f80da72d2b08c334a0e4b1cf
MD5 ab3b29ea5ffe954c457d68f0f93c7664
SHA1 91b831f87245158d8c38f2a95de6a13b072f067a
SHA512 8fb8c892de868f1b2b8f37138e443a487bc62d7f11809f0628955a7deb5a299cd1931afb9a7376023a3d6d19d4dd3a1ab3352922e00cd5f531a27dfcff93b1a8
SSDEEP 384:MiiFiZcIPzsNy8TUNTUlIlx38puljT89iX5FF+Uce6tgOIwZOyiseo3:cFQrnwgv8Q34aZBB6Xsh4
TLSH
T1C1A27D738CA88D7F6DF69A54F68A32038FB550A7D9D5EE90EADC571C019B0D8030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ac3ba9c-a5e2-420e-bee3-62f21545c7b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ac3ba9c-a5e2-420e-bee3-62f21545c7b2.tmp
Size 8KB
SHA256 77e2b9876750e2e1bf442da8625198b803a5240ef4e061d68635815adf10e09e
MD5 b0d942fc5d20a43fb3963286a10c00f4
SHA1 b439f30e62f33edeb11e4f7988d18452a0e87b13
SHA512 1e34f8d422c3c36cf294335e293629f8841b5c285027ddf578808628f336e5dc59c94404e2b6167fc48c7144d13c981a1de010a15818ba08b59ed26301e884ca
SSDEEP 192:LONm6AmwprQmiUy/B6siX5FSY+U9JicaU6:LONm6ipdW6siX5FF+UqHU6
TLSH
T135020B35AC786C7B8EF2AE55B58B3B239F99116BEA941F84C9E81B1C01D764C1346833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

04cd6bc2-febc-4491-a870-fd1abea68f52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04cd6bc2-febc-4491-a870-fd1abea68f52.tmp
Size 9KB
SHA256 d21a6d30839c6c8b4be96f07c679542b194671c45ff271e1b3f846988dbda913
MD5 d73892af0e4878bc7022803e8bc9e97f
SHA1 e2b26cbf3e01aedfef4c868408c2351cde172999
SHA512 a7ae3c96eb90561ccd28d8af29fb8250c557111bb79dfe306f150829acbbd6f9a2e48312323031791fcfd8cbcc4e9e41b3016ce6e59d1acf102adfc3c304e4b8
SSDEEP 192:sxZ/RbWC/fXsUjIdpdPHW6+WNGY3Rz+++HIgrJ:sxZ/MC/fXsU8VHbG8++I9
TLSH
T1BE22C7516E38A97B8CCBD21DBB657F53E6FA5032A1941E48AAFCC61C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f4e3203-e556-4466-afe6-28e05221c248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f4e3203-e556-4466-afe6-28e05221c248.tmp
Size 10KB
SHA256 06d352ac46f04ee9b492446ccf5a7f88ec7979f77533e0e989620199eeb04155
MD5 73955a72222b6b9ea0f2bd21c26751ca
SHA1 672e8eca1eb5c9486f3f8d0774a8bc6b90e8ba09
SHA512 c90285af15951056c1290084d634f2831bd7f331e6d975101d9b95964c569d9f569a5a244bfc07665cfafda1d31c3bc92b53c9b275a06880f46b5fb004c68612
SSDEEP 192:sxZ/RbWC/fXsUjIdpdPHW6+WNGY3dz+++HIg5tJ:sxZ/MC/fXsU8VHbGE++Ip
TLSH
T18422D8516E28A97B8CCBE21DBB557F53E6FA503290941E48AAFCCA1C05E76CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e432cda-1c3a-40dd-9b7e-d686b7c3a42e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e432cda-1c3a-40dd-9b7e-d686b7c3a42e.tmp
Size 10KB
SHA256 a9a85b0bb75e20b50d01700a6f93e9321836da8f19fb9936b9bf99043243764e
MD5 e91efd979f84d82ec96e4183835b6a0e
SHA1 6794e6d475898b15eededa04943a9eaea1a8db68
SHA512 68f9c81a4344909acf69a0277510b1e29a48fd83d8eccffaf47065fbc5b8a049160e8d3871a3662bbb35e2037c4bf7b53245a059672c20eeadce247297ce6e4d
SSDEEP 192:sxZ/RbWC/fXsKjIdpdPHW6+WNGY3Rz+++HIg5PJ:sxZ/MC/fXsK8VHbG8++I3
TLSH
T17822E7526E38A97B8CCBD21DBB55BF43E6FA503290941E48AAFC861C04E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f0050a-018a-43d9-82cb-c56948c032bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93f0050a-018a-43d9-82cb-c56948c032bc.tmp
Size 27KB
SHA256 95a05ac28f23b3ef1408c1d1fa24edb1fe51604a81b3987aa5fb8b957b3507f3
MD5 67b4550215efc7ee1e5f0d0520533312
SHA1 3586d4ddb1218e8600c172dd2891282eb11eb6fa
SHA512 a3fead5932ad88ee3ba0ddc26231fd14f28f50610e762cd4c2c4d7e9ab32ae7ed46d0ceee5ad840a5d4f751df7d44debff71e9d5351e160df3126af05d1b6a92
SSDEEP 768:7R30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72IrolZMpQ:7R30AbSWvS2l9u1jaLmLZ12z4Q
TLSH
T129C2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b9f42df64539519c0f5e27271ef44197c9d4ebf65348e13943049ae6fdf379a1
MD5 f68e914993c3799d75961a886760de99
SHA1 6f2bed3c8d6fa840c8be0b9fd175ac9e2c12c0d7
SHA512 10b6c565f0eaccc61cde6e834fd18c5211d24e65e643a57ab01998a378cac742dfedd1da655ff95ed688b39defedc9f26b15957ad43d9b2edccae1cd0d48982f
TLSH
T1D66183A959E45A51FBA04C70AAFD32433B3B97F147C34F821A54D978D619F3130D6E82
MD5 SHA1 SHA512 TLSH

Submit Download

9ccc99b3-7603-45e3-b5dd-6a95cc98df5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9ccc99b3-7603-45e3-b5dd-6a95cc98df5b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

75de211f-f128-45fa-ae26-4d1f08b40f4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75de211f-f128-45fa-ae26-4d1f08b40f4c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a296a30b-78f8-4474-9f1e-c24bd2262237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a296a30b-78f8-4474-9f1e-c24bd2262237.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d296122f-2114-4519-b2b7-971e3d0387e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d296122f-2114-4519-b2b7-971e3d0387e1.tmp
Size 949B
SHA256 3a6c0a41adf891ead61c7fbeea63ba2ddf7072eb7378ccd4c424f3153668dec0
MD5 0ededccfa40f75700715c40926611c14
SHA1 f940f78a2134426726e6e50259409be72a4a96f1
SHA512 294972ac9b2c764901edc9953f3873dfe9b0cef98c27fd1e4295d4778368e86a807e275dd87b592800f8ffd672b978a32e6370b3cba86f606a7c18dc9d57af25
TLSH
T1F511BAB3C7D595AE891516F06A28BE2BCE2D0606431C3C1A89E4EF2BD3E3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d7e860aaae3d89113642e93df8be185c80e6a62ea8bd0021d6e50d4b1a9db632
MD5 3cf0e5cee9a53f99f60b5f6a23f8c27a
SHA1 4b6485f267f55269b44255e0a8757e175761020a
SHA512 74e74e51fef125ef55d2bd15da4e86ffa1f2597728b4cb16882904d9b9e7f079de587559e05f383d1f843a4d0798fd72062bc078ec411e9bc10cdf28086e6a4d
SSDEEP 24:K24ngUOItKkhg1eSBudyXhGxeAsIVKahU1+S7Y7zKmHzKlzKuzK7OzKohzKszKwU:KA5ItKSgIPylrIVKMU4gWIvKvKo/yW
TLSH
T1D7911312756B0252387F661C80A59A5A129339F37069E92F7BFC80665D2BF044DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6581fb9-7544-4061-9bba-6a3fd8d6ca86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6581fb9-7544-4061-9bba-6a3fd8d6ca86.tmp
Size 10KB
SHA256 d401b8c9d5b2cbdb6099c6feef1ef4a3cd759d280890b11702e3ff129e958232
MD5 6be933a7a09873a40e5ed1b4da55d311
SHA1 a454e02aa58dc697f0e36c5e4416f7664f037dcc
SHA512 cc0bd17d1452be8a6129a871a8f4e004370c9f7e30fd484ea99e89c2f2624d76aed4c327f79e59aad50d1efd13feb92dc8e31681cb2a4608adf67a31c68e8907
SSDEEP 192:sxZ/RbWC/fXsUjIdpHPHW6+WNGY3Cz+++HIg5tJ:sxZ/MC/fXsU8vHbGX++Ip
TLSH
T18822F9526E38697B8CC7D21DBB557F53E6FA503290941E48AAFCCA1C05E76CD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5aa25ae-edf4-4113-a172-006b05287f95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5aa25ae-edf4-4113-a172-006b05287f95.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c095c065-6e21-4990-a93d-ffc1877aa769.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c095c065-6e21-4990-a93d-ffc1877aa769.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d214ca92-a7e3-4673-9eb3-f2f48c61c8f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d214ca92-a7e3-4673-9eb3-f2f48c61c8f2.tmp
Size 18KB
SHA256 e4f56cb7d89e0e853161a5459c910d6d21e4601322e5ad0278e47dd0692b48c8
MD5 c0c79bc17031d925cd692aab155a1078
SHA1 f22ebac19a798e52e200b02ba6b8d4f8e6a48a5e
SHA512 06e3037cc44cfad71cddd178c0148439e8341a4bb02c47e43c9572031927cca7e442e9e853f8b1c4ee5967de299b876f77dc5a438c4fbf0e57ced65ce1756051
SSDEEP 384:XZcIhsNxUs38puljT89iX5FF+Ucb6tgOIwZOyiseo3:fhG8Q34aZBu6Xsh4
TLSH
T156829E369CB85D7B5DE3A150F58736035FB9606BE6D8AF80D8ED672C06EA494030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db07f412-d044-4690-bb30-258ffbcbb4e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db07f412-d044-4690-bb30-258ffbcbb4e0.tmp
Size 18KB
SHA256 67790d8faaacfe2960b3022b02059af59eb1376ba86f12b958cd22142f836c7c
MD5 b5cf84a43a883b1900a2263f84c7c11f
SHA1 0457003a5eff95d4693dea0e0e6e67dffd78ff63
SHA512 43c9ffb657471db8b0b4d3e94195c6cf6810db34e1fad08e249b69a4217a4db0623d816c9b9750134092b15a70620cc07f6e18db147a011936941607ec97efa3
SSDEEP 384:BZcIhsNxUx38puljT89iX5FF+Ucb6tgOIwZOyiseo3:JhX8Q34aZBu6Xsh4
TLSH
T1D082AE769CB85C7B5DE3A150F68736035FB9606BE6C86F80D8ED672C06EA494030F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebd78ea6-23fc-472e-97a3-3ba462501ef4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebd78ea6-23fc-472e-97a3-3ba462501ef4.tmp
Size 8KB
SHA256 91c4afcf6d36077a210fcc2356707b1d76b0f1f7f31764e6b13601998456631a
MD5 a00d26188289b0d147850871a5bf02ef
SHA1 cc519eb3d39d18dafbc2e702d2175fdf2af70027
SHA512 38101920cb48043b5d6d81c0520e76e7d00efac4607bc16905d8d4def753b4671136bb34ad783b6cbff9eb4bbdca12efc69194d5c6cd74bf5cf902363c14524f
SSDEEP 192:LONT6Amwp7zAQmiUygBssiX5FSY+UcXeHlRPqlU6:LONT6ip4vssiX5FF+Uc66U6
TLSH
T19C122A36A8786C3F4DD2A560F08735135FA55267EB886F94D9EC2B2C06EF598530BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dcf9867-44e0-4edc-9304-0e40e98bee5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6dcf9867-44e0-4edc-9304-0e40e98bee5a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 534ae093185e6b048ce357b2ebca46c555956826179f2eca0f749c7be241f2df
MD5 82617a1cdaea23b2fbc8b2bf9e274933
SHA1 a1bebca61d3477b3323625d51ca7d8862fe993d6
SHA512 ffd3ae2f9ceb06d5339d39011b1ffe62bfcbb1b05ecf9f7f568a58cf9beb63eafbdb668735b52c254ef29c5ed20b11ac8cdd7d849c8ec68d586816d866ae01c1
TLSH
T135413A58B7F91108B3B76E5A9BF6A56D487EBC772E06D55D00110E4F0A62B00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2104-183-0x000001B828750000-0x000001B828899000-memory.dmp

Download

memory/2104-182-0x000001B828750000-0x000001B828899000-memory.dmp

Download