5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-y0cm1l.htm
Size 1KB
Sample261002-j8egbsdf49
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2572	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{1721AA05-3FDE-4DE5-800A-ECF4C1A36018}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2100	4232	msedge.exe	89
PID 4232 wrote to memory of 2572	4232	msedge.exe	91
PID 4232 wrote to memory of 4140	4232	msedge.exe	92
PID 4232 wrote to memory of 4140	4232	msedge.exe	92
PID 4232 wrote to memory of 4076	4232	msedge.exe	93
PID 4232 wrote to memory of 4076	4232	msedge.exe	93
PID 4232 wrote to memory of 4076	4232	msedge.exe	93
PID 4232 wrote to memory of 4092	4232	msedge.exe	94
PID 4232 wrote to memory of 4092	4232	msedge.exe	94
PID 4232 wrote to memory of 4092	4232	msedge.exe	94
PID 4232 wrote to memory of 3352	4232	msedge.exe	95
PID 4232 wrote to memory of 3352	4232	msedge.exe	95
PID 4232 wrote to memory of 3352	4232	msedge.exe	95
PID 4232 wrote to memory of 5956	4232	msedge.exe	96
PID 4232 wrote to memory of 5956	4232	msedge.exe	96
PID 4232 wrote to memory of 5956	4232	msedge.exe	96
PID 4232 wrote to memory of 2516	4232	msedge.exe	97
PID 4232 wrote to memory of 2516	4232	msedge.exe	97
PID 4232 wrote to memory of 2516	4232	msedge.exe	97
PID 4232 wrote to memory of 1832	4232	msedge.exe	99
PID 4232 wrote to memory of 1832	4232	msedge.exe	99
PID 4232 wrote to memory of 3888	4232	msedge.exe	100
PID 4232 wrote to memory of 3888	4232	msedge.exe	100
PID 4232 wrote to memory of 1064	4232	msedge.exe	102
PID 4232 wrote to memory of 1436	4232	msedge.exe	106
PID 4232 wrote to memory of 1700	4232	msedge.exe	107
PID 4232 wrote to memory of 1044	4232	msedge.exe	108
PID 4232 wrote to memory of 3276	4232	msedge.exe	109
PID 4232 wrote to memory of 3276	4232	msedge.exe	109
PID 4232 wrote to memory of 4944	4232	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-y0cm1l.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff9617cc188,0x7ff9617cc194,0x7ff9617cc1a0
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2595550723712556418,9590987871513573624,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,6816193290583478769,14531002696671681948,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3817864627148692107,2139188160573513236,262144 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,9736565626846088469,2016832265996821527,2097152 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17338000103027769734,886892561058864679,2097152 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,7203341168690532032,9223775539313290304,2097152 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12526154929829761867,5089996900229752214,2097152 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2979391532684057036,2082742539427623653,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14499923697345200314,8792188431944892596,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15428503009842612607,2220781200556453537,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15428503009842612607,2220781200556453537,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,12375280450600271160,17460162003472981140,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,16839180850286503504,7673708861482067567,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,3688553362770312978,9427913896030804997,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4265258239913263463,3851860292816497128,524288 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,16349599373955735288,18254745156545002979,262144 --field-trial-handle=2388,i,11634327973423958082,14817583463989078595,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05d31d87-7dfd-4833-b092-4541e19642c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05d31d87-7dfd-4833-b092-4541e19642c4.tmp
Size 34KB
SHA256 729a53acabb00a9be9cfe786040461d2b4384a52ad09e5073a8761685960d886
MD5 6634f1fb55f73a520e9151a53fd828f3
SHA1 d0f4c946900f47626a579f6d1e7356a811c8905a
SHA512 86eef5d0e354aca38de8b02fa743dd0c792971a0a0dbd12a09100d6061a122d476cb3de3e94b295a943ceaba28110339cfa7fdbdf80060f5357680afdd8dbf73
SSDEEP 768:ykB3/49SO5p1j81jBMIYNa8S5oYklnA+D2sRP:ykB3/epB89fTWRdAc2sRP
TLSH
T144F2BF35A9B4ADB39CEA93C5F20673126EF55223D1C95ED889EC1B1D06D76BF0303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c497375-5c07-4fae-be3a-e1d42032bba7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c497375-5c07-4fae-be3a-e1d42032bba7.tmp
Size 34KB
SHA256 38dc16e7369ae13c4a03131c809ca31bacae8646dc835b00af0ed9893e4e0755
MD5 4d9f709b93c942c3f4c94b9b5804bfb1
SHA1 561701f3696bc178a3fd4a7add441bec9dcd7f61
SHA512 f299bc7d5f3a2242f70664fbae0ba686a9bc12fbdade998a88238910923075c451e0c745e630372131825d5263b44d9293870f545d2bbbe3e943f7d7902810fb
SSDEEP 768:5skB3sT9SO5p1j81jBMIYNa8S5oYklnA+D2sRP:ykB3sNpB89fTWRdAc2sRP
TLSH
T1CFF2BF35A9B4ADB39CEA93C5F20673126EF55223D1C55ED889EC1B1D06D76BF0303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

949a7932-81ff-45ce-a729-ea5909b96689.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\949a7932-81ff-45ce-a729-ea5909b96689.tmp
Size 36KB
SHA256 420fe8dbe4de22d7a2646fae382ee6a5909b9f80cf43fb6b551e9a54738ab26e
MD5 baf4a17e2e5e630919d389f59cd0cc26
SHA1 703e49815465f5abf9562b98e8a14c4e1c8561d7
SHA512 a4623da12dad7128b55004d82e6910c249aaf483b6cd8430c034344ae6eba2120b44cebf81ed068c222a7a90e660e53fc7147693c0341e0fabd75b29f64975f4
SSDEEP 768:KrFQz3xwgZ49SO5p1j81/BMIYNa8S5oYklnA+D2sRP:K+z3pepB8ZfTWRdAc2sRP
TLSH
T1D803BF3699E4D9B7ACFA97C5F30A7312AEF15263C0C5AAD4DADC1A1D02971AE0303C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

034d1cb0-447b-401e-bdd2-66018cda2ce1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\034d1cb0-447b-401e-bdd2-66018cda2ce1.tmp
Size 10KB
SHA256 6a716390c97eb67a4bbc6d58f9a1ec01c3a6e0a473b529d1db1d4ee600ba109f
MD5 776bbbeb05f905ebdffb9927ef9fdf08
SHA1 bfb60bcb5f8a0a9845bd29018a902433a0c7c511
SHA512 a8b198be75444d6efb51cae5f6fa0c96e38fbda65900aea2511eee2d2e23c1af7570839fba456e4edd6c82f199e649a62c8caae022e859adff90aa77f72086fb
SSDEEP 192:sxRyR9b1/fVsZaazoA8p4n/g6+WNIYue72GaIgDmJ:sxRyf1/fVsgXW/5InW
TLSH
T13A32A615AE38A97B8CCBD20EFB55BF63D2F9503261911E48B6FC992C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c40bd66-0deb-4fb4-9755-d3009e9292a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c40bd66-0deb-4fb4-9755-d3009e9292a7.tmp
Size 10KB
SHA256 d4ad1f16d4149b5112a0b283e0074eefa03d91c874025d31edde0cf0b1c9ea7c
MD5 70f302796a19edba9890799a23570b3e
SHA1 a6f9f6e720ac4e11a67d5915d6f8e991faeaca9f
SHA512 eac9d2c731bfe8d80e4160922a13b57525d6177a17759649ac4dcf1c49ec946917e16dfcf1f31f9a43a39ea1775650d94a1d806702a3fc83fdcc0f6823f5d7b3
SSDEEP 192:sxRhR9b1/fVs+aazoA8p4n/g6+WNIYue72GaIgIJ:sxRhf1/fVs7XW/5Ins
TLSH
T10D32A515AE38A97B8CCBD20DFB55BF63D2F95132A1911E48B6FC991C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b4cb9e7-7529-4841-816a-f7144f437ef8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b4cb9e7-7529-4841-816a-f7144f437ef8.tmp
Size 11KB
SHA256 0a242bbde36dd3aebaa151411d7137a54562e397a802db92b9e38da608672a6b
MD5 d46e196f8c3fe9b976a03a4f4a7afbd0
SHA1 71fc0eda5f6afa518cb6cf1243f6b0ef78c0da51
SHA512 7d1e1c552284a42300f4ce1aac27e4401ea5649181a13cc97284eb254dd09b7bf616b726eb32f09e793e36629e0055c0df2772d47a794bf269b791e65dd2610c
SSDEEP 192:sxRyR9b1/fVsZIazoA8p4n/g6+WNIYuN72GaIgD8J:sxRyf1/fVs6XW/5IEk
TLSH
T14532B615AD38A97B8CCBD20EFB55BF63D2F9503261911E48B6FC9A2C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83d58a88-c9df-41d2-be4b-a072fa10d32c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83d58a88-c9df-41d2-be4b-a072fa10d32c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 6e8fec4895fd2164532c362647a729b573b82e7dbd4cd48511e7341c02a14171
MD5 49e14eed86c72d40a6de2d4e874e8a83
SHA1 f6b857eb4d37cd2b32c81023c96bec52a8e298b1
SHA512 8251a77484ddfe24ac6f50eb7c0c1db3f45686ca5d5f7dc576db2525a8d7b657c002d1631aa064c7e6b75fc88ca54f6f3f742d15a01e473988009cc3ec7409bd
TLSH
T1D541FAC24260A39CF7B8457DB5C00E93FAF2E9B06487DF500654C5BBBAC1399FE54600
MD5 SHA1 SHA512 TLSH

Submit Download

b0712904-46a7-413a-9580-c20ae3858bdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b0712904-46a7-413a-9580-c20ae3858bdd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

009dfea2-519a-4da2-86b9-472dc23dfbf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\009dfea2-519a-4da2-86b9-472dc23dfbf0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

69c8d097-6dc5-4975-80ef-7b4f94a3ecc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\69c8d097-6dc5-4975-80ef-7b4f94a3ecc7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

96b304d8-fe03-4428-a05e-24f0b14e7372.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\96b304d8-fe03-4428-a05e-24f0b14e7372.tmp
Size 2KB
SHA256 0c906e7aa743ef4259016d837cd318652786adffa8d44758e723f7cb50c594fd
MD5 4f4deab0da03aed2f65303898439f68f
SHA1 0ed0e10e538cd658d990df3201d0c675a402b48e
SHA512 699e24d0cdbde6a714d1ebb92b9fb85c596416c1ee972ca0c77ef19635eae310619f495c9f011d912d17fd6fdeabc83174d9866cd734dbc3ccc3c0426de6a5f1
TLSH
T193418FF3C3E8867E890156F4AB146E1BCE1D0915832C3D5AC5D49E2B93F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d0c62846ef1f40978bce2c305d674e0cd6524d0b4313698ef0c32e0b65a67f47
MD5 3ef519e7c0466c2d360bfb52ea602994
SHA1 99cba5bf43c7c82295827b8aee89e1b174e93031
SHA512 7e22cfcc034d216ed674631c1adfa1c1f7accb81e20bee7b15a540c483c692ea693a148bd284af89d44b5c9926e353d6c20adcfb214ec3f36c60dd387949c1d7
SSDEEP 48:KM9MZN3LXYTD+LIa1YKV99fYR1IoOfN1yD3SL3pJZiTB0RIaHiKVH9FiRnyo8d3A:KkC4Kf6+qUAKNimiGoK7S/
TLSH
T1F4913421307B0651383D364CA0EBA7DA174177A77828E62B3BEB40A94D67E095DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a9136be6-f104-48b3-8e17-12567cef3cf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9136be6-f104-48b3-8e17-12567cef3cf6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc1cb5b1-9312-4261-bf53-f2a7da20532a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc1cb5b1-9312-4261-bf53-f2a7da20532a.tmp
Size 23KB
SHA256 7d54140fb8e58f15b03b8f80476cd0a0d5147ea7a5951c99ed629575dc781ba6
MD5 733f7d7839f8bcc93ea3e52a9e998c74
SHA1 49fc7ad0b3fad5839f95200f88ec22f911beed4f
SHA512 e118e843214f0d2748033803767b50255833ca59331d744d984dbaafb3de486ff4a40fe8179aa873dd9d59ed861eafbcf5d3965ea0c3f00221a257823d11b847
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6procbK:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0Vw
TLSH
T108B2EA2B644CCB7E9FC00AADDC196F9B6D9802C796988D4047FE994C03C77EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b0727774-7237-4ea4-aaf1-732d3471fb3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b0727774-7237-4ea4-aaf1-732d3471fb3f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6c1e659-0b92-4a9d-83cb-a21fd6d6f731.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6c1e659-0b92-4a9d-83cb-a21fd6d6f731.tmp
Size 38KB
SHA256 835b8022277eab2d7b8839389f51a21213f980d1df2bb4186142ec1ff27191b0
MD5 a84aea2d374fd935370025bd745e9a77
SHA1 7cd7132225efa74f043d560889dd190a51594de2
SHA512 54fd3d33860bb46785a8cddae00438607c5a4cc37759a2598f320e6d21e2528670533bec07cd78fc6660db3476403ef691ca6f8635873beec532741dad4414d5
SSDEEP 768:do/UxvxjgC+23tfOSO5p1jdJMIYNa8S5oYklnAagSH8L4:nZj3+23dqpBdHTWRdAPS04
TLSH
T1EC03C03A9DA4A8738CF663C4770AA357AEF55263D0C16AF88AEC1F0E17C72AD5303455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b4999cc-1452-42fb-9467-755c6b7a439a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b4999cc-1452-42fb-9467-755c6b7a439a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download