Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
attachment20261002-278819-cyjkge.htm
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20261002-278819-cyjkge.htm
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
General
- Target attachment20261002-278819-cyjkge.htm
- Size 194B
- Sample261002-ke9wtaea46
- SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
- MD5 0fe53cf75ee2569670f22b4df68cfdff
- SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
- SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
- TLSH T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3540 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{ACCAB8F0-F20C-4329-88A4-6CF2DF7AD218} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4968 4252 msedge.exe 86 PID 4252 wrote to memory of 3540 4252 msedge.exe 87 PID 4252 wrote to memory of 2200 4252 msedge.exe 88 PID 4252 wrote to memory of 2200 4252 msedge.exe 88 PID 4252 wrote to memory of 4104 4252 msedge.exe 89 PID 4252 wrote to memory of 2200 4252 msedge.exe 88 PID 4252 wrote to memory of 4104 4252 msedge.exe 89 PID 4252 wrote to memory of 3180 4252 msedge.exe 90 PID 4252 wrote to memory of 3180 4252 msedge.exe 90 PID 4252 wrote to memory of 3180 4252 msedge.exe 90 PID 4252 wrote to memory of 2056 4252 msedge.exe 91 PID 4252 wrote to memory of 2056 4252 msedge.exe 91 PID 4252 wrote to memory of 2056 4252 msedge.exe 91 PID 4252 wrote to memory of 3816 4252 msedge.exe 93 PID 4252 wrote to memory of 3928 4252 msedge.exe 94 PID 4252 wrote to memory of 3816 4252 msedge.exe 93 PID 4252 wrote to memory of 3816 4252 msedge.exe 93 PID 4252 wrote to memory of 3928 4252 msedge.exe 94 PID 4252 wrote to memory of 3928 4252 msedge.exe 94 PID 4252 wrote to memory of 2996 4252 msedge.exe 99 PID 4252 wrote to memory of 2996 4252 msedge.exe 99 PID 4252 wrote to memory of 872 4252 msedge.exe 100 PID 4252 wrote to memory of 872 4252 msedge.exe 100 PID 4252 wrote to memory of 1688 4252 msedge.exe 104 PID 4252 wrote to memory of 3960 4252 msedge.exe 113 PID 4252 wrote to memory of 4752 4252 msedge.exe 114 PID 4252 wrote to memory of 1648 4252 msedge.exe 115 PID 4252 wrote to memory of 864 4252 msedge.exe 117 PID 4252 wrote to memory of 864 4252 msedge.exe 117 PID 4252 wrote to memory of 888 4252 msedge.exe 123 PID 4252 wrote to memory of 888 4252 msedge.exe 123 PID 4252 wrote to memory of 5016 4252 msedge.exe 126 PID 4252 wrote to memory of 5016 4252 msedge.exe 126 PID 4252 wrote to memory of 4064 4252 msedge.exe 128
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-cyjkge.htm1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ff812dcc188,0x7ff812dcc194,0x7ff812dcc1a02⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,9662727307445270748,617235016897075598,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:32⤵
- System Time Discovery
PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14198677169695000240,5033333039975852100,262144 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:22⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,8975214987508910182,10458390970748776356,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:82⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13245573860573616573,9500478364735621429,2097152 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16292746128481151400,4500782663453265190,2097152 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5908554514610559923,11007736633928836736,2097152 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:12⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,15378796266861077063,3621394939496557076,2097152 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:22⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12151986719813540373,6128076953752554809,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5918938434108796286,1240035220751789465,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16583349794834827685,15240873492368904495,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16583349794834827685,15240873492368904495,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,4653975958200617719,14584868684710626072,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,906886333184028903,11349801445285033264,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8485028571278046322,17695056988075969012,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:82⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11406586824369533281,5975224665302986457,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,4290926918000065267,7476353534842272596,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,16784937262578119865,10789963000757013537,524288 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:82⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,7336070679053416712,16262552211306986283,262144 --field-trial-handle=2964,i,7216557801252254805,4231208909013004890,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\066d472d-e616-4cfc-aa5a-299cc4a55d2a.tmp
- Size 21KB
- SHA256 714e34622c7cc108c663f2e51c41bad802851eaadebccbe180977108f3cfad86
- MD5 77a67b2d4419c900ed701af0146c5d9a
- SHA1 732ebcebdd261e132651f328ef7cc0aa9b6f3b7d
- SHA512 45fbccbb229daae89f6084f3cd1f7ab5ddb67374e7fcbc297f7ccb7e641c446409b239113265fc3b7f516346f076d3e177b3afeb7fa2bc37ae11284c8b0fc317
- SSDEEP 384:E3iFiZcIpzsNw8TUNTUlIlbFi4IluQX5+DtJOnIqNJrvGa3tgOIwZOyoLFok:5FQJ5wg78zkDzOIqNhvGa3XsrRH
- TLSH T1C2A27D339CA4CD7B9DFB9A85F54A3203CEB45167D685EAD0E2EC5E1C01A62DC130BD12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10461f98-bc22-4388-b93e-075c815a8526.tmp
- Size 8KB
- SHA256 848d3ec617532dcab1211324cafe5b4e6b1d1ae3a77491520f8d15330601e1c6
- MD5 fd9f02e70ff2ce26e3596b757481d0e7
- SHA1 01a1835bdcfdbf325bc7e9491c60b8a4b9cb6b93
- SHA512 7d5949b4eeaa32e4086ea511b38a8609f428ae4d0453603f103c29f7fa3f6790765ca335a30ca088177f53c060b2952a5778b1d5e6bf8bc372b47d178458a244
- SSDEEP 192:EONJ6nnH6QmiUylWQYcX5hQDP1JOnHoqSSJrFg3Gpq53U6:EONJ6nWbQNX5+DtJOnIqNJr6Ga3U6
- TLSH T12B120B31B9A4AC774EE3A595F4873153DEA55127D6897FC0D6EC2E2C01DEB6C230AC22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36253914-f880-4466-999a-fc1fea9219ae.tmp
- Size 18KB
- SHA256 309e255d798a9b1ef756297b5a942467b67c462ad678b3c951830daf43c30609
- MD5 111cd22ad92986be3d9f2ee549f769ba
- SHA1 6fe8fa469e75f833fc111cfc996cad8687d55dc0
- SHA512 6a11fab116b40d87822cc847779503c326edfb39ec9c4e2b88ec43389717f934dcd716ea20619eee8030b6b3137e783d77603864883cf4164b815bae079a92ac
- SSDEEP 384:sZcIhsNwaFi4IluQX5+DtJOnIqNJr7Ga3tgOIwZOyoLFok:6hE8zkDzOIqNh7Ga3XsrRH
- TLSH T1D2828E31ADB89C775DFB9185F48632039FB49167D2C9ABC0D5FC6B2C01E97A8130AD16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\706fe6f5-c974-4b14-8c11-be27093b9257.tmp
- Size 8KB
- SHA256 d60ca98a64c7bd61871d07c5c936115c098d3db8735f915fcf556bb95cd59b91
- MD5 f2a1f4ac0211fc3520425ad0f7bc0d97
- SHA1 d24fdbf5c3d27f29f36eb282023cc531391e95ac
- SHA512 f268be705bbaf33d4a552e4fead05b4a808b1e29d8c54adc4b172218d86b79363e07768d0e5b17fcb4a1a6ac4ed0dc958747abe9ca6fe05e5f428f076d18ad23
- SSDEEP 192:EONq6nnHGQmiUyzWQYcX5hQDP1JOnHodMcGG2U6:EONq6nCtQNX5+DtJOnINGZU6
- TLSH T17402D934BCB86CBB8EF36E45B48632139FA5217BE5956BC4D6F81E1C01D7B5C2306822
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 2cb0b2e7b2f05d775343f6d8358811aa49d866a633de80073ad625e169021a10
- MD5 f075ad7186a1f6c200abd69ca7856c96
- SHA1 9bc250f221c26c725e12199febb7a3a178070ec7
- SHA512 52730b59c4a720a9d526482430c0b2af7e12cb71a526f9149bb1b7748ec8134b51426f9b1d414cc62a4ca0c89bb9b0344afb23b1313af6aaf8e1075ff2f08415
- TLSH T1D0D0C001ED689FF4E071183C0239800836CCB1424B023141D0A012578C24242106CCE4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
- MD5 cf18b86051311e5d4cb3435637b32441
- SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
- SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
- TLSH T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
- MD5 be02dc26a22f37196d8a2ed1f90604b5
- SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
- SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
- TLSH T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a1b3d39-6bf0-4daa-843e-04b571bf6bc9.tmp
- Size 10KB
- SHA256 b287c01ca951e8a15f364fd8ade5a0713991a4bdc992bce8e067521f1d3eaae7
- MD5 ceadbe5837c56efd6e4ad9a6e129e2c8
- SHA1 63642038930ea8116f7dd22f53da486cd78bd39f
- SHA512 3ade51188ae96a23a3cb329a001349ecfadc4855be1ca9d0d811dbe83608851c25864aa1343b590a75c51a8df1e80a0671858e77ad988c204377d3eba0dfc102
- SSDEEP 192:sxZ9RoWe/fjs2jIdpdIHW6+WNGYYB7fwSIg5iJ:sxZ9Ne/fjs28iHbGf7/c
- TLSH T18122D8516E28697B8CCBE20DBB55BF53E6FA503251951E48AAFCC62C05F76CD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\216f2f39-aac6-47a2-8ce6-c1352a145660.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\569689f4-955d-48c6-aab4-b7a92c53242d.tmp
- Size 9KB
- SHA256 837c03c6214418c3d4ca4fceaf0026f3ae5fc1bac9c1104a912740ebe1e6b510
- MD5 75b414115dcffec1ac630b19189d8940
- SHA1 135e4225d8cbf1000e99729dc7aefc041918ca63
- SHA512 5f7122785ce6bbef5060de83c8f3dea546e43b1175411b77d72ba3df1be22cce6bce79352ab8853b255645730d61050cf545b283ead777fec9e7ddf5d7318bab
- SSDEEP 192:sxZ9RoWe/fjsvjIdpdIHW6+WNGYYBawSIg5wJ:sxZ9Ne/fjsv8iHbGfsu
- TLSH T10422C8116E38657B8CCBD21DBB55BF53E6FA503251D51E48AAFC862C05E76CD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59cf4631-66d4-4454-b970-65120a207af6.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94fab29e-5f47-434c-9fad-60997a3d0db7.tmp
- Size 27KB
- SHA256 fe340cfbee43684eeb360fc87b953f4068bc3fd13e5f4ba8b30491faa04eb2ab
- MD5 ecb5bc024382f4dbe6b20ee7d143b3ff
- SHA1 2c5faa7c3fdfd2f7e5f0ff1316f18022170decb4
- SHA512 148a4e02da8d9c852fd01dd35d11351c6f3dcb27b7cad76cdd76253a66b749df6137a974f5734fe089b1f168a6d7f6fa5c8337e2b82423d75259c1ca527c332e
- SSDEEP 768:S3yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXBropRp8:S3yYR7jWv3NpBu1ja/CL8OX6a
- TLSH T160C2E93B640DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EE912A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 484bd175f447c8f6caa655a01617ee5dea6e5666542722665c48df7384076e1c
- MD5 c1e1246016f8e90cd2590932beb821ec
- SHA1 fa55c356642864926200db27e5710f0286b4c33c
- SHA512 271a673d6b1fd080729ef13d7b1d8c2ac845c2a96e32f762bed120e33dda04062991fd529ee0b9c94bf215e14a208598d14cf1510e5b991b66f361c629af7c93
- TLSH T1F6E020F804C4C21F770CA59B01BC4B0C9381375FE6C0BE4D3B06C54975054946B85764
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 d97378cbe341b336eada8cc335966b7dee784e77c08e1a1cc77ba2a02ffcfeda
- MD5 1c4fafb8c26a3c888306c4db0f0c7dce
- SHA1 6b82c0bf00a8b6f3deba4aea49921956ced40502
- SHA512 42a29f61f22c98b4270afb1255f607ca4220ff27a3ca9a3ae14582c69ae972e58eb4022d1accbfe9ff2b672695a6953a8e1f8d69542114896c3612c9ce8e1a7f
- TLSH T1D4E026F446C8C26EA208A64702BC438DD380379F96C0AD9E2B50D58C7605985EA837A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 2KB
- SHA256 ef18006bb9c27484adf4f04b3b824ed38d24cbbb5f4b3bf2b6c9546f49c68091
- MD5 470216bca084a831aa89786e63c69325
- SHA1 1b0f2f6478d0730dfd3a77f2bae11342f727c4fa
- SHA512 736e7fe3a7db7755d03ce4b0aecd2a4a9d37aa4cdc2a1bf4ca2b21a75bdb677eb185ce7d511dbe710fd1f2c9ec1c63f2b512be95576b7cbf1a6511c9fd28c9e1
- TLSH T13B517285E6D184B0FF59D970B1DE2F873AB887B958C71FB32CA4D4BDAB0A7165830044
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 ee0ecd9e8b3f2d289c54799eb211644a2115f07e1edfa894af3d866bc41f39de
- MD5 7ab800a8bfc9c06f67b066d8076db393
- SHA1 99a981e47f487069b4e125304da321d7dd496522
- SHA512 42f6a02a48654003f591ecd89ff4dd7fc935d9fd61fda0e641271dfd27325e46ddc5a09bfe7f2af4553aceb5035ec40236ab896aaee49c9d36d36932d27ce7b9
- TLSH T1CD517285EAD184B0FF59D970B5DD2F873AB887B958C71FB32CA4D4BEAB0A7065830044
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\77ee9e4c-2351-4c14-a567-acfa262b50b2.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2657f91-ce75-4f0f-8ebc-adbd99dccfee.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba71778a-b57b-454a-a808-81c5dc1669b2.tmp
- Size 949B
- SHA256 0877d1fa9ac246ecc4176c277e17a9b1afb4152e65550caf640db46877e80e35
- MD5 b74a7631ff857f59b08d9cd907a2e680
- SHA1 e357c87f151104e0041040bbecff9763abbb2e84
- SHA512 5aa13059be61e0a06c9d4a6af11729dec32a0b36d270e351a94dc49e2afca11b033feb2eb323c5bbc98071ef254907be402122674047610071db4fd4f5cb2722
- TLSH T147117DB3C3D585AECD0556F05A24AE2BCE2D0605421C7C1985D4EF2793E3475D10259F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d710be33-bbe8-4e10-9794-e16c2a7fec99.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 8d145afe87a4acd24e61603e76f55560c551fcd49269e0237e484750d20d2e57
- MD5 4450a762fc45c899548164f990b67c0b
- SHA1 9b5296e3d908dc8419a862dc584c8b0fa086aa72
- SHA512 a043f312181218e3f1fb9cbf4335a86b4eaf98d7f0634d7f1376c92b57fdf24b998814aacc2b5d8370f7e579c2f1e6fd0c71ff72328d68f95643e9b039e1a54e
- SSDEEP 48:Kgfir/BhBab5UpISPaK9v1lax/KYstvTyLnKzHJp5Sbx8hISXSK9X19SxXCY0lHI:KQsAKVC+ikAKR+uRmKKoS+ROK6E6
- TLSH T1F1B1BF1531B7020038BD759880B69B1B6281B2B3311AE63BBFBC51A58F6EE545DFF4C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\deb3748a-f136-4ca3-b88f-f2d5c9bbc1fc.tmp
- Size 10KB
- SHA256 e5eb2c0108142ec5e85deca9a2c0eb94649370eaae94a108e1249ea269d98edd
- MD5 d89b37db88b846de146b1f6a48ebe92f
- SHA1 0e2e70691c91b3347dd3b52ac6f5125f9d59b69d
- SHA512 88990d0e8265dba7629bb59211a8d1f24b03091f447f92668208433f1f1e2f5f72f7bf57f803cf8f84f3ad71c4b6732834a61edbc7c9d40bab395b7fce877afc
- SSDEEP 192:sxZ9RoWe/fjs2jIdpHIHW6+WNGYYBjEwSIg5iJ:sxZ9Ne/fjs28oHbGfjWc
- TLSH T1C722D9126E28697B8CCBE21DBB55BF53E6FA503251911E48AAFCC61C05F76CD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\faa6fe72-3115-4702-9769-0c9bb227e00d.tmp
- Size 9KB
- SHA256 8d30183482b8179c7fe92fdbfd69c249db137531b630351dce4f4e218ec06267
- MD5 da4970cfba699bba4bb8525cf0638b01
- SHA1 552e0f182628f7f768b8fb7dea0f8a17b0259bdf
- SHA512 34778ce46d3df5b1a23f7dd30c1f401e9f029ab31aa113261fbeaec2c91ca86cc2e3edde790131b6cd4477c7491f965bd196255b731f21eda3fd3434465a4cbd
- SSDEEP 192:sxZ9RoWe/fjshjIdpdIHW6+WNGYYBawSIgrJ:sxZ9Ne/fjsh8iHbGfs9
- TLSH T16412C7126E28657B8CCBE20DBB55BF53E6FA503261D51E48EAFC861C05E76CD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\696592aa-ba7c-4523-9bdd-27999fd47ff5.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c35960a6-81c8-494f-8567-4fc310c5aa67.tmp
- Size 18KB
- SHA256 7b388e1353a94365e7d7c0481a91adfe43f32b3f2d887efbb9d301123237efab
- MD5 40a61823f06dd918da80158934fc36ff
- SHA1 9ace376910914d0b436d8965f8c6f2ad5809b072
- SHA512 5cc2e809e5ae5eba558e56e42c04a5c866e1ce99024d8972e93fb90c876da5dc4882cfb644b05dc55ab9f5e58149f781784e45881ea1e190414a65ea9554027e
- SSDEEP 384:8ZcIhsNwbFi4IluQX5+DtJOnIqNJr7Ga3tgOIwZOyoLFok:qhh8zkDzOIqNh7Ga3XsrRH
- TLSH T1F3828E31ACB89C775DFB9585F48632039EB49167E2C9ABC0D1FC6B2C01E96A8130AD16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1239c036-9461-4651-aec1-39741d658416.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 28c4acbca02ac6463efc42c491a43b31ce90f82fcee80f0dae9b3a4357325d13
- MD5 7d4807011f83bdbc8ad95079d7d72446
- SHA1 bf27700b5addc2aa56efd97a3a836df79f28d4ee
- SHA512 1fb3e29607603b015d4ff6ede51a6d211ea7bdbc73980bf6e38429d29c61f0c4142cef3f16b04f90892b38629b5547d07f19c4237231333bd9492ec210f17ee5
- TLSH T121412858ABFA1148B3B76E569BF6A86D447FB8772E46D49D00110E4F4B23B00C972B37
- MD5 SHA1 SHA512 TLSH