5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-9knuje.htm
Size 1KB
Sample261002-pyebgasfne
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{A693DC18-5677-48D6-B0D0-70B7C1023B0C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2176	1960	msedge.exe	86
PID 1960 wrote to memory of 4120	1960	msedge.exe	88
PID 1960 wrote to memory of 5968	1960	msedge.exe	89
PID 1960 wrote to memory of 5968	1960	msedge.exe	89
PID 1960 wrote to memory of 5968	1960	msedge.exe	89
PID 1960 wrote to memory of 1956	1960	msedge.exe	90
PID 1960 wrote to memory of 1956	1960	msedge.exe	90
PID 1960 wrote to memory of 3816	1960	msedge.exe	91
PID 1960 wrote to memory of 3816	1960	msedge.exe	91
PID 1960 wrote to memory of 3816	1960	msedge.exe	91
PID 1960 wrote to memory of 4864	1960	msedge.exe	92
PID 1960 wrote to memory of 4864	1960	msedge.exe	92
PID 1960 wrote to memory of 4864	1960	msedge.exe	92
PID 1960 wrote to memory of 2016	1960	msedge.exe	97
PID 1960 wrote to memory of 4844	1960	msedge.exe	98
PID 1960 wrote to memory of 2016	1960	msedge.exe	97
PID 1960 wrote to memory of 4844	1960	msedge.exe	98
PID 1960 wrote to memory of 4720	1960	msedge.exe	102
PID 1960 wrote to memory of 672	1960	msedge.exe	111
PID 1960 wrote to memory of 3560	1960	msedge.exe	112
PID 1960 wrote to memory of 2452	1960	msedge.exe	113
PID 1960 wrote to memory of 404	1960	msedge.exe	122
PID 1960 wrote to memory of 404	1960	msedge.exe	122
PID 1960 wrote to memory of 4976	1960	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-9knuje.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fff3d11c188,0x7fff3d11c194,0x7fff3d11c1a0
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,10407652552152839891,9100765883580117240,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,10708924998607543110,13440344246094174505,262144 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,8389916855806847782,10018763543348731186,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15935591060504883675,851385738113264351,2097152 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2664308324251754076,5997849322636646406,2097152 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,3894756068015744093,10467478484120326829,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,7772712821497794823,12900538251769224639,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,1132607472210919387,12668941282558159043,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,1132607472210919387,12668941282558159043,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14103101515395351197,9091358167848723006,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12305829574512347280,14954999489805421144,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11501492776971463072,11151603106297371477,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6148649910601351320,15256748978772652280,524288 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3100,i,16232381773616734037,11696567394647718371,262144 --field-trial-handle=2276,i,3410510466277515112,1716062576446541415,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

78020a94-1b6f-45f0-be7f-54e610d4baba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78020a94-1b6f-45f0-be7f-54e610d4baba.tmp
Size 26KB
SHA256 766aacc9dac8e5efbf4bf73950ca4580a3421d4664147040c872449862398177
MD5 b637964d9f3c54640f7ae98468c2e306
SHA1 575bb9a172f9b8f5e00875065a78ceb313ddfa98
SHA512 8e028688ccc9e7e015a45a8cbfa7644d84aa204de678ddfd8e24276975340b6460f0c08548bc3687c5b3b173eaef6e42fc8d95a2e648a9717e292990e172d7d6
SSDEEP 384:npiFiZcIdn3sNv8TUNTUlI4SaKMPGCw2f0BChCAQPwuFsQ+tgOIwZOyPoXgL/7Ip:AFQh3qwgKEHBChFQYAsQ+Xsx+e
TLSH
T1DBC25B32D898DABBFCEA4BC9A74A7603DEF04223959C9AD8D9D91D2D00D71DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7df4a400-591b-421a-8443-41aab644136d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7df4a400-591b-421a-8443-41aab644136d.tmp
Size 26KB
SHA256 613711af254e2177f863b51305a28b5d189b946b2f515a252e871b447be1c410
MD5 1fe23aea2c524ea1d94f5a4365665b78
SHA1 0e7cce45b6366dde38e89e0ee5724c4e473b3ca7
SHA512 c90072dc95f34f3f6fa87f99038713c3e132b3221f48232f327cb373a1923062ef80a4acf89cc2858b60eff71c758497c16f19aeeabfbed9988c73ffd3cecae8
SSDEEP 384:nliFiZcIN3sNv8TUNTUlI4SaKMPGCw2f0BChCAQPwujkQ+tgOIwZOyPoXgL/7IzF:sFQN3qwgKEHBChFQYokQ+Xsx+e
TLSH
T19EC25B32D898DABBFCEA4BC9A74A7603DEF04223959C9AD8D9D91D2D00D71DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f89a678-6ac9-4551-be9c-213f544f47fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f89a678-6ac9-4551-be9c-213f544f47fd.tmp
Size 25KB
SHA256 d6cb53182c7f6fc6b606614c1912482c625a2c7801b2b9c2b53ac2dac0454b8e
MD5 1a18d7a3f89e63de4ac99fed7acfca4e
SHA1 e3b83b0c11fb558a05d4cd567e432522184413af
SHA512 88a935d75e5d04889b00bf3bfeb3d248d5e639e3cc5730dc10be1c1922fabe8e638032a4e1df279873201d6816b1a8a2c2319fcfde893f4154421ba1ce4fe84e
SSDEEP 384:n/iFiZcI63sN38TUNTUlIm2aKMiy4w2f0BChCAQP4XQ87O6R2FeoZgL/7IzEoj:KFQ63Wwgc5ZBChFQwXQ87TRrg
TLSH
T1ADC25C32EC98DAABECFA4F9AA74E3A47EEF00163949C5AC4D9D81D1D009359D1707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

2d867673-5fdb-45df-843d-913ec90acfde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d867673-5fdb-45df-843d-913ec90acfde.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

49dfaabf-65c6-4ccc-ba15-fdc5820b05e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49dfaabf-65c6-4ccc-ba15-fdc5820b05e7.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a98492b-ed76-4044-94d5-b8dd0f870200.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a98492b-ed76-4044-94d5-b8dd0f870200.tmp
Size 649B
SHA256 e6c28c84194a73788dc64de09dc03a4df58d3601656705a0ad97a70d5f619e85
MD5 77edad986d39f18eec63424741ccb224
SHA1 8e39620273bb09cf03174105eef5f91ba88742e7
SHA512 533f81fd566937fd86dd55fe2415fc7e1e240ee84cb8f11b439d43f1f0ca390ca05be1a51d4d776854083c4c0a0e32e270eeada4328d38d77a2c49015d0f3fc7
TLSH
T17CF0F4B5C921AC3B08FD1B3960D40B46F750232B2A41984B3B3E810C8FB053B458596C
MD5 SHA1 SHA512 TLSH

Submit Download

5d6714b0-4016-46c3-b9ff-794f7de8d514.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d6714b0-4016-46c3-b9ff-794f7de8d514.tmp
Size 11KB
SHA256 dbe2452ac85f6bb81aa8202876eb9af1b4cfd5805a95408841c4952abdcd61dd
MD5 32515cd1fb23157d6adc9b97dbe23ab3
SHA1 d3f8e36c4ca93d81e75af08b4ba8cf3ccb7f1347
SHA512 6d03dcd9e3f071e5d7735d4b4722e32caad792a7e8ba178daee2b9a81ff65d7c6e5274dd07744f690f350e57dfbe185faffdee3fe5cac3ecacc83383a08ea4d0
SSDEEP 192:sxZERUkG/frsGTaQZLz8EzodpHnHW6+WNGYoW4SJMIg5tt9J:sxZExG/frsGWO83HHbGNS2DtH
TLSH
T16A42F9156D28B97B8CCBE219FB55BF53E3F9503290910E48AAFC8A2C05E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9707a48a-fcd8-4ca9-802c-6db6a4d67340.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9707a48a-fcd8-4ca9-802c-6db6a4d67340.tmp
Size 11KB
SHA256 1e35fcc9e95a8bf62a98a37da44f58b1f9fdb2e103e0901c50f54957c1ae411d
MD5 b0738f7fa0c6e0dcd0578d84b7605358
SHA1 4a46aaa4530a3e998cf1fc8782b55a0fd67c1514
SHA512 03b6627a277e40d709c3c1e1537e8a21cc1705e75839091794ff6466baad4653f05bdc9c8df5e284dac7e165cad86f82aba25e24cd7a09781313dd170fe248bf
SSDEEP 192:sxZERUkG/frsOaQZLz8EzodpHnHW6+WNGYoW4SJMIgjt9J:sxZExG/frsnO83HHbGNS2jtH
TLSH
T13142E9156D28A97F8CCBE219FB157F53E3F9503290910E48AAFC8A2C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ff8e79c-add8-4292-8eec-a3833a2027a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8ff8e79c-add8-4292-8eec-a3833a2027a4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

b2e938aa-f63b-4858-a2ee-066c2d996a50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2e938aa-f63b-4858-a2ee-066c2d996a50.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fbf43105-2cad-4fe0-8d0c-9602fb79ce64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fbf43105-2cad-4fe0-8d0c-9602fb79ce64.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fd563fba-4db3-4c0c-b09f-f50102a9c570.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd563fba-4db3-4c0c-b09f-f50102a9c570.tmp
Size 1KB
SHA256 24cbb48b5238dbffcde80737e9dba183860561d51c59418fa2f37beacc88005c
MD5 028cc47364399624e99dc4054fa36869
SHA1 95792ff0bd00cdc975bd69fd36cdfc6684f002c5
SHA512 3f8b9a32067728115ead4dd9018bc0d9e820b2eb7cbaa0be090d380a5bae1abb52124ce9b4cdd3848cdb4864438a1a65ef14abe38be65db3ee6744f72e09ddd1
TLSH
T19C3191F3C3E4C56E890156F0A618BE2BCE1D0554532C3D5AC4E4EF5B97E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a0bc88b169aaae03157fe8f9d1eaa19673b645c192d7c60fc39592655de9de92
MD5 579b1e0f4e7ae8dd45be03aeb2f13804
SHA1 d8024af71736051c8e3ac08a0e026e1dcfe43462
SHA512 d06e93d725485baee7b3779a7c90c312399e32644d4a1aeb8720fb013edac5f9d790696d6060c60dfa72792985c790acc7493a9973d527f6070e1690b4485e2b
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgn:ST/2dXOJhJlpfnpp3tNXVrN38I5pb
TLSH
T1D0B2111571BB425039FE291891B69B2E064231B33119E67B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d7a69205-6a20-4a6f-a7f3-095c639a09c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7a69205-6a20-4a6f-a7f3-095c639a09c5.tmp
Size 11KB
SHA256 6adc74007a517f69cea639f80262db65aa86a76cb1cdd5f1789aa12faff872ea
MD5 271ba1eba34a26531dac99e565937d48
SHA1 fa48f43e5e6e2f0c95327ea36ea334fb3dd1e95e
SHA512 de9dffcf424aad70cc44b74c71b9e59a7c208301239788f6c1ae2aef40413d4611479a5977d5c24780548a7b3017ba7ae9a449843d2d860bce881b49ae9d507d
SSDEEP 192:sxZERUkG/frsG8QZLz8EzodpHnHW6+WNGYoxO4SJMIg5tt9J:sxZExG/frsG8O83HHbGrS2DtH
TLSH
T19842E8156D28B97B8CCBE219FB55BF53E3F9503290911E48AAFC8A2C05E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f977a632-6ecb-47ab-8097-12143de1252b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f977a632-6ecb-47ab-8097-12143de1252b.tmp
Size 26KB
SHA256 d06ad3336709a520b163b95a2a1c7ad8703370ced17930c15a9143a507760130
MD5 37f161e7e9fd2cf192ca22d247e9773e
SHA1 5c66d0edc3d83367feacd43d3397e18160a25e0a
SHA512 8b17f26ead5bb64b0f5ccb58f2041c85627665abee7ed7ee7f61ae007b6e7d9ed9065f442abd395972aa708687cfd3314408c1674eca8c451fa8d41061b57f14
SSDEEP 384:niiFiZcIN3sNv8TUNTUlI4SaKMJGCw2f0BChCAQPwujkQ+tgOIwZOyPoXgL/7IzF:pFQN3qwgK2HBChFQYokQ+Xsx+e
TLSH
T159C25B32D8A8DABBFCEA4BC9A74A7603DEF04223959C9AD4D9D91D2D00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 13e619bf8ed7a25d4e6f8b19fdea2e9ae6d8d66c61f77bacfc691a0fa0e1bf58
MD5 ba1e534d131a1132970d685d0e9ecf8b
SHA1 311e563a42e617471e6afc05a6151c577ae5de01
SHA512 a9770ed0baa74be844c2f44dd4a7f8d310eb9cdc9959a7292f341161c960f923dd55b0fe9d876757b4fef6e1d745e00aeb290a2d5de288d64299fd213acedc61
TLSH
T178412758B6E91009B3B7BE5AAFF2A86D487BB8772E06C45E00010E4F0A62B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4720-189-0x000001CC24F10000-0x000001CC25F10000-memory.dmp

Download