5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-yguzks.htm
Size 194B
Sample261002-pyg3csac46
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{5448552E-ABC4-43A6-A362-0B5A43B27CC7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1768	4956	msedge.exe	87
PID 4956 wrote to memory of 4384	4956	msedge.exe	89
PID 4956 wrote to memory of 1660	4956	msedge.exe	90
PID 4956 wrote to memory of 1660	4956	msedge.exe	90
PID 4956 wrote to memory of 1980	4956	msedge.exe	91
PID 4956 wrote to memory of 1980	4956	msedge.exe	91
PID 4956 wrote to memory of 1980	4956	msedge.exe	91
PID 4956 wrote to memory of 3784	4956	msedge.exe	92
PID 4956 wrote to memory of 3784	4956	msedge.exe	92
PID 4956 wrote to memory of 3784	4956	msedge.exe	92
PID 4956 wrote to memory of 4636	4956	msedge.exe	93
PID 4956 wrote to memory of 4636	4956	msedge.exe	93
PID 4956 wrote to memory of 4636	4956	msedge.exe	93
PID 4956 wrote to memory of 4296	4956	msedge.exe	95
PID 4956 wrote to memory of 4296	4956	msedge.exe	95
PID 4956 wrote to memory of 4296	4956	msedge.exe	95
PID 4956 wrote to memory of 1428	4956	msedge.exe	96
PID 4956 wrote to memory of 1428	4956	msedge.exe	96
PID 4956 wrote to memory of 1428	4956	msedge.exe	96
PID 4956 wrote to memory of 1268	4956	msedge.exe	100
PID 4956 wrote to memory of 1632	4956	msedge.exe	101
PID 4956 wrote to memory of 1268	4956	msedge.exe	100
PID 4956 wrote to memory of 1632	4956	msedge.exe	101
PID 4956 wrote to memory of 3496	4956	msedge.exe	105
PID 4956 wrote to memory of 4928	4956	msedge.exe	113
PID 4956 wrote to memory of 3364	4956	msedge.exe	114
PID 4956 wrote to memory of 716	4956	msedge.exe	115
PID 4956 wrote to memory of 1780	4956	msedge.exe	123
PID 4956 wrote to memory of 1780	4956	msedge.exe	123
PID 4956 wrote to memory of 2828	4956	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-yguzks.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x26c,0x7ff91224c188,0x7ff91224c194,0x7ff91224c1a0
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,15606122333446143050,12683200728826277187,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,5373512683428705760,13639868673716594407,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8246741153559940336,312250483801953763,262144 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6174799359064329521,8832324633917976066,2097152 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9783819479890349667,356309614469985729,2097152 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,14338844209389459663,17316702418186713453,2097152 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,14035069503745504511,14968536927217835473,2097152 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,14470142153682572938,592934484138733996,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8736862309434799053,6951332807462616941,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5307395494556644776,16754820162060020719,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5307395494556644776,16754820162060020719,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,16916590545564349113,774153655154463004,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1925629563449267976,14814209019362319354,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,12657551743305824349,15729431800535655502,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,294867782640855476,8391875478225699377,524288 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5416,i,10735666509043156142,17995985288383067529,262144 --field-trial-handle=2352,i,1647826766464698133,2438146116193837367,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

030311c3-0805-4431-be38-48f2265fa077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\030311c3-0805-4431-be38-48f2265fa077.tmp
Size 8KB
SHA256 8882475336e6928a950a79218264a244fb73ab428bc29ec722351636e14ff128
MD5 7c184b4ec784838c3f1d7ac4e146036a
SHA1 44f6a96191c4c23230d84b1fbc828a311ee5ba51
SHA512 7336103c597a7c25c26548b63a97f3160082119e87e3dd236d72c6f11fd7671da480f153146955664cd6ed08dd6e1945fbbdccf86d37e412d5a63ec42673870d
SSDEEP 192:aONA6IE7QmiUyIBSTPuIGmDnjzorbhRUmC7sDPU6:aONA6DtMPuIGmDP8ysbU6
TLSH
T1ED02E935AC78BCAB9EF36D09F4473A23AFA4112BE6D56F54DAD41B1C00DB25C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15cab26f-ea4d-46c5-877e-f192aac8d4d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15cab26f-ea4d-46c5-877e-f192aac8d4d0.tmp
Size 18KB
SHA256 16a2dbf23597fe3aa894fd496b88b8f4391e0d014b0002627555a215c5dc178a
MD5 c34d3db56761ac66e4bb697454f47b1b
SHA1 572d08cf169dda610c7623e96b1cf778ad7b4f0d
SHA512 59d0348f35ec995913354bf013b6a050f4bc1e86ff1923116bbfd9fc53ce3a1338cbeb5bf91ac0cf9c41a8c92b748cbf8114aa39d6796f50f1f8b0a581150b65
SSDEEP 384:CZcIhsNd6h0W1+BYzIGmDP8ouXdi4tgOIwZOyCLqoS:whT0W2qsh+di4Xsdeh
TLSH
T126828D329CB8FCBBADEBA044F44636035FB89037D7C99F54D5EE5B0D01DA298130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e789f75-467a-48f6-a371-582142c24c15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e789f75-467a-48f6-a371-582142c24c15.tmp
Size 21KB
SHA256 ad49446071a1b71310afffec7223d49c549a40bb753b38486d12d342ad51914c
MD5 b97e437a12357b5dd56306e569d56196
SHA1 dc19575a12cc84c5e437ceb809873aa8e66e73f9
SHA512 258441cac7ac4925ab5e08db72c16ed4020670a6f3eb6261551e28139d07644894c2516b633cb0572af7fba985b4a31e60a466824b2a2e8aeef1faeeee90dc3e
SSDEEP 384:SiFiZcInzsNn8TUNTUlIl6h0W1+BYzIGmDP8ouXx0i4tgOIwZOyCLqoS:ZFQzSwg60W2qsh+x0i4Xsdeh
TLSH
T111A27D338CB8ECBBAEFBAA44F54632039EB44177C6C5DB50E6DA5B0D00DB198130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

761647da-1d17-4c5d-ad05-e27adb33e9da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\761647da-1d17-4c5d-ad05-e27adb33e9da.tmp
Size 18KB
SHA256 12e0c4a6c9cf17adc390526476f32ce4f795d9ab9a2aa25189b1e8c8d5583b23
MD5 3cb7dd058408e78bc3843260f812ea41
SHA1 173ccc799b189cfa579059bcc3ecb7b27985670f
SHA512 3108e6e05b11ef523e9f7ca42cee8436fc4482fc33be28b25141ab7267fc67c77e7baeb876380e4ff80e8b693b7fd4eff3d18cead9d1a2e83060bf6aebcb6b87
SSDEEP 384:GZcIhsNd7h0W1+BYzIGmDP8ouXdi4tgOIwZOyCLqoS:UhA0W2qsh+di4Xsdeh
TLSH
T10B828D329CB8FCBBADEBA044F44636035FB89137D7C59F54D5EE5B0D01DA298130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ae7d344-e9e9-427a-99f9-284361576a20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ae7d344-e9e9-427a-99f9-284361576a20.tmp
Size 8KB
SHA256 9670310d730f27cab9e36df7d06a6c9d495aee081f16824bea53783564ccd1aa
MD5 7e7375981107d00266276d7723d3f340
SHA1 1d48e4b094588b533b49f8782b0f64fab5e580d5
SHA512 e707366070651f6d9eb9172638d67a8e0c8a46b0490f0c218f8b1cffdec14cc008193b9fede9966d7dd24d0825195dedd0a7a1488092bf6da8f5028b5abfb512
SSDEEP 192:aONo6IE0QmiUyIQSTouIGmDnjzorbhRUpuX8Y27HIqGU6:aONo6DEdouIGmDP8ouXiH4U6
TLSH
T14712FA36A8B8FC6B9ED3A844B4873523AEA45127DBC96F50D6DC1F1C01EF25C530A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

2500555a-3a63-44d9-9d3a-57afb8db9534.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2500555a-3a63-44d9-9d3a-57afb8db9534.tmp
Size 10KB
SHA256 fa4c46199f124f518eeb739f70cad8799d012235d87c719afff2d6dd566d234b
MD5 a250b37df7b68220a1cd1e3bf3b5ad98
SHA1 48cf61312257a08fd7c3fb35a0691e75760c4808
SHA512 4fb315e2f8ad74884e11088511b5ad27e8326cc06cd6dcf1e42f635de77b865b1dcc6db6875c616192cbad15014f3bd4c24b7c835dde57790415cc1b5e750f78
SSDEEP 192:sxZNRWWS/fnsik6IdpdXHW6+WNGYapXuWIg5OJ:sxZNnS/fnsigdHbGLg
TLSH
T1EE22C8526E28797B8CCBE20DBB15BF53E6F9503291941E48A6FDC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c65aedb-8233-49dc-af01-dfd7cb5b2c7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c65aedb-8233-49dc-af01-dfd7cb5b2c7d.tmp
Size 10KB
SHA256 d7c7fdb41e07c9592160270736cd7287c0073993586cc5ff5b4870464d548e71
MD5 6bcb6657b68fe29df60252748311a337
SHA1 89439d632a0bc9cfddec4bf74c5fd364c6fe436e
SHA512 577dd380c3d3d93487be7590a8b5c7ab4bfa4f4c503eafe5cde6e9ee334fd01ff20cb3ce86080d495eecdbf234921a35bfef2a86439a5f4c8f19e78f98a775e8
SSDEEP 192:sxZNRWWS/fnsik6IdpHXHW6+WNGYap4uWIg5OJ:sxZNnS/fnsig3HbG+g
TLSH
T15822C8526E28697B8CCBE20DBB15BF53E6F9503291901E48A6FDC61C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77446010-ec83-44a7-b8c8-66076c8673b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77446010-ec83-44a7-b8c8-66076c8673b3.tmp
Size 9KB
SHA256 25c255efee2934915b30fb85ede1c26b53a300ccbbd13655839da1005a89fcb4
MD5 199401d0f8633e4046cdd8dedf61ae6c
SHA1 7dcbfb4aa8c2de7d1cb74df5e79c4c649349b85d
SHA512 57faf65dc12a129afee48dec83a39486224ca452835d02b894cb45b331a111fa0784c7139ede27720116681fa1bcf194a150a09f9894224409c11c845889eabf
SSDEEP 192:sxZNRWWS/fnsRk6IdpdXHW6+WNGYapYuWIgrJ:sxZNnS/fnsRgdHbG29
TLSH
T11E12B7126E28657B8CC7E21DBB25BF53E6F9503291D41E48E6FD861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

795fe579-aa8c-4392-a9d7-540420c66b99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\795fe579-aa8c-4392-a9d7-540420c66b99.tmp
Size 9KB
SHA256 7105e66b28500f451dc009d59c5f73b21cd51203ef25009b8d1855e687f4236b
MD5 379bc51c53181d5108dbc825add5b833
SHA1 cecf0878485308326b4122bfbf18f6ff11dd5f06
SHA512 748add0a59b90ede76e3749f485fc870457c9205472dae1b35a092c31807e8fe8c7cb641da8600cceae0b5b1a67f89567c445a8eec545ce5b4f15986bd351b9b
SSDEEP 192:sxZNRWWS/fnsLk6IdpdXHW6+WNGYapYuWIg5cJ:sxZNnS/fnsLgdHbG2i
TLSH
T1D122B7126E28757B8CCBE21DBB65BF53E6F9503291D41E48A6FD861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e0b2d6929d2b81b1304cb435763589e3fb49a9d238ae741e822c87589cdf6b0f
MD5 17e791d3305b854e1b30710dd71f3e65
SHA1 18644e21ec68b905457a18de059d72b99468ca9d
SHA512 92b6c42d0f7e4537e8a36e7886bbf3062b2cc97ec4643dc7201681eb3881a0e454dbd734b62108ba0369c358cd680e8679b0faf29f509c3f06282e3d7a79fffe
TLSH
T1DC513CA13692C0D7F7F841B482DD214B3FF8D5A1418BCEE32FA4C8BA9846771C194258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ec11b1f1e32aca161298c72da65bafa52484483d767c8e9632f1cd0db8b248be
MD5 72dd1eabd0066c6ae8fb672a3f44d7ad
SHA1 b1fd2fac18f7986b0b6317be0b96cd2132a57947
SHA512 1a9cdae79725d8e31122c79e48c175a10a8384c8694fb11010d209a66cd8e940fa366a7228b9072c4a375b4e31f5926ff7337f31d84eb38d8a45940bcb39c71d
TLSH
T181513CA13692C0D7F7F840B082DD614B3FF8D5A1418BCEE32FA8C8BA9846771C194258
MD5 SHA1 SHA512 TLSH

Submit Download

e7cdd1a2-b92c-4b50-be4c-003160b4313c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e7cdd1a2-b92c-4b50-be4c-003160b4313c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

31dcfa2c-d3b0-414d-8fc6-510d08117952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\31dcfa2c-d3b0-414d-8fc6-510d08117952.tmp
Size 949B
SHA256 a8a38ab3daef85f8570dbaed4dbd30eb3c20fcc4d90046faa44f836a061532c6
MD5 2a4f07fbfe11ef59a8cee7fb60e89bcc
SHA1 60b49acd71804d873909bbdce77e8411e536a0e4
SHA512 84910250e4a035fe5ba10caa7d1171dcf1a1d0c0809c43f37cf4c34a4316298829e737fea6fb1ea4cc6632c7058668a4bded90cdfaaeb249354b2a56041d0a84
TLSH
T189117DF3C7D595AE8A0156F05A24AE2BCE2D0605821C7C1989D4EF6BD7E3476E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

8b01a1f6-0157-4452-9c2d-8e3d6c809896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b01a1f6-0157-4452-9c2d-8e3d6c809896.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cf9c75e7-eb7a-48bf-8778-5586b5b1bd0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf9c75e7-eb7a-48bf-8778-5586b5b1bd0a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ac56a8a5-63cd-4aa1-b0a9-ca9b734bf3fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac56a8a5-63cd-4aa1-b0a9-ca9b734bf3fd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4fca2f6-e3a5-47d5-954d-1fd0e9509a98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4fca2f6-e3a5-47d5-954d-1fd0e9509a98.tmp
Size 27KB
SHA256 ad9510e376148b1c7a40972464dbe5fd1a307f0592f1363f205b6575f577ccec
MD5 d085c9c49452451570dff709802a92a9
SHA1 0567fc945a7bc4792fcea51c571f320ea371f70d
SHA512 b2214314ca350c944265d7c996c4a3ad3a04d098d9c61aa9fa38a046535e2702c54c417e79d13e97aeb29886db19582c319fdb7041e62ea97644c755fee0f611
SSDEEP 768:aaWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Rro4HfekmRW:aaWPcLKWvKeEeu1jaClLiF7q4HWkmRW
TLSH
T1F5C2FB2B640CCB7E5FC01E9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fda8b69-5637-492b-80eb-242947af7405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4fda8b69-5637-492b-80eb-242947af7405.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8451d455-f671-4346-8cff-a54d89d45b4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8451d455-f671-4346-8cff-a54d89d45b4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9dace3753415ae579b94cc3d94be3b81b304a3187f015ea217ab518efc1413d9
MD5 66d61cb64b2bbc832caf74aeafb9462f
SHA1 ff4fbb1b9030dbf9ad5a84e1c5c46419a0e67ad4
SHA512 fd38268f93dab25ff2b80e63f19bc77dac70f8da36828f27e51574618b9a6425afefdda680de2c19dd622b8de265b206e72a19d7a63284a344ca1425605c1a4f
TLSH
T133412A58A6FA1108B3B76F1AABF7A96D487FBC772E0AD45E10110F4E4562A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download