c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-7z1zkg.htm
Size 34KB
Sample261002-t3vaps1vbx
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1C379E63-88AC-4F1D-975D-2FAD00457E54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1736	2044	msedge.exe	84
PID 2044 wrote to memory of 4088	2044	msedge.exe	85
PID 2044 wrote to memory of 4320	2044	msedge.exe	86
PID 2044 wrote to memory of 4136	2044	msedge.exe	88
PID 2044 wrote to memory of 4088	2044	msedge.exe	85
PID 2044 wrote to memory of 4088	2044	msedge.exe	85
PID 2044 wrote to memory of 4136	2044	msedge.exe	88
PID 2044 wrote to memory of 3776	2044	msedge.exe	89
PID 2044 wrote to memory of 2112	2044	msedge.exe	90
PID 2044 wrote to memory of 3776	2044	msedge.exe	89
PID 2044 wrote to memory of 3776	2044	msedge.exe	89
PID 2044 wrote to memory of 2112	2044	msedge.exe	90
PID 2044 wrote to memory of 2112	2044	msedge.exe	90
PID 2044 wrote to memory of 4236	2044	msedge.exe	92
PID 2044 wrote to memory of 4236	2044	msedge.exe	92
PID 2044 wrote to memory of 4236	2044	msedge.exe	92
PID 2044 wrote to memory of 960	2044	msedge.exe	91
PID 2044 wrote to memory of 960	2044	msedge.exe	91
PID 2044 wrote to memory of 960	2044	msedge.exe	91
PID 2044 wrote to memory of 556	2044	msedge.exe	100
PID 2044 wrote to memory of 556	2044	msedge.exe	100
PID 2044 wrote to memory of 892	2044	msedge.exe	101
PID 2044 wrote to memory of 892	2044	msedge.exe	101
PID 2044 wrote to memory of 3784	2044	msedge.exe	104
PID 2044 wrote to memory of 3948	2044	msedge.exe	111
PID 2044 wrote to memory of 4924	2044	msedge.exe	112
PID 2044 wrote to memory of 4840	2044	msedge.exe	113
PID 2044 wrote to memory of 4612	2044	msedge.exe	121
PID 2044 wrote to memory of 4612	2044	msedge.exe	121
PID 2044 wrote to memory of 2088	2044	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-7z1zkg.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffdf87bc188,0x7ffdf87bc194,0x7ffdf87bc1a0
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,5590776728379447045,9022873664381595333,262144 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,3177879696517413925,5982919260567140442,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,3168116904990425647,9657672287096137075,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,5016041873315151979,1756078444845434686,2097152 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,1679120256441685755,6017465286471099271,2097152 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,8483217484236051531,3022385861308096953,2097152 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,10807161751041529807,15155910867670264345,2097152 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12488996084310613022,7108715866021162302,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,2238170729420829305,283467844519896064,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,11670769100028874879,13211407866272462626,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,11670769100028874879,13211407866272462626,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18317005912064764097,2831820902994823038,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,3795933775071885503,12231907370528365945,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,6094459735687652875,12431669408896120582,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,12414464414192046349,6623293069828046901,524288 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,8485029772202535985,6408336139714769822,262144 --field-trial-handle=2316,i,17015550942276376037,9409335597387982040,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08e1fa42-7de8-4ec5-aef0-f615687702b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08e1fa42-7de8-4ec5-aef0-f615687702b3.tmp
Size 18KB
SHA256 4ca478f6e24ed01c4987e090b37bbdb98a161b2d967e9d75e0112b5a5dc41138
MD5 5ba288e8cabb27cdce0ba8ab3219f3aa
SHA1 bb85d9fec39b8683bb044291e13f47d817836904
SHA512 117c04464f8f80030741998852d09a2d50bd1b1542349ea5e2bbac02dcaba662430f7a8118350701fcb649eb5f5daa7f9c81e06024c47eaf5706374ee89c6261
SSDEEP 384:jZcIhsNuU6meif/h6QX5+DtbOt1AzmJrsPrtgOIwZOyhoooh:7hpmeMhJkDlOkzmhsPrXsfoq
TLSH
T1CA828E329DB49D7B1DFBA185F18632139FB85167E2C4ABC4D5ED6B1C01DA6A8130EC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a22bd33-291c-4b3b-9475-24263159dfe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a22bd33-291c-4b3b-9475-24263159dfe2.tmp
Size 21KB
SHA256 551de83fe8c5fe562ec41a187034971966678e12e081f24aa37f5f267b555c3e
MD5 b7e520501331ee8d09d1bd3602dee175
SHA1 e5871adcdfdd5b8d652cebdc28be52a92f420ab1
SHA512 172cd3fa1c50a5e15010b3b2f52eef111638144c671d12bc6d6256e4dde374e25d0f53b02910c9992f0006da601bde06d73ba3cf0c06256e6024c309a91672fc
SSDEEP 384:bBiFiZcIbzsN+8TUNTUlIlh6meif/h6QX5+DtbOt1AzmJruPrtgOIwZOyhoooh:boFQP3wgqmeMhJkDlOkzmhuPrXsfoq
TLSH
T1C1A27D339DA4CD7B6EFB9A85F58A32138FB440A7D5C5EA90E2DC6E1C019A1EC130AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63866fc4-7183-488f-8d81-75076ce25579.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63866fc4-7183-488f-8d81-75076ce25579.tmp
Size 8KB
SHA256 15e9c1846f95b473290eb812bbcd77156a613a1e319693271494195888147e4a
MD5 f01a6f83cf77d5ba8f76e6e37517e807
SHA1 62c2961387e46ccf29f2cd0688db310fd45a8db8
SHA512 1864d90f846ce96128c9fe57259a4e4676812deadf1f2d6419e6d5ce8de26b9f0795cfed7f82ad8a588b9fb83604c2ee392904729ba35033a0a27b06f66ec1d1
SSDEEP 192:EON36nnHAQmiUyZcgmYcX5hQDP1bOt1ATXhhSJrag30q5rU6:EON36ng8TmNX5+DtbOt1AzmJrlPrU6
TLSH
T170121A31B9A4AC775EE26981F08732139EE55267E5887FC0D5DC2E2C01DE6AC230EC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d991d8d-c486-4d18-958e-df07c8e45997.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d991d8d-c486-4d18-958e-df07c8e45997.tmp
Size 18KB
SHA256 4a61c0911f1c126aedc454428edfe3b11639da5d52e7ff69e0659ceced24f5d4
MD5 2b3b92ba6c02d456de79732cb07d12b2
SHA1 d60bd1b2675d6dd497d5ff0c49873e016b46cb20
SHA512 144d2d4829fbab83993220eed51e88b6cbeabd497e1bc8df861010d315d42afea54574328837467d31fbb0e93157971a1d94079ecd5e788e55b4fc8021590011
SSDEEP 384:pZcIhsNuh6meif/h6QX5+DtbOt1AzmJrsPrtgOIwZOyhoooh:hhimeMhJkDlOkzmhsPrXsfoq
TLSH
T14F828E325DB49D7B1DEBA185F18632139FB45067E2C4AF84D5ED6B1C01DA6A8130ED12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

00d9e126-8747-44a8-86d1-74f37eb52ce3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00d9e126-8747-44a8-86d1-74f37eb52ce3.tmp
Size 10KB
SHA256 fe0fd6585cdbd64576a647493fa434273667714e973311346fe754adff2011c1
MD5 ff2212eee2a0143975d74197e9639557
SHA1 70c0251c3096a988dbe288e087a01a0c1e403173
SHA512 39b612dbe3c5bb78a7b456403afb25ec6a72d5fdf0a318d8e150f1238a48c022048c76cf9b757fd258de7b30b2e7fab832a951fb5023e2a9c4575ecc6e398a27
SSDEEP 192:sxZCRDWb/fIsxbYIdpdGHW6+WNGYYBv2EIg5MJ:sxZCwb/fIstp4HbGfLy
TLSH
T16C22A7126E28657B8CCBE209BB55BF53E6F9503261D01E58AAFCC61C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04841df2-78be-41f6-a832-8bb9f1492667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04841df2-78be-41f6-a832-8bb9f1492667.tmp
Size 9KB
SHA256 ec168ac0f3b52dd42275c82910d8afe0b2f1a72672bfe0eaa7a28a3643d4e4ee
MD5 ed4d12ca81478f034127bc4552ee6284
SHA1 d5cfd51b9881f89ffaa85bc6f28794293c2c2229
SHA512 055c8dcea717120ab995dc54d3d2967db2521e14112552558d12792a28aede7d0a6bf8cd78137fd3df81a7f3b1eabaa907cd643d2f83637f5a316841588ab45e
SSDEEP 192:sxZCRDWb/fIsxCYIdpdGHW6+WNGYYBa2EIg5mJ:sxZCwb/fIswp4HbGfgI
TLSH
T10222A6126E38B57B8CCBE209BB55BF53D6F9503261D01E58AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3aac3f85-6dd0-4173-b932-3bb38ac1a8d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3aac3f85-6dd0-4173-b932-3bb38ac1a8d2.tmp
Size 9KB
SHA256 43706eacd19cf39bb94d57a8c7832b276a38f62253d66945d5d3bcbcdc4a99d7
MD5 3e5ef8f8db760201b3003f98b12e7793
SHA1 5110ab04167f3ebcd46f3fdaeffa40c8f4105d4e
SHA512 4152940d417511179f943069abb740b2be2a759b3af337097aef74e305558ef7ccdba303378bbaea8f76c84d18466af9e5c20d3cb309d73c9d8846eacd693e5a
SSDEEP 192:sxZCRDWb/fIsbCYIdpdGHW6+WNGYYBa2EIgrJ:sxZCwb/fIsGp4HbGfg9
TLSH
T17512A6116E28A57B8CCBE209BB55BF53D6F9503261941E58EAFCD61C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8000697d-4358-4919-87e6-cf6bffdfb3dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8000697d-4358-4919-87e6-cf6bffdfb3dc.tmp
Size 27KB
SHA256 cec158a7944de97d74bbea8927891e69c09419e97130e2a5dfe62a402ae4320e
MD5 c29c18a3682aa1f2b0682f0ef025aed8
SHA1 b3734204a9bd5b767cf6d3ae0acae6b7419870e6
SHA512 762f07a788c0f8ccec3a61fbafbec53301be29c190cf3f9b3f921a27141fce3ade869636491618d2089612e3b007f50624a792b0d7643f25edbe30047f01ba20
SSDEEP 768:/gyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXsropoVC:/gyYR7jWv3NpBu1ja/CL8OX3b
TLSH
T151C2E93B640DCB7E4FC01E9DDC5A6F9B2E9802C796548D4047FA984C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f70813-fcf6-48e1-a425-e9fb4fd9cbf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95f70813-fcf6-48e1-a425-e9fb4fd9cbf4.tmp
Size 10KB
SHA256 ef0d2f8e4f740a32f48dad17a408e5080a595a13dec5127d1cb2a4621fbaac87
MD5 2eb7696d4f8303808b950e56ccb03bd2
SHA1 5df2d9326cb0350aed3b92350365c42c05753c6e
SHA512 1010bedda6329b2a09ac44dd501573ccd1f0137963236cbc7b759795a6cc033a41b786cc3daceb7733c77f7c455c6a3243cb30e813b173949f8857d9854d30e0
SSDEEP 192:sxZCRDWb/fIsxbYIdpHGHW6+WNGYYB/2EIg5MJ:sxZCwb/fIstpmHbGf7y
TLSH
T1FB22A7526E28657B8CCBE20DBB55BF53E6F9503261901E48AAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0ba23d2a671184178288b57ac5de888523be1f098de440986e104d96487121ce
MD5 dc5875b975854180efe9d7c90fc58f9a
SHA1 ba2ba61ce9ec9fa7f106820384e833285e12b5db
SHA512 62684bcc68a360b728bab50c005b2ea7fc1c6c0a5188fbf15e4ee3ea60a2a058c7f8655f1eb0382d194a61e57f4a6df775a09d95ccf7d23537c214e15629d6b6
TLSH
T1E1618280177382DDFF54A6B551C553DB3232B789899BEC4215B4DB7AF80A79CB051D0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9a4de583119f14442f117de7a1667e834002a7ec277a1d6c1edb1fdaeaf90e56
MD5 443f68f33054374d80943082096dc53e
SHA1 1519d5425925431611432bd5100ccb4fe1fe6e1a
SHA512 5b814f9789760051f542dbec8fc020b7d3f7407a2c894ea5c2ff2babe2c050a508f59b617f053cd62a8f58b4072bc58f3e09384bc4151b1c27e4803f9d503737
TLSH
T13A617180177382DDFF54A6B696C553DB3232B789899BEC4215B4CB7AF80A79CB051D0C
MD5 SHA1 SHA512 TLSH

Submit Download

7bf3f868-841f-4699-9944-201df5a0057a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7bf3f868-841f-4699-9944-201df5a0057a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4b2687bb-d868-4b43-8d0f-5c25217473e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b2687bb-d868-4b43-8d0f-5c25217473e1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e8a163f2-2aa1-4cf4-a194-0479a5eab0d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8a163f2-2aa1-4cf4-a194-0479a5eab0d3.tmp
Size 949B
SHA256 66108fd6e843de31822edef447dd4f882c05b38a63188aa6342e0e4d41aacee9
MD5 4150d833609bf4918d751409196db6bb
SHA1 f1f5a7db1b265da80fbec687dbb6f9999167302b
SHA512 f35849f26208bd70852569a3ebe9899a2058c4c628a9bb86eaf1c69c4eb395fb656cf364865df1791d35db9e501a8103e8948b8e98ea73272bde8431eb95ad70
TLSH
T1B2117DB3C3D595AE8D0556F05A24EE1BCE2D0505421C7C1989D4EF2797E3476E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

ecc4eccc-7aac-4b99-9fe5-4cec44ede270.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecc4eccc-7aac-4b99-9fe5-4cec44ede270.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a8708192-19e0-4ae6-ae45-48fa8f18f5e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8708192-19e0-4ae6-ae45-48fa8f18f5e0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 854B
SHA256 82f5c1b66600c705d8b4a3e0886e567769245ce4eb9ed331204784d1004c78f4
MD5 7e71a814034a024cbb595736240ad0d2
SHA1 b7db640f6c9879171abec9a437be59fc570942ef
SHA512 268ae8c7b8041cd303b3c3a661f60c3afbac039bdc8787b6ca825b0a3f5b97214f9a05d4df6596ddbab6a12210c51d9757f18e2c65f1687e6a1e2b8903ed1f13
TLSH
T18A010384B686D1F55E4AB681820F540353F13DB5131D99B9231DC5F44F8CC198ABF995
MD5 SHA1 SHA512 TLSH

Submit Download

d01c9f23-4ec2-43e8-85b5-112967edd6c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d01c9f23-4ec2-43e8-85b5-112967edd6c1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0306538966aa15576b9eb3c3bb3b27b355d42476efca8f65c5924c369aecdc3
MD5 c1a720f4f923982084bace821de622a7
SHA1 3fb2ba97635fd26bc2d62af13d6763514451707d
SHA512 5f8d05b763856393dd123e8e63057fdfcc4d5883bcc374caa33568dc38ea33ec0b9312c843e5d4b9bf6997ac25d55539c0e2d9e3d0a3dbc989b62d327bdab90c
SSDEEP 192:EONp6nnHGQmiUylgQYcX5hQDP1bOt1ATcMcnFU6:EONp6nCtQNX5+DtbOt1A0FU6
TLSH
T1ED02FB34BDB86C778EF3AD46B48737175FA5217BE5946BC4D6D81E1C00DB69C230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c027b07b-14b0-44d1-a109-824132f60a94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c027b07b-14b0-44d1-a109-824132f60a94.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f54a7c052f13b2f00417fc19d43992f2be7a11b177584421a7bd5707d2c17b65
MD5 c44e14e4b29eb3fc4c03535db321e049
SHA1 37d85b110f0f9fd90218fc3dd4ad79ee619fb7ff
SHA512 7cb91b70978523bcdca3763c4f6afcb48ec938229cf97eab2f13a142ee77e4c285ca57368996989dc5cd7dab89154839abd3d087cf1dec3b2218fa6c81354b30
TLSH
T17041275CA6ED1148B3B7AF5AABF6A86D447B7C773F46809E00100D4E0A26B40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download