5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-psbykq.htm
Size 1KB
Sample261002-wfrmeatble
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{04B9AC6A-C4F5-4141-855C-4BFC528EF5AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1792	4568	msedge.exe	86
PID 4568 wrote to memory of 5064	4568	msedge.exe	88
PID 4568 wrote to memory of 4552	4568	msedge.exe	90
PID 4568 wrote to memory of 5032	4568	msedge.exe	89
PID 4568 wrote to memory of 4552	4568	msedge.exe	90
PID 4568 wrote to memory of 4552	4568	msedge.exe	90
PID 4568 wrote to memory of 5032	4568	msedge.exe	89
PID 4568 wrote to memory of 1992	4568	msedge.exe	91
PID 4568 wrote to memory of 1992	4568	msedge.exe	91
PID 4568 wrote to memory of 3724	4568	msedge.exe	92
PID 4568 wrote to memory of 1992	4568	msedge.exe	91
PID 4568 wrote to memory of 3724	4568	msedge.exe	92
PID 4568 wrote to memory of 3724	4568	msedge.exe	92
PID 4568 wrote to memory of 3272	4568	msedge.exe	93
PID 4568 wrote to memory of 3272	4568	msedge.exe	93
PID 4568 wrote to memory of 3272	4568	msedge.exe	93
PID 4568 wrote to memory of 4968	4568	msedge.exe	94
PID 4568 wrote to memory of 4968	4568	msedge.exe	94
PID 4568 wrote to memory of 4968	4568	msedge.exe	94
PID 4568 wrote to memory of 2136	4568	msedge.exe	104
PID 4568 wrote to memory of 4652	4568	msedge.exe	105
PID 4568 wrote to memory of 2136	4568	msedge.exe	104
PID 4568 wrote to memory of 4652	4568	msedge.exe	105
PID 4568 wrote to memory of 3132	4568	msedge.exe	107
PID 4568 wrote to memory of 932	4568	msedge.exe	120
PID 4568 wrote to memory of 2384	4568	msedge.exe	121
PID 4568 wrote to memory of 2096	4568	msedge.exe	122
PID 4568 wrote to memory of 1576	4568	msedge.exe	125
PID 4568 wrote to memory of 1576	4568	msedge.exe	125
PID 4568 wrote to memory of 2628	4568	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-psbykq.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaacdec188,0x7ffaacdec194,0x7ffaacdec1a0
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,6184797825950407790,4245666311516074814,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,3534531180517182287,3340502573518412296,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7375832142728383230,5899325015364514268,262144 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13896153249284654095,9093766131846060716,2097152 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,8759565451907415989,15794770343149480192,2097152 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17847468953195893892,15396855895125228718,2097152 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1146942694772250524,4231497495743137504,2097152 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12084351374130409844,11645898929848284299,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8960265422106776293,10919100973815053994,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11177340342626907206,9563490729800080609,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11177340342626907206,9563490729800080609,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,2192271469274307615,14023195336216678575,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11170560221074983899,5572936769448172641,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,15430070288909277821,8474137607690664109,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,370765423025346585,18012551544228583216,524288 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,9029726865508922889,6210898571299315484,262144 --field-trial-handle=2612,i,13244505507782170903,8774814724167366929,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44b32099-78d8-4514-abfc-d5ccce080b5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44b32099-78d8-4514-abfc-d5ccce080b5a.tmp
Size 21KB
SHA256 bd7dd69adf6022d616d9440232b1c8cd8d034171551cc0f743d678832452ee84
MD5 ea749e6746811ce465a1a7d895c67346
SHA1 c5fce10eb0d06ec163a20f9175f8dfb2cf8e1a71
SHA512 21872c177ce3a2733c3a498b576a8bb64dab256c85154b41c90ad5effc8079a83dd36181b11fb7c942cdbf2602847c09ac2e1efe11e2a3516597193c6504b20b
SSDEEP 384:MfiFiZcIezsNg8TUNTUlIlyJ2wDJjpunLY9iX5F71sFq7R6tgOIwZOyVLooI:LFQ+JwgS+ca826XsOET
TLSH
T1E7A27C339CA88D7FADFB9A44F54A32039EB45177C6D5EA90E6DD6B1D01A70C8130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bc41d32-46f9-493b-87f2-9bafb0d2e2ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4bc41d32-46f9-493b-87f2-9bafb0d2e2ce.tmp
Size 8KB
SHA256 c6aa637e9b630a2e3a215cebbbf5ebaf4e06d583716e3b2837854c99d542501d
MD5 ae4b1eed244575757dc153202f83eb16
SHA1 086f9a820b5d8b22a27f9c2aa9b9713935f8b28b
SHA512 bd2ffb3dc51735b3ec437df20315697491fce9f0c60bcbf90a5fd5fc5b5ff6ae33f97c17e24c853989488e8331d13d930c2c3c434173f26de363a44672760435
SSDEEP 192:LONp6AmwpmQmiUyZ4osiX5F7wksFqwKPeflRTqxU6:LONp6ipCPosiX5F71sFq7i6U6
TLSH
T1CB123B36B8786C7F5DD3A594F04735139EA55227EB887F84D9EC2B2C02EB59C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6352ad77-2852-4a06-b414-d35077531825.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6352ad77-2852-4a06-b414-d35077531825.tmp
Size 18KB
SHA256 c2a92668086cff7295f88684c15a7882e1bb88b6b22bb40278f9982c902e1776
MD5 cb866bd3f1112bc90f87b75d2e1eef91
SHA1 405280dce60f866ffcfdfb77d13465a436e86585
SHA512 c2e79c0bfe560151efaecf4d9e6247e569013afccccb6f4f3cda6d42e8fb9952baac6ea607f7bed9b7ce70e5a2e73a22b173c1ef40d6d0d4d7298121f6c0f8e7
SSDEEP 384:eZcIhsNgyJ2wDJjpunLY9iX5F71sFq7m6tgOIwZOyVLooI:chc+ca8v6XsOET
TLSH
T1CF828D32ACBC9C7B6CEBA144F14A36035EB8913BD7D8AF40D9ED672D05E6198130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

2beddcde-abaf-4707-9354-09eb9aa37e51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2beddcde-abaf-4707-9354-09eb9aa37e51.tmp
Size 9KB
SHA256 d26652cd87d01a3777b7b4e1814424c1cb22634d28e29c9ad97aa0b162bd2803
MD5 4c9752310db2f44e82a4c993af606ee5
SHA1 6f628d56b21b011065e0e7e4706d47da097c9fd3
SHA512 6fb4756ce33580f9abd0eec1f9a3ec6187d4178c7e6ffbd212eca221b1f1bb449c5027eb6239a1a9e11017aa60f43b26e0f62b8251ba0bfba930a647287cecb7
SSDEEP 192:sxZIR+vW0Z/foscBEqIdpdkHW6+WNGY3RLJIg5kJ:sxZIP0Z/fosqEjuHbGM+
TLSH
T15922B8126E28657B8CCBE20DFB15BF93E6F9503251941E48AAFC961C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b1e91e0-dc55-4957-86d8-b48ac111c3a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b1e91e0-dc55-4957-86d8-b48ac111c3a4.tmp
Size 9KB
SHA256 7a779248d10be150b7b57289d1e2120900c9a4738416e7ad6c7dd1991716058d
MD5 2b7946514746a763d76d0a5e57e7037a
SHA1 4849cc0c3f360f8b8b96075768956dd0c4ac6190
SHA512 789721c7f76af60c274cf8556e6007e95c88e668f208f3d454b9a9e486d68aafbc6791e25d9deb8a8154d65e6a78a9117f9cce1f31f7dfcf37eac709d785e8d1
SSDEEP 192:sxZIR+vW0Z/fosjBEqIdpdkHW6+WNGY3RLJIgrJ:sxZIP0Z/fos9EjuHbGM9
TLSH
T17F12B7126E28A57B8CCBE20DBB15BF53E6F9503251941E48AAFCD61C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a3156f2-f957-47c3-bbed-94e3b0978fa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a3156f2-f957-47c3-bbed-94e3b0978fa1.tmp
Size 10KB
SHA256 d131973612649de20a79e8943ffa22bc33b6e40c64329c6dd159c6c74b0441e9
MD5 854bbbd820bdcfd5a42e1a1b91f4b8e0
SHA1 ae48bb90c697814d00cf7ceddc1b686b27c6642c
SHA512 2653b540d68933137a0e121bffdb78b51fba43b9cc055fdda6f17b8a5056c09a0e38311eef6586bce8a54fe899daebb66a458d7db108b94b49d4a68154513b7e
SSDEEP 192:sxZIR+vW0Z/foscaEqIdpHkHW6+WNGY3+OLJIg5GJ:sxZIP0Z/foslEjEHbGpis
TLSH
T1CA22B7126E28697B8CCBE20DFB15BF93E6F9503251941E48AAFCD61C05E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f97ea40-4287-457d-937e-4d35b49c5511.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f97ea40-4287-457d-937e-4d35b49c5511.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5842f70509d4f996f61fcd122565bd5f60807f96248726b658b9f72d54e2653e
MD5 0d4d725b2a0436c2d9f0c5a1567876cc
SHA1 12d7734a2ca3d3845c6f2987b5bf0418a085d428
SHA512 72ff3370cbfc2fa63f2541b04a473187faba7f3cb8d45c1ed1e3ec9fe81c89dcd097cd125b3dbcb58789564e3f9b81556148c1aca1503903c3bd14c0a011c141
TLSH
T10F614F8F46D9C867FBF896B296F5938236F8A6825B431DC131E4D879D82EB53F149200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 efe3ded111b5927f5e563d933ca98d29230152f1c170f50a47ba333687681add
MD5 f380b8715cc9aea29ea9f46ba459dc2c
SHA1 280775e9521173f27de0b9d0ab68a1d14a643382
SHA512 a1ca43eb41e95f06dd4f2e2dfda4ffc34ea74f668199c8815f7f8c3507873ffb759aca42e37293610c28fd7e61f883900a3beacd5822c6a5612eec225fe950ee
TLSH
T15261418F56D8C867FBF895B296F5938336F8A6815B431DC130E4D879D82EB53F149200
MD5 SHA1 SHA512 TLSH

Submit Download

f0a0a4f0-7e57-4db1-9b83-760ceb6a7eb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f0a0a4f0-7e57-4db1-9b83-760ceb6a7eb0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

17f6622d-ceaa-4410-bddb-c7100ba77d16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17f6622d-ceaa-4410-bddb-c7100ba77d16.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

52a54a4e-ed38-402e-adf3-e5b1fef3c584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\52a54a4e-ed38-402e-adf3-e5b1fef3c584.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ef569d47-ba64-45d2-b8d8-073ec4594214.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ef569d47-ba64-45d2-b8d8-073ec4594214.tmp
Size 733B
SHA256 f8fcd5440ad79c5708827f1615e4eaf4da1c0d67b9dfd70ac98dfadfa98f6070
MD5 9b75838a94799041f58eb6ee22d902f1
SHA1 e250d0a6f5f2c71125e6ce21ecf2aee8091e2024
SHA512 2d1f2f053c2d221b8399c3bfa486ff84605248a734bf26a6d8e1b143fe22a178fd1660fafcdd475f4425bf3f19bddf1aadd7e9e0f5e74599895c9c7ecc8adb00
TLSH
T165019CF3C3E495AE8A4152F06A18AE1BCE6D0606831C7C5AC5D4EE2B93F3475D10189B
MD5 SHA1 SHA512 TLSH

Submit Download

d82d9fc6-510f-4932-8490-f9fc40c94541.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d82d9fc6-510f-4932-8490-f9fc40c94541.tmp
Size 27KB
SHA256 fec93b87f5f236f190739d496137f851a63cf6766fff38e1249bf14611ad1d0d
MD5 976286f8dcdfc74c0d2b99ebeac9853e
SHA1 7a955412dd2af0fba51eeb2bb95d8b96d63c2767
SHA512 10297d29b6bedc2355f80fa98b574f9a6ca623bfd5b2cb556e52585e3fe59c9ea1673f90d97ee4f8e32f5e8c9247ceaca7625c665a3b812999a80d87e6d524ec
SSDEEP 768:QU30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72vrolZMk:QU30AbSWvS2l9u1jaLmLZ128D
TLSH
T130C2EB3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796549D4047FA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecfc4411-ed7d-4697-885b-d83b452fc4e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecfc4411-ed7d-4697-885b-d83b452fc4e3.tmp
Size 10KB
SHA256 533daeca93e49195f62ef627e1d8ff5ec7c2e1cca7c08187657ecd8658b0a945
MD5 a11922575d7d763bc6b20f4b3f04db2d
SHA1 9c7823743924e6245e9e086badeadc53c4178b86
SHA512 21fabcf3050d1fa2f5247437e70811412150e57ce81ac68f65a2f6519dfab8120eff6c9ed31d0813c4e95db52e974e446abc739d04ff974b341550c4108fa680
SSDEEP 192:sxZIR+vW0Z/foscaEqIdpdkHW6+WNGY3xxLJIg5GJ:sxZIP0Z/foslEjuHbGirs
TLSH
T18D22B7126E28697B8CCBE20DBB15BF93E6F9503251951E48AAFCD61C05E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ee2c1464-c7cd-40f7-b30e-c1031e8fc481.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee2c1464-c7cd-40f7-b30e-c1031e8fc481.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a57c544a-34b5-4561-912c-9a0e63acb125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a57c544a-34b5-4561-912c-9a0e63acb125.tmp
Size 8KB
SHA256 d62aa54b6065fe5764ef8e6eda1c8e5000d3fab0948f0e59ddb95b7fe4636990
MD5 430220f55946b389357d574188c17e88
SHA1 9b8d042b3c8987a5427439f83111d64478cd586c
SHA512 676c7e4046dffb59f55cdcc446335d00e57dabcee189836389d819b491f0b76dbbbfb35f277c80531f8ed0c3e69443b6c42ed86839fa3546fd64157bca7d2be8
SSDEEP 192:LON/6AmwprQmiUyM46siX5F7wksF+JiopU6:LON/6ipdw6siX5F71sFrIU6
TLSH
T1DF02FA35BD686C7B8DF2AE45F14B37135FA5112BEA902F84C9E81B2C01D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0a539db-81c5-4b6b-add6-304b0b6a56c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0a539db-81c5-4b6b-add6-304b0b6a56c7.tmp
Size 18KB
SHA256 2a18f13b277143c02d0b1b028d468166ffdb44d533dd14c18a8339d6460c195d
MD5 3653e28edeed8ac4ee48d52c24fc7c17
SHA1 bca5cdea1c8193309d6dfd83154235acc9f7e513
SHA512 e1eccbdd61164e8f4a0fb1bb5ca513b750d0d9ab8db858b8cca76df7407478782f69b2e0f488ae336e7e0296460d0820396e71e562acb8e4de0a002a52dd1198
SSDEEP 384:4ZcIhsNg7J2wDJjpunLY9iX5F71sFq7m6tgOIwZOyVLooI:Gh3+ca8v6XsOET
TLSH
T1E7828C32ACBC9C7A6CE7A140F14A32035EB8916BD7D8AF80D9ED672D05E6198130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82cad333-e276-47b2-a292-c29c00fdfafb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82cad333-e276-47b2-a292-c29c00fdfafb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69262f3431e4393fedbd1c729f1ff913a68bad04e2ec57d77fe2cb9241e07754
MD5 e3fcb5d14774cc9b79c2c85f5d97699e
SHA1 eaa6fba6bfc50b9b22e95f4fdf8726875bce6b02
SHA512 03554f02b1abc68b511e317eb600f03582c52bf21cfafd7dc221aa30641987a45583482f9e6f03033d161a6fb00ecc612f9daf6128d67ee5e473ed71e0637912
TLSH
T189411A58AAE91148F3B36E569BF6A46E443E79772E17C96D00110D4F0A63B40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download