57155de56b2bc5166ce4e5ff8c662ab0e4ba7413380430b645ab89f782bc071d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/index.html
Size 28KB
Sample261013-2hlf3acv21
SHA256 57155de56b2bc5166ce4e5ff8c662ab0e4ba7413380430b645ab89f782bc071d
MD5 a3e8ff633bbfd29d97d525108392f030
SHA1 f48b2acc9ed821bfd390186f284206de0da20737
SHA512 fb649c872c172bd8d4fe49257d77d526404304e8414b94be5759fd84e5bffaac04184e50a22ef0453e51f2e852fc36c139cda86f07056237278a31aa6b20b35f
SSDEEP 384:vNqP9FBykznWRJ/seq06INLglby/xSL1LaAT1vnErLxN0vsu5SwU:GnWX/seq06INLglby/xS5La05nH0u0wU
TLSH
T136D2B811CA36102DB277462E75E2BA5D3024C127E5638A7EFA5D9674CBCB18B1F13B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{52195A3B-244C-452C-80C0-622ABE84429D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 788	2516	msedge.exe	87
PID 2516 wrote to memory of 4776	2516	msedge.exe	89
PID 2516 wrote to memory of 1484	2516	msedge.exe	90
PID 2516 wrote to memory of 1484	2516	msedge.exe	90
PID 2516 wrote to memory of 1484	2516	msedge.exe	90
PID 2516 wrote to memory of 1324	2516	msedge.exe	91
PID 2516 wrote to memory of 1324	2516	msedge.exe	91
PID 2516 wrote to memory of 4536	2516	msedge.exe	93
PID 2516 wrote to memory of 4800	2516	msedge.exe	94
PID 2516 wrote to memory of 4536	2516	msedge.exe	93
PID 2516 wrote to memory of 4536	2516	msedge.exe	93
PID 2516 wrote to memory of 4800	2516	msedge.exe	94
PID 2516 wrote to memory of 4800	2516	msedge.exe	94
PID 2516 wrote to memory of 2712	2516	msedge.exe	95
PID 2516 wrote to memory of 2272	2516	msedge.exe	96
PID 2516 wrote to memory of 2712	2516	msedge.exe	95
PID 2516 wrote to memory of 2712	2516	msedge.exe	95
PID 2516 wrote to memory of 2272	2516	msedge.exe	96
PID 2516 wrote to memory of 2272	2516	msedge.exe	96
PID 2516 wrote to memory of 2588	2516	msedge.exe	102
PID 2516 wrote to memory of 1128	2516	msedge.exe	103
PID 2516 wrote to memory of 2588	2516	msedge.exe	102
PID 2516 wrote to memory of 1128	2516	msedge.exe	103
PID 2516 wrote to memory of 2256	2516	msedge.exe	106
PID 2516 wrote to memory of 4612	2516	msedge.exe	112
PID 2516 wrote to memory of 4520	2516	msedge.exe	113
PID 2516 wrote to memory of 3164	2516	msedge.exe	114
PID 2516 wrote to memory of 1700	2516	msedge.exe	123
PID 2516 wrote to memory of 1700	2516	msedge.exe	123
PID 2516 wrote to memory of 2272	2516	msedge.exe	124
PID 2516 wrote to memory of 2272	2516	msedge.exe	124
PID 2516 wrote to memory of 3876	2516	msedge.exe	127
PID 2516 wrote to memory of 3876	2516	msedge.exe	127
PID 2516 wrote to memory of 1180	2516	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd6883c188,0x7ffd6883c194,0x7ffd6883c1a0
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1707802813219011557,14729789301792728570,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,128595709585732650,10818783471308739304,262144 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,4552938324148798470,14672079949998681209,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9410402608279213033,17396834908215214844,2097152 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7874193924335220596,14887850116875285559,2097152 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8496295675507307017,3970297735492723526,2097152 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,13562338523449592901,7902259402228962411,2097152 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7884637666802661906,12901948806307345959,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,15695641970952718598,18101558179204694010,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11602419648501220613,8871471183453208447,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11602419648501220613,8871471183453208447,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1077028663745561919,16061253928718093176,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,18292107284072974358,7508582983809133562,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,6252230040253194924,11130640924443349081,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,8125098262874724797,10600266081971638543,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5808934073955070483,3055479117868977215,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,8273116545859722135,17128961556058956037,524288 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5168,i,11318239997583548018,17769949222780567307,262144 --field-trial-handle=2228,i,566952288608998241,5155334597816730935,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

112c8992-c998-454e-8624-f93969b91080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\112c8992-c998-454e-8624-f93969b91080.tmp
Size 18KB
SHA256 72a5210b47a106747687ec17dfc9526f74a8bd087c13bd0d7cf6a5c740f4eb18
MD5 f224808fe9e904aec3a622ec49ef0650
SHA1 d4615076ccbb5bbf5cfbde1c6d70802cc1673597
SHA512 3f56e75b8723abdeb34441325879d3795b89d0e55ad15b15b10bf2f9476744fb924fe29470325a9f0d991e229ad4459588945e68bd607ea071e9aaa1c4852a91
SSDEEP 384:IZcIhsNXULL5CpuO8YaCj9iX5FCtgDMTK:2hj5CJHhaPDMTK
TLSH
T1DF829D76AC74AC3749E3A514F54B36138FB89137E7D41F84E5ECA72C02DA5981307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42e4fa99-e7cd-4379-ab89-7bf11aa41e28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42e4fa99-e7cd-4379-ab89-7bf11aa41e28.tmp
Size 8KB
SHA256 5b02d23c883d2db0761d24582f0717297f947bcb8aee67087e310ca0052bfb17
MD5 a6c0792768ee290f1bbde90fe57cb218
SHA1 10f6da6e507e859dd71df8a5629f843c79ff6be6
SHA512 4b58d27fb022d901d114d1f44011dd72183bfca35a5253ce02440433a05ac9409b816ab2156b3d0d46b164e96e34a96f8fc8fd453875637e095e4804686d5c6b
SSDEEP 96:gqONk0QsjpfuMVwptaL5ih/cIPURHl8h4otop5ciCDMBIPuva6zx8X5FxXxPYvPK:LONg6AmwprQmiUykA6siX5FCYJiu7U6
TLSH
T1BE020A35BD686C7B89F3AE14B54737139FA5117BEA902F84CAE81B2C01D769C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b63c8ef-2d62-43b6-87bd-8a8a4692f230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b63c8ef-2d62-43b6-87bd-8a8a4692f230.tmp
Size 18KB
SHA256 da15188bd189a9264552b69bcdbf36ae656a5d5365c7fbacb8ba45ca7efe9511
MD5 acb99985e3b5ae3b695212c4cfee8f30
SHA1 b8b6b877e705ea5e57f8ab0d6c99b98bb81687e4
SHA512 8ef159c15f3a2f6c6cee0ce63c7e13b01226605b015de036a4e1507f319a7d4b93c40a05ce1f9a1bde3d400d0e3ff4735f914cec203c120f7ca370e2e7b1e551
SSDEEP 384:cZcIhsNXUoL5CpuO8YaCj9iX5FCtgDMTK:KhY5CJHhaPDMTK
TLSH
T16C829D76AC78AC3759E3A514F44B36138FB89137E7D41F88E5ECA72C02DA598130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7220a230-1c9b-4222-b862-99613f82b1ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7220a230-1c9b-4222-b862-99613f82b1ca.tmp
Size 8KB
SHA256 fcb1f589cfe0e6dd06d24a3bd55e6d56b7d08e1ae9f369a0918cf0e1837ae1a6
MD5 9384005f97ede1f7c07362353a0d6f68
SHA1 9071a05e93068c5b7c05efc81db7abca83b21a56
SHA512 8bde612084978be53df69762a38b5b4e8c7c6b9e5b4170d737ec0e4e7831fc254d955e934d382f63908d061bcb7eadac680e84f7fca3e5dd28f352d4e0f70cc2
SSDEEP 192:9ONt6AmwpZQmiUyYPAxsiX5FCt5eHtlRPqYU6:9ONt6ip3fIxsiX5FCtyDU6
TLSH
T19F122B36E8B87C3B4DD3A550F08735139EA55277EB886F84D9EC2B2C06DF598530AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

21136a20-9519-4161-8d0f-baf87dc059c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21136a20-9519-4161-8d0f-baf87dc059c4.tmp
Size 9KB
SHA256 4c463136430a87708ea88eac289f49c95773e08db4e7af470d1b59c635a069dd
MD5 77a5252fd1f16feb6b125aecd7466608
SHA1 5c91d8415781921c7f19ccdaae044c74af102dc9
SHA512 da8ac983aa26b8b98ec5c4bee4f0749c2c26a1ec53b42823b7609ee928d9412648ad1b35303736b6395aac423b0a35025d7e62f38918986dd36cb8ca254c8b8e
SSDEEP 192:sxZ+RhW5/fUsmGIdpd2HW6+WNGY3SxK+LIgrJ:sxZ+m5/fUsmncHbGiA9
TLSH
T13922D852AE28A57B8CCBD21DBB257F53E6FD5032A1D01E48E6FC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

629cc272-74e4-4124-81ff-0101c191e22d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\629cc272-74e4-4124-81ff-0101c191e22d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c68c60ee7d2a42cdd7a5ec176ea22abf851716f08fdcab50c3759d74c5a79c13
MD5 f90778f1a4b00714f3a896e131f27252
SHA1 e9b0ac9bc9e3e5780a559b880f46a5cd00d6e302
SHA512 1cec4b594ceb00d9290bc772fd84203957d4969d56acc292ea9c8fcaca3ea9973471a64fa50228fe73275a20636ebd82b78533d167f13e8bda65d8b4f13dd1c5
TLSH
T16EE07D8414CAE32FB308649743FC478E8BE0361AD3C87E8E3700C5C470C7658B6C6AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9cfdd83451a131b8b6f976bfba9a1cb97cf0f3ee8e99c5fcb37702d0682cd9b7
MD5 c077276f66a84b54177fd08777bcbb81
SHA1 5765c534c8ca0568bfd00d554c7fc059f05aaf11
SHA512 7c3d1ddb7bf5e87236f3e0fd085ddfb75f914ab7be82dfe840707aba66efc75cdc77e519716880cc729b516bf31714c274ccea9dc4222c24986176d486c574e2
TLSH
T1C9E026856DE8E32EB3186467426C438DCB81261BD3C86E8E2700E9CC7106258E282AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 49d3027cb959a48b47da9bbd75bd017b51f98e28baefb02cb8b565e8c1eca69c
MD5 2d519d3a899d267ec7ffd636cfe85555
SHA1 31be4444a7eebb714286693e27e20e0c1a40759e
SHA512 b3fcf692317f21413c4216b5492c12c7b99e48e2f31b8995e5cffb85003d5c2bb04b15cc0ebdd040da83969d2c727ba87c17e35e3412fd1fb9802cb864063fd4
TLSH
T1796181C198A14095FBF744F392E5F08B37F446A38FB32DB19354D978D70E745A21A04A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 20bebcb7c629c326c696f58aabae151fa8ddfb8988ed745ee782762e6b88c079
MD5 83b45fe27eebe95b3875743f4d93ced4
SHA1 9687943b5af17b0b43568a8d2ec4edafbbb1442d
SHA512 1038d0652d4fd618f973b03c48a78b9fe80b626365a751475c3a93036c1100cf6d1f518a803eb0a60f9166440614a9e02cd9a273dab6d98222ccac8123653ec9
TLSH
T1C06181C198A14095FBF744F392E5F08B37F486A38FB32DB19358D978D70E745A21A04A
MD5 SHA1 SHA512 TLSH

Submit Download

a27a8e01-481a-4d9f-ae3d-deeb84aae0ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a27a8e01-481a-4d9f-ae3d-deeb84aae0ae.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9f6cefc4-cfdb-409b-a08b-548c21558162.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f6cefc4-cfdb-409b-a08b-548c21558162.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d0df4320-977b-42f2-9fcd-e244221a98ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0df4320-977b-42f2-9fcd-e244221a98ab.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e4e0ae4c-59b8-4b48-a4dc-069afa5aca31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e4e0ae4c-59b8-4b48-a4dc-069afa5aca31.tmp
Size 1KB
SHA256 f506f16cf1a32382ac5d9205bbe10d4f8b1f5841646ac9bfd7b5d1ecd37c561a
MD5 bf9b3c59ae3f95fe66c9a4b1ce5d7cc5
SHA1 cc1766640721db1c5bfff8ccfda0e200aafdb631
SHA512 065dd651be65bd9138456ad9e5b1af08d8eec291e4d3b441b5a6f25e6883cae211d3b292a847acaee08e8db458c18307dca129f7e688697e6c1b83459c60a2a3
TLSH
T16B21ADF7C3E4866EC91156F05B24AE1BCE2D0616432C7C5689E4AF2BA3F3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

b3c0714b-c8fe-479f-a0a0-2a9f74a52eb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3c0714b-c8fe-479f-a0a0-2a9f74a52eb1.tmp
Size 10KB
SHA256 9e37f1c38a2b29ca3f0e07c3fa10f0b84ea355d63c4ec5a3c3c4aca6e3a7552d
MD5 2ffc3394d1f4d5b2341a347b12323562
SHA1 29cd71b19235fbcbbd72e006732922b2b0ae10f6
SHA512 9fb1328cdbb2f6bf18b158661dbd817e274c61d81521ef06db510fdc95ca9a17e35c9e9cb5f94b78a29de24b9517df5fb03c4704b4ed64ec281bf3d860fab915
SSDEEP 192:sxZ+RhW5/fUsFGIdpH2HW6+WNGY3AeK+LIg5fJ:sxZ+m5/fUsFnWHbGzAP
TLSH
T16922D952AE28697B8CCBE21DBB657F53E6FD503264901E48E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3c4f53-923f-4443-a101-d4664558500c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf3c4f53-923f-4443-a101-d4664558500c.tmp
Size 27KB
SHA256 5d0021470ad9e083eac87acc70cd151decc2b681bd5cf6f226596d4ff29efdfb
MD5 f0e822890eb506237433678e7af6a7b3
SHA1 c81d53747bf9625f37d07408f9005225249cbfaf
SHA512 14834a582735b3df6e86dcdae69221d7dfa8e65520a386a6386ad9c479c5872a5d46730d0e64c1bf493c365550564c85cac0f288456cffd19eaacfbcd7867453
SSDEEP 768:EE30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ726rolZM/:EE30AbSWvS2l9u1jaLmLZ12xk
TLSH
T1DAC2DB3B644CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa781226-7be7-4230-904e-e5e7f95cec12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa781226-7be7-4230-904e-e5e7f95cec12.tmp
Size 9KB
SHA256 3a3de117976020edfc47234133ef505d8326965c096ec270185875f9867e1bc6
MD5 2d757c81acba090c2d41f2e2bdfef1b7
SHA1 7f271a2fd4fec08982ca79e2c1b76dc37b1b31da
SHA512 98100d9e20e87c82a58a60d0648c2f882ba64ffd8c855e18a6d268eb3c9d5e457c7973f3608eee13f51b25c5b5a34e3de82a8980f9e383d13baa149fdbcf188b
SSDEEP 192:sxZ+RhW5/fUsAGIdpd2HW6+WNGY3SxK+LIg51J:sxZ+m5/fUsAncHbGiA5
TLSH
T19822E852AE28A57B8CCBD21DBB65BF53E6FD5032A1D01E48E6FC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe62addf-0047-4a30-9ea6-250e6cc5004a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe62addf-0047-4a30-9ea6-250e6cc5004a.tmp
Size 10KB
SHA256 745d7c81e0f031c6fa8d39ed9d571a0581c294702d5d023c9462ffe71988492d
MD5 979d1c277f73aa5910a14888a336e2e2
SHA1 4f7113c81257df351df299e54a2248ead0cd32f2
SHA512 3a5f645f6de7435b3444e646bf005b10f8d9563e12840b3f23a1ca0076f6de4ae9455c41f5cf657f2739139ff6899ee9be662f612cf57f233f7c1b60b532d0b4
SSDEEP 192:sxZ+RhW5/fUsFGIdpd2HW6+WNGY34hK+LIg5fJ:sxZ+m5/fUsFncHbGUAP
TLSH
T1B822C851AE28A97B8CCBE21DBB657F53E6FD5032A5901E48E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ebcba86b-f020-46be-8bfe-5d4d589e89ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ebcba86b-f020-46be-8bfe-5d4d589e89ab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2409dd4-29c9-421e-9944-f3c25a7512d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2409dd4-29c9-421e-9944-f3c25a7512d9.tmp
Size 21KB
SHA256 16067d5fe19dc74b92903b9c4c1baa2a00a8dca09f52120298be0083c57d9bd8
MD5 c0efb7e8a2959fc986f7cdcb79742af2
SHA1 9334f1238afeeda88c45ac12fb0d452a1d60033d
SHA512 7f80cfc0030b79e4ec7662223c7cc6c60f941b4977aee9d473a0b3ce20ae10f718ba75b3009dbedd30464c4e6600197865e635f0986f989746303878c8558017
SSDEEP 384:4biFiZcIezsNM8TUNTUlIlLL5CpuO8YaCj9iX5FCt3DMTK:42FQ+1wg55CJHhaSDMTK
TLSH
T1A6A28D739CA4A93B9DE79A44F54A32138FF84173DAD4AF94E6DCA71C029B1D81307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e67cc2-d033-4aa1-8b0b-8d02570c6968.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\71e67cc2-d033-4aa1-8b0b-8d02570c6968.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 62c77567567b2c8d0eada7f4e6f8bb5f35f0d7bb3565071a61e6075452649ad1
MD5 d12d83eba10ef31c18f7649988881981
SHA1 953cccef158ea79fc0914701fd8fb5aee89e4add
SHA512 2b2ed38a2ce6779d55c0c573f2b1c2f6947ef01cead09313f92ba94ca41708ee6f7fa03ac327ed16ca4c02837e4db1ac89d276448b665b163b0f051f29df9ae0
TLSH
T11E412768A6FD1148B3737E569BF668AD987FB9332E07945E00110E4F4A23A41CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2256-185-0x0000028C036F0000-0x0000028C03839000-memory.dmp

Download