hxxps://go[.]optimizely[.]com/dc/OTQ3LVJLRS0wNDgAAAGk2cvPnSIap84ciGQJIQVuNAodNrSUFSY-85j6nCTAWu5G3qEqY7x9JEhow9soHEHotflpTQYmCmEVCcWZ-s4lJqvbDh5criSsrdKJTWvahKahsWrxIe443TGZ-4y1A5tCDJmZsaLvWB1twb9AJlM4ECT_iQG-IASNDR02NyeooUBmxfa7QlKna0bhX2UAFTGhOhXk5QCRNtbt3i9xqCqAoThBK16uI82QIOxppHPTxBXE5_TYaG9335z2IYWcEVEe2WuQ2QMyPYaP6-oKu3VilRmVMaoxrMJ7R3N7VtxI_laLYfOKUrWsvF5pKJvaAK5-0gGOe9F_qgbwXM_si9j7Ensb-6KfUcw6/OTQ3LVJLRS0wNDgAAAGk2cvPmkMIFvM2r9PZwrBzUP_Xchco2wbW81P1CWoN4LSNzL7yiXQc4Myc4wsdLtZHEgJCOF0=

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.optimizely.com/dc/OTQ3LVJLRS0wNDgAAAGk2cvPnSIap84ciGQJIQVuNAodNrSUFSY-85j6nCTAWu5G3qEqY7x9JEhow9soHEHotflpTQYmCmEVCcWZ-s4lJqvbDh5criSsrdKJTWvahKahsWrxIe443TGZ-4y1A5tCDJmZsaLvWB1twb9AJlM4ECT_iQG-IASNDR02NyeooUBmxfa7QlKna0bhX2UAFTGhOhXk5QCRNtbt3i9xqCqAoThBK16uI82QIOxppHPTxBXE5_TYaG9335z2IYWcEVEe2WuQ2QMyPYaP6-oKu3VilRmVMaoxrMJ7R3N7VtxI_laLYfOKUrWsvF5pKJvaAK5-0gGOe9F_qgbwXM_si9j7Ensb-6KfUcw6/OTQ3LVJLRS0wNDgAAAGk2cvPmkMIFvM2r9PZwrBzUP_Xchco2wbW81P1CWoN4LSNzL7yiXQc4Myc4wsdLtZHEgJCOF0=
Sample261014-sshcqaxsd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{F2C9E0E6-0F8E-4E6B-9C9E-CBE76BA4798D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 1468	5008	msedge.exe	87
PID 5008 wrote to memory of 1204	5008	msedge.exe	88
PID 5008 wrote to memory of 1568	5008	msedge.exe	89
PID 5008 wrote to memory of 1204	5008	msedge.exe	88
PID 5008 wrote to memory of 1204	5008	msedge.exe	88
PID 5008 wrote to memory of 4572	5008	msedge.exe	90
PID 5008 wrote to memory of 4572	5008	msedge.exe	90
PID 5008 wrote to memory of 1812	5008	msedge.exe	92
PID 5008 wrote to memory of 1812	5008	msedge.exe	92
PID 5008 wrote to memory of 1812	5008	msedge.exe	92
PID 5008 wrote to memory of 4876	5008	msedge.exe	91
PID 5008 wrote to memory of 4876	5008	msedge.exe	91
PID 5008 wrote to memory of 4876	5008	msedge.exe	91
PID 5008 wrote to memory of 1120	5008	msedge.exe	94
PID 5008 wrote to memory of 4000	5008	msedge.exe	95
PID 5008 wrote to memory of 1120	5008	msedge.exe	94
PID 5008 wrote to memory of 1120	5008	msedge.exe	94
PID 5008 wrote to memory of 4000	5008	msedge.exe	95
PID 5008 wrote to memory of 4000	5008	msedge.exe	95
PID 5008 wrote to memory of 2244	5008	msedge.exe	100
PID 5008 wrote to memory of 2244	5008	msedge.exe	100
PID 5008 wrote to memory of 860	5008	msedge.exe	101
PID 5008 wrote to memory of 860	5008	msedge.exe	101
PID 5008 wrote to memory of 3980	5008	msedge.exe	103
PID 5008 wrote to memory of 3044	5008	msedge.exe	112
PID 5008 wrote to memory of 1452	5008	msedge.exe	113
PID 5008 wrote to memory of 2188	5008	msedge.exe	114
PID 5008 wrote to memory of 4872	5008	msedge.exe	116
PID 5008 wrote to memory of 4872	5008	msedge.exe	116
PID 5008 wrote to memory of 1624	5008	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.optimizely.com/dc/OTQ3LVJLRS0wNDgAAAGk2cvPnSIap84ciGQJIQVuNAodNrSUFSY-85j6nCTAWu5G3qEqY7x9JEhow9soHEHotflpTQYmCmEVCcWZ-s4lJqvbDh5criSsrdKJTWvahKahsWrxIe443TGZ-4y1A5tCDJmZsaLvWB1twb9AJlM4ECT_iQG-IASNDR02NyeooUBmxfa7QlKna0bhX2UAFTGhOhXk5QCRNtbt3i9xqCqAoThBK16uI82QIOxppHPTxBXE5_TYaG9335z2IYWcEVEe2WuQ2QMyPYaP6-oKu3VilRmVMaoxrMJ7R3N7VtxI_laLYfOKUrWsvF5pKJvaAK5-0gGOe9F_qgbwXM_si9j7Ensb-6KfUcw6/OTQ3LVJLRS0wNDgAAAGk2cvPmkMIFvM2r9PZwrBzUP_Xchco2wbW81P1CWoN4LSNzL7yiXQc4Myc4wsdLtZHEgJCOF0=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff26b3c188,0x7fff26b3c194,0x7fff26b3c1a0
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,250915505800584152,9460197664142966915,262144 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,2011598247556216877,18383033770264692060,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12889437297327785270,16560909709671903699,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2949128543900766227,13042438880384013212,2097152 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13677318900859069877,6363960892736100350,2097152 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,9374883839616154681,5268670437499047464,2097152 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,4528371192248480906,6462974519743663207,2097152 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,2726132022549832192,17786907169893796900,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,14301018119825139293,5941634266430540969,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11870557363918937641,3857850736298018371,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11870557363918937641,3857850736298018371,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,13077995719745713646,14147161380777936925,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,12614720529162800367,16720738857305810873,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,10086305184221168914,817515781413333984,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6091898562347753176,7546184618301434828,524288 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4296,i,5285783428408129083,17043621263583675770,262144 --field-trial-handle=2892,i,13270352412613498443,6378215927658430658,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d25ca15-1a57-49d8-b8b6-40e43567b81b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d25ca15-1a57-49d8-b8b6-40e43567b81b.tmp
Size 8KB
SHA256 cedd6069801ce12be34dd52f5b5589da3f3a40337f0a46482db2cc18463f5fc0
MD5 b68f06c8a0deed8d6cdde78a4643cb84
SHA1 35ad8bbb94e3132dc8f93e70423f48f7d6d6926f
SHA512 abed67d01e0211c56bf16a23e403fa9fff4f173549252ff7f86ef08e11f65b8d4ca4f348c9c53eb2d4160e84be55bca8e041cb5db0946edf3cdaf98dfdde3434
SSDEEP 192:IHONJ6JUguQmiUydZtJno//p+GqLsNxfq4U6:uONJ6+tC7Ro//p+GqC3U6
TLSH
T18F121935B864EC7B9DA35590F08336239EA44077AF899F94D6DC2B2C02DF1AC5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8131cb1f-e07f-40ef-b832-12dcd2f7bc6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8131cb1f-e07f-40ef-b832-12dcd2f7bc6d.tmp
Size 8KB
SHA256 13f1a8c4e079af681943c8bd7f3aea3815849b7e792bebc3750ec911a76cbb52
MD5 2453c3c31356082f0ad64c0207a5db9f
SHA1 6a9174e12d933eaffa61d417c219cf094d51aa14
SHA512 1b54f2a39b1bd846ac0dc4bc459798c31b5eebdbbea1461df555aa85644fab4acde27c1da617ee8b112c6a5f7167e729f9659ec665276aaf07ed4cbc6dab09e7
SSDEEP 96:KqONkTQsjpfbUmjH5ih/cIPURHl8h4otop5LaDzBKP4v+Y1xf//ojd6x/eYzRtIq:BONb6JUm0QmiUy4tso//p+8BCDOU6
TLSH
T12402D738AC68BCBB8DF3AE45B54777239FA4107BAA955F84DAD81E1C01DB15C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79eddac5-75c4-4d4b-a463-18adcb476afe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\79eddac5-75c4-4d4b-a463-18adcb476afe.tmp
Size 105KB
SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
MD5 cbb9f3725f3320854f02b5fb7d1eee93
SHA1 9c687195aa5a8f617023a505ab65229bb9a04596
SHA512 a8e728ca1dd3f2320d59c0244f1a4c82c5213ac624c22798462d831fa8936055eccd554951d7106079089867cda6e052f87a3bef24aa908224fd8e90caa6ebfc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T13DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

0691a0c3-475b-4553-af46-063150e20fb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0691a0c3-475b-4553-af46-063150e20fb0.tmp
Size 27KB
SHA256 23c5c61eccefa7b953e0aa9f403897afe030f727b4db71f398efc6e0d2e1b5f0
MD5 f076a2199d63dcd7ca82c099cc1d40ce
SHA1 91b5c19905afea28d8ec9d0c0806b1c137760d56
SHA512 f522359d8401ac505f4bf6f8e9b4f62eda3763e4178dee8d9a2b9897856af9445ee4f12f5116dca1f1fd81277f6ab10415d23992ea79911bda61c9a01bbb74d0
SSDEEP 768:LnKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/srobQ:LnKlm7QWvUYe0u1ja8/L/E/3bQ
TLSH
T18EC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41403574-9762-4227-a35f-1effb246663e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41403574-9762-4227-a35f-1effb246663e.tmp
Size 10KB
SHA256 7afd538117d5ff3dd5ac07fe4a08ce1d8ec25992823fd6260d5ea92397414dde
MD5 d28c05fb90814ef40f660d5af567cae4
SHA1 66ce04dd40905285479042f36581eb8b7eb3059e
SHA512 df24f6616fc3dedfadfa503d44518fc84ee62d3a4cecb009c904e0dc31fd89e3f30651bb9edf1b8cfb68f743d4bbcf47dbd932d9a03c236fd5dd046eca4bf46d
SSDEEP 192:sxZVR+Wh/f8svCIdp8EHW6+WNPSr8RIN/Y36pAV+SIg5xRJ:sxZVPh/f8svrhHbze/XSvb
TLSH
T1CE32C752AD346A7BDCCBD219BB65BF13E2F9513265D05E48A6FC8A1C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b266fb2-137b-486f-a22b-912b4d9e876d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b266fb2-137b-486f-a22b-912b4d9e876d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7863305c-e274-4100-91ca-325749b42616.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7863305c-e274-4100-91ca-325749b42616.tmp
Size 11KB
SHA256 912a7faa05a1d6846cd38159935f563717162072227c79b4cb7960d4d93509a0
MD5 bfe542bdc0f803e3af70c09711df74ac
SHA1 7c2d4eba91d6a9a02fdfbf3f7bd7ccf9278bb743
SHA512 fe1c454ded7d6b04e132932b86c4e8b8027843cd16b95661cb22627d729b1f06503cf8bfbc3c292e80a6bc9a7ed69ca12a6f5f049737c7531efa25b1a2deb26d
SSDEEP 192:sxZVR+Wh/f8svCIdpiEHW6+WNPSr8RIN/Y36rj++SIg5xRJ:sxZVPh/f8svrrHbze/Xuvb
TLSH
T15D32C852AD346A7BDCCBD219BA65BF13D2F9513265D05E48A6FC8A1C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 0cc212fcba07b8970b636b6498bc663d90f70eede3940072c095d69cee805d49
MD5 cbfe4a923ec9b4f36e7d58552d3318bd
SHA1 68b9b748c97645c3c4e85d61ab649bb833bcd879
SHA512 313618fa2667c3401f7bbf3914038f8f3e4d84bdeb77a417e716fbc1a7003a76358c988dea3717a73eeedf107a8d7eb00ccc013b455801fd70491e14cecfc306
SSDEEP 48:LjAz51tWnwWk2IIRKZc3UaShdkI/m9EerdrsSm/E4bj1f6ZdySrOnBCyfyeaaK8L:LKNma2hKZdfhmIk9UawIcYU2cXrMY
TLSH
T1049161F0709356DCFF94217793D2498630309A6262570F2230BBF5789987381B8FA46F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e3ed323-596d-4a22-8963-bb5816d376d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6e3ed323-596d-4a22-8963-bb5816d376d7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0660a649-c097-40cb-a468-c8cdf8fc6330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0660a649-c097-40cb-a468-c8cdf8fc6330.tmp
Size 5KB
SHA256 a678f28f2050d6a9d2f1587ccd96b6b83187b62468d0d906f30b32a8b5ff2595
MD5 f0a6eb30a18299ec8bfd906bce953bc2
SHA1 1b269565bd6393a35307e17854abd246957559f7
SHA512 a13376a06f4d609e926f6bb142a21ec5a7ee820e18a81ed446d0556471a747efa488df88395d73176797c4bc4c7ef919182dfce26db78247a3d209121e8ca608
SSDEEP 96:D0E0o0c0I040R0fVzB0GG02030A0M0L0W0t0c040K0l0C+0i2G010n070FwQ:D3Drl5E0V1DGXin5aT0hpPkMUG4cmaT
TLSH
T18CB16BFB83E8D66FC91251F067163E1ACE2D4528536C3C2B85D5DE8697E34A3E14068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b65500f-6706-4485-a8ab-f1f47b336028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b65500f-6706-4485-a8ab-f1f47b336028.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fe54d05a-3c66-42ec-9058-fda9da3cd1ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe54d05a-3c66-42ec-9058-fda9da3cd1ce.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d84938b31fee4b0c4f1e3a5016237771cfd68b406c3fc73d0924a00eba700fee
MD5 206dab902b16c2d82e43849ea285749c
SHA1 4abc0cd18ad563a986599b5ebd580cb495cf1007
SHA512 4ecc0f271a2bb0dcafd4753beb240707ad4508bb0e330606e91781e9b2021808995f79db4d20b3b4a41e63e9fc34144fe12844e0db195190c70c7781ee1aef4f
SSDEEP 48:K08i8t8w8c8i8A8g8xb888L8sIS808xK98418C8xx868hY8j808g8SyLgvmqwaOk:KMkQKxKqG3OKMMD/SKA0uR
TLSH
T11591849031AB06153DFD294843A5A72A424235B77018FA6B7FBC80E25E2EF044EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8073bd8-cfe4-458b-8a37-073bc03d90ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8073bd8-cfe4-458b-8a37-073bc03d90ac.tmp
Size 10KB
SHA256 56e2801b18dccc9d91855ed5969d1725bc7b7c96e8397087b19e954ae31b659c
MD5 95f038fd7b5c783b93a4e8b9ebe80b94
SHA1 8aebc4a8a894714dd365cb043193446b0f98f823
SHA512 dec3bb747d183e9909ac0b30eb8f6aafaf10ef72cc387cef8214ca814a78dff695401bea542f55cfb5bba7e826f067ce598547def76a8cc6eaf927c1da1d0e03
SSDEEP 192:sxZVR+Wh/f8sZCIdp8EHW6+WNPSr8RIN/Y36YSV+SIg5xDJ:sxZVPh/f8sZrhHbze/Xhv1
TLSH
T1A722C852AE346A7BCCCBD219BB65BF13D6F9513265D05E48A6FC8A1C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3b7c98e-6fa7-42d8-aad7-a49584e152f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3b7c98e-6fa7-42d8-aad7-a49584e152f6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4e5cc1b-866c-4a2c-9c93-a7a21c654ec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4e5cc1b-866c-4a2c-9c93-a7a21c654ec5.tmp
Size 10KB
SHA256 fc81c5dc042a358e67fbe1eb430fe86ebbe2227bb327ff96d29aef025b033890
MD5 5f164c0dcf18f5972bc88be059e2e5d4
SHA1 772889fd4ad06862682b8450b6de5d9928a5c9ed
SHA512 6ff48ad62ba788fa1af25a8d0d97910b0ba3ca28d0a78aac670ce7a603366fe41ec1abbedcdb74f6fef8ac401fdcb2443a2991e6f0d14c2a2f08245f31670766
SSDEEP 192:sxZVR+Wh/f8slCIdp8EHW6+WNPSr8/Y36VSV+SIgrJ:sxZVPh/f8slrhHbz/X4v9
TLSH
T13522C852AE34A97BCCC7D219BB65BF13D2F95132A5D05E48AAFC8A1C04E67CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc5b0c34-836b-4bb9-8147-2024b2925062.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dc5b0c34-836b-4bb9-8147-2024b2925062.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5d4845c-ef3e-4a7f-8046-196104956b94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5d4845c-ef3e-4a7f-8046-196104956b94.tmp
Size 25KB
SHA256 0477863fa3c306782e1f86e28ef57049c8a3cdd3a230ca6624fbe6951627e60b
MD5 ae3c3bdaab000e45b7d392216d458885
SHA1 6baaf5221c59a4680b464877f536ac1cf08448a7
SHA512 e38bdb4b13775c081f9f3e5ffbe32078088f6b23eb5aa39e19a492be6e2f7c8ce364cf747938b29e6cd5165e93ed2746716abf7de47c4aca77514618f797a5d7
SSDEEP 384:ziFzQkUSv2zsNY8TUNTUlIlY8abM9duiduh//p+Gqj3PJAxJ6JIIlO:eFdGhwggiE/hm3PkJ6JL0
TLSH
T1E5C228F298D79936D96E4B53B37E2D138EBCC067BA804A54B3895A1CCC861BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d45703ed-7c28-464c-bbe8-d9ea5027b834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d45703ed-7c28-464c-bbe8-d9ea5027b834.tmp
Size 18KB
SHA256 77868afed9716d7b80cc29ba144faabccf803898eb4ec60ce36becc784d27968
MD5 082f45b21bfc61cf1e50f70ff1818ef0
SHA1 d730e5f3eabc7cd36b0b19c9c841d422c1744574
SHA512 d7254da5055a78b84ca5a487013971907b5ae2a25a05cce345478d4e1f881a5b9a314a23112f6d7db5d5765a55afab6a2eadb616bb3716cf251bcde0bfb41b0a
SSDEEP 384:pQkUSv0sNjUY8abM9ddiduh//p+GqH3PJAxJ6JIIlO:L0NiE/h83PkJ6JL0
TLSH
T1C0827C32AC75AD779EA29591F1473623DFA09167EFC80FA4C6CD6B2C01CA19C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0e924ba-cb9d-4f35-959d-dc809ef6ad1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c0e924ba-cb9d-4f35-959d-dc809ef6ad1f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f0bd3c01-8ce3-4ad0-98a3-091367db64d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f0bd3c01-8ce3-4ad0-98a3-091367db64d5.tmp
Size 18KB
SHA256 12e0642f97f96442da58a3539d663d7e0dfe0edde86d99c4e468f4b5177c7eaa
MD5 22eaed2e6a281019e553db7b5165a728
SHA1 7a80ca648b694875362406029e9ef6d862d7efcd
SHA512 88ac0a28d38c1a0608b947c57bba6853a9f6f2ba133b42ecffe86f70b30c009ce2b94ffbceb838a7aee2c7ebe9ffb5962f611153f52f6326c4acb2ad47ce80ed
SSDEEP 384:TQkUSv0sNjUJ8abM9ddiduh//p+GqH3PJAxJ6JIIlO:90OiE/h83PkJ6JL0
TLSH
T1F5827C32AC75AD779EA29591F14B3623DFA49167EBC40F94C6CD6B2C01CA19C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bfaa7fa0d8cee73c5bcd6338cf485be4fd04e8ff9b2d3935839d336504009d09
MD5 6d014fd473e032dc31de7e68064d9c9e
SHA1 ea3f78285a1d487c86a3a02b946af672fd7816dc
SHA512 932bd66e7ab1e8b7d6a6a8512255b5f1db111468769229df8df666d15f3d311fc8f804fa456392d09fb9f9ff4399d629601d837e2a5859bf9db7fe30fc05d253
TLSH
T14D41275CB7ED1148B3B77E1AABF2A86D087E78772E0AC59D10110D4E0A37B41C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download