76a009737129361b8f0ca298c34c05f323f93496260993c41958c3079628f67e

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
加入官方QQ群【答疑丨催更丨交流】.html
Size 2KB
Sample261017-e4x1nahv6p
SHA256 76a009737129361b8f0ca298c34c05f323f93496260993c41958c3079628f67e
MD5 178885bc0b5d3e28e103c643e2e505b1
SHA1 f7c21c53659128c521d1daf87846f8b27a4c760b
SHA512 6c388c190884982131d89bb5b069802e6ea6fe7478c8cba1e85055f40144de016b60dfcf1a8a75084aa357911f6d8bc556c507fe09650669888d2746fa5a0294
TLSH
T13051556182801C463133A6B497E28745FBD20443DA42C7387FDDA3578FB9965CA93B5D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{6B685D98-AF52-4A76-948E-29C8D5975736}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 4060	784	msedge.exe	86
PID 784 wrote to memory of 5084	784	msedge.exe	87
PID 784 wrote to memory of 3284	784	msedge.exe	88
PID 784 wrote to memory of 3284	784	msedge.exe	88
PID 784 wrote to memory of 3284	784	msedge.exe	88
PID 784 wrote to memory of 3376	784	msedge.exe	89
PID 784 wrote to memory of 3376	784	msedge.exe	89
PID 784 wrote to memory of 2824	784	msedge.exe	90
PID 784 wrote to memory of 3324	784	msedge.exe	91
PID 784 wrote to memory of 2824	784	msedge.exe	90
PID 784 wrote to memory of 2824	784	msedge.exe	90
PID 784 wrote to memory of 3324	784	msedge.exe	91
PID 784 wrote to memory of 3324	784	msedge.exe	91
PID 784 wrote to memory of 1988	784	msedge.exe	93
PID 784 wrote to memory of 1988	784	msedge.exe	93
PID 784 wrote to memory of 1988	784	msedge.exe	93
PID 784 wrote to memory of 756	784	msedge.exe	94
PID 784 wrote to memory of 756	784	msedge.exe	94
PID 784 wrote to memory of 756	784	msedge.exe	94
PID 784 wrote to memory of 1572	784	msedge.exe	98
PID 784 wrote to memory of 1572	784	msedge.exe	98
PID 784 wrote to memory of 820	784	msedge.exe	99
PID 784 wrote to memory of 820	784	msedge.exe	99
PID 784 wrote to memory of 2696	784	msedge.exe	102
PID 784 wrote to memory of 4512	784	msedge.exe	115
PID 784 wrote to memory of 1416	784	msedge.exe	116
PID 784 wrote to memory of 2964	784	msedge.exe	117
PID 784 wrote to memory of 3480	784	msedge.exe	119
PID 784 wrote to memory of 3480	784	msedge.exe	119
PID 784 wrote to memory of 1904	784	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\加入官方QQ群【答疑丨催更丨交流】.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8deec188,0x7ffb8deec194,0x7ffb8deec1a0
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16622649310107469932,8871064603652434683,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3182878934845785670,17596726719249091641,262144 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,3561805150163920218,7649117903334215513,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7163991630109997508,2015781237291235998,2097152 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17152020190347823818,11200175412465301607,2097152 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8055056083233234798,938125349225862704,2097152 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,17681910408852251345,11835390655496963096,2097152 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,18373851010534733445,12140069715943710165,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,17578916070160664956,6223505703427684671,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,2998884525053990837,6724616491619088020,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,2998884525053990837,6724616491619088020,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,9895271720855651530,16109543119578755069,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,3744603439517251983,16541088848423214330,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,17353008384790004703,10900370569989765526,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6382334406138065467,17840274801963501046,524288 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,6946787880623638564,11199710772244302646,262144 --field-trial-handle=2268,i,4931052377756808839,11013208756946918048,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

329991f3-de69-439b-8dbd-80ffef562b3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\329991f3-de69-439b-8dbd-80ffef562b3c.tmp
Size 8KB
SHA256 d71ca13cb1bd8cb27cfec72ea350ad557a9490f5547ba05b6231db0741c1f615
MD5 9b28e73852f61fe4effd34593d8134fa
SHA1 013a001d05a85a7f12f4b13e2d3a24858dfff46e
SHA512 81a4f8be53c353017b853ee094ce137b736b12385f2122d0354b932099e271de2163c142b0ea131f7533f7517de80b9130ec0d95484bf39fd097c7d3315fd7a8
SSDEEP 192:SONx6ygpQmiUyy1tOCTVgI0OXoSPzPGFU6:SONx6lH9tOCTVv0OYSbCU6
TLSH
T10502C834BC687CB78EE36E49F88B26179F98107BDA552F84D5E85E1C01D769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44887690-e85b-4757-a006-0a97bf657d39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44887690-e85b-4757-a006-0a97bf657d39.tmp
Size 18KB
SHA256 484f487647c64eea623a69dee4ec3851a9b960348ad5a3b01be62d2dce5c4c6e
MD5 5141c2c2f3919c0b4e0c5ec9153f6b18
SHA1 9eb61cc381e7d2b5a16a831599cb34c4bd498143
SHA512 90b71978eb9cf26bf6acdadfc13bc30364292dd089774d9e97bab138c774faf7b135fba6036ea23630c253ec4c748b8eac1346a759d034c55a8f95e072843777
SSDEEP 384:MQkUSv0sNUVw8tzTTc3fOjTVv0OYSh6jCwJrZBRgPfAIIlt:M0btE3mniOYBjphZDgPfALT
TLSH
T163827C356C386D378AA79141F58E3543CFB891ABDE8A2B9491DD6B1C01DB2EC3307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52f85be1-0dd8-42e5-86db-d0369ece7456.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52f85be1-0dd8-42e5-86db-d0369ece7456.tmp
Size 8KB
SHA256 a8d8c62248afcf92e8adbec58e69c08177748793ce0bbf8ded91be26daf088d7
MD5 2c0bad89adc2e71614bb2647e5532db3
SHA1 dceffba56a7dfa56aa3f836f6fa49e4cf276add3
SHA512 08dcf97bcb2cffea06fd5052bc7959fafae9c61fb73e0d5b4aa33fbe7ca10f4b3467d8b6690538d86b058614d7d30649d7976ed482cf8adf84461d1c31f31176
SSDEEP 192:hONN6yeQmiUygE19OCTVgI0OXoSh6j+FJSJrZBnc3U0qlsU6:hONN6dBy9OCTVv0OYSh6jCwJrZBRgU6
TLSH
T12E120935B8686C775DE36545F8CB31139EA84167EE4A3F80D1EC2E1C01EB6AC230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8db9caa1-e5bb-49c6-8f5e-4a918bc429ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8db9caa1-e5bb-49c6-8f5e-4a918bc429ea.tmp
Size 21KB
SHA256 5b5782a337885d6a52320547b44194d982f23c2f00774d61dd3aa06f86400566
MD5 9d44610777b0dcf28c870102dc5e576c
SHA1 7343ea611b3d556b69ade639070110a49784f1a3
SHA512 78e780badbee5950c1189f049351a9f76a54fe743a22795d54afbe0c88eae48a3376d9fe60437ab9ea23acb4fa5973ce1c93990fb3a384ea02101c8b4438a0ce
SSDEEP 384:PiFzQkUSvazsNc8TUNTUlIlMw8tzTTc3fOjTVv0OYSh6jCwJrZBHgPfAIIlt:aFdypwg0tE3mniOYBjphZVgPfALT
TLSH
T104A26C326C649D3B9EB79A41F59E3103CFB491A7CD866A90E2CC9E1C01D72DC2307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

1ac2f513-3440-4129-9184-d5b4a8dacac9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ac2f513-3440-4129-9184-d5b4a8dacac9.tmp
Size 9KB
SHA256 79b8f0f392ae816c8a42d703c445f90f4edb7f5e0bf105b327cf2cb037f7189d
MD5 04ec38217c095be5ad3ea874eb84efe8
SHA1 51540e0a64dabc38099ccd976a80199775b5ca38
SHA512 76c89b5a8276b16d7ec404bad7072ae5a2ec6c2f39075164dc2bc49b6da90303ff265507750242317d5166009e43bd42a6df8f45b25737a216f58f71bf4612f7
SSDEEP 192:sxZXR6Wq/fdsCtIdpddHW6+WNGYRPnJmd9IgrJ:sxZX/q/fdsCOHHbGms9
TLSH
T15F22D8126E38A93B8CC7D21DBA657F53D6F95032A5D51E48AAFCC61C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

280458bb-be15-424c-a824-8f33b169489a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\280458bb-be15-424c-a824-8f33b169489a.tmp
Size 10KB
SHA256 ec45638ac36c29f89f993e513c034266418a372c65e4cefa007c6e9cc5226b11
MD5 389d4002b5247c0d0e75e9c6da681d7f
SHA1 0e03e2f42f2f7fdd7795002f1afbfa223842b3e0
SHA512 53550e9275924f66446af2d8c7f04a430d6863b015c60e99a1a28cb57817518fd878d5b9e0cc2f3b211489bbb882336d7d2bc4419500331c4890db841bc6a117
SSDEEP 192:sxZXR6Wq/fdsHtIdpHdHW6+WNGYRPLJp/9Ig5WJ:sxZX/q/fdsHO9HbGmlU
TLSH
T1E322D8126E34A9778CC7E21DBA65BF53D6F95032A5911E48AAFCC61C05E77CE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dddc05d-2a59-40d3-bf4c-b0455ccbeb0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dddc05d-2a59-40d3-bf4c-b0455ccbeb0c.tmp
Size 10KB
SHA256 98083ab7750fa3d6cceed1c376e74818178baa9525d42142950e9beb50132f4c
MD5 b4248f0e3959975a6c800cb959c1d578
SHA1 24e6be55ea71890fb16eb8634a40d8253a7a41dc
SHA512 3a2227b4370d4e2dbdcd81cf16b56142e2028abdd99c31abbd98c9e5b3bc7d8f1404d44879bf797ae425cbd05ec9bda52c8283f79c5811d8901d0d00c3d5fa1b
SSDEEP 192:sxZXR6Wq/fdsOtIdpddHW6+WNGYRPnJmd9Ig50J:sxZX/q/fdsOOHHbGmsW
TLSH
T14E22C8126E38A97B8CCBD21DBA65BF53D6F95032A5D51E48AAFCC61C04E67CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

421d7511-73af-469e-9614-247526c5c23b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\421d7511-73af-469e-9614-247526c5c23b.tmp
Size 27KB
SHA256 d52c2f28a7ac8c13c8e0554cb0772feacd4343c25e79ff5056e4642c1befcb4e
MD5 3aec03c470ca036909d325244604d9e5
SHA1 e05da2b1bcd4249564f951a9ad2090c223b33f47
SHA512 5e9d7ff3fa0011061c4c97c3249d8964793c4e0adb4a8735b3ad3dac85c04d1b2a57e3e29863887616e752aad26ff5ed0e12265c40e96f126fbc95a393d72abe
SSDEEP 768:o+K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3TroU+2B:o+K9uzYWvcQWsu1ja0HL7Q3gU+2B
TLSH
T1A5C20A3F640DCB7E4FC01A9DDC5A6F973E9802D7A6984D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ec6126c-7f0c-4be7-876f-f1f78dd5a617.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ec6126c-7f0c-4be7-876f-f1f78dd5a617.tmp
Size 10KB
SHA256 029814d8eeffc24906af6d6042a38eadf70143c1570eb6b103b0f6b5abfdba72
MD5 56dc9099d58ebf265cdd472920a20c66
SHA1 c94142ebef2fc9cbe0012469894ed3163339bdda
SHA512 35c9d7cc2ad6c27ed86a4464c35665db3a07141961131309f727f27c453287dde07cd049205cca3992266a1afb5ff0315a4b9394852df69bf8751f7e3fef91af
SSDEEP 192:sxZXR6Wq/fdsHtIdpddHW6+WNGYRPrJqd9Ig5WJ:sxZX/q/fdsHOHHbGmgU
TLSH
T1D322E9126E24A97B8CC7E21DBA657F53D6F95032A5D11E48AAFCC61C05E7BCD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f799946-6b4c-4e1b-8e19-2e715ffc9e79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f799946-6b4c-4e1b-8e19-2e715ffc9e79.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4ab33f5f84646a5c7d9ee13eb9cb84c3510e476f1637b89371e40a6a8c00aa31
MD5 972c24cac61807c5041e58764b0a7089
SHA1 447072e9aea6b07a79a550249a7dcda5d0604811
SHA512 a935c5ed0914ea49b7bd03a3184b67363a88524b594090950373e28761f6798ae04a772cc3d4b52c4f48cb0fb9fcb5751f9797da63fa667d5be96e41e78859ec
TLSH
T18151A5DB8A904CF8F7A89C7181EDA2673A7C4CB259836E72CC9DD17D9B1A3DE904D014
MD5 SHA1 SHA512 TLSH

Submit Download

f07aeba5-fed4-40bb-800b-8dc015f0e47c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f07aeba5-fed4-40bb-800b-8dc015f0e47c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

11f29c86-01fc-499b-b511-c6eeb326474a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\11f29c86-01fc-499b-b511-c6eeb326474a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

27a9f910-d22b-48f3-9507-29298667007d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27a9f910-d22b-48f3-9507-29298667007d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

8eccff92-9b29-418e-9f70-91a11941a1bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8eccff92-9b29-418e-9f70-91a11941a1bd.tmp
Size 949B
SHA256 8b2b1a2a9f1091b13d04538a022b7f5971cfaae43e4dd6ee7e01c4635b823365
MD5 fe706b3ae056e44a9aceb50df5968d95
SHA1 5bab19a1b480ed45b03365bd5fafc3f9d55152a2
SHA512 eb995e4bb1455ba0d4ec4d592b0af5678fbe0ae0d45b12dd32259654414fdfefd9532c16f50087620541d09dc85f36a252888c936aff32f3c4351f47a320a154
TLSH
T16A117DB3C3D5856EC90556F05A24EF2BCE2D0605421C7C1989D4EF2B93E3475E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8837c9201453b2d5594338a730fa3c19056b989f085559d423d6a5bc426daecb
MD5 0d900e56b8989b161c25f4047edfe3ca
SHA1 520f08302f7d1a147961cb18e06e3f6bc2f7ffd1
SHA512 06782cd21f00b15a6bc4bb237532c01b95de40d7b08d4a61ed5e66c6fd5d048c5f52ffd5fad283c957facc47b40ca3dd0d2109a09442a5c74a99740a29a5d9a1
SSDEEP 96:K0md/uK0sqOt2KGQAfGt5f9dRcZsMehRK2Ye/Rl:nllVfGt5f9dqZsthbYe/r
TLSH
T16B91F141367B120139FE359442A5861A528235B3315EF93B7FBC41664EEBE084CFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de5118c6-898e-4ac0-9bd5-7fc5611a8f23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de5118c6-898e-4ac0-9bd5-7fc5611a8f23.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f3a14982-c417-40bf-872d-1af3e571461c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f3a14982-c417-40bf-872d-1af3e571461c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d27b2bec-3c13-4788-b045-6d2af3eb6599.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d27b2bec-3c13-4788-b045-6d2af3eb6599.tmp
Size 18KB
SHA256 6f8939befe8c6293cfe6f5ba4d72af891fef2660b52198314bd14a4065cd106d
MD5 9707ee04fc4c7454fa5beda0a2921143
SHA1 0308f786858c92fd3dbb138a38aec458ddb22017
SHA512 8ed9573a886dc52849c31bcefbe6a22fa8443394b3937b47bb6002a32a74a70608aff9979a6c17617bf5640a3ae5a9382efe108a20cfbc0129c188a5db4da73f
SSDEEP 384:tQkUSv0sNUMw8tzTTc3fOjTVv0OYSh6jCwJrZBRgPfAIIlt:X0CtE3mniOYBjphZDgPfALT
TLSH
T11F827C352C386D378AA79141F58E35439FB891ABDE8A2F9491DCAB1C01DB2DC3307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdb860a9-4177-435d-b1e4-96c3fb037a45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cdb860a9-4177-435d-b1e4-96c3fb037a45.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5639828f19362979ced67803223ec5b8c8420e8f765f5e8faae9199bcd354c23
MD5 64e75f0a4f52b11baeb68b2560f4d9a4
SHA1 ba6b338dfbbb4e228502754363cbf8907c96b9e3
SHA512 11ffe8f4f37bc0374eff1d4eafbd72957fbdb10fb68b0498c15b5cdb8b53f93d2fab38b5361057b1eeea27e81d8d0ea130f7fe279481b2b073dea3b569f887e1
TLSH
T104413D58B6F91148B3B36E569BF3686D487FBC772E06959D10110E4F0A26B00DDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download