b1ac2fb5c8f0407ec73ffbfcff46aa634a3acf034eb10ef3f69cf483f43e591e

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 9.0MB
Sample261020-vr9rpacv41
SHA256 b1ac2fb5c8f0407ec73ffbfcff46aa634a3acf034eb10ef3f69cf483f43e591e
MD5 a6788c05c8f55285267442473bc145aa
SHA1 a19630a8a0536a80f095e0be19b5a21b9f8b7945
SHA512 c7125e3062ce1591a646424e6f7fca36f0559cfe37197ad10f74415471916dd6d386b8d3f9c15accd43f678777b8a6f7c515be28f13b97d200942e5f13191d90
SSDEEP 24576:c4QQf6O36j54wRaXe1Vmf/6k6T6W6r656+eGj7/4po:xseGT
TLSH
T12CA6A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{D226949B-386E-4E27-8E3E-4ADE74FDDEDF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2392	1648	msedge.exe	87
PID 1648 wrote to memory of 4680	1648	msedge.exe	89
PID 1648 wrote to memory of 3612	1648	msedge.exe	90
PID 1648 wrote to memory of 4680	1648	msedge.exe	89
PID 1648 wrote to memory of 4680	1648	msedge.exe	89
PID 1648 wrote to memory of 1720	1648	msedge.exe	91
PID 1648 wrote to memory of 1720	1648	msedge.exe	91
PID 1648 wrote to memory of 5096	1648	msedge.exe	92
PID 1648 wrote to memory of 2412	1648	msedge.exe	93
PID 1648 wrote to memory of 5096	1648	msedge.exe	92
PID 1648 wrote to memory of 5096	1648	msedge.exe	92
PID 1648 wrote to memory of 2412	1648	msedge.exe	93
PID 1648 wrote to memory of 2412	1648	msedge.exe	93
PID 1648 wrote to memory of 4988	1648	msedge.exe	94
PID 1648 wrote to memory of 4988	1648	msedge.exe	94
PID 1648 wrote to memory of 4988	1648	msedge.exe	94
PID 1648 wrote to memory of 4212	1648	msedge.exe	95
PID 1648 wrote to memory of 4212	1648	msedge.exe	95
PID 1648 wrote to memory of 4212	1648	msedge.exe	95
PID 1648 wrote to memory of 2400	1648	msedge.exe	99
PID 1648 wrote to memory of 2776	1648	msedge.exe	100
PID 1648 wrote to memory of 2400	1648	msedge.exe	99
PID 1648 wrote to memory of 2776	1648	msedge.exe	100
PID 1648 wrote to memory of 3032	1648	msedge.exe	105
PID 1648 wrote to memory of 4996	1648	msedge.exe	111
PID 1648 wrote to memory of 2476	1648	msedge.exe	112
PID 1648 wrote to memory of 1772	1648	msedge.exe	113
PID 1648 wrote to memory of 4652	1648	msedge.exe	114
PID 1648 wrote to memory of 4652	1648	msedge.exe	114
PID 1648 wrote to memory of 2264	1648	msedge.exe	115
PID 1648 wrote to memory of 2264	1648	msedge.exe	115
PID 1648 wrote to memory of 2400	1648	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff87354c188,0x7ff87354c194,0x7ff87354c1a0
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,6481885665003356744,11984802349324825495,262144 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13324142557881224897,9486884294791187685,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,5494447197820840555,1154359887549168592,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,6674980201532778151,15812389372120888629,2097152 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,4062463002480963378,3690886087606324519,2097152 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,9529571940837851120,15339838054553709545,2097152 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,7185278968125807247,13899239570915631899,2097152 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,1095687472302830446,5571569404303704490,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7726538509057492081,602206964093364333,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1502311301565350241,8988919801739953006,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1502311301565350241,8988919801739953006,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,6810472483909020730,494813990936925614,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,7249758546452122544,14274953556647338026,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,4213104450892641903,4939562293974683609,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,15877737797658472424,1338260056204463502,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,5139961592617199782,14298905669765325401,524288 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,4104741924728189363,3293158796506592443,262144 --field-trial-handle=2228,i,9110851374803219602,15641303265447462289,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4fdfe43e-332e-4bcd-978b-c34e9ea694e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fdfe43e-332e-4bcd-978b-c34e9ea694e9.tmp
Size 21KB
SHA256 8b3b68f25b4c2c9f44517bae1257da4e993b8bd96a02e44d29665f8fbd736385
MD5 ef8c97425e9eb883b1f692847a7dead2
SHA1 b82b4fbb112b55df14c1db35ff966832eefdd8ca
SHA512 3f9bb33ffdbeae0c047f57ab29579803cca648eaa00ff8074c8fab0b9867e9f985d5cc15bd0eeecbf33de41c92bc5d9f3ea911e80315ef3af593b648bf34a166
SSDEEP 384:tiFzQkUSvYzsNP8TUNTUlIlJ3l1+g8zIGmXB8oMcXIBiaMT0sIIla:kFdkmwgxnWEnM0IBiaMTbLw
TLSH
T19DA25B335CA8A96F9EA39A54F54A3613DEB48067C6C46B50E7CDAE1C01DB29C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bd52ce2-b3f3-4f8a-a2e7-4cbf04699a78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bd52ce2-b3f3-4f8a-a2e7-4cbf04699a78.tmp
Size 18KB
SHA256 b6fdc363b33be7e3eccc3bdbff2d64bc8a9758ee36c7eb8324d3e7e2c680273d
MD5 e376a6271998bfefac5a191c2b5b8099
SHA1 9234c415bc8faa625006f39436c073e9c0c7ac88
SHA512 8c9955a1a2133ad10170935b6e89c6bf2afb74564c6d310f0e323c78687e9adb5f75ce4644261ff057bbfe3976afe186ed502fcbfea8489853c45ac3308a62a7
SSDEEP 384:iQkUSv0sNqU83l1+g8zIGmXB8oMcXLiaMT0sIIla:a0fnWEnM0LiaMTbLw
TLSH
T12F826B3668B87C6B4AE3AA54F54A3953AE748027D7C41F50E6DDAF2C01DB29C130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd0af02a-8b16-480c-a633-2c9dc88a30fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\dd0af02a-8b16-480c-a633-2c9dc88a30fa.tmp
Size 105KB
SHA256 3c023366c78522106a9da07039c85fdca442b8b2524e3ef09015959fba816460
MD5 1407776b2d091c5f8f337ca833f701e7
SHA1 26ec3153e7e4ee7174d00776d5731af45502e9f1
SHA512 828cee75ffe6f6dc85f839506df778d4a85a8ecb4be27dfbd05737489c9da66bcc7c1318e30b6b931f9c0dc0ed530c46530b62098d2ec8250df235492165e080
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7O:fwUQC5VwBIiElEd2K57P7O
TLSH
T192B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

2eeaccf5-02d3-450c-ac1f-5e237adc7481.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2eeaccf5-02d3-450c-ac1f-5e237adc7481.tmp
Size 9KB
SHA256 f21c2cb41ce701aa8c58b34916e74ede10e4cd113b57571a9b2bccac743231ca
MD5 9bd231e362e5dc5af1ecc4ad9e54014f
SHA1 bddf8dbad9859550ea54b582bf5dfc4b64165ae5
SHA512 06f2d731bb6ed22976a75ac4e12e86819a227db778f65c5a4638219e348fde1cddcf1551d7caea34e67a0ee30d4fc698126288da8c1d2ad28ea46eb629b8dbd3
SSDEEP 192:sxZURDWV/ffs+fLtIdpd4HW6+WNGYaplZl+wIg5LJ:sxZUAV/ffs4auHbGrPb
TLSH
T10222B6126E28A93B8CC7D21DBB55BF53DAF95032A1942E48E6FD861C09E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c622d8-bbb8-445b-a90f-0d5cebf1a285.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59c622d8-bbb8-445b-a90f-0d5cebf1a285.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7043bac8-648b-4b4b-8828-0c172832d0e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7043bac8-648b-4b4b-8828-0c172832d0e9.tmp
Size 10KB
SHA256 cf8bfa324bae554e90ec8a7faba5a7723cea55e0441f22b2046ac730da491d4e
MD5 301aa6dee238c0bb34d0530eb74770a8
SHA1 bb61c7c2b643ddc9c3c5c03d20d3a80dfaed9d01
SHA512 5d2d70ccd72a202ac4370136499ae83a8cf9fa9602f1857fda4d09896adac6a013b7f24c3ef8a12bac3a7bceb7318c57f0ea4dac83416d24d4f0bcf5bedd06cd
SSDEEP 192:sxZURDWV/ffs+xLtIdpH4HW6+WNGYapDwl+wIg5pJ:sxZUAV/ffsiaYHbGUPd
TLSH
T17422C8126E28A97B8CC7E60DBB55BF53DAF5503291901E48E6FD8A1C05E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74a22f72-c7fc-4e8c-b1d2-80111d872901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74a22f72-c7fc-4e8c-b1d2-80111d872901.tmp
Size 27KB
SHA256 f301d95a9f2e94add79ed47556c584c1634976a5861f7e165eed7d8aaa753907
MD5 8ec0393f34966c0d3ecf9217af7ae34f
SHA1 eddda0468e57eeef74659cc2f6f547099055fb17
SHA512 1474c8d36757f8182fc2d507458dc82a41b47cff69ba0ea4ab36299cc8bb984cdc32e2e648fd2643cbdf2ce9d0f5362ba3026c10d70c05917259fe5a02f50f3a
SSDEEP 768:FbWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Oro4ufesmRE5:FbWPcLKWvKeEeu1jaClLiF7F4uWsmRG
TLSH
T1A8C2FB3B644CCB7E4FC01A9DDC5A6FA76E9802C79A544D4047FE944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8868ba49-87bc-4831-96c7-b7d3fa7d0d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8868ba49-87bc-4831-96c7-b7d3fa7d0d0b.tmp
Size 10KB
SHA256 b4b5a59e8629fec35a9f9749e5d3afa703f586c4ae98fdbea7742056e0f4f8d1
MD5 e85a489e483f6299dc756d5ea5c21492
SHA1 edf08cfaaca1a749c2030f7578378d9fde9b627b
SHA512 4f4e9a358b3243207bf2b214814a41bf0dadc4e6354da72e39907499b816b8fa2e03126b62f06c6daaf15b617c896ce01cab3b67b458cf06fdb9c8f78bd7dc58
SSDEEP 192:sxZURDWV/ffs+xLtIdpd4HW6+WNGYapxPl+wIg5pJ:sxZUAV/ffsiauHbG1Pd
TLSH
T1E222C8126E28A97B8CC7E60DBB55BF53EAF55032A1911E48E6FD8A1C05E77CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99b5549d-8b7f-4cb5-9add-67feaee5860b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99b5549d-8b7f-4cb5-9add-67feaee5860b.tmp
Size 9KB
SHA256 78dba7c1d4e8421691edb8a6ad3a12f6c23f08025d06243cf8d85e05ffe4a773
MD5 7498590ea3bfda82e8010a5cbd67d74c
SHA1 68f961d71c98ae4c86de60b139fd8e8c59038623
SHA512 3fc3ad0572b0a092539bb592543a2103ab3f6472cdd0b872efc61de00e0dc70f7387ee3467d3de9f02e726e708dfaca154035fb400676b04530f09f9dd702691
SSDEEP 192:sxZURDWV/ffsDfLtIdpd4HW6+WNGYaplZl+wIgrJ:sxZUAV/ffszauHbGrP9
TLSH
T1A722C8126E28A53B8CC7D20DBB55BF53DAF95032A1942E48E6FD851C04E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4770978eb60788afc200ac682ae0381628b8a694d3a48463f501262db6649f57
MD5 e4d5f78070525ee6bbf659638be119c9
SHA1 37b0562fe98ee6927f230d83fc07e1cdffb13004
SHA512 a9c2002ed6af33677f80778bb22c81a074bc9a4a3f9bb667a4e8a1eb49dbc60bc653026e7c74b3f3b25deceff68271edee3f2a63aedda5e16c0ac30b293d8b9b
TLSH
T11AE026C51BC8C22EFA88648B026C674C93B0369AD2C0BE7E1718CA8C7605040E3A76D1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c7ff836139471cec32faf0cd5cbc35b7a590a45e37b5d0d6e461ee2624017f08
MD5 5373a712aaeb0deba1a984c31b716800
SHA1 7f08be26de1bd1303f4487f0cb99cbace8895bd2
SHA512 2bda288a36e4d6fede5f48f90ff6d976e9deda1cae231dfea763ed499f6898ac8d887e16cb7954aef53f938b54c700380aa210d25c0295bce1f9d2598cc1492b
TLSH
T19B6170C40540C06AF7D841B5B5D6484F3DF7E5BDD1B34EE615A8D976AB0771140C0E7A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56fa226cd8fa52e40458bfe070d9ab3a0a4cb72be2819cf866e277026f5d0238
MD5 150d11d058c6323c51a1f050d10861e8
SHA1 a01887ee3aadc3f8a5430bd36d086337af24d35d
SHA512 fb131acc2f1b5533fcf1d9afb922a8ed8a2a9391e3f0a9a050499a078c1fe3bd2998595e63bc0fa11a2b92d88abc5f94c88d0fbf21b7169f84795fc7571c08c9
TLSH
T1B4617FC40640C06AF7E84171B5D6488F3EF7E6BDD1B34EE614A8E97AAB4761240C0E7A
MD5 SHA1 SHA512 TLSH

Submit Download

cfe086d5-6631-4b8d-bf8c-422e777ac674.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cfe086d5-6631-4b8d-bf8c-422e777ac674.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1b322604-6803-495e-8bcc-7ce815d55178.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b322604-6803-495e-8bcc-7ce815d55178.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

82f56e2a-e48e-4d63-a182-99a46e882feb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\82f56e2a-e48e-4d63-a182-99a46e882feb.tmp
Size 949B
SHA256 c3d66b2e83a133d04bf25accc9dcb0a4ce9a9802833608fc5d00bf703cc69ed9
MD5 7956bd291fd533f728d1f45168d13694
SHA1 e5122f4cebbbb55e55f8a3d41fa84826051f4474
SHA512 dd9a220f379c7af119fa51a69f719196c2597508ebba3b5728f8c9c02d4e8f9826aef7dfcde633e800d9fd4feaf21a2ceffcaac07655bc7fdc8fedef13bf517e
TLSH
T103117DB3C3D585AE890156F05A28AE1BCE2D0A06821C7C19C5D8EF27D3E3079D00195F
MD5 SHA1 SHA512 TLSH

Submit Download

e6caf521-c75b-4290-99de-9d2be45db507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6caf521-c75b-4290-99de-9d2be45db507.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 45cd7c9da0bf3eebb26140cff33f80f66227f682eaca233df62587ebf2209f14
MD5 af9b20ec22065feb47c2b298628ac060
SHA1 b1c4b06d240daaf961e5d8f9b44dacf1c268dd15
SHA512 6c82225414d5801747c09f9743a2ac09f57d2240b62a3c67519af70fba843b892c4c508f4c0f1a72b33eb49c7c28b4c76de3015e4a6a35abd9a85d0f709adeed
SSDEEP 24:KYuhuIcIRKqh41aSrclyXytWRktI/KBhK1eSEgbfMboHInKDh21KSKtzyXEQFd4N:KAfIRKc4MjyJaI/KnKgzsInKl2c3ytY
TLSH
T104912D04367A12403CBE2A195178861E525132F331A6F93E7BB881B65E6FF480DFE4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7b15f12-30f0-45d4-b5ad-00089222cbdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7b15f12-30f0-45d4-b5ad-00089222cbdf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e04f2f10-6385-493b-9bef-b00dfa88c007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e04f2f10-6385-493b-9bef-b00dfa88c007.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aea4828b-771b-49b1-8660-71d5ce08bd78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aea4828b-771b-49b1-8660-71d5ce08bd78.tmp
Size 8KB
SHA256 abc1399866ac38ac9b4d21dc821c3aef5fc6087f0ab76228f87735f61976bf6c
MD5 25a52a9730e4074414288310631bedb8
SHA1 a553a5d78f5678119ad4f14d4f0feb8db24e8ce3
SHA512 40adbafb8180fa6bfe1c60155a05c05ad751b01ce990793f450ab9b5c5572f12ca1d497ea96a8d7679bba574c06ccea584f6c8fc710356e3d7faa6240514ef26
SSDEEP 192:nONg6IE9QmiUy8/TsuIGmXNjzorvRa0/cX/eUPQ27HrqHxU6:nONg6D77suIGmXB8oMcXxHaU6
TLSH
T190120B32A8B8BC6F5EE3A944B4873513AEA5412BD7896F50D6DC2F1C00EF25C130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9c3406f-998c-46ab-9a7e-44f332d9c1e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9c3406f-998c-46ab-9a7e-44f332d9c1e7.tmp
Size 8KB
SHA256 05a77106efb181542b05b3c0eb57e1a7a00493d0dc6030892966f7e4a62b3365
MD5 7028423540c63c0400558515384eb41b
SHA1 f061aadeb1c85a115a88353b4364b18256f7aa34
SHA512 984e51a5e2d08093726364a063aa2a4c22363f3b588b2fea7a53d4a41152b0e15cb219256bffe8cf897ebe9fad09e90bef2bb9b57fade3098ade47ab5e6ed6a6
SSDEEP 192:aONW6IE7QmiUyQ/TPuIGmXNjzorvRa0UC7s8VU6:aONW6DthPuIGmXB8oeswU6
TLSH
T17902EA35AC78BC6B9FF3AD08B4863623AFA5102BE6951F44DAE81F1D00DB25C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de94f3f4-78cb-49ca-acb3-48fc79d7de8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de94f3f4-78cb-49ca-acb3-48fc79d7de8e.tmp
Size 18KB
SHA256 9c99bae3182aeefbf0687bd2b28300f60539422dcaa0d82e198b2f0f660a5970
MD5 0c1f9f70dfbb7e49c2a7339523d974b1
SHA1 fc2f178620cc020fe69619e764e1d5018a5edfbd
SHA512 82cfa4f5c682267f035e011cf4ee1784f591767ae4a7c0df3772831b3ec2ff5cd93104163c354e4d5fa556b7dc9acbfb1d8f2c1dbb00997ee8da00b1cfee89ef
SSDEEP 384:RQkUSv0sNqUJ3l1+g8zIGmXB8oMcXLiaMT0sIIla:D0qnWEnM0LiaMTbLw
TLSH
T117826B3668B87C6B4AE3AA54F54A3953AE748027D7C41F50E6DDAF2C01DB29C130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a7027f3-b495-477c-a207-1cc476f5beb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a7027f3-b495-477c-a207-1cc476f5beb8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 8fba416aaccc3bb5acb3efe267a8fdc44084213b49546c0a79d8b26482421d56
MD5 cf46545a06b3d058ca5a9227bfc357b3
SHA1 b9460b1dc033707437577185806927eb7b7ca308
SHA512 44d3cae49afe8415e33e8bf00952e999fa91cf5730ed0557d49d256129e8f2bb531d7b40ff2eecb7e617a42d678f7405f73178cfa619de087884cb002b103e47
TLSH
T19A515869AAE91148B3737F169BF6A5AD487E7D372B06C49E10010E0F4A23B00CC7173B
MD5 SHA1 SHA512 TLSH

Submit Download