hxxps://genesyscustomer[.]everestengagement[.]com/ea/vT7hD0K2NM/?t=p&e=EmailAddress

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://genesyscustomer.everestengagement.com/ea/vT7hD0K2NM/?t=p&e=EmailAddress
Sample261022-te8s7adv8w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{B3456F5A-0799-4F82-B2BF-98E82CC6B31F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2052	2672	msedge.exe	84
PID 2672 wrote to memory of 2068	2672	msedge.exe	86
PID 2672 wrote to memory of 2640	2672	msedge.exe	85
PID 2672 wrote to memory of 2068	2672	msedge.exe	86
PID 2672 wrote to memory of 2068	2672	msedge.exe	86
PID 2672 wrote to memory of 452	2672	msedge.exe	88
PID 2672 wrote to memory of 452	2672	msedge.exe	88
PID 2672 wrote to memory of 5056	2672	msedge.exe	89
PID 2672 wrote to memory of 5056	2672	msedge.exe	89
PID 2672 wrote to memory of 5056	2672	msedge.exe	89
PID 2672 wrote to memory of 824	2672	msedge.exe	90
PID 2672 wrote to memory of 824	2672	msedge.exe	90
PID 2672 wrote to memory of 824	2672	msedge.exe	90
PID 2672 wrote to memory of 4384	2672	msedge.exe	91
PID 2672 wrote to memory of 5104	2672	msedge.exe	92
PID 2672 wrote to memory of 4384	2672	msedge.exe	91
PID 2672 wrote to memory of 4384	2672	msedge.exe	91
PID 2672 wrote to memory of 5104	2672	msedge.exe	92
PID 2672 wrote to memory of 5104	2672	msedge.exe	92
PID 2672 wrote to memory of 3220	2672	msedge.exe	96
PID 2672 wrote to memory of 3220	2672	msedge.exe	96
PID 2672 wrote to memory of 616	2672	msedge.exe	97
PID 2672 wrote to memory of 616	2672	msedge.exe	97
PID 2672 wrote to memory of 2424	2672	msedge.exe	102
PID 2672 wrote to memory of 4508	2672	msedge.exe	110
PID 2672 wrote to memory of 4488	2672	msedge.exe	111
PID 2672 wrote to memory of 3968	2672	msedge.exe	112
PID 2672 wrote to memory of 3844	2672	msedge.exe	114
PID 2672 wrote to memory of 3844	2672	msedge.exe	114
PID 2672 wrote to memory of 4064	2672	msedge.exe	115
PID 2672 wrote to memory of 4064	2672	msedge.exe	115
PID 2672 wrote to memory of 4488	2672	msedge.exe	116
PID 2672 wrote to memory of 4488	2672	msedge.exe	116
PID 2672 wrote to memory of 3952	2672	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://genesyscustomer.everestengagement.com/ea/vT7hD0K2NM/?t=p&e=EmailAddress
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff8589cc188,0x7ff8589cc194,0x7ff8589cc1a0
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,5333541768985320689,18387710054191220767,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15250935643903709348,13726707438125697967,262144 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,3206482158496429220,4428052531083547043,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,638220401580343408,3798128243440326342,2097152 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4802929250542767717,7265537311841293807,2097152 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,1782032717909672869,17583932283471801767,2097152 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5971208579880179872,2959272440477308994,2097152 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3269755628818217604,6472426768425223421,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,819147742809725838,8464910236182535038,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7106885864221931995,5364134832906130476,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7106885864221931995,5364134832906130476,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,14491108119997402798,13491477646852482408,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,3301737335091782335,12893627576778479085,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,15026162483745864128,7216682410279172836,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2800,i,2679035469445611995,2552950734248713750,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4879899268780304169,17169847282474062191,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8153356832135443175,9287071213869333464,524288 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,15162762691852320908,16136793818182312310,262144 --field-trial-handle=2300,i,13679096507007024458,17295629397194890501,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17173230-b9a0-42bf-bdb1-4ef13a4a3de0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17173230-b9a0-42bf-bdb1-4ef13a4a3de0.tmp
Size 18KB
SHA256 b4a51f7828674613c12cf83f5bf5b281813193110e6c101c02c312b81c805b70
MD5 3f1cae2283760ccc122cd6d1782a9343
SHA1 62e3ee874335203bd66740533a05099af23161f3
SHA512 b4d0b5785f1218c03105995e6d9e634cf0811a02482649d5702cd930c5ce4cfcedb2f018aa121cf63c42319441ff057079b010fb6baf7f3845db58efad130a78
SSDEEP 384:XwhQkUSv0sN4Wu4wbRQbh//PeXyTvwQTwUEVIIlx:XwT06N/myTvglLn
TLSH
T102826C3278647C7B9EE3E595B04B36139E708167EBC51F909AECAB2D02DB19C231BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bdc0928-6cb4-442b-855c-aa48b2ebc3c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bdc0928-6cb4-442b-855c-aa48b2ebc3c8.tmp
Size 18KB
SHA256 1e569b8b279941b4b8a8b39ac0ff8739c98218d8cadb7849366cce838c17247a
MD5 9a2290b68bb7eef8914a77da6c605202
SHA1 8540d71625699291fd7fa4ad955b6eafdc534b6b
SHA512 a0bca4ab184bd49aaec0338f2e91ece7487ce09c70a38d018e516d2d812677983b5e8a7e550fcb5772333d97393ac0de4dd0c34d7c047cfa79b5a957c4609f10
SSDEEP 384:iwhQkUSv0sN4Vu4wbRQbh//PeXyTvwQTwUEVIIlx:iwT0ZN/myTvglLn
TLSH
T117826C3278647C7B9EE3E595B04B36139E708167EBC51F90DAEC6B2D02DB198231BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41ba2ce0-b77f-4b2e-b899-1de8b250fcab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\41ba2ce0-b77f-4b2e-b899-1de8b250fcab.tmp
Size 8KB
SHA256 bc33911d3d7084a735c1be3f440ebc75d1be193f9c4de0874558749fa15b8f78
MD5 53249c35e7819e8cf55ba13d6d7f6a5e
SHA1 46a521741187ba9bba8c2d4cb18e7a24efff9954
SHA512 9aad03af54145abef17aadf6eacdafe8c33dd7c93c12e6a15a61f1b60298bcee0120fd6e63e0c0836408a3bacd52dedd941099a0d3cd93fe089c19c31d320ed6
SSDEEP 192:CONR6JUnQmiUyvB5o//3ywenez1Nx1cqSTU6:CONR6+J+5o//PeoyTU6
TLSH
T19912F936B878BC7B5EE3E995B48736139E644167EB896F90D5DC2E2C01DB19C130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b7153d9-0c81-471b-bc4e-bd5eacf0724d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b7153d9-0c81-471b-bc4e-bd5eacf0724d.tmp
Size 8KB
SHA256 24df1396655bcb50b5e6d3a382736ca6b9f0d02b217d9cf1ab1af093d561bb45
MD5 fca9dfd7df156d0af49f3c9ad0a1fd13
SHA1 e7d3bbfd2b4400e98fa49fdc237d08cf5c193c96
SHA512 093599885112bafa31113bce2f49ccdb8cca4530b3cd65d4b491b2d4a0e2f62512df0b7b70267e015c578285e92ca3f0ead864c6bf5c0aeb6b62b7a5e167a918
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5PaDnBKP4v+Y1xf//ojdexBywvBC1q:BONX6JUm0QmiUykBso//3ywvBCR/VSU6
TLSH
T15B02E939BC687C7B8EF3AE45B44777239FA41067AA952F80DAE85E2D01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

2bb257b7-e98b-45ad-b2e1-06a55bf6a137.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bb257b7-e98b-45ad-b2e1-06a55bf6a137.tmp
Size 9KB
SHA256 f46aab443bcbe1815b3a3b96cc29bc1a3bd6b02a7279400b897a767e7a8fc707
MD5 4861f54b06efa92828ac464652f95834
SHA1 fd79c2c7949107fcc62b016612edf3139d9eebd9
SHA512 970cae76da949a9f1e2eae28cabbde9f62367d072987318077edd2e51b42527e287e7e784b7af454840c5a3a39bb7b378e8e289645aa826e774e99eaf720c9cc
SSDEEP 192:sxZ6RjWe/fNsCZIdpfpHW6+WNMUg/Y36E99dIgrJ:sxZ68e/fNsCyRHbI/Xk9
TLSH
T10D22B9526E24A97B8CCBE21DBA25BF13D5F95032A5D11E58E6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75d45818-ef0d-4535-83d8-f7086bb1a2f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75d45818-ef0d-4535-83d8-f7086bb1a2f7.tmp
Size 27KB
SHA256 4fecab550d3416a30ef516166833f4c733b3edc5cc2bc6d70d1307bfa54c58a1
MD5 a108f9f13d04bf2c2ab33579b2b4fef2
SHA1 a88cf580a65585feeda1b3752129f7e4d850868b
SHA512 dbf4e9c16f6807aa4cfed93ec27f3314ea08064739ea6bdbfb7da461b2affe9c88fc2ec49b116101a119b38710519319c80a2442d8371dc35dd2733adb465212
SSDEEP 768:wuKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/broNF:wuKlm7QWvUYe0u1ja8/L/E/oNF
TLSH
T1CCC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c96b74b05b19dc00ff0504d18ba317c628517fe033c283647521609cdf3b8046
MD5 360f4b995745efb25534f74c1174fe4e
SHA1 a8c5098d41be99c3496541970446ca9362fe220d
SHA512 41bc50a67ab0d15571fb61c5520b8b16569a487b244990424ddc0f6c83993aa91d3f40453992b92caef3c2e8ab7b445c2a16edea7ca7d03e8a9c53cf705391c3
TLSH
T195E0268D05CAC23FB718A88702EC674CC780262B92D0799E1B04CAC570465C4B2CB690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dfcc88067930ed0dd53015c13bd1d40353bd447a68149f32a08da6b4a728dcc2
MD5 fb26aeb885040d08398ac681553b6986
SHA1 37e516e3254700e33d545f1d0c9c78f1ce8d93fe
SHA512 01bba64d8d68b684f1134b7491af1257c10b27567e4fdceb0f3cac5929345fb0c4331f3cb4c57b2ec8a59cda6ea6a5c2c73490b7e6935aa6de7101d86fb53f30
TLSH
T1FBE0268946CAC23EB34B648F02AE9B0DC380A66F92C86DCE1B09CAC47006050E3C2A90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a976e5ba140b99e52a42cebe6736b1dbf53beaed935b801976b3af4e6a029c7c
MD5 b3008cb8a948143be6479930391711b0
SHA1 44fd0b6e118761f1dbe1a9222c5ada17cd5828a0
SHA512 bf1be123ef9539ffca31a53e7d74af45a6b721c2a8d7b688e61732a0ef0c4164fcccfef44d60c48a1663888caa12db562f60677afc3f768afa1742bc543ec715
TLSH
T1C161FD806C404E64FF965F78A3F622FF35B5F0815AF3AD9D31B8C4799466758920434C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 662aa1167319ce79f74c5763db4c04cbf3e9038e21e277de81213d647a4bd550
MD5 5c2e23c4f6312bc7cc260e17f739dabf
SHA1 13531997de6b22283b9d36a544f27f789dcde3f4
SHA512 e409a3a84aa0f58c2bc8dc87a71f2fc1bc51116197ab1d9be02d6db59f3c26015e21637d6799d7a4f1ee892365eb6820241a03d71fc72112060b5b42d0a844b4
TLSH
T10261ED806C408E64FF965F78A3F622FF36B5F0815AF3AD9E31B8C4799466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

3c5cde90-5db2-4bfc-b712-f891d16accd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3c5cde90-5db2-4bfc-b712-f891d16accd6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

5f31d905-95bb-4f5f-be59-52c71f01d8c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f31d905-95bb-4f5f-be59-52c71f01d8c2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e302f200-fb06-4227-bad0-aebe3438ee4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e302f200-fb06-4227-bad0-aebe3438ee4e.tmp
Size 1KB
SHA256 6cdb11f2d2021f8224e78ee45b1edce6ecb530b47e58fc09c6d121cc8776d10f
MD5 27e4a6e8cf5341ef84fa1ecea55c8ee4
SHA1 e6fed7126d2d2fd5ce69dafd2745ace8e89bb40b
SHA512 d35154f6a447a44b582394534ee64405333e0826c1b55888c502c5649560c4167c66adf30d95255733fbdeeed54cbd9be5ef686b4df3dfe17a762d77f1d55401
TLSH
T14321ADF3C7E5856E89115AF0AA28AE2BCE2D0605432C7C19D9D4EF2BD3E3875E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

e40684ee-34b3-4fe4-926c-d261264c08b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e40684ee-34b3-4fe4-926c-d261264c08b8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

af78d80c-7a13-406e-8cc6-9a046adcc94f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af78d80c-7a13-406e-8cc6-9a046adcc94f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d20b0b0e-4769-468a-b519-ef97c40b4790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d20b0b0e-4769-468a-b519-ef97c40b4790.tmp
Size 10KB
SHA256 96228a246ca297827fc69d682933bf85cc57092e69c35866c89f02d6cb4cb66a
MD5 6a9a6178feaefd89fa67f969288bdd32
SHA1 80040ff004af44bfb8d5b15edce88c5f3a1a3b55
SHA512 986d911ee21bc323bf9ebe4eeacbeb113ba26543c47df04707436a0581a3ac50942e3f842d903055632cc4f2eaf535554743b4e3a5c14461cb29e43bfa1babbb
SSDEEP 192:sxZ6RjWe/fNsKZIdpfpHW6+WNMUg/Y36E99dIg5LJ:sxZ68e/fNsKyRHbI/Xk3
TLSH
T13122C9526E34697B8CCBE21DBA15BF13D5F95032A1D11E58A6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee8e414f-f8c2-4a82-9845-b6db60352a4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee8e414f-f8c2-4a82-9845-b6db60352a4b.tmp
Size 10KB
SHA256 1bab5b7f68f864ba3d805f85cc23ca288e8ddb09e24f2ede2aa11cad45106150
MD5 e08dabb260ee11f05b79c34e3cdd9cbc
SHA1 eb64506c9ee5364d3fad7d800635a346ce90bbc4
SHA512 054a93d2586ea67218e88adfba50fccd5ae1ba7e9757c0e125d611107bb80191c3176569ff1e794bd4d60cc545b716ccf8ca7d5fb80c10d8da590258a1079f4e
SSDEEP 192:sxZ6RjWe/fNssZIdpfpHW6+WNMUg/Y36PF9dIg5pJ:sxZ68e/fNssyRHbI/XZp
TLSH
T12D22B9536E24697B8CCAE21DBA15BF13E6F9503265911E54A6FCCA1C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fca1804a-a96c-4446-befd-170c8c59318d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fca1804a-a96c-4446-befd-170c8c59318d.tmp
Size 10KB
SHA256 00f305aa5cfa15c070e1e06dff78203c3e01a32fcdbf013703daa8071d6a2aca
MD5 a8c1cc771aa54daa36bb29b876fefbda
SHA1 95f02778dea316e4f11f50c80ce60b23f32c86fe
SHA512 110ab94914a54315cef806e41a15157eb6f55ce284ff80dfd621b2f7c8157d0cd38346af5e139f56842596ff177afa4e0d6550b9352af54421d03d7731deffca
SSDEEP 192:sxZ6RjWe/fNssZIdp1pHW6+WNMUg/Y36/W9dIg5pJ:sxZ68e/fNssyvHbI/Xap
TLSH
T13422C9536E28697B8CCAE21DBA15BF13D6F9503261911E54A6FCCA1C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

eed5e99a-d321-4dda-b3ca-e8fcab9abd11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eed5e99a-d321-4dda-b3ca-e8fcab9abd11.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccecc637-c5ec-4a9a-a00c-1d4a8ebdf653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccecc637-c5ec-4a9a-a00c-1d4a8ebdf653.tmp
Size 26KB
SHA256 b74e004f8a7e5a74e491116df75b305b0d75fe145e7f131bd270f33494aa4325
MD5 ee66fe28b9f4fddc5a7c9c5a532d70b2
SHA1 01fa68030cfecf65411a0b88c0598d6593c5be51
SHA512 3e899cbb140de0c97794b1529fa5effc88c57a7a5e656277a6f5a603daf8a22a1e3fed0f72188bb895956beb0e90016e02e5ff8cafc7bddb3984c48f1843df39
SSDEEP 384:vw+iFzQkUSvJzsNo8TUNTUlIlWu4wbRibh//PeHyTvwQTwUEVIIlx:vwVFdpZwgSN/gyTvglLn
TLSH
T1AAC2F7F258D7983ADAAE9B43A33E3D129E7CC153B6841A90B7D8591CCD860BFD307910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a072a5f5-5d28-47fb-82b6-9a2f68b0ce50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a072a5f5-5d28-47fb-82b6-9a2f68b0ce50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ebbe7d790b0289700f6bb332a4ab2360c495a4739c9ce457728b86dddfbcb28
MD5 f6c23a807eac11c024038efffea0282b
SHA1 40a5cc0cdda9a5a28f9842d0818cbcecf0769f48
SHA512 2e62bee7697aefbb5dec28141a1158cd93797d9b1603664ecd6da0857303c7748c4e5c945e77cfc60416a1f5a7ada1d59429b923b04dd6f183cb0b09f79986de
TLSH
T1B4412A59B6ED1108B3772F5AABF6A86E487BB9332F06D59D00100D4E0A32F44C871733
MD5 SHA1 SHA512 TLSH

Submit Download