2dc82d45b41d26140366787d4e58a8bdd9f4335d09912c283018c1d35a04b8c5

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stay-clean.org/PHPMailer/docs/extending.html
Size 3KB
Sample261023-pc3f6sss5p
SHA256 2dc82d45b41d26140366787d4e58a8bdd9f4335d09912c283018c1d35a04b8c5
MD5 7acc2b880e34473fa257b98c495e4cf6
SHA1 8a827c663141cbb07266a8b0d993c4a8e6421be7
SHA512 fe158e1daa95685c638cb0b3ad8c7a6aa94695fb56b322908bc09acf5a01f088cd00bcc232eafc79a56e57e6a3ea11cc96b8015cc38b6cd0bc7cb86000821926
TLSH
T15F71B714A99356E525A7B56AB38D70827C0541073A10F9B078DE43D8CF41C17FF7A6ED
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{71CC8366-FBE4-4C43-AFDE-256DD14B79EB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4420	1264	msedge.exe	84
PID 1264 wrote to memory of 3020	1264	msedge.exe	85
PID 1264 wrote to memory of 4084	1264	msedge.exe	86
PID 1264 wrote to memory of 4084	1264	msedge.exe	86
PID 1264 wrote to memory of 4084	1264	msedge.exe	86
PID 1264 wrote to memory of 4800	1264	msedge.exe	87
PID 1264 wrote to memory of 4800	1264	msedge.exe	87
PID 1264 wrote to memory of 5072	1264	msedge.exe	89
PID 1264 wrote to memory of 2804	1264	msedge.exe	90
PID 1264 wrote to memory of 5072	1264	msedge.exe	89
PID 1264 wrote to memory of 5072	1264	msedge.exe	89
PID 1264 wrote to memory of 2804	1264	msedge.exe	90
PID 1264 wrote to memory of 2804	1264	msedge.exe	90
PID 1264 wrote to memory of 1272	1264	msedge.exe	91
PID 1264 wrote to memory of 1272	1264	msedge.exe	91
PID 1264 wrote to memory of 1272	1264	msedge.exe	91
PID 1264 wrote to memory of 3912	1264	msedge.exe	92
PID 1264 wrote to memory of 3912	1264	msedge.exe	92
PID 1264 wrote to memory of 3912	1264	msedge.exe	92
PID 1264 wrote to memory of 4724	1264	msedge.exe	96
PID 1264 wrote to memory of 2796	1264	msedge.exe	97
PID 1264 wrote to memory of 4724	1264	msedge.exe	96
PID 1264 wrote to memory of 2796	1264	msedge.exe	97
PID 1264 wrote to memory of 4080	1264	msedge.exe	99
PID 1264 wrote to memory of 1028	1264	msedge.exe	108
PID 1264 wrote to memory of 4292	1264	msedge.exe	109
PID 1264 wrote to memory of 3384	1264	msedge.exe	110
PID 1264 wrote to memory of 1740	1264	msedge.exe	112
PID 1264 wrote to memory of 1740	1264	msedge.exe	112
PID 1264 wrote to memory of 1232	1264	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\stay-clean.org\PHPMailer\docs\extending.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa9cb6c188,0x7ffa9cb6c194,0x7ffa9cb6c1a0
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,4184491313548265568,16066231921898350464,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,7373229662816255448,4785137737962633167,262144 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,2431286844784938431,1285753210510970741,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9302252068696733786,15906335759948598294,2097152 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,10342317284198180599,13755123227615159544,2097152 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4366672114409060902,1538706983071231278,2097152 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,8440130232571193082,7427996678011177276,2097152 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,5595089178951517099,12090811186027597090,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6554665722751810902,11485108657996950900,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7739976594876008928,108067151458966141,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7739976594876008928,108067151458966141,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,6875408593825849029,17259800556332077821,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2871537921424056455,600152630935679572,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13950110853023486755,15004902879079360665,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,15911373311363104845,18427457435535368460,524288 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,2001099782284183347,8581606248669530907,262144 --field-trial-handle=2304,i,8926487507356950474,4970614824358786211,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06248066-eb6f-4b99-b7ea-8ff1c789e909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06248066-eb6f-4b99-b7ea-8ff1c789e909.tmp
Size 8KB
SHA256 0e024faee83aeb15f6e909322a25bc7d79a903178134819670a9b51cf5f734b7
MD5 42293b5dd79987e19df72f7bc9634608
SHA1 ac7e10dab6593462818bf3740ba1f3ec967c419c
SHA512 38dc3a3bb7f76005631daa7dc260aee7c5addab13836a533cf4922ad40248f9d3c9043d8fcec789bf340de1a5e96de11418b938ddb5ae8488ae03beb403a1b39
SSDEEP 192:3ONc6iDFQmiUyVytq5u88P4tmethouZ6q5U6:3ONc62vtq5u8i4tNRU6
TLSH
T15B120A36B87C7C7B6DE3A855B48736139EA54267E7886F84D9EC161C01EF2AC230B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e2699d5-1a85-41cb-a4d3-b174fca35458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e2699d5-1a85-41cb-a4d3-b174fca35458.tmp
Size 21KB
SHA256 0db2cb52e07e6461a4b18d4d09214cc50277163f3b2a227edae2b7afee57c921
MD5 c87fe01276ddd6a92d95d179722f995a
SHA1 f0dd1ae8fb30eebff7bee5169f9e07bcca43f2c7
SHA512 6a83aa52455c3290a4ab2b18816dd0e0f91b9fbfd86b6ceb97d362d3fdde1d7c9fc6e7a3323a8b536f95e5d0528dea2e4a21dfb0d5cc63a0b3b6db9a2b45ef61
SSDEEP 384:6iFzQkUSvTzsND8TUNTUlIlnjYjvvp5u8i4t1R2INMUIIlX:xFd36wgknkiR5OULR
TLSH
T173A25B375C98A87FEEA79E50F54A3603DEB48167C6D4AB94E7CD5A1C00DB1DC230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e97af33-a96f-4f12-b196-f05526bf62b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e97af33-a96f-4f12-b196-f05526bf62b4.tmp
Size 8KB
SHA256 073245d99d177f9394429591f8f8dec3a64055b4d67f20c46f66408b4b1fc752
MD5 5179b40235a8ecc5013eb11ed85842b2
SHA1 f1176ed83abaffa9ff5c3a55fce3368c623cb0b7
SHA512 491d8d076196388295e94881c33eb8e6c06cdbe20e9eab3503ae40db0b9f0e1fcfcb017efb00c51e8a5ce816814c5507c26e328ae94d5bd7e51e3c71a503b975
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5nmDSBfPGxvw45RxmJm78lFfxQpLk8:SONu6iDCQmiUyAyHq5u88P4ASqc1zU6
TLSH
T17A02F839BC793C6B9EE3AD05B48737179F99117FE6942B84C9E81A2D01D729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

948f40eb-e7a7-454c-b24f-a8056e225c1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\948f40eb-e7a7-454c-b24f-a8056e225c1f.tmp
Size 18KB
SHA256 c03b5f2ceffa63f3918f0ce841a383aaed4b92a4083500b605adb5857dfd94aa
MD5 79fcf994f1aef6e82665ce1abb461571
SHA1 9513037071cfb9b80debc1aa95c7fc3240a1d902
SHA512 d134a1f5c4c411afa7c571d33574ee454b7964e62ef10786c4e069d07ac0bf8458f8c69d2f1ed824702f28df2815512d5d9c95f92699d4cb8fa46d81c49dc224
SSDEEP 384:jQkUSv0sNxnjYjvvp5u8i4toR2INMUIIlX:N0lnkZR5OULR
TLSH
T1E2827D366CAC7C7B99A3A560F58B3A039EA48117D7D85F94DADC672C01CB2D8230B617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0a8f69b-8143-4f41-9a19-d595e7a52e85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a0a8f69b-8143-4f41-9a19-d595e7a52e85.tmp
Size 105KB
SHA256 3c023366c78522106a9da07039c85fdca442b8b2524e3ef09015959fba816460
MD5 1407776b2d091c5f8f337ca833f701e7
SHA1 26ec3153e7e4ee7174d00776d5731af45502e9f1
SHA512 828cee75ffe6f6dc85f839506df778d4a85a8ecb4be27dfbd05737489c9da66bcc7c1318e30b6b931f9c0dc0ed530c46530b62098d2ec8250df235492165e080
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7O:fwUQC5VwBIiElEd2K57P7O
TLSH
T192B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

10c78286-567d-43d0-9037-1fcd17c53f0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10c78286-567d-43d0-9037-1fcd17c53f0c.tmp
Size 27KB
SHA256 2b3c7a27efbcbe51e2e6cd572a57a1f14b365e1b9a54d441f68cbd588dbe8f76
MD5 80b5a0a1f2daa9f108d68265202f778c
SHA1 de4ba873f1ac46799083aa586c443e6e9c7193e0
SHA512 9ecdc09c474a3e0e926624e4668d7501ff36141e46c6923e87db86ba26dbd90bf0ae0061b8897866868e80ca718b51df6de68ff133fa12c6497964f507b609da
SSDEEP 768:LkyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3froYZs/:LkyQRbrWvvlpZu1jaXKLf33MYZs/
TLSH
T185C2F92B640CCB7E5FC01E9DDC666F976EA802C766688D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23c5639e-5c1c-4ac7-9ea0-3b588726573d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23c5639e-5c1c-4ac7-9ea0-3b588726573d.tmp
Size 10KB
SHA256 31c98347967696a32a22e3cfd582cec66601afc503fda55de9b325a5289fcd6f
MD5 235355e3a852b74df9e6ca98fdf52bbf
SHA1 592d33ec8f3e57ed5b4554867fdc98dc10a80057
SHA512 66bee98c36930492de8e960a1cd136ca3db2a8314175991e5324eee59e8f76bbfa01573babc1fe4ecee9b84583c41137a932dfe0e2bacdf0f1123e6ade8417bf
SSDEEP 192:sxZMR+WY/f1sUv1IdpHgHW6+WNGYaEV9cIg5BJ:sxZMDY/f1sUvGAHbG1V
TLSH
T10422E9526E38697B9CC7E20DBB55BF53E6F9503291A41F48AAFC861C05E7ACE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e555154-7609-445b-8484-e38ef670256b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e555154-7609-445b-8484-e38ef670256b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

43815cc6-c6a2-4ae3-94a4-4d375e6f1ed7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43815cc6-c6a2-4ae3-94a4-4d375e6f1ed7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

650c54da-577c-47bd-922c-f040785a680c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\650c54da-577c-47bd-922c-f040785a680c.tmp
Size 9KB
SHA256 ccaaa12d1068f49d095d1d09ca521f5c3d773773e0587a1986ed8bbdee201146
MD5 fa694b46b4a11bcd4b0a72f069442624
SHA1 34c1f07770c89be379c91f2f1fd617f430d2668a
SHA512 2a7d669e95e272393354074f3cf05006404f46625be9c4faedcb4c48c1a08f2eefdace131650c23f9decc02989bdc7fc9a4ba682c52827bd6ed71cd62f1b4fc0
SSDEEP 192:sxZMR+WY/f1sKv1IdpdgHW6+WNGYaJ69cIgrJ:sxZMDY/f1sKvGuHbG79
TLSH
T1A222C7526E38A97B8CC7D21DBB15BF53E6F9503291941E48EAFC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b998e93-5064-4b69-913c-6d42d5a2b93a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b998e93-5064-4b69-913c-6d42d5a2b93a.tmp
Size 10KB
SHA256 8946710942ff88a59800c759981d61d2678d7064b9daef3a2b9bfadb21ca90c2
MD5 8795e38893b7e7229e99482f7a2d55cb
SHA1 641595d5d2e58512acdb52a7cf5d9d98258e061a
SHA512 5cf58a7ec0e06cc9610f302323bccb13c2dc97f2926e7c5d5b989edd8b246a84c2d1bab5a38d9ab5f0a49ecb13e87c05feec4a0bf838de8fa167f3d7cb1f236b
SSDEEP 192:sxZMR+WY/f1sUv1IdpdgHW6+WNGYa+e9cIg5BJ:sxZMDY/f1sUvGuHbGCV
TLSH
T11522D8526E38A97B9CC7E20DBB55BF53E6F9503291941F48AAFC861C05E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 385dc9eb5088085b1f13d4dd9ece2c9856aa625109894665454a4a9ecfa64554
MD5 0a63a9bab622987d0f2f5d91e92ced2f
SHA1 66473cb0bd65c8852d082b15e99aae961e920a10
SHA512 03f3b27df946a9b775c90a584ac5c1193633ef3b8dd2d31f1f9c8492f2d8c5c280bf387ce820625f09f4268f36b9324b050de9c1241d14781e8847f31c8342a0
TLSH
T15561F786FD90E4D3FB989130A9FF258AE96545B0988F2D3200ADF5FDEF15B9C4004074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dcdd72c4f33dca49ed490103512f599094d684ac9ae23257212b80b202b36e4a
MD5 1322f01d43dbf49b72ba4461caea341e
SHA1 270d4786f70c8799b4375aaa1b9e094f35c690f7
SHA512 99d3ea88d0a7adca326c032f4457af11a86125d782cb824904f04c5ac494c78fcc17ddb107abfa16137102d80f8d38cb48195d80a8666dafb979c7ff5aa88111
TLSH
T1FB61F786FD50E4D3FB989130A9FF258AE96545B0988F1D3200ADF5FDEF15B9C5004074
MD5 SHA1 SHA512 TLSH

Submit Download

917f9555-78f0-491b-b77d-28124f76934f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\917f9555-78f0-491b-b77d-28124f76934f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0c968e3d-4aa7-4d84-942d-2c4cf6420e8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c968e3d-4aa7-4d84-942d-2c4cf6420e8d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

1205632f-e95c-47a4-b036-60ec450e7d32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1205632f-e95c-47a4-b036-60ec450e7d32.tmp
Size 949B
SHA256 a1d4823b7edd4a1e39f55710541329efdf898d6769c7bd26806c0a5098524b97
MD5 a4398e4dab57768a7fb274465467a043
SHA1 7f9a820fc952a98d9650b99c0f666e0af03c3643
SHA512 00f98644b62dd46d7b24df90999f497c337ca1c0f49baf05285897647f83ec9a328e170d13dd6625aafe1237b58879b01e95e83feb75e645fdae82929bff533d
TLSH
T1BE11BDF3C7E5856E8D0156F05A24EE2BDE2C0606821C7C19C9D4EF6783E3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

f4a8ceeb-f5ff-49ef-a1d6-bb08fb2c0f71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f4a8ceeb-f5ff-49ef-a1d6-bb08fb2c0f71.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be8a2fb9040d8197562c9607f55ec3345bdc819078f4aa44762c0c4ceb69152f
MD5 dc79b54d81f1649ac57dfb6c6ebdfe6b
SHA1 106ffd3571c8e1fe818c85a5e0ee6ee1b0ff9dbe
SHA512 2524fc7e1183d16a12261ed1cc9c6547af9a16fc6044c5a5f1959d6e51d0acb0cf54c87d032e18ce2cfb188ef9a6ec7aee4f0da35d36694e93a56e5184f60034
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQ8c:KYduKGwC2JSK60ZIQK5+ul
TLSH
T12F914101B57B524038BE7A9840A5CA1A864235B3344DF93F7FAC41A74A6FE091DFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c132b4f0-b074-4c59-be58-7dae169fb59e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c132b4f0-b074-4c59-be58-7dae169fb59e.tmp
Size 9KB
SHA256 15d3629c88614d203dc8f386aa5fc957238cc0ba0416f1fa980d78d8cde4f0b0
MD5 8642e9b2c25865d9fa25f6f7639e5ea3
SHA1 8a4d48b3ef50750b66c7ccde4ebf1ebf33dee1c0
SHA512 9763a04a1c4fad577805cd9b280256ac38253197a4ed649cd6edf455fa4a8cadf84e0cf25abf9abfa5be99d18bb182ce3eee97e7b236ea4b3d19b1e3d6437e77
SSDEEP 192:sxZMR+WY/f1s/v1IdpdgHW6+WNGYaJ69cIg5zJ:sxZMDY/f1s/vGuHbG7j
TLSH
T13022D8526E38A97B8CCBD20DBB55BF53E6F9503291A41E48EAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a099c54-90c3-4b09-97c6-f81b4e301460.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9a099c54-90c3-4b09-97c6-f81b4e301460.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d3445cb3-9823-4758-bd99-0f8223be8d35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3445cb3-9823-4758-bd99-0f8223be8d35.tmp
Size 18KB
SHA256 b911c1cbf225cef271a4f6b9eb98d5d35f8128cf414c630592fe0cad6cf9ca42
MD5 914bb2e782c7aa95dbbba4c6fed05c72
SHA1 0ca38d5f267ff461eaf8edea553ecc9826b44ce9
SHA512 1e482b07b1a8e9776acb3f54f628ed0b280db0cee82fc26a663a0b934d1357094d0e51dad4448146df40d6281969cb961d287b1c3c66eaef284e301c1615cb3c
SSDEEP 384:eQkUSv0sNxujYjvvp5u8i4toR2INMUIIlX:O0inkZR5OULR
TLSH
T10E827D366CAC7C7B99A3A560F58B3A039EA48117D3D85F94D9DC672C01CF2D8230B617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5a9f1fc-e0b7-4483-ab99-31fb985af75d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5a9f1fc-e0b7-4483-ab99-31fb985af75d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 34fbbe01991ff15d6cee53e01d33db6bd4e870b92df06dffccbb5dc987c12dd7
MD5 dca9d73ec2884d2e74737768e6b70a02
SHA1 aa4d91968f146c240ce42972c9c63c48127e7789
SHA512 f2f335c87e170fbd2c3f0241c066ddce57eb14de909aceb3d556875ff5ad6f0056a51d8ef960babd318bdf8a780758be14d5aaa47c71b8e37bc4986a09195256
TLSH
T1BD412759AAF91018B3B37F56ABF6A46E487F79772F06C4AD00110E8F0A26A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download