hxxps://docs[.]google[.]com/spreadsheets/d/1xXsMx4m2nnqw_lCPz6xd41TClmmWzEfBjb4yi4dzVE4/edit?usp=sharing&ts=6ae05787

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/spreadsheets/d/1xXsMx4m2nnqw_lCPz6xd41TClmmWzEfBjb4yi4dzVE4/edit?usp=sharing&ts=6ae05787
Sample261027-kpm5ssda97

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{D4212086-19EE-47A2-9270-E3223A6A5530}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 5008	3532	msedge.exe	85
PID 3532 wrote to memory of 2348	3532	msedge.exe	86
PID 3532 wrote to memory of 2384	3532	msedge.exe	87
PID 3532 wrote to memory of 2384	3532	msedge.exe	87
PID 3532 wrote to memory of 2384	3532	msedge.exe	87
PID 3532 wrote to memory of 2724	3532	msedge.exe	88
PID 3532 wrote to memory of 2724	3532	msedge.exe	88
PID 3532 wrote to memory of 2764	3532	msedge.exe	89
PID 3532 wrote to memory of 2764	3532	msedge.exe	89
PID 3532 wrote to memory of 2764	3532	msedge.exe	89
PID 3532 wrote to memory of 3444	3532	msedge.exe	90
PID 3532 wrote to memory of 3444	3532	msedge.exe	90
PID 3532 wrote to memory of 3444	3532	msedge.exe	90
PID 3532 wrote to memory of 4660	3532	msedge.exe	92
PID 3532 wrote to memory of 4660	3532	msedge.exe	92
PID 3532 wrote to memory of 4660	3532	msedge.exe	92
PID 3532 wrote to memory of 2488	3532	msedge.exe	93
PID 3532 wrote to memory of 2488	3532	msedge.exe	93
PID 3532 wrote to memory of 2488	3532	msedge.exe	93
PID 3532 wrote to memory of 2500	3532	msedge.exe	97
PID 3532 wrote to memory of 4436	3532	msedge.exe	98
PID 3532 wrote to memory of 2500	3532	msedge.exe	97
PID 3532 wrote to memory of 4436	3532	msedge.exe	98
PID 3532 wrote to memory of 3168	3532	msedge.exe	102
PID 3532 wrote to memory of 3464	3532	msedge.exe	109
PID 3532 wrote to memory of 4604	3532	msedge.exe	110
PID 3532 wrote to memory of 640	3532	msedge.exe	111
PID 3532 wrote to memory of 4512	3532	msedge.exe	113
PID 3532 wrote to memory of 4512	3532	msedge.exe	113
PID 3532 wrote to memory of 5056	3532	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/spreadsheets/d/1xXsMx4m2nnqw_lCPz6xd41TClmmWzEfBjb4yi4dzVE4/edit?usp=sharing&ts=6ae05787
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff812dcc188,0x7ff812dcc194,0x7ff812dcc1a0
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,16021125148611393006,18043739137582258868,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13979059676054539844,2602573639097832886,262144 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,8020471557291023074,12615520455223291338,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14308456529160744604,17751187007209419633,2097152 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,2854711192579425774,7312973096380884660,2097152 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15956475582492809227,16230494557236147103,2097152 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,2209893186847879435,7816990166115548100,2097152 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8204181963921246985,4494175428426581012,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,16443421218840293646,1044541498364489803,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12210658032777817638,9944521667975060697,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12210658032777817638,9944521667975060697,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1382512689668034741,10532074587465645180,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,18273703217201750963,8148792994796471387,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,11658288241911515660,16187412823742041830,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,6885421040906922341,10522191819136186943,524288 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,18297272258367579529,11966092720846134708,262144 --field-trial-handle=2028,i,4853788267478781928,5382992685648361527,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6124b3ef-b560-4a68-aa9b-33b78749cec3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6124b3ef-b560-4a68-aa9b-33b78749cec3.tmp
Size 18KB
SHA256 e42bf6cb084f2220c2096aa8425c3bbb696f54fd090cecaa91ef1ae1a3c57e7b
MD5 cd4c391998a5f6e88e508f2a647cda6f
SHA1 b989bc5af6aa5924bd1ed2b0fc1cf0e5a72fd8ac
SHA512 0c241bc6980221c34b5301af482e921e117d6f2d7cc162868b2ed3c260e7a2290f208b183189902b28a2b7afcdb4af13f22159060cb5b1bccc3a94f833542586
SSDEEP 384:gQkUSv0sN1uI+iKwaQX5+DtJOnIqNJrlowHvaTZcbbtEIIlg:I0b6pkDzOIqNhlowHvaTZcNELa
TLSH
T1F7826D31E8689C375EE69290F58B3643DEB0915BCBC42F94E5DDAF2C01CE69C334A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87918e3e-5712-40e8-9e87-f9395f8fd96b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87918e3e-5712-40e8-9e87-f9395f8fd96b.tmp
Size 26KB
SHA256 ebd38563c7920dd17a2d93a47e0a7ff1d175ba8139c1287664b8a7536bd8f776
MD5 3ae865e8d4fe8ea737c423b462ce76b2
SHA1 5b5d381bc601e87bbd6a0a7a703efe9e87f998b1
SHA512 e3d7e7b02b676639ef41df79be62b905012f24cf421dc27e515d3d098b648d97063e033fb3aa8eef3d59e0e7879e9ae0958f911a69041d1cd4f2c164d03ee038
SSDEEP 384:fiFzQkUSvhzsNP8TUNTUlIluI+iK3aQX5+DtJOnIqNJrRowHvaTZcbbtEIIlg:qFdRqwgilpkDzOIqNhRowHvaTZcNELa
TLSH
T1B2C208F298D79836DAAE5753A77E2D039EBCC057F5805A50F388591CCD8A1BFE30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

0d8c8b9e-052f-430b-87ad-27362fd4296d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d8c8b9e-052f-430b-87ad-27362fd4296d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

0fb55b80-4eda-4cb8-bd3b-1eefd55c89e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fb55b80-4eda-4cb8-bd3b-1eefd55c89e3.tmp
Size 10KB
SHA256 dd22fde113b151c5199e7e98e572551b709b1185f6babd16aa51634f324b9d60
MD5 8b379bfe86ef42ba2273e1b41c7a3ef9
SHA1 46cfe9b745e884a37aceaf4b3c27ec2bdffbfb4c
SHA512 80bb54d539008c3be33f40a8b32acaef2cb6be36b515737f05d317e95c1e3aceee62351136ac36d819b8e04ec3e285eb9c79589456a81c24e60e94ccf7d9711a
SSDEEP 192:sxZaRBWM/fZsH5Idp7BHW6+WNfk7/YYBfLdnIg5yJ:sxZa2M/fZsHSFHbI/flY
TLSH
T11F22A912AE38A57B8CCBD31DBA55BF53E5F9503292941E44E6FC861C05E7BCD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b301f1f-4c32-423e-aae4-4bfc963da0bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b301f1f-4c32-423e-aae4-4bfc963da0bf.tmp
Size 10KB
SHA256 93cb7656c10a2d11f4b28f7d8d3cba5650a492e02ee1e72d2a25b13e755af52c
MD5 5d08c0bfe7b9b444cc729294944c86d9
SHA1 a00cec34c5eb010d6949a0a20f35d74b179afc53
SHA512 12ff6c2051dfeece58a0dd3ef38700d65b932e77d61c79df2c382d69c5334497bf9803dcdd72ee979db2fdaa158631644862623cadbf12e157086c092cb640b9
SSDEEP 192:sxZaRBWM/fZsUt5IdppBHW6+WNfk7/YYBgr0dnIg5YJ:sxZa2M/fZseSrHbI/fg4C
TLSH
T10A22B912AD38697B9CCBE31DBA55BF53E6F9503292901E44A6FCC61C05E7BCD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5908d60c-ba4a-47c4-bbbd-c98cd98accca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5908d60c-ba4a-47c4-bbbd-c98cd98accca.tmp
Size 10KB
SHA256 771bf6cd91f4a05302e28f957987c6bd84ae9924dc95d7d03a7f81d5670bdb18
MD5 9a6f53e7c79518cd6512ec3de470b46a
SHA1 31454a56806dfa45593fb2f9eb973715765046fe
SHA512 b88247f71c24e5ae5ca47b3849ffb0b36c7b364e31419983872c58ee2e95a655aa6168aba6d4d59f3cf37f3a6530ac130e312916077a68a995c459c39703e156
SSDEEP 192:sxZaRBWM/fZsUt5Idp7BHW6+WNfk7/YYBqvdnIg5YJ:sxZa2M/fZseSFHbI/fWC
TLSH
T1EB22A912AD28657B9CCBE30DBA55BF53E6F9513292941E44A6FCC61C05E7BCD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7802a853-e4a0-4e48-be0c-12debfdd89eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7802a853-e4a0-4e48-be0c-12debfdd89eb.tmp
Size 27KB
SHA256 e2ec782334e7fda2fe95d4acf0a90df63a19d57d36a809c52295e31d19cd95e5
MD5 3660dbdd3f71e3445a1530720b55241e
SHA1 45da8a10d6926a466ad23a96cc26003a87a621d1
SHA512 595fee095798580d6ca425ef8189fa04843947184d7258ad1020e3afd637992e725352ed6fde6b3d2cfedb811f8c515c1292fece21ff737c51058aba7356347c
SSDEEP 768:/cyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXgrop+MF:/cyYR7jWv3NpBu1ja/CL8OXr9
TLSH
T1D3C2E92B640DCB7E4FC01A9DDC5A6F9B6E9802C797548D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5c38a6df3d6db8878867c2f7adfbccae694cb5e4ea2a6c9b1897201f852a2e2c
MD5 10387089f12f6af7b530b25132362f85
SHA1 825dee98b60eeb7486ae0e7f802bdd6997f9f664
SHA512 38b8ebf0f82ad18f37637436c37d16357b0a536d797e448e6d1a5eacfc99c825107eb7e37eede92b758db0bf232ffb7e84f0b153e4b88c37f484f5605fe0b00b
TLSH
T14381C892E6D16474FF64D9B0A0CD2E9335B883B558D71FB31CB4D47ABB0A3362822000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5fae2f4c122bdfa0bfe8332d00bf07b96748745ffa11c8a555e701a146fcaddf
MD5 2cf9c9c4675237c4c15175e2e57ab577
SHA1 2fdbd811c6c66a21540322bda95e3a36eb233bfb
SHA512 7f34299356f251001840fd98861776cc2d728a5a37b4b439156ef5f2fcb514a33b9126b07faafc4b19a4f612d320919b2340af12ff21ddb4070a4445adc18a91
TLSH
T194516185EAD184B0FF59D970B5DD2F873AB887B958C71FB32CA4D4BDAB0A7066830044
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Size 96B
SHA256 c67f14e02244fe1db486f785a60741afd1d845b95d2452196f8865a808b03946
MD5 02493ec1ebd12b76596a5de07f0d151e
SHA1 08d0ba0b756e14e9b010a15f722388c951467cff
SHA512 71e8abc6bdabbf7f6213b594862812aadfd0c0c222276c21aa1cb4296ed68f3bbd8109f79f10bae529f7eea30e0d7c126629057394087e18de7b5c5a9b4d8adc
TLSH
T1CDB0110A8088C822EE0082F888C20022B230CC282A22830AC2EAA0328A0A2B28800000
MD5 SHA1 SHA512 TLSH

Submit Download

bf1f2bb7-c156-4ee6-9645-ee1df51caf7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bf1f2bb7-c156-4ee6-9645-ee1df51caf7e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

14ff8440-8823-42eb-9163-1d6e06d6e241.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\14ff8440-8823-42eb-9163-1d6e06d6e241.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c7a760a5-6a91-463e-b34c-23bd5df6c26f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7a760a5-6a91-463e-b34c-23bd5df6c26f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e8564acf-8a2e-4ded-b73b-ea6eff338670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8564acf-8a2e-4ded-b73b-ea6eff338670.tmp
Size 8KB
SHA256 5fcc5250529d5a5ab4a50dd360a09cc037b6481af6be026cbc6560f6efe47ab5
MD5 78662d98ef76bb1db0567f0d5eeba5a6
SHA1 b8498f5ef3ea2cc15e4d3aa17717b5acc16c966f
SHA512 393ea9f2c3905c2e4c52cdee40deb2cefe0e975c5060900e42e703d96e929b9ac919c930aef2ae69b1f1682e30f8795b23d70a83ea00b9e333a9a67d7d635d43
SSDEEP 192:DKWgcjtm4w++ZbV9fH8SYaAowJMlXbhakIEIzQiIDwm:DKWgcjtm4w++ZbV9fH8SYaAowJMlXbhb
TLSH
T1CA029FF7C3D9812DC81156F89B15AF1ECE2D1A18431C3D67C8D8AE9B93E2431D21A79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 98f39f8666c1f64bfa793d7817a18102c1cfa7a5e53b5eed964a849937889e8e
MD5 e128e3642a6b66cfa055a5ca9d743587
SHA1 d77eaa2cb2feaf8f53568fa5a02b027764a72a77
SHA512 18380aba21c059c39a1d9c1b9bf3edafc87218eec5db22c826b3826fd19281e3cd0f6a73bab0d30df6b698a2a17d1e70e2265a6b6bb8bf88f25cf718ee67f4bc
SSDEEP 48:Kgfir/BhBab5UpISPaK9v1lax/KYstvTyLnKzHJp5Sbx8hISXSK9X19SxXCY0lHY:KQsAKVC+ikAKR+uRmKKoS+ROK6EdE
TLSH
T12DC1C01531BB020038BD755880B69B1B6282B2B33119E67BBFBC51B58E6FE544DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c40f388a-f41c-43a4-996b-9e8fcb843164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c40f388a-f41c-43a4-996b-9e8fcb843164.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb06cc17-0e89-45fb-b6bf-6ce0cd75cd19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb06cc17-0e89-45fb-b6bf-6ce0cd75cd19.tmp
Size 10KB
SHA256 de1b67e5c1367896674afa5835de069ac55627cad1ac5fd39c53e6af1a6656b7
MD5 5e45d67cd15118ce8b0e96d51c67701e
SHA1 9429f674dbb14ad948f8aefb43087c6f84b68ecc
SHA512 11c3b1d580db8a2e242b780cb7e7895863765357fe0714279783c9f5fa5df13495f3d79ec98aaf6bcaf6275f048e9cf7bded2f49f45532067ff22b5080687624
SSDEEP 192:sxZaRBWM/fZsu5Idp7BHW6+WNfk7/YYBfLdnIgrJ:sxZa2M/fZsuSFHbI/fl9
TLSH
T1D322A911AE38A57B8CCBE309BA55BF53E5F9513292941E44EAFC861C05E7BDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97dad0a3-0d16-46d1-a9b8-bd14eb842e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\97dad0a3-0d16-46d1-a9b8-bd14eb842e4a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd980891-bae4-420d-a626-908160d68336.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd980891-bae4-420d-a626-908160d68336.tmp
Size 8KB
SHA256 3ae5bdd412c0ac7cd73d9776519ccfd7c5e5645cd8573f8d86157c74b92e5b4e
MD5 a913d726630865d3e95ff8b9e718fca6
SHA1 938b734fdd989aa4762ac7bbb1eb1c143af1f282
SHA512 6fc8b4a0668b89dbec801481592b820a1c07c2ef8cd402f650e6e817e4a93d198ed1216b1614dd7a3755d6808cf76bad58335989751828566c92f2420cfd5f40
SSDEEP 192:yONQ6nnHdQmiUyjUGYcX5hQDP1JOnHoqSSJrfg3bq5wKCU6:yONQ6n79GNX5+DtJOnIqNJrUowHU6
TLSH
T1B012F931B9A4AC775EE2A595B4C73153DEA45127D7857FC0D6EC2E2C01DE76C230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

199c4498-8e90-4532-9e21-31af998f707a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\199c4498-8e90-4532-9e21-31af998f707a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f315f9c6-7de1-4e1c-bcd6-8bc563742e6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f315f9c6-7de1-4e1c-bcd6-8bc563742e6f.tmp
Size 8KB
SHA256 2f34ff0be8cc8f58dfbbf5ec8eadeee4b1c414a4d44f9f52f28a6a0efb3e53ce
MD5 1dd3a2db087a261870bf0d9a2488d96f
SHA1 b71070771ce363e4adb395e5fd3129ae4e724b7d
SHA512 32df6144bd60faec93d917ae4423acee7352d2f09dac283a43e550fed0b31c12a8345eba3faefd12f5bc6a232a249e3fece6d7be1b2b2a9e63f046356b0c896b
SSDEEP 192:EONq6nnHGQmiUyVUQYcX5hQDP1JOnHodMc02U6:EONq6nC1QNX5+DtJOnIN7U6
TLSH
T16602D834BDA86CBB8EF3AE45B48633139FA5216BE5956BC0D6E81E1C01D775C2306922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f34dcfaa-6410-4876-a105-90c53484b3e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f34dcfaa-6410-4876-a105-90c53484b3e6.tmp
Size 18KB
SHA256 3463ea0556c6faf27265ab12cd3136a8710f079cee38d86c676a3a6e787aa54c
MD5 e762766de37ca9697d638ce62648f87b
SHA1 54a65c0f8fbed6540ba14102ab6b719c7c13d21c
SHA512 0aaa4473589c9ea3b32282136ea6fbcc13322271af3a81e229e710541f0d771ca9ec6835ccf71688e8335e0d7560225fb1a353c8ed3cab14d4f5b7beb3e46022
SSDEEP 384:rQkUSv0sN1bI+iKwaQX5+DtJOnIqNJrlowHvaTZcbbtEIIlg:l0w6pkDzOIqNhlowHvaTZcNELa
TLSH
T103826C31E8689C375EE69290F58B3643DEB09167CBC42F94E5DDAF2C01CE69C334A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 24789d1f059c64e9a261ea1c9065c46cfae8059f49a99d83efbf429d9003899e
MD5 a2b57ae20aca7b7f5bfcc636ac622974
SHA1 cdfb528b0f98a9ce1653f224639e8d625c17a8bc
SHA512 84c524a7cea64f89fa1c3c830e1bd5b0bd6a53e0527157325f72533e33682c3c29d05b04f884f1b6739220c2027bc857427b34da9f8c0b228bb137054a649b16
TLSH
T1E3412A5CA6F9114873B7AE55ABF6A8AE487FB9372F06D45E00110E4F0622B41D871B37
MD5 SHA1 SHA512 TLSH

Submit Download