hxxp://harpercollinsread[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://harpercollinsread.com
Sample261027-mefdbads3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6C65346B-BD6E-4481-9937-3AFE13C37940}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1724	4956	msedge.exe	84
PID 4956 wrote to memory of 2300	4956	msedge.exe	86
PID 4956 wrote to memory of 4928	4956	msedge.exe	88
PID 4956 wrote to memory of 4928	4956	msedge.exe	88
PID 4956 wrote to memory of 5024	4956	msedge.exe	87
PID 4956 wrote to memory of 5024	4956	msedge.exe	87
PID 4956 wrote to memory of 5024	4956	msedge.exe	87
PID 4956 wrote to memory of 748	4956	msedge.exe	90
PID 4956 wrote to memory of 748	4956	msedge.exe	90
PID 4956 wrote to memory of 748	4956	msedge.exe	90
PID 4956 wrote to memory of 4160	4956	msedge.exe	89
PID 4956 wrote to memory of 4160	4956	msedge.exe	89
PID 4956 wrote to memory of 4160	4956	msedge.exe	89
PID 4956 wrote to memory of 5000	4956	msedge.exe	91
PID 4956 wrote to memory of 5000	4956	msedge.exe	91
PID 4956 wrote to memory of 5000	4956	msedge.exe	91
PID 4956 wrote to memory of 2648	4956	msedge.exe	92
PID 4956 wrote to memory of 2648	4956	msedge.exe	92
PID 4956 wrote to memory of 2648	4956	msedge.exe	92
PID 4956 wrote to memory of 5080	4956	msedge.exe	96
PID 4956 wrote to memory of 5080	4956	msedge.exe	96
PID 4956 wrote to memory of 5080	4956	msedge.exe	96
PID 4956 wrote to memory of 3708	4956	msedge.exe	99
PID 4956 wrote to memory of 3140	4956	msedge.exe	100
PID 4956 wrote to memory of 3708	4956	msedge.exe	99
PID 4956 wrote to memory of 3140	4956	msedge.exe	100
PID 4956 wrote to memory of 3964	4956	msedge.exe	103
PID 4956 wrote to memory of 2424	4956	msedge.exe	111
PID 4956 wrote to memory of 3292	4956	msedge.exe	112
PID 4956 wrote to memory of 4684	4956	msedge.exe	113
PID 4956 wrote to memory of 2388	4956	msedge.exe	115
PID 4956 wrote to memory of 2388	4956	msedge.exe	115
PID 4956 wrote to memory of 5040	4956	msedge.exe	116
PID 4956 wrote to memory of 5040	4956	msedge.exe	116
PID 4956 wrote to memory of 4008	4956	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://harpercollinsread.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8589cc188,0x7ff8589cc194,0x7ff8589cc1a0
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8787386522052346220,2544563831927931180,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,7756712594972776396,7510353204855753955,262144 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,11492008202040330777,5327787275306135902,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,268637683343859112,11878021374486713838,2097152 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3701732453744730724,10257750288864493197,2097152 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,1953575971239327815,1882820015028450629,2097152 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,6536031198579528874,10377243889148182142,2097152 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3436,i,5471305755511574341,17874705855454384379,2097152 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,7664839769763827621,11469694669739644618,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,8886418694291838439,5489925675926285751,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13958115809421547930,7640900036023179790,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13958115809421547930,7640900036023179790,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,8363981709195935786,8038500289120044004,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,876508136558332250,7496142772814415234,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12640286686074793471,7943839426369062001,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12081011570906906641,18324392343936684942,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4820826580636750047,1383140525761384198,524288 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,14346223207451628034,10495748605092562786,262144 --field-trial-handle=2372,i,11404115331696332620,9992848873513741458,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1cbdbfab-e219-4b34-9ae5-40c5145bd2fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1cbdbfab-e219-4b34-9ae5-40c5145bd2fc.tmp
Size 18KB
SHA256 705a502150dba0a4cb052ae6e5603a865bfbeab08aa31e519c035430eea6a72e
MD5 dc7bc10e37d27537ffbc9675f96bac4b
SHA1 dbd9d11c064bddaef204728d4b1e8386998a4c8f
SHA512 d18d38faca9b54eeec8c9c41653bce89091accd67f1f2ead899eab9662f77f9d020909228f031eb8dcf87f91b0c3446904d919d03fbf247de02428ddac2b2638
SSDEEP 384:AQkUSv0sN4xrmZbj8i0h//PedTvaTZcSHSIIl+:o0lm1F4/ITvaTZcSHSLI
TLSH
T147827D32A879AC3B4EE7D561B44B36139EB4D1A3D6C42F90D6DDAB1C01DB19C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2739caf3-1920-4c22-95aa-6e17c5790b2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2739caf3-1920-4c22-95aa-6e17c5790b2e.tmp
Size 8KB
SHA256 f72a389fb22ff62a9b59756ff11b5a0be5ed7824bcc1c9fe6d7f20aa202a348d
MD5 ac5f289a80212e8459156338b8b2948b
SHA1 cd8f7bb06dab9d4851c3bfdbd6b7eb52d30edec9
SHA512 8746c584647724cf45f9e7b17fd978c81ecf9fd41772d019ec244c33f1e83f57d5bbfb59e7562d86976a717aef884a9d6c3d9705e41ba8cb05c389e193c713f0
SSDEEP 192:8ONh6JU2QmiUyuWUo//3ywenezTNxocqWU6:8ONh6+SMUo//PeCTU6
TLSH
T163121A36B868AC7B5EE3D995B48736139E644167DB896F80D6DC2E1C01EB19C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e83207d-1223-4d5c-b6ef-71acb1babd1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e83207d-1223-4d5c-b6ef-71acb1babd1d.tmp
Size 26KB
SHA256 2be42af089dba043c6d7c8b3ceaeaeb8bd5590bfad4257c2789f5139965664b4
MD5 cf44f866ab2ecc62a8197e62f7749fd4
SHA1 2c5876f507ebef0774d3e613c4f74e06325a6a56
SHA512 7b7f61420ca01f680a8ecdc937d52c0001656e29500736d753f3bfacbb7f3f7325b6f873f72699e677ed3c0f3e24466f4634ea51664139fe0f32592ed90088ee
SSDEEP 384:wiFzQkUSv2zsNo8TUNTUlIlwrmZbj8c0h//PeZTvaTZcSHSIIl+:LFdGpwgim174/iTvaTZcSHSLI
TLSH
T109C229F258D7983ACAAE9753A77E3D038EBCC063F5805A50B788991CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fc119e9-b9d5-4bdc-89b6-c21eee6c297b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8fc119e9-b9d5-4bdc-89b6-c21eee6c297b.tmp
Size 18KB
SHA256 337945cd9071006d571270d26c68dae80c7a7ce4237fd9023eff8b300835c720
MD5 542c811ea9dac565cb46304b49d3a558
SHA1 214a31574ed0ae5822b2ce0f7203f0e1e3d7e6e7
SHA512 19359c5781d4ecf9d2f8eb3940e41abff4ad7d5d379fa075e6154be7fb2661e7b928258ebcf383524a061fb90314c2858c029a62d34da95193f056480c86f51f
SSDEEP 384:lQkUSv0sN4wrmZbj8i0h//PedTvaTZcSHSIIl+:/0cm1F4/ITvaTZcSHSLI
TLSH
T127827D326879AC3B4EE7D561B44B36139EB4D1A3D6C41F90D6DDAB1C01DB19C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

0944c141-d7c1-410e-b979-472a82865b25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0944c141-d7c1-410e-b979-472a82865b25.tmp
Size 9KB
SHA256 e014cde7a43385e50b1cda501b19992e0ed6db563d05cb0c15a5f314e91f64c2
MD5 a089557a25a8c307ad3581ba901b1541
SHA1 0e567ed238f96a3e7eb073b2ed6ab94c9c18badb
SHA512 b0237288b9b54ab4e404100af4581132fb8b27cda027000b7c97dfd2bb3ff8cf4986531e27f826e62ee95ec3a59e2af1de93419b6853e79eb823f823da80b905
SSDEEP 192:sxZORBWt/f6sWyIdpAWHW6+WN/mV/Y36OXNgIgrJ:sxZOmt/f6sW7XHbY/XT9
TLSH
T13F22A9526E24A97B8CCBD20DBA15BF13E6F9503251D51E48EAFCC61C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

274350eb-dee5-4376-965c-538706f7c0e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\274350eb-dee5-4376-965c-538706f7c0e6.tmp
Size 10KB
SHA256 c48330a82f860f4e2706043571769d74fd82d04acff828e574043ccff69cdbb6
MD5 4452b99371e6ba09857ffe3ca09259ac
SHA1 0e210d0ff6e236f5e3cc65dc81ffc0135c9b3f93
SHA512 daa5e7f91437fb15eb52220d8075a4abe5e866dadefb2e1dc601cb29fd7a578ab13905295ee5485365deb0ae59d2a5e493199fd2b7904022f3c8a808d4f7c578
SSDEEP 192:sxZORBWt/f6smyIdpAWHW6+WN/2SXY36AzNgIg5KJ:sxZOmt/f6sm7XHbbXX/w
TLSH
T1B42288526E28A97B8CCBE20DBA15BF13E6F9503251D51E94A6FCCA1C05F7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53334248-0e1e-498c-97cd-017581dcd356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53334248-0e1e-498c-97cd-017581dcd356.tmp
Size 10KB
SHA256 3a437da1421b365b41b143408f6898a7e5d573f0ba7bcc896688e11b1bc909da
MD5 0fee892324e014ca7fa2012dc3b1205f
SHA1 652343b4538732424508e6cbf5f764fe35a1ccac
SHA512 607cc86e419f9c891cbc07c82ab5a2581cf72de525e2de1df2862109d543e93af7869a61d053716e72eb7b527bab4be8ebd63e8ae3292a1f83fed9b00cdd1f84
SSDEEP 192:sxZORBWt/f6sXyIdpAWHW6+WN/2SXY36GXNgIg5oJ:sxZOmt/f6sX7XHbbXX7y
TLSH
T1F22297526E28A97B8CCBD20DBE15BF13E6F9503251D51E98A6FCCA1C04F66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84a0fa8c-5837-4b74-a8e5-cce9df0a06ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84a0fa8c-5837-4b74-a8e5-cce9df0a06ba.tmp
Size 27KB
SHA256 35da18c357f4ce10d596b9ccdcb19cf6a65539267a004b272c788f2794ba1092
MD5 eb9f4f5cdbe164889732abe3ef9714ec
SHA1 ed854692859827a34af5f586265e19c8fa3dbcd4
SHA512 0b4146160bef2cbd17f3e73824ba70cd9a61b418f2c8b49f804f353b034ac4247c3f3c60e202fe563a55a927927e1cc0673dad26ecbdf87cebe33eb7b37f376c
SSDEEP 768:KYKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/trozo:KYKlm7QWvUYe0u1ja8/L/E/Gzo
TLSH
T1F0C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4087FA984C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f6d75a63f2f1f4e80052bcc87643433e8504e21b6406ac0c929aae97bb5e11d4
MD5 07aaee1d619e5114e43349db71598a41
SHA1 86f51171adac2ba7d9f2734cdb853c604f308895
SHA512 3573869d6d2eac710c6c801f50a8cdbbc1b7170f253daa6741812a5658130338ef0756f57ad6d81c012ae387632dd2a0a73d13db50a20bdb64d9a153f1ed13fc
TLSH
T1A3E020C455C4C23F9214A547016C770C8B812B6B93C06E4FA704C6C4B30744066CBDE4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ce54cf04e5758e70f88bb1f573c36cfcf92acc719789e18b89633c0268e78467
MD5 89b9cfca9f6bf7c06d186f23a7ecffed
SHA1 308e25f81665a47ea7293f2fcbb339db656d513b
SHA512 a104e8a6a40f4a1020f5ce1b4b74a4f7c085fed012ce6373cd819f7a9548955df0c7301de5daf0943eda6c6b9a75407f1b5c05927f955c9eb578ba94a56444bd
TLSH
T1FB81DA80DC804D69FF965B74A2F52AFB31B5B0819AF79EDF30B8C4385467798AA0034C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8df87a5bd9f4cfb66f111cca612edf5f47cd26f62f83efe3c155c3dad056749c
MD5 eb939900e48454fdd1efb5132920cd43
SHA1 7d76933717558ca43de0dbb3eb034d0a7e57dd9d
SHA512 7adf13440ae03f009f4a04df11aae15798067052876dfb2c0e57e05122e87d5bdf03789185eff6e3d8e09d7538833cb0e38939c8935ec07697bba5404eeebc17
TLSH
T1D661DA806C408E65FF965F78A3F622FF35B5F0815AF3AD9E31B8C478A866759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

2766f704-1b43-4923-b961-bbcc466115b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2766f704-1b43-4923-b961-bbcc466115b3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

05a8dd57-3947-4c11-8fee-3d5b2aacf8fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05a8dd57-3947-4c11-8fee-3d5b2aacf8fd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

21ef0211-a5c6-439b-85c7-3a5eea35aa08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21ef0211-a5c6-439b-85c7-3a5eea35aa08.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

adf7350e-9edc-4952-9b20-009efa11bd27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\adf7350e-9edc-4952-9b20-009efa11bd27.tmp
Size 2KB
SHA256 ef53963b7acf59a3cbe55b3526c48d8cd959e53156e050920051da7cd5a93ae9
MD5 4ccf3178878921ed4e204c13458394ea
SHA1 ef31204c1cca051cec7437ac239d0cade56ef2bb
SHA512 411ed535457d1a66a38bfc93e172610b3d91ccd58159e0efb5f955f8c8ac81fa9f7688f67d4e074fd338ad97de2209ed149eded74e84c34e23a837ead6e11b22
TLSH
T1A141CEF3C3D8866DC9015AF0E62CAE2ACE2D065452187D1EC9E8EF5B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 88601858c23647c8238e075ebc4ae5d91bd81550292f929e05d8dc8e9bbdd1fe
MD5 00fa4abfcd6db2c7358e1d34d1931167
SHA1 68df5e6b944d63e50680b334356c231ebe1d223a
SHA512 264c3467aaa54240c2bc1924878150afca4a7c1c08493bf7705aea97313d8aa591a9a8d24006c2788e21d8aba094b37bf3481d7aa40c944909d5ce20f8632085
SSDEEP 192:sxZORBWt/f6smyIdp+WHW6+WN/2SXY36SENgIg5KJ:sxZOmt/f6sm7tHbbXXQw
TLSH
T11D2298526E28A97B8CCBE20DBE15BF13E6F9503251D11E84A6FCCA1C05F6ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecec7ae3-76ba-43ce-80c9-75e4117e0645.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecec7ae3-76ba-43ce-80c9-75e4117e0645.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cb078e6f-5b04-48f6-a810-ebad37ac41f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cb078e6f-5b04-48f6-a810-ebad37ac41f7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d16dd4b0-4adf-43aa-9bb3-f950812ed9a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d16dd4b0-4adf-43aa-9bb3-f950812ed9a8.tmp
Size 8KB
SHA256 79859efae72cee694d2dbc8aedac01a287a8ec8896aaf476d4fd89b8971d2aaa
MD5 8dc6bc0f3c086ddea0303c9da24fb8be
SHA1 89e317b7852b0e2d4441ff09144d58428a8068fc
SHA512 7d29025d52a278e260a86ddce302cc7b25320a03bf599ca4e7fd29c5e9368687a47722fe9267bccf84622e31d42816c37fdf1208386c66160baba94b2c12fbbb
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5gaDGBKP4v+Y1xf//ojdexBywvBCoq:BONX6JUm0QmiUyZWso//3ywvBCG/VSU6
TLSH
T19302FA39BC697C7B8EF3AE45B48777239FA4106BA6912F80DAD85E1C01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

046c1dd6-3a9f-40ff-bc03-7114fee267fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\046c1dd6-3a9f-40ff-bc03-7114fee267fe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6bbcd80b73f0825f43e2d5589575f517213f918f42d5249294b81a5023fccc53
MD5 f1cee90d1d649e01be5ed804c53bec6f
SHA1 95749f83288e05dc6e8265ebecb14bce1ab8863c
SHA512 eabe73d6e6884c7667c4856ea3985e461158a7622857a19edba7442eb3f80d438076888f8ff34f2ac785b464742a62eefc400b0742c2ae89009d2e08db26995a
TLSH
T12241486CA6E91148B3B76F1AAFF2B86E447FB9372F0AD05D10110E4E0A72A40D961737
MD5 SHA1 SHA512 TLSH

Submit Download