f66b899a0ea467629e387e7e703236789333125ccae907fa495d00e8e7277195

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TS2306A-240GF-MSM-9_C388290/Altium/Readme.html
Size 335B
Sample261029-vccteaev5r
SHA256 f66b899a0ea467629e387e7e703236789333125ccae907fa495d00e8e7277195
MD5 6223a82e07b61ab4195faee45255af4e
SHA1 586fd70600f29017b647d54109147a20aa8feb60
SHA512 5ae37ccce42b77aa81dabf67989c14aebeabf6586fc59f6aecc7fa4dd93189ad185f8ddd42303d5ba26685f9edbece1706845f07c9d0500b8236431fd15f3bd2
TLSH
T16BE020F679455E252FF053B090EE32D4545352C315F61D4754C5426364425108FC278D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6C6700B2-D5EF-4849-B5CC-282F32E3AAF2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1620	3668	msedge.exe	85
PID 3668 wrote to memory of 1280	3668	msedge.exe	86
PID 3668 wrote to memory of 436	3668	msedge.exe	87
PID 3668 wrote to memory of 436	3668	msedge.exe	87
PID 3668 wrote to memory of 436	3668	msedge.exe	87
PID 3668 wrote to memory of 4440	3668	msedge.exe	89
PID 3668 wrote to memory of 4440	3668	msedge.exe	89
PID 3668 wrote to memory of 4964	3668	msedge.exe	90
PID 3668 wrote to memory of 4964	3668	msedge.exe	90
PID 3668 wrote to memory of 4964	3668	msedge.exe	90
PID 3668 wrote to memory of 748	3668	msedge.exe	91
PID 3668 wrote to memory of 748	3668	msedge.exe	91
PID 3668 wrote to memory of 748	3668	msedge.exe	91
PID 3668 wrote to memory of 1544	3668	msedge.exe	92
PID 3668 wrote to memory of 1544	3668	msedge.exe	92
PID 3668 wrote to memory of 1544	3668	msedge.exe	92
PID 3668 wrote to memory of 4372	3668	msedge.exe	93
PID 3668 wrote to memory of 4372	3668	msedge.exe	93
PID 3668 wrote to memory of 4372	3668	msedge.exe	93
PID 3668 wrote to memory of 4476	3668	msedge.exe	99
PID 3668 wrote to memory of 4640	3668	msedge.exe	100
PID 3668 wrote to memory of 4476	3668	msedge.exe	99
PID 3668 wrote to memory of 4640	3668	msedge.exe	100
PID 3668 wrote to memory of 3260	3668	msedge.exe	102
PID 3668 wrote to memory of 4184	3668	msedge.exe	109
PID 3668 wrote to memory of 2240	3668	msedge.exe	110
PID 3668 wrote to memory of 780	3668	msedge.exe	111
PID 3668 wrote to memory of 4600	3668	msedge.exe	113
PID 3668 wrote to memory of 4600	3668	msedge.exe	113
PID 3668 wrote to memory of 2068	3668	msedge.exe	114
PID 3668 wrote to memory of 2068	3668	msedge.exe	114
PID 3668 wrote to memory of 3792	3668	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\TS2306A-240GF-MSM-9_C388290\Altium\Readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8753c188,0x7ffb8753c194,0x7ffb8753c1a0
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,13743576874859363358,10935595425150481338,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10168203744795616045,4591856962721571966,262144 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,10835232711320388469,10005360016855274814,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,10899952830970565191,17236771471371988689,2097152 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1130234943531752202,13640499736611157670,2097152 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14637709355558344364,14991013626442981957,2097152 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5358155064286327484,12791200873967297002,2097152 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,18181837280682554804,8063610280984970400,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6074259665672490214,1780935413464726115,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,9201260266199554715,15450031381023741910,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,9201260266199554715,15450031381023741910,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,4733157716719046642,17779116842567386583,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17392359109156106599,6006813074962171711,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9778507223963687417,10410800184703091121,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7589721035004210757,12034649236488892298,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,5807631498672285819,8462962093776585322,524288 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,17217973061850161579,12627343222474934362,262144 --field-trial-handle=2056,i,9640497606893149601,6418840633601535795,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b2fac2a-4c53-4951-9ec6-d31b52c281a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b2fac2a-4c53-4951-9ec6-d31b52c281a0.tmp
Size 8KB
SHA256 9b6cacec75042f66cc56fd659dcdd67c1a736b9441479b469822af786fb1af67
MD5 1de6d390b0a78e689bce4106a2864d27
SHA1 7cb1fb7b80a58464e40db6d7e78d0c1eed121b56
SHA512 12319883cd2a75b7caa42421b6d692a568731f6bf9c25a24fbfe0957cce6753afd67ce5b81b163dfeb969241796e59d6c6be07d6444a5acc45650f041a96c20b
SSDEEP 96:KqONkGQsjpfbUmjH5ih/cIPURHl8h4otop55aD0BKP4v+Y1xf//ojdnx/yw8eBCB:BON+6JUm0QmiUyy4so//aywNBCA6U6
TLSH
T1B102D738BC686C7B9EF3AE45B48777139FA4106BA6952F84DAE81E1D01D725C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

493f02de-449c-4ba5-ae40-02d8abbc00f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\493f02de-449c-4ba5-ae40-02d8abbc00f5.tmp
Size 8KB
SHA256 b92f1954171afd63a0d4ec82da787b7461f54275a184a41462ebeb8c39e5ddf9
MD5 49de263f90f65cd18cfc5496b815a978
SHA1 77eb602094db0ada85090d62e6092fbc53308efa
SHA512 c6a264d17791bcf104e31c680a45be6243921eb5a552ac58bca0c0e0e4af635c75781c63151d608b51b8b8b7b2517adbd252fec167d03c7a3727bb75e83e986c
SSDEEP 96:9qONkKQsjpfbUhH5ih/cIPURHl8h4otop55MID0BuP4v+Y1xf//ojdnx/yw8OxwD:0ONG6JUSQmiUy++4oo//aywwnNx7qyU6
TLSH
T14D12F935B8A8BC7B6EA3A584F48336139EA04137EB896F94D6EC1E1C05DB25C530BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70a06b66-7510-4731-9bf7-338e2d7aada8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70a06b66-7510-4731-9bf7-338e2d7aada8.tmp
Size 21KB
SHA256 6e7df0496aa293d382bd70b0c0477d5919f4705a0a6ef79c88109296f934d7fe
MD5 8f637da75ce02f752d66bee8c9c80108
SHA1 f9746dced56b8c97ccb679e3ef73d1b09e3b5b49
SHA512 f5b31e2ceb50dc29f61128c8d8764500bc5f98cbd625594af6d3f42401a05e3591a9b09f9df76074e4daa13339d5e5b547bc31f6290909c9db220e8486b48e6e
SSDEEP 384:0LiFzQkUSvSzsNV8TUNTUlIl1w4wbDPyHYh//2w65vaTZcaSIIlV:0mFd6swg92KHk/45vaTZchLz
TLSH
T1BCA25D32A8A89C3FAEB79A40F54B3603DEB05167CAD49A94E7DD9E1C01DB1DC134BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

2e21bd01-3286-4806-b4d8-89a7b01b962e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e21bd01-3286-4806-b4d8-89a7b01b962e.tmp
Size 10KB
SHA256 03765da57be387230d5d7f5a74217fc3a42652db77bfca3b8d3c65a56276555c
MD5 2d621aac7a5d60cf2b7ce3d11c499ad6
SHA1 8425f8f3bffd6066a22e8f1b8fa3d7800a537647
SHA512 62f1bebed792c67d0068f1ba5ec2c25ecbb17bad2339c3f1bcef21d3ff1335499e02ee0f6a167155f58db3ca65b139bcb122f918c4b62ca7b12fde0a8ff5d05c
SSDEEP 192:sxZbRHWb/fSs7jIdpd0HW6+WNGY369jS+6Ig5CJ:sxZbYb/fSs78+HbGXcFk
TLSH
T15B22C8526E28A97B8CD7E209BA657F53E2F9503251941E58B6FCCA1C05E76CE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53759bee-3975-4405-8ad4-98d8d5292bbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53759bee-3975-4405-8ad4-98d8d5292bbf.tmp
Size 9KB
SHA256 060f5542d75d6b24d3abb9e662bc16039d2a7d5da0a1aabfb66049bd8d5f5050
MD5 c22315b51c42caea0b4a54f9a62141d1
SHA1 51b0abb95749255176f9369e61abf8cd48de05eb
SHA512 27b2d1de733e0844aaa4ef7dbe96c3b2b223f61a11162abc2a8380eaafe8e142f38eb32ea2b156b83be7f77faa079545788310f093e0e685a798448cbd6d98f1
SSDEEP 192:sxZbRHWb/fSsVjIdpd0HW6+WNGY36WHS+6IgrJ:sxZbYb/fSsV8+HbGX7F9
TLSH
T12F22B7526E38A93B8CC7E209BA65BF53E6FA503251D41E58A6FC8A1C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55001286-ea00-4ca9-964f-cb13b320d3bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55001286-ea00-4ca9-964f-cb13b320d3bd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a37fce1-cee1-49f7-bcfc-fa0e0d6cf8d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a37fce1-cee1-49f7-bcfc-fa0e0d6cf8d8.tmp
Size 10KB
SHA256 dfc274cab307e3558ad391faad8c86b31543106935b15d22b92b9936792bf599
MD5 0261aeac59c488fea7eae5af4d55cd6b
SHA1 153170795259e0d9457130cca0555be0e21e2d6f
SHA512 6ae3677dd747f41bb94beb223cb574dce3bb39d2aa0c7a733b7bdab3358195200589d8df0abe501612f1a933840ceb2c2f05106e87985f6ae6387f7763fd765d
SSDEEP 192:sxZbRHWb/fSs7jIdpH0HW6+WNGY36MUE+6Ig5CJ:sxZbYb/fSs78UHbGXoFk
TLSH
T14F22C7526D38A93B8CD7E20DBA65BF53E6F9503251941E58A6FCCA1C05E7ACE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85f89c92-8eac-4fec-b073-2d7b139d490e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85f89c92-8eac-4fec-b073-2d7b139d490e.tmp
Size 10KB
SHA256 e9478bfd0cace3fd126202444305dc3bfac1929d57ed230a0a42a4684700a4d3
MD5 0e6cc2c110f6c29a02a77b81e62e3931
SHA1 6d2462c505668519c31caf19c0c7ec267dad25e9
SHA512 3c36894fc21c7f817874e6504db325e28617640b79fe83d7f10e4101fd14fe2f3950964a2f95de6d303bceb14156b709c94fbcc172e8e6f8e13b55a63c1c3ed2
SSDEEP 192:sxZbRHWb/fSs3jIdpd0HW6+WNGY36WHS+6Ig5QJ:sxZbYb/fSs38+HbGX7Fm
TLSH
T18422B8526E38A93B4CD7E20DBA65BF53E6FA503251D41E58A6FC8A1C05E76CE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c6c6a56-cb33-4461-a2b8-8169fcc480f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c6c6a56-cb33-4461-a2b8-8169fcc480f9.tmp
Size 27KB
SHA256 9517a5687a1f8b3cb352e8fb2a9c34bc34fc4c3530d8719b11be7a5e65a8937a
MD5 8ed977f55e79f1e4d82cbc09721a6ae0
SHA1 40d79bfb2a100948cc5f709ab26c87c1f9f10cfd
SHA512 9ebeaf46287d51781132c6b6662c5d0789f921f66031b00c1a085dadf44ac6d754689890dd2f2874b300c9e5c1282288649f55a9354a7fc6206f722f375c73bf
SSDEEP 768:fzKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/wroS4:fzKlm7QWvUYe0u1ja8/L/E/bS4
TLSH
T1C2C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1b2711f886af34541f9276fc810f3c90ad5625a0f83dbfebd8cfdedccc74a7f7
MD5 fe2312aed9b6ec13f39c894b75538c6c
SHA1 04001d3fd09cb340be8d6405430bdb1706d37799
SHA512 b8ce629c64c6912db923cf3e22a12e4595ea3a55fae5a3986bf6a4cde6065ad863496f9d3c2764d8022f6f256a4ef575ff75d4f15fd2ce91342d99422456154e
TLSH
T1A0E07D9D15CBC32EB31864C7437CD70C83C0369ED2C4AD8E1708C595B449090B2FA6D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3d24ace3553f78b8fe0d646eac11ad1b7afd587b0c57c1b908f8906bd0c88fdb
MD5 67723d8ac98febb5b163d0e1179da15f
SHA1 985715fc78b1e5392c0a3c846554c4f22e67f04d
SHA512 eaabc3554bf7fae53b606dd29669789ff4b2a43270b12696903654e7fb475f36479c784726361d26a4d44472217991e549a82af1fe2619bfe068fc86688f0def
TLSH
T111514CB1F6EE74C0F75C903997E001933F34B6C196B32E4A1EE4DBB408CA70D801028A
MD5 SHA1 SHA512 TLSH

Submit Download

8ab53ff7-1830-4170-9b59-f47f81c7606c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8ab53ff7-1830-4170-9b59-f47f81c7606c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2ba4d4fa-6f40-4eb3-95ab-4df09fca4559.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ba4d4fa-6f40-4eb3-95ab-4df09fca4559.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a0b032ec-1d16-4c5c-9bcc-e247a80fc3ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0b032ec-1d16-4c5c-9bcc-e247a80fc3ca.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f6e6d19c-8b83-46da-974f-9247119fd0f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6e6d19c-8b83-46da-974f-9247119fd0f2.tmp
Size 949B
SHA256 45c653773716b047515701125c838501babd5e002798e869c3ab508e3e89497b
MD5 c49b3d3ed7681bc566dcdea2fcd9b5f3
SHA1 03e2a23074d599dc6947232cc90aa019e207f0d7
SHA512 404999fb18fd9a2bfbf2e114022c5f7291237638818438e69af8201173b3e1a9378de1445c6e5ad0f904341aa164ea7abfd9696ef3effb758aa6c4d3ed14367a
TLSH
T157117AF7C7E5856E8D1556F09A24AE2BCE2D0A06431C7C1AC9D8EF2B93E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f44a3168c4c7c768b7cf1233329203b79ca9e44a3aee3659a208b34d1bbf65e3
MD5 c3ad8ae6f51028ca95af1d282efb371e
SHA1 0af80f6aa4f03dfa479825e4cb6dbce3bff9a52a
SHA512 bd75baf3369adbe030746f7ecb9c7349fd6b95da847c6aa38b41da4f7a1c2a4d8d7a4c019e3297b92213245997541a76185c97bb2b6d70892c9a37356b387010
SSDEEP 48:K0wfWaAqefbWt2ISyfK9O1UfxoPYVGuuyLb5bIbVbpbzb3bLbkbb3bSbPISbBbkd:K4fSKcYwKOoKXqobeKQkyv
TLSH
T10D91431131BB4B01787D29894675861F428231F37459FA6F7BBCA0E18EAEE044DFE6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a37b94ae-1e1a-41b4-8cb5-b02b785f92f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a37b94ae-1e1a-41b4-8cb5-b02b785f92f7.tmp
Size 18KB
SHA256 1579f61e8ce0317c0d01d8764f367596f93ed1ce75e5b5d484b9048e0c3bf925
MD5 929a28a43957eb00ed75e7df29ca4b7b
SHA1 f8b0a07b3ae6069c021ab2c02ae12bbd09daf2b3
SHA512 af8b6eaeb50656a7a1a02733b7054d1000514d94845a6315769f4f55febfdb57ba677546cd4d9d575f27f424e131924ae0aad6199cc33f4b44a5ad5c70ac51f0
SSDEEP 384:6eQkUSv0sNUUYw4wbDPyHYh//2ws5vaTZcaSIIlV:6O0h2KHk/W5vaTZchLz
TLSH
T157826C31A8B96C2B5EB7A540F18B3603DEB09127DAD81F94D5DE9F2C05DA29C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b25feaca-d356-4ac2-849d-5c13bc91cff3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b25feaca-d356-4ac2-849d-5c13bc91cff3.tmp
Size 18KB
SHA256 9ab7c479ca4e5631373541e126feb97c1d67dcb2f6f679cfc5651b44077e643e
MD5 30bc5e0e12dfd897b08e52a01bf38c3e
SHA1 0a33627af55c7bc001b32e1032e785ac34215c93
SHA512 10ddd28e3ce96a77d68714526ae9bdf552252173050759f4da138c864b15d55f9c4d0c23d73289580f8d4410fdb2944662811e89ac2b8fcb116c35c34b3cdd63
SSDEEP 384:ceQkUSv0sNUU1w4wbDPyHYh//2ws5vaTZcaSIIlV:cO0g2KHk/W5vaTZchLz
TLSH
T12D826C31A8B96C2B5EB7A540F1873603DEB09127DBD81F94DADD9F2C05DA29C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab2d7361-c116-4919-a1d9-09f48d12c9e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab2d7361-c116-4919-a1d9-09f48d12c9e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a4f5a10b806ab3cedbbc0b20cb5cc2fba2414df37d5a4a46bac6af245fd88b19
MD5 88d863dc767e1f947d1613e1db742348
SHA1 472ab243a111e2c26d8d37f86a44341472024357
SHA512 ec51833bb1a6d2478d4e9254414d2545bfdbedfeb881f5ff723151e047e8da21afafa7e614ec39b9570be8c832d33f288683d896d4aa08ae8225fb3a48d655ff
TLSH
T1D4412758AAFA1158B3B77F1A6BF6A86D487BB9332E07D49E00110E4F0662A40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download