2da94c11d816c1709b03930d7599b2109ab29b6ea557cc1f04102bff8e23657d

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command-vault-v2.0.0/client/index.html
Size 520B
Sample261030-wehccafb34
SHA256 2da94c11d816c1709b03930d7599b2109ab29b6ea557cc1f04102bff8e23657d
MD5 851ac596afc923b17d521ff18a05417d
SHA1 8e364513141d089630350f03994972067011d1f4
SHA512 108cb5110bb96f77dcc230a9e2a9117b53cbfa58e7ca6435daa3b43d474651b18e9daee08514fc17679b8f04dfc6fde7ac64a37d9b8e65a501550b3be52adec2
TLSH
T19DF0598388F6CD09423046A55DD1F25D4D81C39AA3895C4636DF696A4FC47C6CEE71A8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{EFEDD834-BCD8-4D6B-9BB0-63E3D20526A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
900	msedge.exe
900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4836	4876	msedge.exe	84
PID 4876 wrote to memory of 2276	4876	msedge.exe	85
PID 4876 wrote to memory of 4440	4876	msedge.exe	86
PID 4876 wrote to memory of 2276	4876	msedge.exe	85
PID 4876 wrote to memory of 2276	4876	msedge.exe	85
PID 4876 wrote to memory of 4188	4876	msedge.exe	88
PID 4876 wrote to memory of 4188	4876	msedge.exe	88
PID 4876 wrote to memory of 1236	4876	msedge.exe	90
PID 4876 wrote to memory of 1236	4876	msedge.exe	90
PID 4876 wrote to memory of 1236	4876	msedge.exe	90
PID 4876 wrote to memory of 4120	4876	msedge.exe	89
PID 4876 wrote to memory of 4120	4876	msedge.exe	89
PID 4876 wrote to memory of 4120	4876	msedge.exe	89
PID 4876 wrote to memory of 4348	4876	msedge.exe	99
PID 4876 wrote to memory of 4348	4876	msedge.exe	99
PID 4876 wrote to memory of 4352	4876	msedge.exe	100
PID 4876 wrote to memory of 4352	4876	msedge.exe	100
PID 4876 wrote to memory of 1824	4876	msedge.exe	102
PID 4876 wrote to memory of 5780	4876	msedge.exe	111
PID 4876 wrote to memory of 3796	4876	msedge.exe	112
PID 4876 wrote to memory of 1884	4876	msedge.exe	113
PID 4876 wrote to memory of 3832	4876	msedge.exe	122
PID 4876 wrote to memory of 3832	4876	msedge.exe	122
PID 4876 wrote to memory of 5780	4876	msedge.exe	124
PID 4876 wrote to memory of 5780	4876	msedge.exe	124
PID 4876 wrote to memory of 900	4876	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\command-vault-v2.0.0\client\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8a1bbc188,0x7ff8a1bbc194,0x7ff8a1bbc1a0
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,14025511196804945087,15214763172296304929,262144 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,14891286601276751229,7342867282432993541,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,4959943187461502185,96120149264610697,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16375279378574853368,11733185348749700528,2097152 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,1422480519216267979,3582197694399524528,2097152 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,10002940297712691537,13232300676999688675,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9163907835679869181,1689043360616784798,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,17983230669245872900,3428041918989461998,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,17983230669245872900,3428041918989461998,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,4890152573906801365,3741612109308254115,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,12267623105985598204,13123150641644276879,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12616562412154886425,8151986579039860048,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4057966612179712803,4662906614462976636,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17509114458647314777,12619736637790053926,524288 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,7418657949180665956,6272283949378888967,262144 --field-trial-handle=2256,i,10651405825868584777,10265169605103329858,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13192bf6-3f8d-486b-9ba5-4d2a2e7924e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13192bf6-3f8d-486b-9ba5-4d2a2e7924e4.tmp
Size 26KB
SHA256 3fa8acf49bf2f9250478ba15dd54e43f0434a389ddb78f682127c21629505147
MD5 3b107b28fe5050471fce79fcdba6e2b2
SHA1 540048a02541ba7b16b2d74dbf04330831f7881b
SHA512 bc0479dda12f2d40eb23bd854a26cf8e181c2299138db5ad04ee12ad1eb128b165278639f3f621e5a156302ee03436d6d9bc4c78bb32d1c8425d6adfc1b6f308
SSDEEP 384:ndiFzQkUSvGs3sNh8TUNTUlI4HaKMloiw2fiBCfkhEyjiiJ2I/gL/7IzxIIlj:UFdGs3gwg1Q9BCfkhDWiJ5xLp
TLSH
T142C24A36E898DEABEDEB4E95B74A3A43DEE04213DA8C5AD4D6C91D1C00D71ED1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b61f799-5aeb-4b54-acc4-e64a6306612c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b61f799-5aeb-4b54-acc4-e64a6306612c.tmp
Size 26KB
SHA256 f1e1eebe2a1f5a0d9c53a29f8491a5beecb4e3f8b7231881b6c6dee8bdc090ae
MD5 7dffa5bb24c85c02f04f751dd845757c
SHA1 32e5c706320a01991f590323845ba83c7ffd7efc
SHA512 8b5e4a213491d05349581ca60f7d0d80046850c46fc73b5867e991e6cc6ca0616fb3cc6a751e5d3b03cf9063c7ffe47d5dc2a25caa342394d58623afed07af08
SSDEEP 384:nUiFzQkUSvGs3sNh8TUNTUlI4HaKMNoiw2fiBCfkhEyjiiJ2I/gL/7IzxIIlj:vFdGs3gwg1w9BCfkhDWiJ5xLp
TLSH
T175C24A36E898DEABEDEB4E95B74A3A43DEE04213DA8C5AD4D6C91D1C00CB1ED1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79de0820-87e4-441b-be1d-b4d2b9e8b80b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79de0820-87e4-441b-be1d-b4d2b9e8b80b.tmp
Size 26KB
SHA256 2ddf98d0d138a453f8e194915674f243e1919fa9189b354431ec9df934157f84
MD5 7fd170847ae3c5f365dad987c37cc4a8
SHA1 d1ebe3507448e530023c06a84cf889129184ac42
SHA512 ef22a17ca8254627040008910e6a85d8b985bf6c040f9a54c1e21fb3864c3243beb4c0577ed07e895c6f9b26aa69d9fad954a40536fc99729c6b65dc20092f03
SSDEEP 384:nfiFzQkUSveJs3sNh8TUNTUlI4HaKMNoiw2fiBCfkhEyjqmJ2I/gL/7IzxIIlj:qFdws3gwg1w9BCfkhDmmJ5xLp
TLSH
T175C24A36E894DEABEDEB4E95B74A3A43DDE04213DA8C9AD4D6C91D1C00D71ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99eb76d0-f9c9-4122-828e-ce965561ee46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\99eb76d0-f9c9-4122-828e-ce965561ee46.tmp
Size 26KB
SHA256 c84450d356d897abf9bff56fe497c6475834841f16c49d4ccca8c269732e9215
MD5 b94666340c18fe7103f79d36043bb373
SHA1 091907aab8eb0b0bd6a44d74c8d4709300c8a450
SHA512 82ba551adf2a83e47e67e272169cb6d682659216e1f62804c699024ddfcdd02bd3e274801b187ea5242c8694df8e9432de0b8c820ba752885f16ce677223f89a
SSDEEP 384:nQiFiZcI63sNV8TUNTUlIm2aKMOgTw2fiBCfkhEyj6iJsa+VYwSgL/7IzLon:rFQ63wwgc5sBCfkhDmiJhgAc
TLSH
T168C23A32EC94D9ABECEB4FD5AB4A3A03DDF44263968CAAD4D5D81D5D00DB1AD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cc3e3c2-4a6d-41ff-aa57-b2077088a07f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cc3e3c2-4a6d-41ff-aa57-b2077088a07f.tmp
Size 25KB
SHA256 bfe0cdd3100f60720137ff42ccf8359e58b60c89769ed16082591bac5ff972c5
MD5 8aec487df6c770dd6de111816a81f205
SHA1 ccb0441866956bb6497e5f4dcb353d2dc0b3d047
SHA512 9d83cb8b6496b58852ca455429811dd35c2b9bc99b1ee1fd2428cefcc6612cca2b285e4c2fcef8b74459ec99e72f882e3179d7a32d11d0d212819d8e8ff97e8b
SSDEEP 384:nKiFiZcI63sNB8TUNTUlIm2aKMix4w2fiBCfkhEyPFSsa+VYwSgL/7IzLon:BFQ63Uwgc6nBCfkhDPFShgAc
TLSH
T156C24B36EC94D9BBE8FB4FDAAB4A7A13DEF40163959C5AC4D6D81D1D00871AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

02b253f2-729f-484e-a510-c4acf4196e48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02b253f2-729f-484e-a510-c4acf4196e48.tmp
Size 11KB
SHA256 ab48e5c4785102ac1bbe3e78f6d76bff4b387b184393419d6a273cda4a811cce
MD5 a2d53462b571eab5a2d0dc64d507b884
SHA1 6f5155f3bc0140c1a279f4f452532e5f866f76e1
SHA512 792cd8623b956eb595a71bfe8525a0f4406c743b9ad00fd0ff5d98d5c360bc8bb94884c61dbd9b3c125cec3eb72b68f38b5575ee346d9fcd0d432746708afc30
SSDEEP 192:sxZIRJk4/fVsmUaQZL586zodpHXHW6+WNGYor+pSDUgIg5ot6J:sxZIM4/fVscOqB3HbGESvqt2
TLSH
T1B042C7156D28A97B8CC7D619FB55BF53E3FD5032A0910E44AAFC8A2C15E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b333581-3c58-42c4-81f5-8df8041bddba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b333581-3c58-42c4-81f5-8df8041bddba.tmp
Size 11KB
SHA256 dd767652644eb040500d4040c7c0a58db219a67637f3ad242927dcbe9039425d
MD5 46ab30b2107a859f0e8da92f258bff91
SHA1 30ca4201bd83c51cb99392344bb8ff47511a4cd9
SHA512 646392335f55129f49689c187d1fbdb52df97fab73a85af859ebd3b601ba621814797b5f290313caf0ff2db5e6355b9de622d2bd1152fdfcd8680664bdf90ab6
SSDEEP 192:sxZIRJk4/fVsmXQZL586zodpHXHW6+WNGYors+pSDUgIg5ot6J:sxZIM4/fVsiOqB3HbGdjSvqt2
TLSH
T12C42C7156D28A93B8CCBD619FB55BF53E2F95033A0910E48AAFC8A1C15E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

373beb9d-4613-46b8-9228-63d92a0f9653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\373beb9d-4613-46b8-9228-63d92a0f9653.tmp
Size 414B
SHA256 23fde376ee33d7ce62ccb3e6fce0e7497eef86c3e56fcaceb0869c3056041ec6
MD5 f8036a1344910d39373a601a41b62b68
SHA1 421e65a57da6f134ad87e903262bd782e38e164f
SHA512 892b5c4f8b9dfd1072ec289e8a4443265654be752412bab628870d717205040c1936f7aae53b17e6cd7db897c43b7403a2236401a310a4b61f4574a6f4a62590
TLSH
T183E022AAC821EC3B18FD0B7860940246FB45232B2B40EC4B3B3D940C8FF063A419AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

3fc09855-1efb-496f-bc77-f0c1ab9bd212.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fc09855-1efb-496f-bc77-f0c1ab9bd212.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9eeae768-9b18-40b6-ae12-85a2e7aedead.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9eeae768-9b18-40b6-ae12-85a2e7aedead.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ae50572574f6c13bb06c9e7879463410f1b1444f085c16979870f17a7855c12b
MD5 02056a1f4494536d8240e6a90bbd8468
SHA1 9ec7accac57af717cf72aee3b526e844fdb96dff
SHA512 e3ce4ea22afcfe5246466b28f7b27616365b41e448f4b5125d07cd641bfff831434fca7d909744074a6af7185a11287bae8c3c35901b4921a193992436d8c7b3
TLSH
T1E6E026C544CAC33EF70CB657017C530C8380666ADBC46D2F7B08C5C57845848A287AE0
MD5 SHA1 SHA512 TLSH

Submit Download

81d04df5-cf99-4d0d-a3ac-a0891cdc9edb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\81d04df5-cf99-4d0d-a3ac-a0891cdc9edb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

49ee2f18-734a-4afd-a3f9-4c670b79dc30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\49ee2f18-734a-4afd-a3f9-4c670b79dc30.tmp
Size 1KB
SHA256 2aa08cbd24cd33ae59db948d6d0b5cd2be499b8b9e2689bcffe982a1b1ff93ec
MD5 7a07ff283e3b8c4de8d5f2d7b11465bc
SHA1 5cb227ae243a9b960c78623ce133ef1cd5ced2c4
SHA512 c5dd1e5658b21fcbb633e2d4818ced285a2d09496b6a254f5daf8b10d645917efe303b60dbc6b6921b934e8fba9e03012a416f58a11d490a5d1670f2a5b69066
TLSH
T1DA3190F787B4856E8A00D6F0AA18AE2BDE2D0511431C7DA9C5E4AE2B93F3471D141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

6587ba9b-9d6c-4625-92c8-9834797df81c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6587ba9b-9d6c-4625-92c8-9834797df81c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d7e33d54-8aaa-4560-8afb-582ddc01d084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7e33d54-8aaa-4560-8afb-582ddc01d084.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9640bbd8302938688e00365a90469ecdd4a97d140ce6405471800961a14ddaed
MD5 fbd5b393f7502644b7716bab111f5c8c
SHA1 44ddb357f00a2115010544749deb963435ca1182
SHA512 f00cac824021d9316f1956c44b29511d4c3e94b7245f8abaab6008392a4b9a126038a248dc2440e51d03cae59a15c76e354bb6a14af4e826ed26cafb951e5372
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgj:ST/2dXOJhJlpfnpp3tNXVrN3AvDy
TLSH
T1CDB2225571BB421039FE291C91B5872E064272733219E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d05379ce-d228-46e2-9d04-3925e32e94b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d05379ce-d228-46e2-9d04-3925e32e94b3.tmp
Size 11KB
SHA256 ddc3122b7db4300ddfbe155b2180395cccd46c327cb49465f2527565e340435d
MD5 7927176cf2ff1bb20028fe144d523048
SHA1 03816c095627c49a4de6fd364be61de706237c46
SHA512 f69a9584a23a8004e91b374090acf9e736a8521a3dd4bb01e59eb61adf43f966b287e4a5e8c7c03abaf49328a7fe392e50585d0b60d346c6ed4b5da2fdeaaf7d
SSDEEP 192:sxZIRJk4/fVssUaQZL586zodpHXHW6+WNGYor+pSDUgIgjt6J:sxZIM4/fVsyOqB3HbGESvjt2
TLSH
T16C42C6156D28A93B8CC7D619FB55BF53E3F95033A0910E48AAFC8A2C15E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32e9d4d1376acbe61fdd9290763ebaa1be8f847b1f877b36676445ebaf1616e4
MD5 4d4682469ba121764523a87d45533f5e
SHA1 bc9b1132e4209f54d5133712b41b0ef99d247988
SHA512 0c42a33a7252e61ea83618816e252285fdbb3de74048af2131a6ea074e5c598e793451655603c4e6df5a49faf3d9088ccada8dc0fa3a19e5a71e68f6daf629a4
TLSH
T10141FB98A6E91148B3B76F5A9BF2787E487B79772E07D4AD10010E4F4A22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download