0e72b8e7e3672bc7fa38b6033d67819c66222ac3049ff57523bf90a544d4f930

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
外贸单证与装柜系统/使用手册.html
Size 2.0MB
Sample261104-wthxesb13y
SHA256 0e72b8e7e3672bc7fa38b6033d67819c66222ac3049ff57523bf90a544d4f930
MD5 d0fd21c844f2fdabcdcb4b34f3c2e761
SHA1 ccef6d1982068473799fe82513c9422b48b057f3
SHA512 708954aaacaa21b5a27d1627382014326b34817db366def57853d7fa3e69e410c9a2521f83ef00974fe3e661ffc54117276259fa95ac643662b25660661a6151
SSDEEP 49152:MfffffffffffffffffffffffffffffUDkBw77777IO4yEFvqlYk8b0:p
TLSH
T1B2A5E0398AB2F8ED073C11E9F41D9D313DD22CA390A853435BCA56ADE85D8D2C50ABDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1684	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{0CD16DA2-FE39-41C2-B4CB-21F9ADC04602}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	msedge.exe
468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4684	1660	msedge.exe	84
PID 1660 wrote to memory of 1684	1660	msedge.exe	86
PID 1660 wrote to memory of 408	1660	msedge.exe	87
PID 1660 wrote to memory of 4324	1660	msedge.exe	88
PID 1660 wrote to memory of 408	1660	msedge.exe	87
PID 1660 wrote to memory of 4324	1660	msedge.exe	88
PID 1660 wrote to memory of 4324	1660	msedge.exe	88
PID 1660 wrote to memory of 368	1660	msedge.exe	89
PID 1660 wrote to memory of 4132	1660	msedge.exe	90
PID 1660 wrote to memory of 368	1660	msedge.exe	89
PID 1660 wrote to memory of 368	1660	msedge.exe	89
PID 1660 wrote to memory of 4132	1660	msedge.exe	90
PID 1660 wrote to memory of 4132	1660	msedge.exe	90
PID 1660 wrote to memory of 2000	1660	msedge.exe	92
PID 1660 wrote to memory of 1592	1660	msedge.exe	91
PID 1660 wrote to memory of 2000	1660	msedge.exe	92
PID 1660 wrote to memory of 2000	1660	msedge.exe	92
PID 1660 wrote to memory of 1592	1660	msedge.exe	91
PID 1660 wrote to memory of 1592	1660	msedge.exe	91
PID 1660 wrote to memory of 4312	1660	msedge.exe	98
PID 1660 wrote to memory of 512	1660	msedge.exe	99
PID 1660 wrote to memory of 4312	1660	msedge.exe	98
PID 1660 wrote to memory of 512	1660	msedge.exe	99
PID 1660 wrote to memory of 1868	1660	msedge.exe	101
PID 1660 wrote to memory of 4724	1660	msedge.exe	110
PID 1660 wrote to memory of 1772	1660	msedge.exe	111
PID 1660 wrote to memory of 3868	1660	msedge.exe	112
PID 1660 wrote to memory of 4880	1660	msedge.exe	114
PID 1660 wrote to memory of 4880	1660	msedge.exe	114
PID 1660 wrote to memory of 3884	1660	msedge.exe	115
PID 1660 wrote to memory of 3884	1660	msedge.exe	115
PID 1660 wrote to memory of 468	1660	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\使用手册.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc4c7bc188,0x7ffc4c7bc194,0x7ffc4c7bc1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,4285012122246783502,3455628707224921692,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,12047033147639527268,5696530236726923305,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,4680683153696502965,7146914140137633598,262144 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13774390075990864585,2597679045953377698,2097152 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12959545611169294634,8270992887307446812,2097152 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14836877886902276397,496222117922157527,2097152 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,4533120452463528214,15678615280746492257,2097152 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,172784602992077453,1046006109347997062,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1410922793318228529,8843711366245256212,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5020698874269335128,17664258378939620732,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5020698874269335128,17664258378939620732,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,16079073404117664240,3567587374568574616,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,6443947328635523878,14265913718839466129,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,2994262283808403684,5952377929585412846,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,2264909022746973399,7512473385726108958,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5870963129873803133,7753209801289013017,524288 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5228,i,7963682607685206372,16816710013344783273,262144 --field-trial-handle=2284,i,12970536965404841761,14528314952824231836,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11ab9452-94ef-426e-a4ce-1c7b258a3bcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11ab9452-94ef-426e-a4ce-1c7b258a3bcb.tmp
Size 8KB
SHA256 222e95c690c13eb5c0394ad6d1a9d30148ec8721041d8046bcc56e18221df297
MD5 2d63ccc9dd7fa765bd58dc48755cca77
SHA1 9aaf468df537ba5b219ce7210d119f6232a0ef13
SHA512 9a9836aeeccb84c7358e350778c16ae2cb5f57b39f0934f3378b7150ff656adb7f5f12330b38e2ea8ab8d25af6d6cd27205f6ee21be34ebfd1fd59a327b13376
SSDEEP 192:QONq6JUiQmiUyYYY5xo//ORhpANxSqTsU6:QONq6+ejN5xo//cpqjsU6
TLSH
T1D2120835B8A8BC7B5D939541F08372139E64407BDBC65F95D6DD2F2C02EA1AC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29ebaf39-8fc1-4e50-b550-04cdd3cb66de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29ebaf39-8fc1-4e50-b550-04cdd3cb66de.tmp
Size 18KB
SHA256 dc4ef1378085e2bad546cf1e758912957f38cf6a160ee81d5ccaec9e230b4ab9
MD5 bd14e716f1a2db5792ad3f06e8dca067
SHA1 686503e61b15e5c24676b0dfd53cc4c7456cb34e
SHA512 5e5fd03237e4aea2d50bb2004ab2c61954182e915f9df75c8343689acbe0e1f9ca3972f21e72998a0d6c90474c4d4cbc8f862f7c4c656b2da87d83a49f54a141
SSDEEP 384:HQkUSv0sN/fpor94qbJKWsjh//cpUjsH7vBERzIIlW:Z04WsF/DjsH75EtLo
TLSH
T1F8827D75ACA8AD3B5EE3E541F1063613DE74806BDBC50F90D6DEAB1C01DA1E8234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

389c8301-ed66-429c-8723-bd9ab0c8a847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\389c8301-ed66-429c-8723-bd9ab0c8a847.tmp
Size 18KB
SHA256 84e236b72911f06e95a6e2f8994aa77eb4e3e9f8da92d648ec2316959c2f819a
MD5 00b1d3335617dc0dc06b812fdd93cf3d
SHA1 1fd35dbbc4fd700cb3e6325959c3219cb147a7e3
SHA512 6f0a872c1ce45c8079ee274567d2320dc727a9d87f9d07a316cb14f90cc60e6dbfdeef01c5368133a210bf020ce3e1be36dbe1a40a087687f938180d867ce7af
SSDEEP 384:kQkUSv0sN/6por94qbJKWsjh//cpUjsH7vBERzIIlW:U0lWsF/DjsH75EtLo
TLSH
T1E7828D35ACA8AC375EE39541F1063613DE74806BDBC50F94D6DEAB1C01DA1E8234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

1a69634f-20bc-412e-b00b-0c42973e3450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a69634f-20bc-412e-b00b-0c42973e3450.tmp
Size 9KB
SHA256 c9e7e329d46274e7ec1de98f6e367c63286d66c4e7ad7d571cb947015a7227c9
MD5 10612ab570346880b4caa1fe33f5effa
SHA1 f6b31cb70b6eb22580e2741e799644bf5d5cbde5
SHA512 ed8e5db2fbaa6ba3776807d853b1219fc0680bbe3310ce16acff053af924231c7ae681c23f32f990c80f83ea21293430d4fc6c0e93cdedaaa3bd3089a21df19a
SSDEEP 192:sxZ+R8WW/f7sDE9IdpdVHW6+WNGY36WiGrIg5iJ:sxZ+lW/f7sDE+XHbGX6Y
TLSH
T1C722A7116E38697B8CC7D20EFA55BF53E6FA503291D01E58EAFC861C05E66DD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b8d9c0f-96f5-41a2-891d-8a707dcab193.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b8d9c0f-96f5-41a2-891d-8a707dcab193.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2792735c-a4a1-420b-a1ce-a4e7d74e9d17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2792735c-a4a1-420b-a1ce-a4e7d74e9d17.tmp
Size 27KB
SHA256 c64807f62bc43973ac4089233cb2937f20b604f0b8cbf5b6aabb9dac923b8bc1
MD5 1bd71354de771366cc8447015f9af0c3
SHA1 e3e1665c3aaae3ec1d705bffa9c06ea2fc7644df
SHA512 c0d2343c1406179cb867d29d2a38018501ea34587e45dcb8c149a1f7a4552775a3ba1839702c791bc99526f1cf3642a4658d5e5bb30827e9174c685a89f9f3d7
SSDEEP 768:qQKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/1roI+E:qQKlm7QWvUYe0u1ja8/L/E/OI+E
TLSH
T18BC2FA3B640CCB7E4FC04E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 391adfc85a932bc7f883b536bc076bf404da26def75feb79954cba709f42cdcb
MD5 eb7850db8f63bd34a5358a4e2c60a9ac
SHA1 1f2bf3b65b3280a21832355044e2371437f5a41a
SHA512 db5c4ca629a74dfd1e62a3133830b1ff1eb68cf5f6224cf0a270ef41f778821b7f15602ed0a5e5251af3d4a427b1472591b6aafd646e7bcb358f4656fdd63d76
TLSH
T1ECE026C889C8C23FAA48F44701A8530CD281366FA3C4691E3B01C48D7445088FBCAAA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f862fc53e8717b831ecc3868d4988904f7b21227450f8c23cb5ccd98ec0f54e
MD5 47b87c2da79d29262850a6cbf0f4651d
SHA1 37c1b5e20b218d81df995c5ef17d35177cf6c1ce
SHA512 df796938d6635b1e8006820f47cd6ff576410eb7f207e8b496610577864e849d45f1191804549908194d02634746f5c416c3c757b26818f38a0cada464813f5c
TLSH
T151510B81E554FA60FBA8C43842D616F732376BB0B2831D8E0FD3C4781817755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e9af7493d1ede9dae0423133b3dcf9382b986a75f1ac1a23daf068d713570ce
MD5 2310ee2502daf6095edb634b2c874201
SHA1 14873a909dd93035998a80ea8b3edf76b2788178
SHA512 edf25f3785c98a14e8210146fc06ceda177fc62f1e694651a7eb4d3e57aa829f0cd21249024d4aef7035751772c9c8d4744ff59ebdab9a34255d761235a46957
TLSH
T184510B81E554FAA0FBA8C03886D216F732376BB0B1831D8E0FD7C4781817795A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

7af5f375-e661-470b-b9fd-1af513df1e9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7af5f375-e661-470b-b9fd-1af513df1e9c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

309a72f6-37ef-4375-bdef-9bcbdcbb710d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\309a72f6-37ef-4375-bdef-9bcbdcbb710d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

87466fd8-cab5-4b7a-8b4f-04482250057f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\87466fd8-cab5-4b7a-8b4f-04482250057f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aa1f99f1-03e1-4e0b-8d1a-28487cc6a185.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa1f99f1-03e1-4e0b-8d1a-28487cc6a185.tmp
Size 949B
SHA256 2ff38629c567b1fd63abe09a20a0f158512a307e50f38ca4369f6f10a0e93a9d
MD5 255fced7a68202cbaea64cbdec50f39f
SHA1 307a542a8c6781e1b4dd09e7e0249a37aed2c213
SHA512 dd540c745ecee3b8106de6a5de1dc9ab063b8864938f5765798e22bdb50609a6112e39ac2beffe6737c7bb5e2bba77c2238223dcb796c95160d4527d6df25046
TLSH
T12F117AF7C7E5856E890157F05A24AE2BCE2D0A06821C7C59CAD8EF2B93E3479E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8b62addfa6eac75d45537c8da6508280cacb6a78acb820b635ae0cf933156168
MD5 04c57f15c57ee33eeef1cac739dd84c1
SHA1 b9bcc4686a8021bba9d3fc17570449305d3e28d2
SHA512 fb087b61000c47af7f773ee5a7e6901f30ab810fe0be44404256624aecc4c5c27dd6866bc19165457f6a9b835e47016526d2690506b23ba183e447b5cd00a154
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/jyL8rKWkmKzb6ZCISOzK9q1IzxsjYhyKW:KEYQKhmOej+KE42WLWKQUU
TLSH
T1D391E18471BF124539BE29489078971A115231B3309CFA7AFFBC51A64EAEE044DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c067dc67-2b8c-4bd2-8429-2944876f0475.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c067dc67-2b8c-4bd2-8429-2944876f0475.tmp
Size 9KB
SHA256 b750515e5c8198b727f29dac6def43fa8d73183f54043990d361aa3b2ef74dce
MD5 80c8274e65520bed812092b74954e3b9
SHA1 181fbeba887753ae9d0fe867a68e7ba5d20317d0
SHA512 78f3a8690af3c7778af3d563eb7b55f72a0710a3393ba3d4ec885db848973245e0d993f6573c2a49b6fe4a2a28e1724776f4ba05cb1b3044d33790e82004ae40
SSDEEP 192:sxZ+R8WW/f7saE9IdpdVHW6+WNGY36WiGrIgrJ:sxZ+lW/f7saE+XHbGX69
TLSH
T18B22A6116E38697B8CC7D20EFA25BF53E6FA503291D41E58EAFC861C05E6ADD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd176644-7db0-46aa-95e7-ba12a5007385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd176644-7db0-46aa-95e7-ba12a5007385.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e05c698f-a770-4f24-8739-82ce36556abd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e05c698f-a770-4f24-8739-82ce36556abd.tmp
Size 10KB
SHA256 a3b8c7ac8c1d6a4564e65c09f612f1178c236abd8fe4a19421b5a0d658122b5e
MD5 ea76f4f0463aa728007743a211aa319c
SHA1 22d395f558cd7d9af388e45eb65e15ff15d72733
SHA512 aefe55d6102cca1002a407901696633c8c417f74097048d6ac35ae6b72a011a991bb4c000761c8bcae2833b2f9526cec584ae5b4f009726490aa5cc4b3671e34
SSDEEP 192:sxZ+R8WW/f7sNE9IdpHVHW6+WNGY36jTGrIg5IJ:sxZ+lW/f7sNE+1HbGXwC
TLSH
T16622A6526E38697B9CC7D20DFA15BF13E6F9503291D01E58AAFCCA1C05E7ADD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6ef4d2f-f338-4bb3-8f26-f64e06d4795b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6ef4d2f-f338-4bb3-8f26-f64e06d4795b.tmp
Size 10KB
SHA256 a8b7b275d50f9edab78f9d2c152469e53790ee1fd8e629623cbb8fcee6bc69de
MD5 e23cb51ed69d644a2ca2dbd799a4dfd4
SHA1 7ef9cb1438c6527b4bc0d61a71825f497a2c759d
SHA512 1c04965cfd3cafc4ae6e96fec31489cf4f454b53713ff8413a67da0c4f1ad3702a7f853fb5675d7139e502593684fd22f17e3669f0c3693b4c722d6772b71884
SSDEEP 192:sxZ+R8WW/f7sNE9IdpdVHW6+WNGY36GQGrIg5IJ:sxZ+lW/f7sNE+XHbGXqC
TLSH
T17522A6516E38697B8CC7D20EFA15BF13E6FA503291D11E58AAFCCA1C05E7ADD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e591f436-da06-43e9-86a3-c0dd370d0424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e591f436-da06-43e9-86a3-c0dd370d0424.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc501edf-da33-4dad-aff7-5e4be56b9ad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bc501edf-da33-4dad-aff7-5e4be56b9ad3.tmp
Size 21KB
SHA256 0132c4c4fad56f435b54d2ab82590ec47cb064ea537dfa943615ac9a3475458f
MD5 4779211a911ad652b8e5c94992b6116d
SHA1 325632f43ce76c0b6381ca56334dc2ddd29235a3
SHA512 50e02306ce3781d977218519e3131dc1938d357bfbf46f5f2e5a3d8de63359e786f31303818b0c012a766895f8827a015382dd3625cc29e8ccc2a692c2204bf3
SSDEEP 384:ziFzQkUSvYzsNh8TUNTUlIlfpor94qbJKWsjh//cpFjsH7vBERzIIlW:eFdkswgZWsF/MjsH75EtLo
TLSH
T125A26C72AC98DD3BAEB39B41F14A3213DEB080A7CAD55A90E7CD9A1C01DA0DC134BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e60250e-9cab-48b2-bda1-fe359be1ce0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8e60250e-9cab-48b2-bda1-fe359be1ce0b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb6e6294-c272-4817-bb95-b6035fe987ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb6e6294-c272-4817-bb95-b6035fe987ee.tmp
Size 8KB
SHA256 a89565aafc8aa35e0a0a8f9aac13a8ff944532fac7b337794b7d4c3d51f3e5b2
MD5 1cf6ac8d2cdfb32451e8915376c47a99
SHA1 603306c32af8e438629dc7cf5670cae37eede033
SHA512 7906b3bbbebc5ff7f38f1db15c9f4afe5e2191b1b22b5148956517ac25273a5e0a5ccd2043023517182070b1ec4b37af8722a1afd1069856ce5a2e8a490b9ad9
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5YHaDYPBKP4v+Y1xf//ojdFxjYpoR5:BONw6JUm0QmiUyY8Y5so//ORhaBC6aU6
TLSH
T1AB02E634BC68BCBB8EE3AE45F48777239FA4107B96911F84DAD86E2C01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a12f2dbfd7e43d63529f3594acc4db57d4b74dae053c198dc46082ed25302c1
MD5 8f51a444c32dba58311204b801aa7c2f
SHA1 7184a207cbac16b565ba23fe0c1b439ac225b991
SHA512 acf18aa97c05f7da27e1cd608a7dca08e303ad9f5a01bee5762615b67fd6c77a0633c570de767583c82cd80348829eb020a8109f5fa0e99cc79e57cbc612572d
TLSH
T1D8413B58A6EA1148B3B76F5A9FF7A86D44BAB9771E06D4AD10110D0F0A33B00CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download