hxxps://yousign[.]app/signatures/8dee7905-7bbd-44e5-b68a-ac6371ad5732?s=b6b2341efc80f8baf994c1384f73b3b3dbdfc41013873b8ea70f75775a75d326555f01b12af778a682ea113be712a2839acd0a3530771217d7fa83d9efc3cd29&r=ded1ee5c7d1dabd64f9a73dce7e71bfd&source=email〈=en&magic_link_id=fefc78e7-0e01-45ae-bcad-3222d8d106ec&domain_id=93af150770

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://yousign.app/signatures/8dee7905-7bbd-44e5-b68a-ac6371ad5732?s=b6b2341efc80f8baf994c1384f73b3b3dbdfc41013873b8ea70f75775a75d326555f01b12af778a682ea113be712a2839acd0a3530771217d7fa83d9efc3cd29&r=ded1ee5c7d1dabd64f9a73dce7e71bfd&source=email〈=en&magic_link_id=fefc78e7-0e01-45ae-bcad-3222d8d106ec&domain_id=93af150770
Sample261104-xesnraed89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{5E5C938A-021C-4241-A90E-784C4FB748D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4320	2548	msedge.exe	85
PID 2548 wrote to memory of 1412	2548	msedge.exe	86
PID 2548 wrote to memory of 1928	2548	msedge.exe	87
PID 2548 wrote to memory of 1928	2548	msedge.exe	87
PID 2548 wrote to memory of 1928	2548	msedge.exe	87
PID 2548 wrote to memory of 3728	2548	msedge.exe	88
PID 2548 wrote to memory of 3728	2548	msedge.exe	88
PID 2548 wrote to memory of 2716	2548	msedge.exe	89
PID 2548 wrote to memory of 2716	2548	msedge.exe	89
PID 2548 wrote to memory of 2716	2548	msedge.exe	89
PID 2548 wrote to memory of 1776	2548	msedge.exe	90
PID 2548 wrote to memory of 1776	2548	msedge.exe	90
PID 2548 wrote to memory of 1776	2548	msedge.exe	90
PID 2548 wrote to memory of 4796	2548	msedge.exe	92
PID 2548 wrote to memory of 2980	2548	msedge.exe	93
PID 2548 wrote to memory of 4796	2548	msedge.exe	92
PID 2548 wrote to memory of 4796	2548	msedge.exe	92
PID 2548 wrote to memory of 2980	2548	msedge.exe	93
PID 2548 wrote to memory of 2980	2548	msedge.exe	93
PID 2548 wrote to memory of 2744	2548	msedge.exe	97
PID 2548 wrote to memory of 2200	2548	msedge.exe	98
PID 2548 wrote to memory of 2744	2548	msedge.exe	97
PID 2548 wrote to memory of 2200	2548	msedge.exe	98
PID 2548 wrote to memory of 4376	2548	msedge.exe	100
PID 2548 wrote to memory of 2696	2548	msedge.exe	109
PID 2548 wrote to memory of 2280	2548	msedge.exe	110
PID 2548 wrote to memory of 5020	2548	msedge.exe	111
PID 2548 wrote to memory of 1440	2548	msedge.exe	113
PID 2548 wrote to memory of 1440	2548	msedge.exe	113
PID 2548 wrote to memory of 3020	2548	msedge.exe	114
PID 2548 wrote to memory of 3020	2548	msedge.exe	114
PID 2548 wrote to memory of 3776	2548	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yousign.app/signatures/8dee7905-7bbd-44e5-b68a-ac6371ad5732?s=b6b2341efc80f8baf994c1384f73b3b3dbdfc41013873b8ea70f75775a75d326555f01b12af778a682ea113be712a2839acd0a3530771217d7fa83d9efc3cd29&r=ded1ee5c7d1dabd64f9a73dce7e71bfd&source=email〈=en&magic_link_id=fefc78e7-0e01-45ae-bcad-3222d8d106ec&domain_id=93af150770
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,17262937798597663540,464675980531457150,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14740087904629084898,3901591624742311004,262144 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,16420920402828588028,18377816417517550289,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,17586073377678282294,6693866264171854742,2097152 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9093494263445957116,4663879054428427613,2097152 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9822088446461911578,11849595515013487082,2097152 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,16435363055752581333,1444130843559560641,2097152 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10973743695162483547,36909702265385649,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14678650228429675458,17750634695850985932,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,7031364589882469422,5526639272669002919,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,7031364589882469422,5526639272669002919,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,15528124721919108142,2128250903792566592,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6513695378547129659,15834577647283419870,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,2512473596439144268,9747973514812382173,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7846609994711942042,13612698758429022582,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,485255225686028807,9920443368782130255,524288 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,7638453531915841024,8440682154908412907,262144 --field-trial-handle=2288,i,3097784040949025812,5550483857111279884,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06278b24-3939-483c-a356-64261c1badf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06278b24-3939-483c-a356-64261c1badf4.tmp
Size 18KB
SHA256 a30f30002c1e38b8aa20bfd48c32775a84fc3b925337d64c19e0165ccded2064
MD5 2dd5933587e816664d3b9fa8af10f7a2
SHA1 d98e59377bed3f303db16f216b8d6fca37227d5a
SHA512 e2ab47a1a42c9c920379866ab55510fe8832f5f541456fc0e51fdc94ebac10be004539b8f97877562f35e6cd427f97adc6dc01d10e18fc5f877dd58a4e06b672
SSDEEP 384:7QkUSv0sNjvfpng59RWBGYX5EFcZlkwH7vBEp6IIlv:10SgVQGYuFcfdH75Ep6LF
TLSH
T15E827D75A8B86C3B09F3A551F14A36079EB4911BEBC86F90D9DD5B2C01DE2CC234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b0492d1-c6c8-40e3-a291-c9fdb7ec168b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b0492d1-c6c8-40e3-a291-c9fdb7ec168b.tmp
Size 8KB
SHA256 10ce3f927ef7f009d177cb30a5e526efe63e808c9e4c50d2ae441e27370108e5
MD5 f2f4b1bc80ad31d90e386d3d4d15b854
SHA1 b839d6b9c6d97bf6d3e55c9cf8edf82de1a73967
SHA512 6dd6a2457a05b1a7699da34157edd002a3df26f1560e5286bee0295d5edc0b887868b9a2b3d4edd07b769fd93c6c2a92f01efb70c3355bc4dcc773cac0b407fe
SSDEEP 192:AONm6DphmqQmiUyDNCwGYX59ezkCERtZTkIIkUq5UU6:AONm61tsCwGYX5EFcZUkwU6
TLSH
T19A12FA35A8B8AC7B1DD3A951F48735139EE4511BEB88BF90D5DC1A1C01DF69C230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de07fed-b217-48ea-9bdb-5f9be41bb0e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9de07fed-b217-48ea-9bdb-5f9be41bb0e7.tmp
Size 26KB
SHA256 9dfa47951df4827ff22b20021e30209660a834eb7a052076c231607b92d0fb4a
MD5 901b0763172d738d0d52012e5ad39dd5
SHA1 c0ec97a46e90d2e1c63e1ec82d67c80a20212b04
SHA512 0c938b72bd79d2d24be3265da7a8d08b92e5ccd60605b0dd2dea8079817a371778b086fa366a7afeef8b082564ef56c7958ed47523e2fe7274f254934f14e2f7
SSDEEP 384:NiFzQkUSvFzsN98TUNTUlIlCfpng59CWBGYX5EFcZtkwH7vBEp6IIlv:EFd9YwgKgWQGYuFcLdH75Ep6LF
TLSH
T1DEC219F294D7983BD9AE5743E37D2D038EBCC017B5846A50B788591CCC8A1BFD30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

05e7bfeb-673b-4326-afb3-72da5069b6b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05e7bfeb-673b-4326-afb3-72da5069b6b9.tmp
Size 10KB
SHA256 49347a41afd730e9cf0eb4771fc37d28348fd9487ac8a76e36de2004682ba7b0
MD5 f2582e9458be818bf6394934c907bb7d
SHA1 24da96b02f06a1eb93fed73d2ed59d83131d3927
SHA512 5a171c559a70319be78aa78dab8a77ff4b597998a0d82ba02707810c1f9ab92b83c0453d18e06cc04e41c98612e514aa95d82b56dc70bfa0f57923834ea49f66
SSDEEP 192:sxZYRRWz/f3s1uAIdpcxHW6+WN7TM/YgSCyqIgrJ:sxZYSz/f3s1uBYHbc/b9
TLSH
T1FF22A7526E28A97B8CC7D20DFA15BF53D6F95032A5941E48EAFC9A1C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74e5ba91-66c5-46ae-b3ef-3b3dc795c441.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74e5ba91-66c5-46ae-b3ef-3b3dc795c441.tmp
Size 27KB
SHA256 db044b240811803ebb0029a20248c93aaaf7a38e69920935b7e4698ef888276b
MD5 3d8f507990eb3e92bc0258f62f651cb4
SHA1 e503a4cb5bd24bf033f4dbc7327aa50f4739782b
SHA512 e0a133e503a7ff0460b3811422eee83d6f67d4f4e6169938da0a4c460dacbddaa8128379e2ba52aa323d8842de9882414469ad5e7e8bc87802902776bb5e1d7b
SSDEEP 768:STichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz1rowsIc:STichfPWvPZplu1jan+LKgzOwpc
TLSH
T15BC2F93B644CCB7E4FC01A9DDD1A6F9A7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8db3ca72-4db0-445a-8c6b-55592641d450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8db3ca72-4db0-445a-8c6b-55592641d450.tmp
Size 10KB
SHA256 2f751ae04bae1e2bf2769bcbd0ba5a6013e30f0c72e6e974df581fd1a04912e8
MD5 0f8abc35b4a98921ae7eb6703993d735
SHA1 a237420e6c5d2e7c5775a71be58bf5595b2165f3
SHA512 db45b55fbec78210f3ed7fd8c25497917eb895db59574b681f569f9c8f971ff6aa9a65a6c5e37b196863e886d74a8804a9417a134b6feeb1f5f95a38cf66f40c
SSDEEP 192:sxZYRRWz/f3s/GAIdpmxHW6+WN7TM/Yg3ZmqIg5iJ:sxZYSz/f3s/GBGHbc/X8
TLSH
T1AE32C752AE68697B8CD7D20EFA15BF13E6F9503261941E48A6FC9A1C04E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3f3c33683d2ff3a3f09f8b29afbac204afc424a4395005ae767bc73f727c3ed7
MD5 1b6b14db7daaa8b2afd0d642bd3bb5b3
SHA1 41cb3168a99422d0f7b3a84e36b5b7fc4ac2a831
SHA512 3a7eca4cd6314e7025af8e1af4a641f514ff56af6416e8f6694a4fa6474de0a6ba943dee825564dd70540bee0bb31bd918c771e2ecc0e5cc28a798a2ebca58c3
TLSH
T1D1E026AC44C8CA3EB64CB84701B8D70CC2C03B1B93C06E8E1B48C4A57407C40AA87AA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6f69234fee332b84c1f759c25ad449a65ffbee1fd004516eb1c5ab9c06eb439b
MD5 1aa89386414d3bd0a74b81a8af9df04a
SHA1 5924d57ea23fb8bed2722d8e6408d82eb9f3fa2f
SHA512 162c794f03a24068fe2199994d0a7058de705de759c2853c2d5a0cb439f2df07cece385428c6efb2ab968b716c7fd87aacbca6c0734a06a46ccbbda157ad1c23
TLSH
T1CE71608116964867F7A4B0BCFCD92E473930F56F00A7AF120864EC3BB876314995BA6C
MD5 SHA1 SHA512 TLSH

Submit Download

7feac228-eea7-4ff6-9916-160fa2a4df40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7feac228-eea7-4ff6-9916-160fa2a4df40.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fbee199-cab4-40fa-ab88-fd1ae7ab38d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1fbee199-cab4-40fa-ab88-fd1ae7ab38d2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

3657b49b-d92e-493a-9580-a4fdd3621c79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3657b49b-d92e-493a-9580-a4fdd3621c79.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

37e9bc70-a509-483a-86fb-4da8eb0345d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\37e9bc70-a509-483a-86fb-4da8eb0345d7.tmp
Size 1KB
SHA256 3572802d99fa92516481c98c61b1f73de129e5b296d5a7b62a486de78150ce05
MD5 487d22e8380bdbc37830f4635b4889d9
SHA1 4f356955cde7de86a43c84ecc1ec33135d971a99
SHA512 0a6a44b1afffe4dc96687cad8b8a903db40de4d9de8e9fe13a558f17ea7db84cd703267280e60765d709b738a244119aca533e72c03f81463ade84571fc78f66
TLSH
T1D3419AF3C3E4852EE91156F46B187E2BDE1D191843683C1A89E4EF1B93F6071E20664F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fe32c527781013c977cab8133fecb1279c370efa628389eba9fa54a84048b134
MD5 3b686881365aba45b8ea6a7db214f58f
SHA1 6e5e0549f3eada0c7e494cff0a06349397f3809d
SHA512 cf77bbcb56494254080a0f5168cbcc24b0353355cef32aa2c5582687180a1d8c48c67098dcfdd58295b2e9d5caf5e4c5f9796f11b8186195ea7599dbea5eaf6d
SSDEEP 48:K0LuvL1ttOb9wVISrOK9715OxjeY4JbPyLFk51Hznob7+7ISNoK9t1foxt4YufrU:KU0AKtuuKWEKLCcsQKV+mt
TLSH
T158913D05756F12403ABE399841B4872B0A8335B73519E92BBFBC84A5DE2BE151CFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c23ce094-29c2-4e58-b695-66c0d4a19ff4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c23ce094-29c2-4e58-b695-66c0d4a19ff4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c96247f6-dc44-4ec6-a340-95514ab00f9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c96247f6-dc44-4ec6-a340-95514ab00f9b.tmp
Size 10KB
SHA256 53d4499c67031e5815cafe486a74498a045c09e2656847355f512e5538b5905f
MD5 3407dfe919a480bf047055f27c3db73b
SHA1 efad7e7b4d99156ad98b56f3b955143b9334353b
SHA512 9ce9c148f04d563446782eb234d71c7d0f253bde4e4d0a8fca3e247c91602d8866b6a57b700e61fb8af954ec8aab4daf4bde7bcd155bcc5b817e4b73404de066
SSDEEP 192:sxZYRRWz/f3s/GAIdpcxHW6+WN7TM/YgYKyqIg5iJ:sxZYSz/f3s/GBYHbc/r8
TLSH
T15D22B752AE68697B8CD7D20EFA15BF13E6F9503265941E48A6FC9A1C04E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feecc752-d372-4ffc-9454-858bf98430de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\feecc752-d372-4ffc-9454-858bf98430de.tmp
Size 10KB
SHA256 8eeb593a5c6aad8f502e09d75cb16efb20fc5c3b62b09ca996a69e55a7beee35
MD5 ba7f52265db4408db228073396be3e49
SHA1 85694cab80116909c12b9b513ff804d36c35fd9f
SHA512 29024f4f5f5ce6640c85e8dac3c33d6f3dd0b8fd4d82a531ed978aa00a53f12cc93fbc811203cb355375d2e2800ad376e6f75e618800be8f57290a5e409f51a8
SSDEEP 192:sxZYRRWz/f3s/uAIdpcxHW6+WN7TM/YgSCyqIg5wJ:sxZYSz/f3s/uBYHbc/bO
TLSH
T1F322B8526E78697B8CC7D20EFA15BF53D6F9503265941E48E6FC9A1C04E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f085094c-f8a2-454f-823b-1e7ac2248b26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f085094c-f8a2-454f-823b-1e7ac2248b26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabcfdea-beb0-4bd9-902b-73d920df252b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cabcfdea-beb0-4bd9-902b-73d920df252b.tmp
Size 18KB
SHA256 c8f322949460bacdef4e0200b8db46faf867a6e49621912181c6139cdb052947
MD5 3e956e6ec6cb22079144aae4ef544426
SHA1 33f0d77a35b8a28fd643fd9095ff12a1ed88a9a3
SHA512 87b396a2c4f914e62d77c20f36b1b92ae80dcc74d2f340635e1bbe1f8d725d7c91197860fe1ab6fcb0373abcf6b98af1631df069221a3fc96a295513ca25ad2a
SSDEEP 384:LQkUSv0sNjCfpng59RWBGYX5EFcZlkwH7vBEp6IIlv:F01gVQGYuFcfdH75Ep6LF
TLSH
T14B827D75A8B86C3B09E3A551F14A36079EB4911BEBC86F90D9DD5B1C01DE2CC234BA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2b8f277-4007-4e3f-892c-7aa064d5b095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2b8f277-4007-4e3f-892c-7aa064d5b095.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f4dec4dc-cf28-4b0f-9afe-c6bf4982c935.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4dec4dc-cf28-4b0f-9afe-c6bf4982c935.tmp
Size 8KB
SHA256 7e8e6ae7d6c49c69a32f02a5add8ddf730e6fb937e575c9a2a391fa07d64f6dc
MD5 d13fc437f2079572344d0f204fb38930
SHA1 53d4b667dcc494e9560284fa2afcb2c7a4dd7ec1
SHA512 40edcb35060931605bd74f2cbdfd9f0e5a86b388e9f2c8539a1c0a605e3827e91d5dd9668c735cee6dc3dde830e27a3e62fa3f7be97e6db83f62ff4e2d9d8b26
SSDEEP 192:LJON06DphmqQmiUy+Nq8wGYX59ezkCERnkk7T0MU6:lON0619zRwGYX5EFWgMU6
TLSH
T10502D735E8B87C7B4DE3AE45F54B26139FE8102BAA956F84D6E81E1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 66f6d3d4aa0ba97db24e315f8574ea301c2a9f55da7b326f9d9fadf694f3874f
MD5 c7ca2bde26e2cd63c2daad9c1b2012e9
SHA1 f7a97972af0dab7b059928aa337978f85a30b627
SHA512 8db75778004e3a19171331be4f220c95802524eccbd8f01db8a88fcda5a69711998dcab93c2cc965a5b5ef3dcd2cbc3c7be5551e7b2d60f492936bf5e92eecea
TLSH
T164412C5DA6EA5148B3776E5A9FF6A82E487AB9372F07C45D10110E4F0A63F40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download