6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.8MB
Sample261104-xgp1msed99
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
TLSH
T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1424	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{6C462110-7609-4BE9-8318-B3FD79E852F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4860	2788	msedge.exe	85
PID 2788 wrote to memory of 1424	2788	msedge.exe	86
PID 2788 wrote to memory of 1920	2788	msedge.exe	87
PID 2788 wrote to memory of 1920	2788	msedge.exe	87
PID 2788 wrote to memory of 1920	2788	msedge.exe	87
PID 2788 wrote to memory of 5724	2788	msedge.exe	88
PID 2788 wrote to memory of 5724	2788	msedge.exe	88
PID 2788 wrote to memory of 3868	2788	msedge.exe	89
PID 2788 wrote to memory of 3868	2788	msedge.exe	89
PID 2788 wrote to memory of 3868	2788	msedge.exe	89
PID 2788 wrote to memory of 1380	2788	msedge.exe	90
PID 2788 wrote to memory of 1380	2788	msedge.exe	90
PID 2788 wrote to memory of 1380	2788	msedge.exe	90
PID 2788 wrote to memory of 5076	2788	msedge.exe	98
PID 2788 wrote to memory of 5076	2788	msedge.exe	98
PID 2788 wrote to memory of 4772	2788	msedge.exe	99
PID 2788 wrote to memory of 4772	2788	msedge.exe	99
PID 2788 wrote to memory of 208	2788	msedge.exe	101
PID 2788 wrote to memory of 6008	2788	msedge.exe	110
PID 2788 wrote to memory of 3456	2788	msedge.exe	111
PID 2788 wrote to memory of 2828	2788	msedge.exe	112
PID 2788 wrote to memory of 5368	2788	msedge.exe	114
PID 2788 wrote to memory of 5368	2788	msedge.exe	114
PID 2788 wrote to memory of 4160	2788	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcf638c188,0x7ffcf638c194,0x7ffcf638c1a0
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,15180543684153171411,3913870963984849471,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14506210607072957227,16826977463738824222,262144 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,8994527070122699851,2069923034103612163,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,10984289687259260522,15226317692700753342,2097152 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10183794257242413806,18023831012265932348,2097152 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,16445793559636892903,3144658605240966741,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,9132539751418286996,13722122222949158042,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,11860670177030276232,10542604568623220931,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,11860670177030276232,10542604568623220931,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,435408152898368399,18161212846381608970,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6580094916935849890,5377808359263215963,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1312775569197255030,13794454065165495916,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,6587216098681980455,16456233910609463955,524288 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,5438818729142660452,11452546138320659823,262144 --field-trial-handle=2232,i,18228292813922128104,12235111326691696580,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40a92495-f987-4117-bbb0-63bd95b6ed66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40a92495-f987-4117-bbb0-63bd95b6ed66.tmp
Size 26KB
SHA256 da74f8144332338dfb9e566a674a76adb457abd1f48eb539bf7bfe5a5c7cf9b7
MD5 5ef024843526c2f4449e2144820fa573
SHA1 6adf45c0935a6bfdcbd821ffa1f11246d5ea25cf
SHA512 35c5265c0e8d9354ac90906539753491f6a7fd58df08deeb7bf1a45c7f7d6b0bf11aae43fccecab29ae05064bffb70ef8c50605924626f403c349c0601115844
SSDEEP 384:nfiFzQkUSvl3sNb8TUNTUlI4z5mgWV94zf8B7neYZH7vBE/UgL/7IzFIIli:qFdl3GwgP3LB1ZH75E/iL4
TLSH
T183C24A76E894DABBADE78AA5F34A3A43EEE04153C9DC4AC0DAC95D5C00C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

685c0ef8-f216-4678-bfd2-eb62e002226c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\685c0ef8-f216-4678-bfd2-eb62e002226c.tmp
Size 25KB
SHA256 171a43e2e65410caf07ab0f4f0b6c08d3ef2dce60c6210179fa6ecc837cbe426
MD5 92a12763368a89b9db4c41fa4fd7e908
SHA1 d9ef944aba13615303304a50c8f8803a843bf2fc
SHA512 aea6b8cc8e415ecc015c5ea6d37e8662896efeb9d6af3f0152761f8a19adc0b2f8bc2746528141563e6fd873201173d1cbb3085facf30bb350ea2fbb71a8a1a0
SSDEEP 384:nUiFiZcI63sNZ8TUNTUlIm25mg5un4zf8B7wHEsa+VY/ZgL/7IzWcoO:vFQ63MwgSZJBkkhga5
TLSH
T1ACC24A36DC98D9BBEDEB8FD6A74A7A03EEF01163859C5AC4DAD85D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d126f1f-f9dc-4663-96b4-e750bb290a3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7d126f1f-f9dc-4663-96b4-e750bb290a3e.tmp
Size 26KB
SHA256 451aba0702b7ee4bad033be55c4e91ed37e89a5d746764169b3db8fbcae36d0f
MD5 a085461e0409d1517d59fea14668c531
SHA1 5d893c7f91fa5e376494af546bc09c2d72178c73
SHA512 7003816639905ec0c0217f974238f1a16f19988c7978185ab14c1afe3fe4ebb3d5bca95ac9d530dc0753fc6c87fbd9bdba70bbcdb44c0c0bdd29cb65d4ed36ac
SSDEEP 384:nOiFzQkUSvxQ3sNb8TUNTUlI4z5mgrV94zf8B7netZH7vBE/UgL/7IzFIIli:lFd23GwgPyLBqZH75E/iL4
TLSH
T1D2C24A76E894DABBADE78AA5F34A3A43EEE05153C9DC4AC0D9C95D5C00CB1DD130BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

299e7fa2-ebf9-4d61-9659-eaf72432bf5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\299e7fa2-ebf9-4d61-9659-eaf72432bf5f.tmp
Size 12KB
SHA256 5f31985ce7ed5f0af2b932cc257079fe93b580c605de92c5bfa1bafa742f5804
MD5 19d682e137601e473f3ead556cefbe0b
SHA1 4a47ecd6d7412d29577f138da9690dc5829926f7
SHA512 7a0c315846317fe1714d9d88794fbd4f0fa5bba094413597111c21ddc55932ad5760097b8e7a90e0ec0cccbc454efe0e411cba2e6ab2f83f4d4c43daf403a114
SSDEEP 192:sxZHROkj/fwsmQZZjwzodpHlHW6+WNGYbIt5mYvWIg5rpJ:sxZHLj/fwsmOZjzFHbGFyY2hT
TLSH
T1C442C615AE28A93B9CC7D619FA55BF53D3FD1032A0941E44A6FCDA1C05EBADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dbefccc-52f4-4897-b984-e9ad5850c906.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dbefccc-52f4-4897-b984-e9ad5850c906.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

734c5dee-111e-4b8b-ad97-bcccd0054f83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\734c5dee-111e-4b8b-ad97-bcccd0054f83.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ba8d1e5f-595b-4c89-95a7-9979424cff19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ba8d1e5f-595b-4c89-95a7-9979424cff19.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

367d7deb-50a8-4512-9548-9cb221b2d38d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\367d7deb-50a8-4512-9548-9cb221b2d38d.tmp
Size 1KB
SHA256 d0005f328e4c0c5746e7e66b965595920f0b40cc57181777c384212df2c77a44
MD5 e43b05e2a600e795d5ffb36472fd5b7c
SHA1 d64d276c9dfd5b45e684f42d956a8d695287d060
SHA512 1060a44507beeaa59af2a5f88eb04194d110b4682b40ce150f059c1da0290eccb2ebf5e882ed2e05dcf816fe294762a094ca1a4ee7e2148e1aa210aeab238209
TLSH
T1DC31D0F383F4856E8A0096F0AA18AE2FCE2D0511432C7D9AC4E4AF2783E3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

4ef40e8e-dcb2-458f-8785-f09939788718.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ef40e8e-dcb2-458f-8785-f09939788718.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d827bb7a-10f6-40bc-8b6f-40a292aeac8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d827bb7a-10f6-40bc-8b6f-40a292aeac8b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4156b4fd038929844bff0d6beadc62549ae9add9a95457fec2df7969d2704cba
MD5 cd3a22d364eef862fc5590d9cfc9eeb8
SHA1 4284e6df07f8b838bd7a766713e8ae0f9ee2efd0
SHA512 f842e47eee80fe1399fed3a44a9e4d58f0ca541439d910d0c32386ab40ffd100f4db5f68cd4497b0d33a8180855831796dc475c3a36a1399fd292134b90b8155
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgHxJ:OtfFvpopPxrB4RhfgRJ
TLSH
T132B2211571BA121038FE790881B5972F064232B37258E63B7FBD54A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

addb53e1-39e7-4ea6-a608-082c46eb1949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\addb53e1-39e7-4ea6-a608-082c46eb1949.tmp
Size 12KB
SHA256 4dae3341f3d14f173f69a3c6b65550700b8fcb5e8c8b5694c501bd98e23a3e56
MD5 5da5020aaf38753fbc55cf14a495ff66
SHA1 b87d8f81288d9c5916e16ebb7bc5d339b343ef6b
SHA512 619d5aaea2f99212672010a3497dd8d7eb1e6a72e84d42cc9678a474be03e28f0dc9c38d4b7ab5a9b291b56e999289ac2a9ede3a04f9800e62b40419faaeca61
SSDEEP 192:sxZHROkj/fwsPQZZjwzodpHlHW6+WNGYbIu5mYvWIg5rpJ:sxZHLj/fwsPOZjzFHbGF3Y2hT
TLSH
T1DD42C615AE28A93B9CC7D619FB55BF53E3F91032A0941E44A6FCCA1C05EBADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df93acb0-34e5-4130-bcbd-37b757041d58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df93acb0-34e5-4130-bcbd-37b757041d58.tmp
Size 414B
SHA256 12a2bbf3d02a32c6a9d6ffa3097b6b88877fe4b0fd80c9728a5829b93516db11
MD5 e9834b9e04da0c423168a73e6862dc99
SHA1 ec98f4066251fcb2c3e508ef99e70f913d44442b
SHA512 86dc3a51bfabc5ed50647cb7f328f8921482a9906469ff4eefe6921089a68f7535929a7f4e8f59122c509c922247635a242c08ea46bf7a603003f642e602db49
TLSH
T1F3E02BE5C9A5BC3B08FC1B2850540685FA55134B2A80848B773C850D8FF5B364186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f8c3f72a-94b5-4878-9545-bf0d4d789801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8c3f72a-94b5-4878-9545-bf0d4d789801.tmp
Size 11KB
SHA256 e5720e5a9eefe7f2ca8e9809286c506a14cc0203eb6be3321695d9ca79dfc3f4
MD5 d4b6a58e336553270130a03fed3242ab
SHA1 b285e896a011a0660b6742ac28ea7eae33cd8b6f
SHA512 10c33dec9ce6aca80de94935bdb6e13fa84e9fb0b6ad6937bb002d164bf528684126ae42375cad7eaec5d54f3fccfc57ee2ef3b96d3c13935cfcd2cf4460f2dc
SSDEEP 192:sxZHROkj/fwsXQZZjwzodpHlHW6+WNGYbIt5mYvWIgjpJ:sxZHLj/fwsXOZjzFHbGFyY2jT
TLSH
T1EA42C715AE28A93B9CC7D619FA55BF53D3F91032A0941E44A6FCDA1C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7b0b62f-a536-4bc1-8438-700fe5b732fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a7b0b62f-a536-4bc1-8438-700fe5b732fb.tmp
Size 26KB
SHA256 d7c7ab18c731e01f2c6e3e4fd7828cf46bcbf1007abe9a0226cca806a51cc232
MD5 3b7c01e40a87094e4ceea32cbaff8cd5
SHA1 befc1a225271480c83a313540925ba81b96d917a
SHA512 77c155d970bff3a2326ab299beebae8b0a61a1d0c9f860ffdb96f6dcbb5b70d1b3b6cc6d9d8b41a29e09930629b595a5dc4591286905b75ea5c0f42031b88f9f
SSDEEP 384:nNiFiZcI63sNH8TUNTUlIm25mgw8u4zf8B7neVZsa+VY/ZgL/7IzWcoO:EFQ63WwgSw4BmZhga5
TLSH
T192C24A72E894D9BBECE68BE6E74A7A03DEF0416385DC9AC4D6D85D1D00C719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daddddb2-f317-47f5-8c4c-37e67129a096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\daddddb2-f317-47f5-8c4c-37e67129a096.tmp
Size 26KB
SHA256 085d2ef3a5aee607e0845d4188596cea885b5fc62bcc6597569e6f261642b512
MD5 23ead506dc7ec0433c773c06b3c97afe
SHA1 83501140684ca31e28c0b1e49ad99079850a05de
SHA512 7ac353ad679b71bf7f6276f251d76e28e1249621937ac63fa273d161481246169450cf08a941d1ee89699317ba9fd5724916dcd8f4b081a3fb6455eea59d44d8
SSDEEP 384:naiFzQkUSvl3sNb8TUNTUlI4z5mgrV94zf8B7neYZH7vBE/UgL/7IzFIIli:RFdl3GwgPyLB1ZH75E/iL4
TLSH
T1B3C24A76E894DABBADE78AA5F34A3A43EEE04153C9DC4AC0D9C95D5C00CB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43066f4b3540574a125adb90bf10593a02d412236b8b3d1313aac4876934e033
MD5 a5a0bc591738b97cb766d41290dd619b
SHA1 46b6389db9f255d3d50974ec8a8f25ea65bb9e29
SHA512 683789acfb2343eaa11cbe058ece86f4c77d97cd2c12552bb436c9bfea0d63c9f0435de581f1ce3ffe962b90d628d75581ca7bacb50eeaf5b8267c3a79ba1ef7
TLSH
T18F41485DA6FA1148B3B7AE5AAFB7A87D44BB7C372E0A945D00110D4E0636A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download