hxxps://harmlesscreations[.]com/

Analysis

max time kernel
128s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://harmlesscreations.com/
Sample261107-24v8dsgd89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{59F9E555-DA4C-4F98-A6F3-C67AF64C0B03}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1084	5004	msedge.exe	84
PID 5004 wrote to memory of 1152	5004	msedge.exe	85
PID 5004 wrote to memory of 4176	5004	msedge.exe	86
PID 5004 wrote to memory of 4176	5004	msedge.exe	86
PID 5004 wrote to memory of 4176	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	87
PID 5004 wrote to memory of 4984	5004	msedge.exe	87
PID 5004 wrote to memory of 5060	5004	msedge.exe	89
PID 5004 wrote to memory of 5060	5004	msedge.exe	89
PID 5004 wrote to memory of 5060	5004	msedge.exe	89
PID 5004 wrote to memory of 5088	5004	msedge.exe	90
PID 5004 wrote to memory of 5088	5004	msedge.exe	90
PID 5004 wrote to memory of 5088	5004	msedge.exe	90
PID 5004 wrote to memory of 4736	5004	msedge.exe	91
PID 5004 wrote to memory of 4736	5004	msedge.exe	91
PID 5004 wrote to memory of 4736	5004	msedge.exe	91
PID 5004 wrote to memory of 5052	5004	msedge.exe	92
PID 5004 wrote to memory of 5052	5004	msedge.exe	92
PID 5004 wrote to memory of 5052	5004	msedge.exe	92
PID 5004 wrote to memory of 4040	5004	msedge.exe	96
PID 5004 wrote to memory of 4040	5004	msedge.exe	96
PID 5004 wrote to memory of 2916	5004	msedge.exe	97
PID 5004 wrote to memory of 2916	5004	msedge.exe	97
PID 5004 wrote to memory of 4608	5004	msedge.exe	99
PID 5004 wrote to memory of 2988	5004	msedge.exe	108
PID 5004 wrote to memory of 1740	5004	msedge.exe	109
PID 5004 wrote to memory of 2452	5004	msedge.exe	110
PID 5004 wrote to memory of 3856	5004	msedge.exe	112
PID 5004 wrote to memory of 3856	5004	msedge.exe	112
PID 5004 wrote to memory of 4008	5004	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://harmlesscreations.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff50a6c188,0x7fff50a6c194,0x7fff50a6c1a0
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,16751828256671349799,15187395770025577341,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,17587937177315931400,12539386111074785271,262144 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17868025639738651614,79363703684047553,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6909315908445829779,9620396323696298225,2097152 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17446098612319485885,15256705647521715876,2097152 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4874516310164335286,14054533335756058248,2097152 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4065806698855915186,1122160672883039429,2097152 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4641278601583030212,12502579893559696498,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,12610219816226521373,504722294659404871,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13292268322069613946,17880081103180896414,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13292268322069613946,17880081103180896414,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,157917829792914784,16332934951009540121,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9896813090325044515,8007621960671532632,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17190374391374215985,11789954618236137256,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,5560330065752211058,10031575650555448209,524288 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,121242995060650697,1808834968410218427,262144 --field-trial-handle=2284,i,7701262587454790694,14188775802397423974,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04022b9d-7a42-4b35-938c-4ffad8012192.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04022b9d-7a42-4b35-938c-4ffad8012192.tmp
Size 18KB
SHA256 da6c1e27db48f5c7f67eb32115fbd4eeede0754526f3b97dc49845d230d2dd2c
MD5 ca2d3815b07847186c56775b4c035b4b
SHA1 981662bd8ce2deaa366b8a9673d41cf085fbe8b4
SHA512 fdcc7f4dd182fee6cc03486f174f88369812953b76c0a97eabea2bd2e67a265ebea7825deebef19f7d1051107d1010980904cd82cb79bf10085be0813fdf8147
SSDEEP 384:MQkUSv0sNgHk3iVSEQX5+DtCM8l/+Xv8rHFGqaaX1L9tL8G3gIIlQ:M0GhvkDY/u0rHFGqaaFBth3gL6
TLSH
T16B827D3278B9AC675EF25641B54A3143DFA4A113DAC82FC0DAEC6F1C01CE299235BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e4ca260-36cb-483c-922a-640a4cf5e83d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e4ca260-36cb-483c-922a-640a4cf5e83d.tmp
Size 18KB
SHA256 b302a6979892bd7eaff15639c27ea915ea479dde51f35c1a98984847f9c9f92c
MD5 7eac31cd8d163013ffb51bc7beb34c32
SHA1 44eb83ec677f98ccc5ac341a2801e8f1e01f8dab
SHA512 1f83bbf6756416b0cb742668878844ffd69cb43db1e157e689710e25dc58b9ba3ff828684655d0c12738eb02cf04ac305b8a7adfb357c449a10129d4f2074c25
SSDEEP 384:mQkUSv0sNgek3iVSEQX5+DtCM8l/+Xv8rHFGqaaX1L9tL8G3gIIlQ:G0DhvkDY/u0rHFGqaaFBth3gL6
TLSH
T158828D32B8B86C675EF25641B54A3143DFA4A113DAC82FC0DAEC6F1C01CE2D9235BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61bb06e9-ecfd-4310-bca8-b082b363417a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61bb06e9-ecfd-4310-bca8-b082b363417a.tmp
Size 8KB
SHA256 27ca66f35db09ea643ff3e22d7781a1806390ea5b174dec5c2639d03e2539475
MD5 03a1552c9f4276f66fc530183c2d6204
SHA1 300058d5dd1b794eba54eeb55ca2c2153d378f28
SHA512 86097ec3a1229b12f77bce0f9202a95525a72b5866544a9a360746786734469eb94f813ccfd88751e75e1bdf910a99dc3021fe27274623aa9e5c04b248d85151
SSDEEP 192:EONq6nnHGQmiUyRKQYcX5hQDP1C8jzorqo/qMcyp4U6:EONq6nCLQNX5+DtCM8l/SNU6
TLSH
T1A702DA35ACB87CBB9EF36D46B48632139F94212BE5942B80DAF85E1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

886e7265-a25a-40fe-a6f8-738a45d54841.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\886e7265-a25a-40fe-a6f8-738a45d54841.tmp
Size 8KB
SHA256 9ea57a29f849a42e581c057abf84609f219e0a04f6ce0e4401841143878a16a7
MD5 4ef83275ead3fc0198d9718564143841
SHA1 8faa2d5e86abc7bb7daa1f19b93ca369a17c45e9
SHA512 eaf2c441e9785f822a5756f53ea4af1b5baaa7ba254b378329384a974f9ef90af5b188e7437d60b1f7b4ac8435b1401c1a887c960aa62b785d90fb25380a7162
SSDEEP 192:oONZ6nnHTQmiUyqKEYcX5hQDP1C8jzorqo/+XEcFfErQg3Oq5GU6:oONZ6nlyENX5+DtCM8l/+Xv8rLFGU6
TLSH
T1FC120C31B8B8BC6B5EE26595748731139EA52127DA887BC0D6FC1E1C01EF69C234AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

019728a7-2e66-4325-9819-9eba4f8c1708.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\019728a7-2e66-4325-9819-9eba4f8c1708.tmp
Size 27KB
SHA256 9409ff6433f15cdcdcaff4b7face2ca147c4b5ebc577e9b3fb5a8b1e50b2e2de
MD5 6c9f75fee4d3a0b96c7560a82c7d9ee3
SHA1 fd5040ebf9c7ac2faa351cf8ccd8e18a57f212c1
SHA512 9cbcbad1de8d9da8168c5300c058e90368cc915b2524db988048581fed4f96bd059f698305b020fc7b9e80900908495ff6f67f438f29795d822a84bac06909f7
SSDEEP 768:uvyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXErop0fA:uvyYR7jWv3NpBu1ja/CL8OXPL
TLSH
T1DBC2E92B640DCB7E4FC01A9DDC5A6F9B7E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0af7c554-3457-4794-a4a6-4d6b8d6a6902.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0af7c554-3457-4794-a4a6-4d6b8d6a6902.tmp
Size 10KB
SHA256 750c2df8acb8804aeb33b3d8b232bbac48e45c384fbb06aefa7774ca4075bd1c
MD5 9100b5f393da91a5c0984a24316f911c
SHA1 8a4ea0b27b826b28926c68b01b3cd34fbee988c3
SHA512 c7a2989b002b926432303bcde30f37c467744709745b7bf091fc30765a66883adf8d9327f6c5245b49b59f296b0b10ba37a118f59a4be507e03b9dd1ad049600
SSDEEP 192:sxZVqRpWtU/f3sQEWE7IdphpHW6+WNM8T/YYB6Co+3Ig5kJ:sxZVqatU/f3sQEWEkLHbr/fRW
TLSH
T16C22B6526E38697B9CC7D209BB15BF53E6F95032A1D41F44EAFCCA1C05E66CD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

172d1126-4ae8-4e3b-b9a1-955f3d14cbe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\172d1126-4ae8-4e3b-b9a1-955f3d14cbe4.tmp
Size 10KB
SHA256 ad042512d97b186ff5f472543fba3b2ccc7ecfb4a6967ef59f8e35e55030deec
MD5 3cb37a8e6765988ef7a3387235f9571c
SHA1 a0be88b32685b0c0cdcd7cb66722e8eb92c346f7
SHA512 b34f86a569c49be8595b046c137d1d25f28dd4a3a830d1c37c8421e5e32cd8a2b2d1283960286665e841cb129b01be1add3dad8a42a298f8165df435550a052b
SSDEEP 192:sxZVqRpWtU/f3sQ/WE7IdpHpHW6+WNM8T/YYBfFo+3Ig5OJ:sxZVqatU/f3sQ/WEkJHbr/frc
TLSH
T14122B7126E38A97B9CC7D209BB55BF53E6F95132A1D41F44EAFC8A1C04E66CD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

459b0690-ccbb-45be-8843-fee5b6a1d834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\459b0690-ccbb-45be-8843-fee5b6a1d834.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a0f6c3e-1144-4b63-9502-5416775ed29a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a0f6c3e-1144-4b63-9502-5416775ed29a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 37cbd0d0884803458815639ec249affe2a30d7d79a0b3058725efeb13d73faee
MD5 f8b7ed26018d818fb12850ca3522f381
SHA1 a596aad984ff98d5bccb85f9f724a8adc3394293
SHA512 82f299ed7f4fc455fdd74e2ffd77c97ff39872a33a76c1a6e73dc0f2fdc3f284214bf10c54b0738f48cebf47457c12e66437cc72b8c7e9f87478868a086361f9
TLSH
T1FE517484554DCBC4F3E64CB189D9078BFF72318447A7BEA532A8DB795456754C2300D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ca0d155f8d88311c58d126146d4f569c6a645e5f4dffc7f6e449c3100b2060e7
MD5 e9cf98deb0d91384f2223178d88bb51a
SHA1 8efb432ac1abb6e8666d9c9b22f2ce0cddbc4ae7
SHA512 38b862d5d71fc0588b4698c353b405ef6657d8f36bfacc0fffc0b7268e5a0aaaacb6ddcf583d55b0e45662d816fc9581ee234214b77304786796ea3e5b8b70a8
TLSH
T148518584554DCBC0F3E64CB145D9078BFF32318447A77EA632A8CB795456754C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

533ca6b7-0cb8-4180-b68c-2899cce6fcc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\533ca6b7-0cb8-4180-b68c-2899cce6fcc7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

080088c7-77e9-4ea2-9239-e79aa317a6c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\080088c7-77e9-4ea2-9239-e79aa317a6c5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4a498a14-0b2c-4fdb-8792-d891e63198c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a498a14-0b2c-4fdb-8792-d891e63198c2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b5032fde-7e49-46d5-b319-8ba4c65d86df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5032fde-7e49-46d5-b319-8ba4c65d86df.tmp
Size 2KB
SHA256 0a20f20fc5ecf52ea426309e107faddf9d5b5a310ab24e57486a5ad7910df454
MD5 5ff1c0afa496cc38b0269a1a150700f5
SHA1 22f8cf37e13a47700b21acadc152806b4d7a5db5
SHA512 e7e20d116d2a00070b64890d0473b12e8a49947b1d03dffe8968d150951a11eb1498c26170e64226eb4c09b22d67213238653404de00cc9a7f786ce2a61d91a0
TLSH
T1CC41C0F7C7E9866DCC065AF0AB15AD2BDF2D1914822C3D1D89E4EE8B93E2061D10264F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2e6c222d72e87894e6166d4e5b37963391f95b73daa13745ee0ff6afb3182b9
MD5 e1d734d9839c02704b7c6d16bab5dc1c
SHA1 14903f8f22b426017c5253a32cb4784f3ded5f5d
SHA512 4556c5fa3552a225da27db521c52a37fa57cc392d5213ada7a007535ab7ea65da9672ae07cc002a7677fb85d1ed1a6fd5d238c16d278f797635362fd4e9ce428
SSDEEP 96:KhrANJD1l1GBqIEh1KMEET1IeyMKHqeO/KKYUDL:GrANJD1lkBqFhHEETSDDxq
TLSH
T18491068031BB060838BE2D8941B7971A524172B3705CEABFFF7D80915E5AE481DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfff89e7-9ce6-4286-974f-1072a0f434ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfff89e7-9ce6-4286-974f-1072a0f434ac.tmp
Size 9KB
SHA256 982c660a2e56ac7dcc1dab0f63de35f4e996227b97ad2db6bd55968a8fadf765
MD5 c4cc8d42073de7f6831bffc4bbd19a58
SHA1 91e986651a0e7dcae0bff773402bf979328f3b1a
SHA512 8ff9542ebe28bc69a204d350c191b544ac8794aed68b1f9409a4e8a0ed51fcb621dde6b527feb2c6ea55e23e12e8338c2456b64a430d66f93ad21e06a01248d0
SSDEEP 192:sxZVqRpWtU/f3sZ/WE7IdpHpHW6+WNM8T/YYBfFo+3IgrJ:sxZVqatU/f3sZ/WEkJHbr/fr9
TLSH
T13522A7126E38A97B9CC7D209BB15BF53E6F95132A1D41E44EAFC8A1C04E66CD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e48cb1b2-4d9e-4f33-85ac-09c551ef55e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e48cb1b2-4d9e-4f33-85ac-09c551ef55e6.tmp
Size 10KB
SHA256 c8aa7741865bd1d87f7b954c4e2584e17a0554f005f22f33101e289ef06da739
MD5 eb43360b9a1b9616fa50f29287685d46
SHA1 bd18350c43842e5d9bbe1a2822738ab99290dba3
SHA512 df614b332a857c234372784a7a840d12af61de639410489c0578af9293c982a50f0bdadfb09ceacba851789c7bdae6e9144adbad90d0a56e1e7aae9cdf5b98c9
SSDEEP 192:sxZVqRpWtU/f3sQEWE7IdpHpHW6+WNM8T/YYBG1o+3Ig5kJ:sxZVqatU/f3sQEWEkJHbr/fwW
TLSH
T1A822B6126E38A97B9CC7D209BB15BF53E6F95132A1D41F44E6FCCA1C05E66CD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c8103ab-9f16-4181-ac18-fa687713239a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c8103ab-9f16-4181-ac18-fa687713239a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b57126d3-4c91-4c67-ab96-3b5187670664.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b57126d3-4c91-4c67-ab96-3b5187670664.tmp
Size 26KB
SHA256 f7f13647b4e71c712e3b2dffe0cbe83a2f703ed84b23bdd29d4ea4ac31762341
MD5 2bb1b758e292a25908baf5f6fedd631b
SHA1 dafe06c3dc609a546f163cc3c06e005989fbc255
SHA512 bbde8dbec8829d4bdf958eb31d3bf42e2874db73598e4b64c3239fb69a47963beb173033b8a4a598300521a3b9417867c7a20eb5eac211e3ebdbde4a0e7d9878
SSDEEP 384:EiFzQkUSvjzsNg8TUNTUlIlHk3iV6EQX5+DtCM8l/+Xv8rVFGqaaX1L9tL8G3gIp:fFdnZwg8pvkDY/u0rVFGqaaFBth3gL6
TLSH
T1F3C219F258E79837DAAE4743A77D3D028EBCD113F5845A80B798591CCC8A1BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3412a3af-e3c1-40f9-bc7a-644fe6db2e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3412a3af-e3c1-40f9-bc7a-644fe6db2e2e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3afad74c4f956f0fbf49b45799b4f7a854cc5ed20997f483fb22b3904f216ef9
MD5 59413c3b058a66a43f76f83104169c16
SHA1 57316ff2d114bc96696aa847c101110048f06c2e
SHA512 ebf81137c1f37902f50a61fcdcbbfb31f0a377c9c45b80682b5695f945f89cb75884fe7094524b88860e415a883e34bf0efbcdcc2b46163d4abee39adf64ee97
TLSH
T14F412748B6FA1148B3B76E5AAFF6A87D587BB8772E0AD46D00110E4E0662A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download