hxxp://schemas[.]xmlsoap[.]org/soap/envelope/%22

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://schemas.xmlsoap.org/soap/envelope/%22
Sample261110-kl3fbaeb55

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
30	4916	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8E6AEC7F-A9F3-45AB-9D48-19D333293A9B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4388	2956	msedge.exe	86
PID 2956 wrote to memory of 4916	2956	msedge.exe	87
PID 2956 wrote to memory of 4808	2956	msedge.exe	88
PID 2956 wrote to memory of 4808	2956	msedge.exe	88
PID 2956 wrote to memory of 4808	2956	msedge.exe	88
PID 2956 wrote to memory of 1388	2956	msedge.exe	89
PID 2956 wrote to memory of 1388	2956	msedge.exe	89
PID 2956 wrote to memory of 3124	2956	msedge.exe	91
PID 2956 wrote to memory of 3884	2956	msedge.exe	92
PID 2956 wrote to memory of 3124	2956	msedge.exe	91
PID 2956 wrote to memory of 3124	2956	msedge.exe	91
PID 2956 wrote to memory of 3884	2956	msedge.exe	92
PID 2956 wrote to memory of 3884	2956	msedge.exe	92
PID 2956 wrote to memory of 4256	2956	msedge.exe	93
PID 2956 wrote to memory of 4256	2956	msedge.exe	93
PID 2956 wrote to memory of 4256	2956	msedge.exe	93
PID 2956 wrote to memory of 5004	2956	msedge.exe	94
PID 2956 wrote to memory of 5004	2956	msedge.exe	94
PID 2956 wrote to memory of 5004	2956	msedge.exe	94
PID 2956 wrote to memory of 2728	2956	msedge.exe	97
PID 2956 wrote to memory of 2728	2956	msedge.exe	97
PID 2956 wrote to memory of 2728	2956	msedge.exe	97
PID 2956 wrote to memory of 2980	2956	msedge.exe	99
PID 2956 wrote to memory of 3816	2956	msedge.exe	100
PID 2956 wrote to memory of 2980	2956	msedge.exe	99
PID 2956 wrote to memory of 3816	2956	msedge.exe	100
PID 2956 wrote to memory of 5012	2956	msedge.exe	104
PID 2956 wrote to memory of 1464	2956	msedge.exe	111
PID 2956 wrote to memory of 1888	2956	msedge.exe	112
PID 2956 wrote to memory of 2812	2956	msedge.exe	113
PID 2956 wrote to memory of 5012	2956	msedge.exe	115
PID 2956 wrote to memory of 5012	2956	msedge.exe	115
PID 2956 wrote to memory of 4012	2956	msedge.exe	116
PID 2956 wrote to memory of 4012	2956	msedge.exe	116
PID 2956 wrote to memory of 2420	2956	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://schemas.xmlsoap.org/soap/envelope/%22
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff90ef1c188,0x7ff90ef1c194,0x7ff90ef1c1a0
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,16180503757447700218,18170171918964998420,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,9576632916182061660,16893578775282038976,262144 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,11145442462932400848,3167218831854049798,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17204547868803657741,10271632773116353842,2097152 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11183286239764978506,104024043692864010,2097152 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4615762624451698397,2130700015960617556,2097152 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,9487744990724328228,17934866276563390963,2097152 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,11417351699627115089,5952713250116382006,2097152 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16587708163442529990,1104481009608689262,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,869835334985472196,12714270285875386399,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12341686116583747545,4779864361777986551,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12341686116583747545,4779864361777986551,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13744092846915281827,13198775833105410388,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,8691176204011027050,15388853386018726151,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,18322776093548049809,970802983517063113,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11951732401660692321,1735992698315114035,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9062395245952556387,13924581371015082396,524288 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,11419665756526542059,17889304613615370236,262144 --field-trial-handle=2332,i,7879611183388849232,12604567205627233838,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ca6218a-ec29-41fe-aca4-06bd50aeccb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ca6218a-ec29-41fe-aca4-06bd50aeccb9.tmp
Size 8KB
SHA256 4d3edc4f085674b1d34bb6aae46f0259294d7e7b795f6a6e31c0f09b1e549384
MD5 93a9733bf8496001c9335fcb08dfcae6
SHA1 bca7e4a3c25af5fc6fa7c8467765f90144361f9f
SHA512 49f9ab1d204ec75177307d433de3241c662c040527ce92be789b1d717eaf7d3aae264daddabf872ed8ca906d548a4ed4c92a3caeb94ad9f24aa41efb3587c678
SSDEEP 192:UONj6AmwpbQmiUyf+ssiX5FbRDaHDY2PwojlRW5q0U6:UONj6ipNpssiX5FVajY2YoXeU6
TLSH
T156120A36A8B8BC3B5EE39554B48736135EA54217DF8D7F94CAEC1B1C01DB1AC030E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c481029-f0d9-4669-a444-b5a04ec4041f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5c481029-f0d9-4669-a444-b5a04ec4041f.tmp
Size 8KB
SHA256 d24025b602479c048f2d5e0939676e1d3f60f297f025b080591e2be0850f9bfd
MD5 dfff1e7774d6d4fcc91ed01f6ef43bb2
SHA1 b138c5b5ca6df6ea7ed63a8b2e526ad981463304
SHA512 120269e0ae67c917e62de4f11b532094ce4ebcd9a25de89e0697c249b4dfe0d394c23d41265ddc38da26cb5d8cf10d9adc420834de28699f1eb889e86c2b029e
SSDEEP 192:LONh6AmwprQmiUyq+6siX5FbRDfJiWzNSU6:LONh6ipdk6siX5FVUrU6
TLSH
T1E702F939A8787C7F8AF3AE05B48737135F95112BEA952F84CAE81B1C00D729C130A936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c15e123-3886-4e06-9048-a0eaa27a6aff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6c15e123-3886-4e06-9048-a0eaa27a6aff.tmp
Size 18KB
SHA256 fb90ea7025e685883900ad7d04a44c0682175262a8fd0d809d35af164e3e599b
MD5 40dd47f2008c41be3fb1b46352fbdfd2
SHA1 4d3862acf015e01fcd026ece80d52a039214bd89
SHA512 28a8779475b385a3d2a95c4bd9113218003ac3a536108d371d45b726eeadd8310b5377dc018dce7e3f55c6a50c6c74065d98f8595f0b90749dad7aa8176844c2
SSDEEP 384:LQkUSv0sNCvVIpu+P89iX5FVajY2YoSevaTZcEIIlR:F00d4ahkqevaTZcELf
TLSH
T113828E36A8687C3B5AB39620F58B36039FB09117DFC82E94DADD5B2C00DA1DC135B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ad75e02-bf7d-47a2-90ee-f649eb017b3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ad75e02-bf7d-47a2-90ee-f649eb017b3a.tmp
Size 18KB
SHA256 6e114246fd911867c57de8f372176cf0cb9635f26a5e9fd51f8485fca9177275
MD5 c223b29cd42d0f46ef60aac89272154d
SHA1 75ec058840639b85e48ca38d98372402202db844
SHA512 9fbbe3bed76db1f25c0424afe497899e6e9bc9165010eb7a4d1732554b0136f6146d5880e65cdc6b8ba8e218182fc0dc7054e7aaf0d69321b19bd6b432c2e547
SSDEEP 384:bQkUSv0sNCWVIpu+P89iX5FVajY2YoSevaTZcEIIlR:V03d4ahkqevaTZcELf
TLSH
T142828E36A8687C3B5AB39620F58B36039FB09127DFC82F94DADD5B2C01DA1DC135B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

4ec1adec-6b0b-4dc4-9cb9-acb3f2da6634.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ec1adec-6b0b-4dc4-9cb9-acb3f2da6634.tmp
Size 27KB
SHA256 91e13375c3a858619df2bd0dea6bee8f3495b298c765eb5a5c0d3b824bd59284
MD5 eeee35be5427d2e1f720e1c58c7e082c
SHA1 3e8b1f6480eb349f394db3f58fe0cf4bdb91b07b
SHA512 0c0235934280592c02908f2edb291ff3395262885959b098bbf7c6929ad11e7a779b0c98bc3d8a02446a3e35b8da6aaf1c7304bff8fdf8eb8b813cfb890085e1
SSDEEP 768:hD30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72+rolZMx:hD30AbSWvS2l9u1jaLmLZ12V6
TLSH
T181C2EB3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796649D4047FA944C02C77EA911B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d2ca1b5-09e9-4595-97b1-afc9c07c1a0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d2ca1b5-09e9-4595-97b1-afc9c07c1a0e.tmp
Size 10KB
SHA256 c0e5d62d4637f191f832ebaf2375c92f88decc4a92a6528e37182b10675d5fc0
MD5 857ab8a0cca9caeb4a88afbbd163a6a9
SHA1 426236aec6cb25f2a061306f103d9f4b570724c5
SHA512 f1a4a3b32323d9d7b7f41fb3e2fd63bd6b1b989b8d511b0198457d9277ccad2fbed9a5c0d3cd5f58213a08efbf8e91cf2c21e4b5cc44a05efb5f081d8b7001c7
SSDEEP 192:sxZHR3Wy/flsZXIdp3mHW6+WNI3s/Y3uMm13Ig5jJ:sxZHIy/flsZ4WHbb/Fv
TLSH
T1CD22C8526E28B97B9CCBD219BE55BF13E6F9503265941E44A7FC861C04E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6de93f0c-ed32-462f-be84-97942b482987.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6de93f0c-ed32-462f-be84-97942b482987.tmp
Size 9KB
SHA256 48f56fde7db41d24d30ee1fa00851701b52b7ae0524f73e84d2ad7cd855253cb
MD5 0548182eb815cbf9329674991a922314
SHA1 e2ac68612e8c0165092c7f8f53688c4003abb8a2
SHA512 2260df92146eda350be7d948a1ea28b9ceccd17c8ecea8f7dc79bd8138299bb428dde5d3f6f802fd55524f01035e158c943d9a2f68fb268672f13c5be076990f
SSDEEP 192:sxZHR3Wy/flsJXIdpRmHW6+WNI3s/Y3Z513Ig55J:sxZHIy/flsJ40Hbb/SZ
TLSH
T10022C8526E28B97B8CCAD219BF55BF13E6F9543265D41E48ABFC861C04E76CD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3475cec62efa845a0fefc9d014a2267bb5c0d5b3d5dcc9987b39c13ff6196175
MD5 85de9957f33548909e514a1d094dcaa5
SHA1 279988459b0b0310b3fb400ec8393ae23537420a
SHA512 337bf3ef9cca58a64998f6381890362f2722056a02ba93e1a007ac1e9867836e7cacd87e098d9d110997c7a6dd31cdf43c1909bda57fd3f46ba597a2c4ade4c6
TLSH
T1EBE0809815C5C65FF304A55713BC434C85A026DAA7C47E4D5F44DCC87D46544EA91B54
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7ef64d2d59f636cee6ceba107b0b5ebff9dcc27148f1469e9ddca9c9933a9937
MD5 4d4ca9dd8a8d9f5c8af2809089b96853
SHA1 722f2c5dcdba337944eb896ae681bdb24adfdb13
SHA512 6ba242a4ab20e542802bf4e68e1aaa2c1bc85b56ce40f6b2e9254060638c8f253bc38d72a188cb140b35b8202cd5698144ae29b833fbb5b8ce585d57dd253fae
TLSH
T1D9617065755861FDF7D9517189E212EF39B487500643CE631CBAEE38B80F31C6F28AA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91336d3d28ba5aaf5bbc1c2a75adc7470749fe748e207ec14a7fa4b1644a0620
MD5 294d4a7e23459de47353ebf10bf1c3e0
SHA1 ab3aef784e329743ddebb942be376cfb4e3c52b3
SHA512 0b3e225383426bf3561637ee692b1b0da7077375a6cbf213cc03ebd29a5546a0c4426ff8d2b99719d084a234a440000457251c4f94ece9213c526cb875329813
TLSH
T1DB617265754861FCF7D9517189E212DF39B487940543CD631CBAED38B80F31C6F28AA4
MD5 SHA1 SHA512 TLSH

Submit Download

a5b45968-d0e8-47a1-946d-469690cf51a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a5b45968-d0e8-47a1-946d-469690cf51a6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

21d6a1a5-cbe1-4b76-b2a2-057139b147af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21d6a1a5-cbe1-4b76-b2a2-057139b147af.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

3b7fd59e-0d2f-4407-b252-5b9fccc652ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3b7fd59e-0d2f-4407-b252-5b9fccc652ba.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

912fe401-8aa3-4768-a9a4-e94658da0854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\912fe401-8aa3-4768-a9a4-e94658da0854.tmp
Size 1KB
SHA256 c8c230bb50ce19ea453b2d193fb804950f89db9b305ecd2decbb81122f2b355c
MD5 d5a8351fc64d0067dbbaf8bfb033c1e0
SHA1 62705d71727cdb47b47ac5f99091127faf5bec27
SHA512 53e245f011c094832c2e10ca928336361fd71fbb5696adb32bcf55d2667d9fc1d035346c13e903a10059489840560a5c8871bc09db5c9e412ea7b87fa9f63ad5
TLSH
T18111ADF383E585AECA0516F0AA14AE2BDE1C0501432C3C29C5D4EF2B93F3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 a604f7fb238ccaef2c6d0c8cd080f98d529cc757677f8f1e82f4ce034b08d657
MD5 615a5879f3dfd831b23ec0fc9f8ffdbc
SHA1 69df9e3e4eadd313f2900d7e26ecd9f27abd3fae
SHA512 ae002f704501c78280dd933377fcaa3a1cfb64cc6787d9a0728ec8b148dfdb186d6d0fd81ba9bd6bfcf2f842c2cbf1d227e456dd6d0d62a65282e1e9bf3cb82d
TLSH
T170112E15325E01002BFDB51D5268962B428120773524E77EBFBDD1F90F6AE60CDB89CD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 9d19206a0ede34ddf0253b3d94136d932befd1fa9f551d39c1b26b61f348098a
MD5 fcf4cd833bf2a0fe1ea43e53ecb4efd6
SHA1 aed6dc9839c66cd68334716a6ce899d2d22f521a
SHA512 623e4f79482838925b532949e6bb80ab3a0f9be2a23ffe093558f342123ad0cec326ddc9eb07cb6d77713f07cc84cbdd662935ef970ce45518eacf0421b12dd6
TLSH
T128214A10321E02002BFDB51E5268A53B418120773124E67EBF7DD1F90F6AE10DDB99CD
MD5 SHA1 SHA512 TLSH

Submit Download

a7762731-36d6-42fb-a08c-12140742b5f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7762731-36d6-42fb-a08c-12140742b5f9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b25917be-bb4b-446d-b0b9-9e6d8dee8d23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b25917be-bb4b-446d-b0b9-9e6d8dee8d23.tmp
Size 10KB
SHA256 470ea3919156dadbc646ffb13cb8024df04a9d245891353ed4574d867c29be4f
MD5 51c74f378a6527c9586fabcc304a7c57
SHA1 aaed81e87b3374fa064426a46d9831751617c660
SHA512 e3adbd9560cad716468ee3a893ffb65d8a958c2dacc7208aba71361fc1ea2abb433e422c39b937e2ee01b36f1cd000cdf1b68647929bbf708bd582f056735605
SSDEEP 192:sxZHR3Wy/flsZXIdpRmHW6+WNI3s/Y3kM513Ig5jJ:sxZHIy/flsZ40Hbb/ov
TLSH
T15922B7526E28B97B9CCAD219BE55BF13E6F9503265D41E48A7FC861C04E7ACD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e52010bb-e778-4740-87ea-9cb308d30408.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e52010bb-e778-4740-87ea-9cb308d30408.tmp
Size 9KB
SHA256 290d6201d0f7418cb18e766562ab18100af1add5a939716a5604bc5afe0fd236
MD5 7ab2fb9213e2e1dd44f3e145c58f5797
SHA1 c4d69e2d0431114f34e1af3fcf3b003afe911279
SHA512 7a9f3a2257907467fb0efe8b583ab04cd9e5f2c3a00055c495eac4946fe49b24ebb6a519e4fc0b8bc79d9e8020cf06d23403027115882d2966dcfc04ed2b118e
SSDEEP 192:sxZHR3Wy/flsMXIdpRmHW6+WNI3s/Y3Z513IgrJ:sxZHIy/flsM40Hbb/S9
TLSH
T11B22C8526E28B97B8CC6D219BE65BF13E6F9543265D41E48AAFC861C04E76CD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ef92167f-50a9-435c-b3df-3036691c4803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef92167f-50a9-435c-b3df-3036691c4803.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3adaa80-c411-4555-b5c6-72e7e5658169.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3adaa80-c411-4555-b5c6-72e7e5658169.tmp
Size 21KB
SHA256 775c192039d50f97c6f072d5420c59f99eee891d354595814cdde99df4709189
MD5 d633402d35f274d39964363f081a6b74
SHA1 cf58090a66f48e139542b57837a04f252c678063
SHA512 d1a3f9d66c920b5934cffe29719f82ede270cd172cb37c34eb56070ca7e38f61b957468cb8f59b6796874695f8ab2b7159e5a16d2852bad673688ee0aafd5749
SSDEEP 384:CiFzQkUSvDzsNa8TUNTUlIlvVIpu+P89iX5FVajY2YoLevaTZcEIIlR:JFdHnwgsd4ahkDevaTZcELf
TLSH
T137A25C339898A83F9EB69B50F58A3203DEB04167CED9AAA4D7D95A2C00DB1DC134BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25969ede-19d8-446f-8215-0d6e671cc48e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25969ede-19d8-446f-8215-0d6e671cc48e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f25adc32c1b1b148fdd70b30444d8c359b46284c6079b781607b5a40b3fd19ab
MD5 13c1c419a1cf5f94b50d76a4aefdd4a2
SHA1 59d88d46dcaafe35a95bd60a1f3179f73ae785c5
SHA512 9bba2dc4e7ac25116283c436edef8ad547baa5cb9c7543b6e0a81d4686406a22814616dc4dece473ef59d20b011a34e0e00a57bb8172021136990d8ed705f61a
TLSH
T10541F69CA6ED1045B3737E5AABF6A86E847F7D332E47C45E40110D4E0662E41C962737
MD5 SHA1 SHA512 TLSH

Submit Download