hxxps://www[.]docusign[.]com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend
Sample260731-wstyasdn2w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299951014338927"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{81EA58EC-30D6-4D12-9226-A137EED4ECED}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 788	5052	msedge.exe	86
PID 5052 wrote to memory of 3028	5052	msedge.exe	87
PID 5052 wrote to memory of 2308	5052	msedge.exe	88
PID 5052 wrote to memory of 2308	5052	msedge.exe	88
PID 5052 wrote to memory of 2308	5052	msedge.exe	88
PID 5052 wrote to memory of 2960	5052	msedge.exe	89
PID 5052 wrote to memory of 2960	5052	msedge.exe	89
PID 5052 wrote to memory of 4980	5052	msedge.exe	90
PID 5052 wrote to memory of 4980	5052	msedge.exe	90
PID 5052 wrote to memory of 1536	5052	msedge.exe	91
PID 5052 wrote to memory of 4980	5052	msedge.exe	90
PID 5052 wrote to memory of 1536	5052	msedge.exe	91
PID 5052 wrote to memory of 1536	5052	msedge.exe	91
PID 5052 wrote to memory of 3384	5052	msedge.exe	93
PID 5052 wrote to memory of 3384	5052	msedge.exe	93
PID 5052 wrote to memory of 3384	5052	msedge.exe	93
PID 5052 wrote to memory of 2212	5052	msedge.exe	94
PID 5052 wrote to memory of 2212	5052	msedge.exe	94
PID 5052 wrote to memory of 2212	5052	msedge.exe	94
PID 5052 wrote to memory of 560	5052	msedge.exe	99
PID 5052 wrote to memory of 968	5052	msedge.exe	100
PID 5052 wrote to memory of 560	5052	msedge.exe	99
PID 5052 wrote to memory of 968	5052	msedge.exe	100
PID 5052 wrote to memory of 2204	5052	msedge.exe	102
PID 5052 wrote to memory of 416	5052	msedge.exe	103
PID 5052 wrote to memory of 416	5052	msedge.exe	103
PID 5052 wrote to memory of 416	5052	msedge.exe	103
PID 5052 wrote to memory of 3068	5052	msedge.exe	104
PID 5052 wrote to memory of 3068	5052	msedge.exe	104
PID 5052 wrote to memory of 760	5052	msedge.exe	105
PID 5052 wrote to memory of 760	5052	msedge.exe	105
PID 5052 wrote to memory of 760	5052	msedge.exe	105
PID 5052 wrote to memory of 3164	5052	msedge.exe	110
PID 5052 wrote to memory of 4004	5052	msedge.exe	111
PID 5052 wrote to memory of 4008	5052	msedge.exe	112
PID 5052 wrote to memory of 2468	5052	msedge.exe	114
PID 5052 wrote to memory of 2468	5052	msedge.exe	114
PID 5052 wrote to memory of 3968	5052	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffa3985c188,0x7ffa3985c194,0x7ffa3985c1a0
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,52541590175477408,9051571408515689344,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6448676561611789955,1914776157900345520,262144 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,8869252829024106323,7111239012009772457,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6200411949127827254,12058231914068694504,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,718544013825554737,14420313346473716319,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15852237941097459641,8351524554845591525,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3521432784996184210,1599249800467691369,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,7547052809817748381,8332766575537711913,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6669510620361998664,3123825932215291073,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1815554843422256742,14951704653125989580,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1815554843422256742,14951704653125989580,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6184,i,3298052621236946528,5599465610894059439,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9242715689267152308,386160442156220077,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4532,i,17377508201968364192,10510984371589689307,2097152 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,17867041971582295204,8047342897746888360,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,4164203573898093603,9484071322909953771,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12930818661510965809,6597000254180375303,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4653747385939974610,6177507737498070789,524288 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5196,i,11207076801772892556,2199436989727940598,262144 --field-trial-handle=2184,i,7378732112913251795,3001773442068130462,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 cc93f95cd40c694fdc3bc9c4b3ce72395975eb709a8950994eb343dae8f6b6c8
MD5 42afbce035731962fdf956f5537ccc2e
SHA1 1706aa67702918aa593d704776bb3ac62cc678e8
SHA512 a91a8616c77c194716239112c49f784de2950db215351bd32564e2311ec638cde4bfa0a23ef73a6157593c3dd762b52ca713a643634d292378f2a58a7558d027
SSDEEP 48:m7loDTlxltIt0WL7+0CKqgKORy69WFjV3GdbysKc7mufZn6y:mh+T2+DKG569cj2KchfMy
TLSH
T188814C3704C840D2DB96053A54F23248B8BD82DAF53FCF8200F76A7E5B97756806A17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4f138ccc3ad680ee2059cd0127557cd21f45cf61aa7820f2ab98607e8c5b3655
MD5 2873a950bb3553d79531a3683c26080d
SHA1 dc6f092621ec4a8aa5be2e8c892e173be21fb65f
SHA512 c9fc0ee2cb2dcd0d7153951692b39db8c0527e8ac59191758b15d7b38d33b0b5e2d1d2c59b978b9b5ca63bbfe6c18ca0db2d57b1bbfb68ad15685afaaa56eaab
SSDEEP 48:Fm7lojTlxltIt0WL7+0CKqgKOR169WFjVTGdbysKc7mufZn6y:Fmh+T2+DKGG69cjaKchfMy
TLSH
T1F5814C3704C840D2DB92053A54F23248B8BD82DAF53FCF8200F76A7E5B97756406A17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5916ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5916ba.TMP
Size 3KB
SHA256 18428f8a34a4cda84ba3f8132dc47d84268aaa81ce91ee4c6f04c82d8aadf6dc
MD5 e562500195769cc832bec8e20fe78309
SHA1 fbf59e7367b693d6071f245fc17074bfb75a058d
SHA512 f4b7ca3733bd81fa17663aa5d9e6fa63c6e72d95dc0dfaf203fdff07b9ba5cb5f81ae8bdd986c13e43a397780d14171829ad06d57935ec638b3b33a462e7bc25
TLSH
T14A714E3705C940C2D782013A54F16284F8BD82EAF53FDF5110FB6A7E4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1f96d0f4381f935712405039a3a30621426e3e17c0d849049c937dd54cc7e5c9
MD5 c3197c509aa51c051602dbb492b61f61
SHA1 03a05b8718aa103780cd4e7c7021c9b3b59aa1cc
SHA512 f07e0281bb0a5a8a9868f995a2fe5c611cdd0b560bf16833a0debb57eb8b51404a5f08aaa01a6f8de54f2ae54015a037914c2c1903851e880ff71f63488e2fc1
SSDEEP 96:D0OYASX1zByXXDXDl+cpDeFV0RDRjT6JD9PeSe5fFBwQ:D/YASX11yXXDXDl+cpDeL0RDRj+JD9mb
TLSH
T143C14FF7C7E4992DCD2252F5AB362E6FCE1909105328382ACAE4BF1B93E1471E10165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17993e2ae635f432ef8d2a4487050985ae94ba0fcedbf54e0d37c0957e1c6d1e
MD5 a540d0c051c5451f88385d2719bb0e12
SHA1 0c427b962406c34f2e15ca2f551356da28174642
SHA512 1e92fa05c799bb5dc2a9de52b8634a38ce0bf09ec109da8c7aec9acbdc3aa97a781a4e68d19ff0d01c9aa52a9b7846cd28684c00faadc0da243edecab39f2399
SSDEEP 192:sxZcu+RJyM/jK1Ml8Mk31/fXNspfCWqHIdpMoHW6+WNIQt/YzIDeiIgrJ:sxZcu+lM31/fXNspfCTIlHbl/19
TLSH
T13142C716AA349977CCDBD209BA55BF53D6F51472E2900E44AAFCDA0C04E6AED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e5b757c809d4d16556977d4f4fe220952e4b11cc0d0bb9ae306f73ce18db57d0
MD5 b199b30ad9a0de1c3646a799052b1a20
SHA1 47e14368d2d18ce68b52c8731fcc66e08f719891
SHA512 e41670f1c3fd36881f5b43912d10969a761594623633a572c495f86320d70c18eb3ba07a3edbee11bf5fd648b8c3a40b0de0ac66347c42e034d535a578e5b5c1
SSDEEP 192:sxZcu+RJyM/jK1Ml8Mk31/fXNs4iCWqHIdpMoHW6+WNIQt/YzsReiIg5gJ:sxZcu+3M31/fXNs4iCTIlHbl/v2
TLSH
T1BB52B656AA3499778CDBD209BA51BF53D6F54472E2900E44AAFCCA0C05E6AED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 de8c4f791e34018ad3a189086b0e662d6e4ff2fd6f7f4d71f552f3f9aa69194b
MD5 6be1648e33f859838254e2052a0a8b90
SHA1 776ae013d13ae7f685fee609aaf64acf46acacab
SHA512 0d2e03f149e9df739e84547fb0502bd5608e38e73bbcb397745e6bdf1012878293b76a97d10949d02f1a6e1f349cb1dd0be713b4d688a633afefdd14b43da0d1
SSDEEP 192:sxZcu+RJyM/jK1Ml8UQIk31/fXNs4iCWqHIdpOoHW6+WNIQt/YzISeiIg5gJ:sxZcu+3qr31/fXNs4iCTI3Hbl/g2
TLSH
T17652C756AA349977CCDBD209B951BF53D6F55472D2900E44A9FCCA0C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 77bb28c7047f86f7addb4c9d257194712892447f3d2e38f0a66be0dfc4eb88b4
MD5 b9f2fa2d0057f9ad181e2b6e27d0e9ab
SHA1 037d2f8c7481f66f8a252e7593380929074c0004
SHA512 82d095c9c3b1c59a2e3a398a070abeb9d4e4f32881bf4bedaea80c922acac8ec6e506c618f0571005cc824f32b3c8beb9376597eb1ee08b7d0e4879a63d192b5
SSDEEP 768:dYW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjmroIyi6Yi:dYW7kf0Wvqidau1jaa5LA3jdyi
TLSH
T14CD20B3B680CCB7E4F840E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a628c56d-fc42-4ec1-90c0-94e3e1bc5748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a628c56d-fc42-4ec1-90c0-94e3e1bc5748.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d7dac44c49862ce6b4ff552ef89fd9ca9c9b450cfc02c9d5c74d92d1db4fda6
MD5 750c793f12a3affde1b2aaf3e8c14378
SHA1 40019d502bce30015ce92946f3b2666be088d491
SHA512 c2705b849c1d8d6fb1b54d9a09d6c29a32f6bbd2651ad25d6ffbad434b99fbd0fcb94398715b8411a0268b743ad6020a2b5c21f1b13193fcaf8d54aa41b9f802
SSDEEP 192:y2LsNchQPBbiMNQmiU1SpXJB4aGBPK7hCI9jlEJdNuqBU8:DsNchKbi2kXJubM2F1U8
TLSH
T156323A766C789C3A5DA2A151F08A37136FB8417BE7882F40E2EC6B1C05DF29C231791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 12c78ea22ee75b24ab0d78d5e8a8c91c597d38fd02d32320005a79a4475dc41c
MD5 c5e2d1694ae14f1fb8ed54fbb572a115
SHA1 d0b2c188cf7bcddf04cbe2316972b5bbca1fe9f2
SHA512 2a8041567bab21e6242b3ffbbaf8eb48a12b4a98cfccb17365f86b9eaa46f21a4801ba5da841cd2178bf1b511046255b065a31251da2286ca3416cc4cc0111e8
SSDEEP 384:liFiZcI7zsNU8TUNTUlIlKKbi2eXJubM2s1OObjI9G6w7vG:sFQvxwg/Gyzs129Me
TLSH
T147D228F258E7893AD96E5753B7BC2E124EBCC167F6846A40B3D89A0CCD9607FC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e9b23901a3b4fc85ad405722013dec8f517b021a235e42cdc0254d37387e264a
MD5 d6ea7eae4d13b6ed8d70747059722757
SHA1 57d7e1e77d2a4a45b82e59f7443a1b3c950403b2
SHA512 faf64169b9367a0a416d79a4e7b11f7a324ff52fb26277397e6e78688d7c41d097d398efc313c1cdb3a613e1a0445975b427b12d6b520810009e0bc1a1b936b5
SSDEEP 384:iZcIhsNcKKbi2kXJubM2F1OObjI9G6w7vG:QhZ0yzF129Me
TLSH
T127929D76AC788D369D62A152F4C936235EF8917BE3C82F44E1ECEB0C09EA55C031791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 468d2517ec46c2962ee949369db5f7abfa6f76eba47246397b59c6dabed09b34
MD5 589300835fb6097e54542378dffe8495
SHA1 6de332f5fef3d4bd6cdee2b592d5add843df8a8f
SHA512 e15ee3673316d7e00dbdef4b3a12a139cf9e221a8f0fbb394130b0bce5c759720ba94427a14bf8a3017c17c4e63bc623bae1471416ae97f4de0f384db1ef0612
SSDEEP 192:MONo64BAQmiUyd1GW5GBPK7hCI9waDKXU6:MONo6eACEWQM5cU6
TLSH
T1AD020A39AC796C7B9EB2AE45F48637171FD8117BF6845B40E6E82B1C00E764C234392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2226bd10416b35dccc81c66923206b0de88524c82d7ea7c8be7c2bcbedae2e7
MD5 d56f062a2e1dfd1c680c324392bf3a64
SHA1 876ffe5c2d21891c3c9cfda1d71d49caa3254edb
SHA512 5955f0919d236db73f75175c77f0aeb361c1ce9d2a86873d489b6a0f6ad35a173ff40f6d89db220ce0052404e3cc78ff6ebb3322a4cf349f99ac455c733c99a2
SSDEEP 192:TONl64B7QmiUyjGU5GBPK7hCI9jlEZWwuqBU6:TONl6etDUQM291U6
TLSH
T173121A76ACB89C7B5DA2A191F48637131FA9412BF7846F40E6DC3B1C05EB65C230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05882697-209b-40b5-9a3b-d6a217f1f78c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05882697-209b-40b5-9a3b-d6a217f1f78c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b2c88504d270be1534032669090d755f16072322837d6631cecb6a64248a4be9
MD5 87e4c90924ee141421fd30475dce5b76
SHA1 d33da4dffeed7dd97b52e4ae77284095c9e88296
SHA512 7865e06071355c87f3fa0764aeba158107e4d3a0b7691c55fd51f069382e017c53de72113353c0ee9292b933e0ac37065a863a6572401f635268fb5728a85e76
TLSH
T1AF4139A8B6EA1154B3B77E169BF6A86D487F79772E07D45D00000E4F0A22A41CD72737
MD5 SHA1 SHA512 TLSH

Submit Download