Overview

overview

8

Static

static

1

sample.html

windows10-2004-x64

sample.html

windows11-21h2-x64

8

Resubmissions

03/09/2026, 15:21

260903-srbhsazele8

03/09/2026, 15:17

260903-spegnawwds4

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    728s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-fr
  • resource tags

    arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
  • submitted
    03/09/2026, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sample.html
  • Size 66KB
  • Sample260903-srbhsazele
  • SHA256 6f084319a965b4c9eb09d53375f1114dff29ca5503793447fd2f14adf4fe1b4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 22 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ff980dec188,0x7ff980dec194,0x7ff980dec1a0
      2⤵
        PID:3256
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,8241920076103963619,9258193390451561200,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4860
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,15557962368028804739,14768160888550420949,262144 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
        2⤵
          PID:1596
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12125589311780916551,10263247409340598216,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
          2⤵
            PID:4684
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,13670428574190029288,8295371722730409056,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
            2⤵
              PID:2124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,7576853903910442334,12142967816349529886,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
              2⤵
                PID:4220
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,3873792802784754023,14939267539903838377,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
                2⤵
                  PID:2176
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,16728879463207552278,3351724102371296185,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
                  2⤵
                    PID:3196
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4200,i,4550025903346668169,15302059573834833801,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
                    2⤵
                      PID:4600
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4168,i,16133454849202002752,7620549597248162664,2097152 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
                      2⤵
                        PID:1028
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,2236831252717264362,13606829537124397906,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
                        2⤵
                          PID:3616
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,18201021917526997405,17693139311591494037,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                          2⤵
                            PID:4160
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7808998342978041791,5218996034272629301,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
                            2⤵
                              PID:1324
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7808998342978041791,5218996034272629301,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
                              2⤵
                                PID:4808
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17531726496241885447,9695129362378031306,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1320
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1132
                                  3⤵
                                    PID:1788
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,13177082044827473583,9824787646462845019,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
                                  2⤵
                                    PID:1784
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,8746797259135136728,15807000209190414991,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
                                    2⤵
                                      PID:2124
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,8283682504476654924,10301721823406253663,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                                      2⤵
                                        PID:216
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,12011543720466505346,8714352891343652188,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
                                        2⤵
                                          PID:4560
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5856,i,2983678014857385444,2999211139381955504,262144 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3144
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,520970634474477949,3234849303555173897,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
                                          2⤵
                                            PID:3472
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7200862603527118060,3770819777026309193,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                                            2⤵
                                              PID:2192
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,1026989516220984075,2330618614701476648,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
                                              2⤵
                                                PID:3332
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,13309732412988260473,9715114429335738943,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
                                                2⤵
                                                  PID:1052
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,6751951101499638665,18102192775412829098,524288 --field-trial-handle=1856,i,4984153875091471450,11681682240563813551,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
                                                  2⤵
                                                    PID:1612
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:4216
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:216
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe /LOADSAVEDWINDOWS
                                                      2⤵
                                                      • Boot or Logon Autostart Execution: Active Setup
                                                      • Enumerates connected drives
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4076
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:764
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2352

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        blocklist
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                        • Size 105KB
                                                        • SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        LOG.old
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                        • Size 331B
                                                        • SHA256 e305792d289945bdc835620992fabc7de63569122f0a181d50051d1e4386f2fa
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        LOG.old
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                        • Size 334B
                                                        • SHA256 946ade76bb97a93ca0db842036ba7b0f3e1ab48a5d3ba1e71684ffc2db39fc67
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        LOG.old
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                        • Size 352B
                                                        • SHA256 8e0a828a5c41076973118c6bdc5deb2edb992b1573a2e2176ce1fc0b6e71dc19
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        MANIFEST-000001
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                        • Size 158B
                                                        • SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        BookmarkMergedSurfaceOrdering
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                        • Size 6B
                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 3KB
                                                        • SHA256 2af02b17bad3e56ebd21787a7dbcbfe366d20ea87fed5b355f17fc7046fd66f9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        the-real-index~RFe58aa16.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aa16.TMP
                                                        • Size 3KB
                                                        • SHA256 181eb48dbea4b2432f39094ad80d3c8c8184cb11dde1574bac6ee2c59f0d5262
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SiteList-Enterprise.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Edge Profile.ico
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 712B
                                                        • SHA256 ab7999213d0495ac16a6a04d4b23fc38a314148959349de3be39444a5a74a670
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 907B
                                                        • SHA256 141f1a273b3bddfd589269b5da0e32df900fd2c8e66d4a6c44a7b8ed0922604d
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 111B
                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SCT Auditing Pending Reports
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 13KB
                                                        • SHA256 2755fb5071c0b38ced9c2f912331d4595ba4863ffe3d4df5340d3d549a3856bf
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 dd082a29052fc7f8a0e950e2fd89c24d09ae229bcb0fd9599f46fef2b355b059
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 13KB
                                                        • SHA256 1efb16f665c2adf1d42c67553efb927d7f11ac2090ee8cbb5d88044945299e1e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Secure Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                        • Size 31KB
                                                        • SHA256 b2b6b9c10a699f8eab1127e5a6b9416c62122e25cd2796fa328110d88fc4167a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
                                                        • Size 1KB
                                                        • SHA256 c50da325f0b4e1d729f2ea0f5efe522dd93f4d82732f3a0b40381f2082ba276a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        the-real-index~RFe5cf8b0.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe5cf8b0.TMP
                                                        • Size 1KB
                                                        • SHA256 66a684e743a1d698f8bd2196feea2eb4a0d779e280802296a3c1371cbef06b8e
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        index.txt
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                        • Size 371B
                                                        • SHA256 8865cef715437c4a2556b633b0ab0a775e6d2b5fc2181acd1e60c7accd1891a4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        sync_diagnostic.log
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                        • Size 4KB
                                                        • SHA256 122836d7c21d7035ac3ad938323253a345c65f40716cd8446adc39c8abfcf49f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        d2cb4e35-e66a-49c2-8a7e-c53cd20fbbd9.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d2cb4e35-e66a-49c2-8a7e-c53cd20fbbd9.tmp
                                                        • Size 22KB
                                                        • SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 18KB
                                                        • SHA256 4958068537a845abff2321c5b00c7c88641139be4ef67c625c652ae86de60881
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 21KB
                                                        • SHA256 f802ed0ff1df6d5fa5c38e8ba91e67cba5759b10be4878163b6107e5c89adcbd
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 21KB
                                                        • SHA256 e52359ccf6fd2a4477044263c4e2a941b84c4cd4b04368d7849dd665987b898d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 18KB
                                                        • SHA256 f6fc21bfe29d7a44197f444975bcd99c24b134a6f4ccf79a9ea94cf43b05125f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 8KB
                                                        • SHA256 5c85735489ceb65586e5db3972d08ed7571ff6c1276d0d27e617aa1d3078dae6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 8KB
                                                        • SHA256 7814fe97d5dee16a8147531a10a45810cce75e5aeb7dc7b01d0a49b634fa1429
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        8d9f298b-384a-4fb5-964d-9187b25c2873.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d9f298b-384a-4fb5-964d-9187b25c2873.tmp
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        www.bing[1].xml
                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\14KCXKU5\www.bing[1].xml
                                                        • Size 12KB
                                                        • SHA256 9b526b342144f5f550c16304a3912014fbd0fdb9376d7bd0ae934be09a7b8def
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        memory/764-396-0x000001F98EE00000-0x000001F98EF00000-memory.dmp
                                                        Download

                                                        memory/764-461-0x000001FAB4330000-0x000001FAB4430000-memory.dmp
                                                        Download

                                                        memory/764-523-0x000001FAB46F0000-0x000001FAB47F0000-memory.dmp
                                                        Download

                                                        memory/764-460-0x000001FAB4330000-0x000001FAB4430000-memory.dmp
                                                        Download

                                                        memory/764-435-0x000001FAA2AA0000-0x000001FAA2AC0000-memory.dmp
                                                        Download

                                                        memory/764-434-0x000001FAA2B40000-0x000001FAA2B60000-memory.dmp
                                                        Download

                                                        memory/764-400-0x000001F9A1CB0000-0x000001F9A1DB0000-memory.dmp
                                                        Download