af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-8dvi3e.html
Size 214KB
Sample261002-k5ehlaef52
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{2879544B-FC2D-47B5-9ADE-1183690C8164}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4952	1588	msedge.exe	86
PID 1588 wrote to memory of 4204	1588	msedge.exe	88
PID 1588 wrote to memory of 4480	1588	msedge.exe	89
PID 1588 wrote to memory of 4480	1588	msedge.exe	89
PID 1588 wrote to memory of 4480	1588	msedge.exe	89
PID 1588 wrote to memory of 4112	1588	msedge.exe	90
PID 1588 wrote to memory of 4112	1588	msedge.exe	90
PID 1588 wrote to memory of 2508	1588	msedge.exe	91
PID 1588 wrote to memory of 4732	1588	msedge.exe	92
PID 1588 wrote to memory of 2508	1588	msedge.exe	91
PID 1588 wrote to memory of 2508	1588	msedge.exe	91
PID 1588 wrote to memory of 4732	1588	msedge.exe	92
PID 1588 wrote to memory of 4732	1588	msedge.exe	92
PID 1588 wrote to memory of 3996	1588	msedge.exe	93
PID 1588 wrote to memory of 3996	1588	msedge.exe	93
PID 1588 wrote to memory of 3996	1588	msedge.exe	93
PID 1588 wrote to memory of 3964	1588	msedge.exe	94
PID 1588 wrote to memory of 3964	1588	msedge.exe	94
PID 1588 wrote to memory of 3964	1588	msedge.exe	94
PID 1588 wrote to memory of 3348	1588	msedge.exe	101
PID 1588 wrote to memory of 4064	1588	msedge.exe	102
PID 1588 wrote to memory of 3348	1588	msedge.exe	101
PID 1588 wrote to memory of 4064	1588	msedge.exe	102
PID 1588 wrote to memory of 1428	1588	msedge.exe	104
PID 1588 wrote to memory of 4432	1588	msedge.exe	113
PID 1588 wrote to memory of 3760	1588	msedge.exe	114
PID 1588 wrote to memory of 4364	1588	msedge.exe	115
PID 1588 wrote to memory of 1880	1588	msedge.exe	124
PID 1588 wrote to memory of 1880	1588	msedge.exe	124
PID 1588 wrote to memory of 5000	1588	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-8dvi3e.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84c7ec188,0x7ff84c7ec194,0x7ff84c7ec1a0
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,9261204223095910382,13413104021402113190,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,7453327165559153116,13540512001055814936,262144 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,8791684530704332115,428704927683113823,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,10971572235395097292,13709859879099376482,2097152 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9170672931330609092,15826977671952453260,2097152 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4637247287176702450,7057967235947793387,2097152 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1005501861853094070,4413323892447130003,2097152 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,17973425508159360184,8593128924131173594,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9023674601015735590,11629736864618690517,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,11523371574298418712,14274808699111378559,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,11523371574298418712,14274808699111378559,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,9072595138506570320,12808572007363414878,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,8920526685938513077,11544451625952620731,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,180949496136175345,4308439886022173419,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,16883189028206280794,13127383696759814910,524288 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,871471257703671096,4355477454609126113,262144 --field-trial-handle=2692,i,1315375102143895572,11861985123532028456,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7309cd03-c0a3-47a1-bd03-1bf7a42cb070.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7309cd03-c0a3-47a1-bd03-1bf7a42cb070.tmp
Size 18KB
SHA256 8dfe8d2094a391a9e220bda67341c6caeeb7c6f88bd0ea3e78715da659121222
MD5 ca48a76c12cb7947281ad539ac7caa8c
SHA1 725ece92ee48ce0acff3f7cae6ac8a4542b261ef
SHA512 6cde3c86bb2ddcf55f42e6eb4d2294e3ddec26309467acf3353fa93340f779ad1ffec0bdb0c7130c9190336a66f4d9afd1dd4a027d3c7e657be622331811ce7c
SSDEEP 384:wZcIhsNGUOfwZGxiuHX58EndrSBMa2wtgOIwZOyuLyou:OhMEXaQQCwXsBmx
TLSH
T1D3828D3298B86C7B9CFAA545F08736035FF8912BE6C9AF94D5ED5B1D00D92A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

904f3236-e02e-463c-bd48-4185c81c5f02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\904f3236-e02e-463c-bd48-4185c81c5f02.tmp
Size 21KB
SHA256 8e328813fe665b180e140b853ff02e9f24cb8364d631c70db734f9568dcc7a7f
MD5 fbd7277125da56ab26f004053f397348
SHA1 56e78b6028306d4621fc9e404d4539e3a2933493
SHA512 8d0f9752ae876e2981f43510d12edf9927ea9e3f179f3ed15a7ed749b3ae5846a4bee09f14189d3e9547e2faff76f89f08958a15c829efb169887f3a115ca59e
SSDEEP 384:ciFiZcIdzsNL8TUNTUlIlTfwZGxiuHX58EndrSBMaRwtgOIwZOyuLyou:HFQlOwgmEXaQQFwXsBmx
TLSH
T133A28D3388A89D7FADFB9A45F58A32039FF48167C6C5FA94E2DD5A1D00961DC030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73589e6c-8309-4d6a-9743-8f38c0591b78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\73589e6c-8309-4d6a-9743-8f38c0591b78.tmp
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

0af50e4e-2f66-492f-a0af-c84c69afc594.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0af50e4e-2f66-492f-a0af-c84c69afc594.tmp
Size 9KB
SHA256 909de5725a933c61f082190606281c6874d394f676b3d83c6edc0e2164050906
MD5 be65d5e78ee2fa6e55d73bc15105cfdd
SHA1 c0c000fdae7a9940c1aed589270435ea2f6538e1
SHA512 e4a9deed4115fbb3a0f1d4cff4d4fde4fc16def8d3b273a1ff6c734996a3a54e6f34e6cc97cd3f0bd150b1abec7e6a8009fd6a74fd26d3e0e7967920ac47c170
SSDEEP 192:sxZ9R+WK/fSsp1IdpdiHW6+WNGYrbJ+HIg5iJ:sxZ9LK/fSspGYHbGUI8
TLSH
T17A22B7526E28A97B8CCBD21DFB55BF43D6F9503291951E48EAFC862C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4601892a-39fd-4254-a2da-c392d4e123d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4601892a-39fd-4254-a2da-c392d4e123d6.tmp
Size 10KB
SHA256 48c9e4d2d1e92672c6e27dceb3d3d38cfb6c902d1111b78330b1309a32d57e83
MD5 f4e82e8797967e12c3c6741643c32cf8
SHA1 a053aadc1c858d1c72f6f47de03111a5b242a297
SHA512 972a35861c595ef69739ba3938ec03a3318748d2e0e3f22e987424f58725e17c6f948c467229c342266f1a5cb2c4c736cffa6eb3b7e52d06b46c4dd7b0ad535b
SSDEEP 192:sxZ9R+WK/fSst1IdpdiHW6+WNGYrnJ+HIg5IJ:sxZ9LK/fSstGYHbGSI2
TLSH
T19822B8526E28A97B8CCBD21DFB55BF13D6F9503291951E48B6FC862C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6049b39d-83a3-40e0-95ed-0b99d1f01e53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6049b39d-83a3-40e0-95ed-0b99d1f01e53.tmp
Size 9KB
SHA256 698f14652329cdab188b43a291805fd85a33ea9dedb71c693a0aecbd0842da8a
MD5 a1bf8965c6164af216484272d9af6b3e
SHA1 4ca5f65d5a1d1cff7690d0386d98e971c19fe62c
SHA512 922121090641690b6880ee669425a04bd7d9cccdef61c369a9e0da8bd3db07ba7bbbefe4ea09ecd67d9604ec136b2cfdbeea366ee8ce4be320df9f8abeb7aa97
SSDEEP 192:sxZ9R+WK/fSsb1IdpdiHW6+WNGYrbJ+HIgrJ:sxZ9LK/fSsbGYHbGUI9
TLSH
T1C912A7526E28A97B8CCBD21DFB15BF13D6F9503291951E58EAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 de158040b98b20dcc5f773ec6f871726294f53f2e7dc4786395a71bd3f7a8b6c
MD5 b605ed83cf653425a01233380bbb863b
SHA1 522c85e165f43540ce63671b4c74b4d071b734af
SHA512 ca0392e05578b766cacf75fad9361d0508845735884d88f71e4ebdf941fb6e3d7ac95e4b760c1d41d69573da3ed2f8f162a78dcf91ced322b1a41e9cc6f5ef3d
TLSH
T196613D834BD14064D35B4EB4C7E6268739F38EB04297BE3209E4C4FB4BA73656B35208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6fc643eaf93c36f932391b3aa4e244ce320bc26242f22510298bb4c9ebd2c9a6
MD5 fd4fe19a051befe23e0cf29914df4def
SHA1 7a63aa418a59de82c79f755e19a4ac678e7b8f70
SHA512 500b95a3168e299859d33aa85842542840b79fce2f9ef7c7d51fd7ebd0bf3eb143c98936dd039e2d4ae4cee3a2da98b0e1e6d184813a8b1820acdd0bff04fd6c
TLSH
T1E1613D834BD14064D35B4EB4C7E6268739F38EB44297BE3209E4C4FB4BA73656B35208
MD5 SHA1 SHA512 TLSH

Submit Download

6ca1a60b-4ab5-4247-84de-3a263d29762c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6ca1a60b-4ab5-4247-84de-3a263d29762c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8634478c-c52a-4423-8dfb-a1486f9410a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8634478c-c52a-4423-8dfb-a1486f9410a9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c1b0dc70-0a09-484b-b396-dbb4d8994e7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c1b0dc70-0a09-484b-b396-dbb4d8994e7c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c4bc7b39-c068-4b03-acbc-cf5f779f1977.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4bc7b39-c068-4b03-acbc-cf5f779f1977.tmp
Size 949B
SHA256 959f28d3a0c7f86733099369a8af8a0aa1ba4251fa5d35357d9929bc8e783718
MD5 94dcaca5a16c6cbccb271d0ab488171a
SHA1 46fbed9b50a569a0453bbb6e091460c6c38a288b
SHA512 aaead669458a84dd388eeb5db2c1ce5be599ad19843e2ed8d2da7ec19104f43ddfbd6516929b2ed0715ef8fcfb00b8fbccd12af35541a8b111e22354761368c3
TLSH
T13C117DB3C3D585AECA4556F05A24AE2BCE2D0606821C7C1995D4EF2B93E3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2e86433f939042c2bffabd7bb70e508567f6497b5bb2855bb999f9b4da933ca2
MD5 0f4e5cf4b1122a75d9f6d713cad12653
SHA1 0293b1a633551610bc6f17f7f64970e081e96ba5
SHA512 30b7636b6094d8276c94ca8f584d4402f998bdde72eac747d0cb19aeecb81ceb8f34543335d056e0693df6c9f7587aa9ce231f656173ea099b91a94b351cbb43
SSDEEP 768:rsy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbUroRHl:rsy4J/DWvbtBhu1jajiLm0b/Nl
TLSH
T162C2FB3B644CCA7E4FC00A9DDD5E6FD73E9802C79A948D4047FA954C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 55dd649616d6d0fc68aae5bb0db32f6690c0274a41249a1cefc69a59443535be
MD5 ef29d7e5398b981f4886645a38395814
SHA1 3c013f1c3c50ba542e450f01f548891d426297ac
SHA512 9f076495f5ca454ab6a10fdbd6171d278404b7e4bf9432573bdf3082e7be0a5707d6e4af75634b80cc557390f541012c8c7d836fe3b19103113eb3ec2f78a17e
SSDEEP 48:KIDI1Ks04jyL98xN/rvQbjWDISFQK9F1nQxVAYGH99yLHqTnpJZybRcBIS3yK93u:KIDCKs0+SC0KraqakAKNyt
TLSH
T1B091F25670BB064038BE3A588075D72A228236B37119EA3BFFBC40655E6FE085DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7ad40c9-e2f5-4ba1-8b59-ef1df8649499.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7ad40c9-e2f5-4ba1-8b59-ef1df8649499.tmp
Size 10KB
SHA256 920ae739715fb8546a70d0a117d6489ef7ecf518b23283d9eb25f0835f7e12d1
MD5 1c58e7234ea83b2e7fa95d198bd3357e
SHA1 c68511ecf325e8afe00316039cd02cefe2badba3
SHA512 b659a092caec82d967a62c47b1504a8e7769652bc0c25dfb3f5c1e478379b18cd2d14c4358eb03b26e2365e17b53f99be46ae3c333ad61684e2281497e009c18
SSDEEP 192:sxZ9R+WK/fSst1IdpHiHW6+WNGYrqJ+HIg5IJ:sxZ9LK/fSstGCHbGzI2
TLSH
T17022C9526E28697B8CCBD21DFB55BF13D6F9503291951E48BAFC862C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb638a81-be91-4d97-a66c-f522ac586046.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb638a81-be91-4d97-a66c-f522ac586046.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b057bdee-394b-41ce-8794-4634796cab88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b057bdee-394b-41ce-8794-4634796cab88.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a474e386-9772-4d87-b00d-92f4f83ac427.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a474e386-9772-4d87-b00d-92f4f83ac427.tmp
Size 18KB
SHA256 4c419c2645afe75d0eeb50a9e9d77ad2015482e20ff9f354eb172f74706bfb66
MD5 5e12a1ff4d8553ce2e59d2a4b4975b80
SHA1 1b436eb175225917597271e5482c8d211fbafefa
SHA512 1b8d177e9c1b6f76fc0af66ddc2bd9f4b0f9bb1a06ee9e31ee0b6831b1fe825e1789da16440c1323bc66a837b068fe3a86f6edeb9adce7763fb1eade3e1b124f
SSDEEP 384:HZcIhsNGUTfwZGxiuHX58EndrSBMa2wtgOIwZOyuLyou:vhrEXaQQCwXsBmx
TLSH
T1DC828D3298B86C7B9CFAA145F08636035FF8912BE6C9AF94D5ED5B1D00D92A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5d42ba1-4004-46f6-903f-a231a588be2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5d42ba1-4004-46f6-903f-a231a588be2a.tmp
Size 8KB
SHA256 874f959b70a8758a488ff3d443826de8273bcf010237d1d101351e38426ce1de
MD5 4babe0f6b72aa3e2f8f7a5a573fde6ff
SHA1 e04b76f373d37c717b5795e6f19678a0871649a2
SHA512 185104a232239ae502bd11c7604d10350e85888d66efcdeff922106126e59aa4fa0a6bf8fa611ba32d0b7c4be0b11cf1626a1c21ff9e753b40d3a5e39b11b600
SSDEEP 192:1ONU6wlDBQmiUyZuU14X58gZs+Fdrva+KMafveCqwU6:1ONU6kfO14X58EndrSBMa+wU6
TLSH
T169120A35E478AC2B4DE2A555F0C735139FE49227EB897F94D6EC1A1C01DE26C134AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd2d123f-1e54-45b5-a108-20eba64dadcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd2d123f-1e54-45b5-a108-20eba64dadcf.tmp
Size 8KB
SHA256 0bd9eb876b754fb841ec80854d205df20503e049d74b5186821cbb92e6bc841c
MD5 a8f934b7130e8d36183367bed0db7f83
SHA1 b4bc45f32c78adaa3b17abca6bc7d2af744bca76
SHA512 f21958fb47100d449c01d243e567c21d5e412c3f983ee508c7be0e22285c683e2555d01a98b7c1888624292a6a4f141f8565b6414532da3d59006870b6ec6cb5
SSDEEP 192:1ON76wlDgQmiUyMUW4X58gZs+Fdrva2DlCmU6:1ON76kgcW4X58EndrS+pU6
TLSH
T17502E935E9787C7B8EF2AE09F4872A139FE4112BEA952F84C6E81A1D00D775C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3590056c-9b76-41e1-a4c0-1d4b4abfb0f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3590056c-9b76-41e1-a4c0-1d4b4abfb0f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8327799e0605f94b650e9d85c1b9d5ade3a07086a4a9548c2675413d5acb269e
MD5 c2cebe9df99aae3c05bff5491ac16e0c
SHA1 834a60d26fd860d42f48e819f9a9a0b49a28f23a
SHA512 3de12355898b9fb3d1b33b6c3a36356a537ce0c782ba3802e491ac7a95e689adc94386ed72219afd05cbaabceb6942be0e4c2d117828c3ade8cfbfc6f2b8c032
TLSH
T12A41265CAAF90158B3776F4AABF6B86D84BBB9772F07D45E00110D4F0A22A00D962737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-194-0x000001A5D5140000-0x000001A5D5289000-memory.dmp

Download