af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-nr71y4.html
Size 214KB
Sample261002-qaattawv6j
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{5A61C316-5A08-4773-884A-B799061168B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
240	msedge.exe
240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 2904	5560	msedge.exe	87
PID 5560 wrote to memory of 5872	5560	msedge.exe	90
PID 5560 wrote to memory of 2720	5560	msedge.exe	89
PID 5560 wrote to memory of 5692	5560	msedge.exe	91
PID 5560 wrote to memory of 2720	5560	msedge.exe	89
PID 5560 wrote to memory of 2720	5560	msedge.exe	89
PID 5560 wrote to memory of 5692	5560	msedge.exe	91
PID 5560 wrote to memory of 2696	5560	msedge.exe	93
PID 5560 wrote to memory of 2696	5560	msedge.exe	93
PID 5560 wrote to memory of 2900	5560	msedge.exe	94
PID 5560 wrote to memory of 2696	5560	msedge.exe	93
PID 5560 wrote to memory of 2900	5560	msedge.exe	94
PID 5560 wrote to memory of 2900	5560	msedge.exe	94
PID 5560 wrote to memory of 4936	5560	msedge.exe	95
PID 5560 wrote to memory of 4936	5560	msedge.exe	95
PID 5560 wrote to memory of 4936	5560	msedge.exe	95
PID 5560 wrote to memory of 460	5560	msedge.exe	96
PID 5560 wrote to memory of 460	5560	msedge.exe	96
PID 5560 wrote to memory of 460	5560	msedge.exe	96
PID 5560 wrote to memory of 2780	5560	msedge.exe	98
PID 5560 wrote to memory of 5956	5560	msedge.exe	99
PID 5560 wrote to memory of 2780	5560	msedge.exe	98
PID 5560 wrote to memory of 5956	5560	msedge.exe	99
PID 5560 wrote to memory of 1832	5560	msedge.exe	101
PID 5560 wrote to memory of 3816	5560	msedge.exe	106
PID 5560 wrote to memory of 3204	5560	msedge.exe	107
PID 5560 wrote to memory of 1344	5560	msedge.exe	108
PID 5560 wrote to memory of 5296	5560	msedge.exe	109
PID 5560 wrote to memory of 5296	5560	msedge.exe	109
PID 5560 wrote to memory of 240	5560	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-nr71y4.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa640ec188,0x7ffa640ec194,0x7ffa640ec1a0
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,9084348188068337407,14767419796730233781,262144 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5164909570700571710,8260945578896558963,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,14644780182356510622,7752521518400553283,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,6082894609050009908,11704063715390936068,2097152 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,1094987901783722157,8512745303707890443,2097152 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,3335797174546941841,17550356985684914093,2097152 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,6602203420940407825,14917577256973417594,2097152 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3922519223767809637,5332728693853428414,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,10142781887165212800,11327776818774730205,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17668956349230536663,8700546942037900353,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17668956349230536663,8700546942037900353,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,9675764905952450040,14744876183919812582,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14554548357208469051,11770781794845148407,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,896866247643151742,15568506236370670267,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,302224073563788045,1680946412534994391,524288 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,6711166781425731286,6106529810815854633,262144 --field-trial-handle=2940,i,13799239746007159109,8200629346215887971,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1db2fe3d-80ee-4e67-a3a9-d62fa4d1d33b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1db2fe3d-80ee-4e67-a3a9-d62fa4d1d33b.tmp
Size 38KB
SHA256 def96d8d364edde7ad7566b13bebc998a59a16d8dc86074b00e69da3c850c8b4
MD5 160ba20776aedaa3b71cf1e040eba2f1
SHA1 bd42bdfb17efeec99c51524d899757efec132d10
SHA512 dca1744a6820a81a8474c92f0ce930b748b04cab37c051101824926189913a7f826de1f68916cace9689dc6022a0b356bacd79ea5dc81c0c9f789c09dbd59db6
SSDEEP 768:y/UxvxjgC+M3DZYdwybNbzohAyOeRFZD1fTos7Rj0Ai:3Zj3+M39YqzAZY1fT/RwAi
TLSH
T18E03B03ABCE4AC738CF6E244B24A7747BFF4466385C9199849DD5E0E05CB7AD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fc7eb54-b9b2-41f3-aea4-a051f7d80116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8fc7eb54-b9b2-41f3-aea4-a051f7d80116.tmp
Size 37KB
SHA256 83264d2d35a1d83f5ffb55eade7a383616be5716500d9d92cf0eefa63389e322
MD5 55d0fe5559527878aea67dd66ef8ce98
SHA1 d7978abbeeda1a37cb506bf07b24c6abe1a6774d
SHA512 7aef6f1e22fa7456c3023927a56418d8431b416ac1d70485a482447b960cc9b45c4674336cecc43b53426b884260e51df9de5aa62a687eb155213e6d0625fcca
SSDEEP 768:z/UxvxjgC+k3PLEybNbz5OeRFZD1fTos7Rzf/+Pu:GZj3+k3PQbY1fT/RTKu
TLSH
T1DE03C03AF8D86D338CF6E244724A764BBFF055B395C91A9809ED2F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90032dd7-01a9-4dc9-8532-d91b083e2909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90032dd7-01a9-4dc9-8532-d91b083e2909.tmp
Size 33KB
SHA256 07622fbc098099595afed149cd8bb70df59001a36d1a15d6bb2228e6d99cc6e5
MD5 74ec863a7de09cd383214c420bf5b137
SHA1 692a22d28ac76f7db827a95edddf91db3a2beb2d
SHA512 e0d7a6843999ea9c7d77625a4714586979a9a25987a6ea292dc9c251ea6a02b65d83a3a20f1d60e3fb6013644f890f2e26f0954cd49187a38c453fc8d9704dad
SSDEEP 768:yB3AZyDwybNbzohAyOeRFZD1fTos7Rj04YGHfHu:yB3iy0zAZY1fT/Rw4YUvu
TLSH
T14FF2AF36FCA49D734CF5E285B2467A437FF48263C6C9558484DD6F0E059BBAD130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

3c25802f-bd33-4ef3-a20a-c4b5a92885c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c25802f-bd33-4ef3-a20a-c4b5a92885c6.tmp
Size 23KB
SHA256 4a0a7fc63fd793d3d9e61561e2922cb212fa790822a93eb847b8c23af53f2ea7
MD5 feaf21892cbf39abd5a2963bfbb64bf8
SHA1 3d1fd5ba81b4e404d6052f48498da488ed3f639f
SHA512 15e06ffaacda1d2b37d07ba490fc4832ca716f7cd9c0286628a05e7797dce5ed52861132b351ddafed8a05d01604835ebac8149cc790c77ce37bc60d632cbfb5
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9wroTyF:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vx
TLSH
T166B2DA2B640CC77E4F805AADEC196F977D9802C796988D4047FE994C03C77EBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a3aea80-a8dd-4745-a819-541677676d53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a3aea80-a8dd-4745-a819-541677676d53.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99ea48a8-eec3-4840-95d7-5de1aa6f3c97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99ea48a8-eec3-4840-95d7-5de1aa6f3c97.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c32b9aba4f75964ebe19063494774094ded334353f521b7e1b5a2238add0004a
MD5 909e49aa0d2bd89886ec28ad82dd7c78
SHA1 b988ee39a5e67a6bdf7ee900e81eb4e27157571f
SHA512 1fd614b33590164ab5fff644d87d23860bd107149a0d1c5351ae8eb24fa8101077b8bb85e604a56a8cd976f68d847e52821901802efae2d7abfa61750f56847d
TLSH
T1C341A788C24D0026FFB98570C1D8E2B73B316572EBFB9D063456D4BD974B711192D05B
MD5 SHA1 SHA512 TLSH

Submit Download

9f041474-2437-44fa-9f63-71d5595f801b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9f041474-2437-44fa-9f63-71d5595f801b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

79e5111c-f639-41a5-9176-9ce91db22c4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79e5111c-f639-41a5-9176-9ce91db22c4e.tmp
Size 2KB
SHA256 69871754541299788417aedd3726c715454796338bd939e499f1317a5c8ec46c
MD5 7aa393e7f6bdd5ba3b31e3d30939f15b
SHA1 88d2e6b84271650bea97ad494d9243a9ba8e1002
SHA512 994aa9343fe2a6918b075be33c2f63e2251e57a1c731fefa576bf3a94a86603a1ed423446e6788c50ea796888ee90586e1b053c601604cb2f381900ab51c9e93
TLSH
T12A41CFF7C3E8867D890156F4AB186E1BCE1D0915832C3C5AC8D49E2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a5dd29e5-dd24-4376-b5cd-d2afcbde14cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5dd29e5-dd24-4376-b5cd-d2afcbde14cb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad17e9d4621ed9c7b6aa39d4c7dd5cffa7930dbfc3903c95881b1f1ff37b2c8a
MD5 c1f87480aeb1799ca090594a9fd08df1
SHA1 5130953f965dc18647a28e72870586b75128b958
SHA512 031d92f8fd11faf375af54f58228ee6baab9abd9754e39328ddd89806f214ffe84877749e08657fdf00b922851fa295aa6416a74f24c0bdb2d9d72a43c7df851
SSDEEP 192:sxR4R7bP/fnsRudK7xJzzoA8p46/g6+WNIYDFsGgIgDMJ:sxR45P/fnsRud6W7/5In8
TLSH
T1F532C815AD28A97B8CCBE21DBB55BF13D3F9513260901E48EAFD961C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3e5c0b8ec3ac08c1f5622569a7fbc05ac1297d24f9c0b1246af5574cb2c386b2
MD5 957af352c7b6287ce4172b2c767332d6
SHA1 fc83b2df9c04a622dc3b4f5328c8e69276a563ea
SHA512 31480f3ac40a26581937aef49809136da9f2634669976b673b2d9af40197a4955891af61a2ab6bd623963c8a9df3bc44093c974d87dc48fc068f96c2971bb310
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/FyLz2Xz9Vlmb1YNISzmK9j1Rmx72YAhd8:KsgYKxOo60AK1O+OEKrCu5
TLSH
T1CF91611536BB825038FD795D52F4876A124631B33019E66FBFBC41A14E6EE148CFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a56147d2-b17f-4c7d-8fa0-b589728019bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a56147d2-b17f-4c7d-8fa0-b589728019bb.tmp
Size 11KB
SHA256 2497198b017079162e8588792926709a7ed0c9de50ad3d663f7e5153a0e53615
MD5 ab23fed0431761e995c71f606354535f
SHA1 7e2b288739998ffd8bed248762319b635c68973c
SHA512 7a2bcf8cf66c6a1a8a8a34b4315cfbdcec7e88031fd9bcb40b019d625e071aaa6907bd19ebcef111782684d7d0baffb9179fe58e6bc820d0329078e89bbcc5f7
SSDEEP 192:sxR4R7bP/fnszudK7xJzzoA8p46/g6+WNIYDisGgIgDuJ:sxR45P/fnszud6W7/5Iym
TLSH
T1FC42C815AD28797B8CCBE21DBB55BF13D3F9513260901E48AAFD9A1C04E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4725f11-7aee-4d11-8314-92c0316ef44b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4725f11-7aee-4d11-8314-92c0316ef44b.tmp
Size 11KB
SHA256 18ed6376393de9d4934b92e9efc060658f27db1dee774ef1122f3c8d6c2f453d
MD5 14dc0fc55f92c6313bd26bf6a18ca7c6
SHA1 0fef6e94f08747b1a95f9b661a1e9bc52f1c8c51
SHA512 3f931a504685f5826df801f6466e0f03b9ecd532fe54c539f04e4565c99c24498c7860470725e8411c6cfc83da2cfb5b00ffa85fb3869e3367001c6e6a52227c
SSDEEP 192:sxRvR7bP/fnsxudK7xJzzoA8p46/g6+WNIYDFsGgIgIJ:sxRv5P/fnsxud6W7/5Ins
TLSH
T1FE32B715AD28A97B8CCBE21DBB55BF13D2F9513260901E48EAFD961C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fdfea81-044a-4cd3-ae4a-3ece049853b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3fdfea81-044a-4cd3-ae4a-3ece049853b9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d30c3ac5-65a3-4932-84e5-b2201c77b601.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d30c3ac5-65a3-4932-84e5-b2201c77b601.tmp
Size 33KB
SHA256 0ff7679856771329dfbbaeef3d09bfa607a9392b3f77dc13dccb5fc3b4475600
MD5 6b0388964eba7425a5c5ca9653e25892
SHA1 924447561097967d1cd76565579cf0ba9573dc77
SHA512 7fb4ea9b6995e1133220a936312ce00263035b5a550bacc3ca12dc839e94351d0fa24551701a92894afd042ba045d08d33eb2cb76d1c661bdc5dcd383e798be8
SSDEEP 768:uB3vZyDwybNbzohAyOeRFZD1fTos7Rj04YGHfHu:uB3hy0zAZY1fT/Rw4YUvu
TLSH
T1E3F2AF36BCA4ADB34CF5E285F2467A437FF48263C6C9558484DD6F0E059BBAD130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2f385e2-2dab-48e2-bbf9-801eb8d5f477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e2f385e2-2dab-48e2-bbf9-801eb8d5f477.tmp
Size 36KB
SHA256 944fae2e1544315df33f1d56630cf0885d7198722c28744511f00e23c0785940
MD5 fb673e00ac7310ab834ea86718a359f4
SHA1 b186aed1552a0d19ca21b0b1ec1657fbdff13f8a
SHA512 ca013b56597c1dba498dbfec6614a3341b84c33fb6f322d978fda37bdc0f72500951f87ed795f0874e18c1ee13f41c6d1793a5a58ef42560a06d06820cb10e2a
SSDEEP 768:qFQy3WwgEZyDwybNbzohABOeRFZD1fTos7Rj04YGHfHu:Ry3fy0zA0Y1fT/Rw4YUvu
TLSH
T16EF2AF37ACD4DDB79CF9E785F2097603AFF482A3C989558495C96E0E009BAED1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

894409c8-c140-49d2-812c-44308b379e5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\894409c8-c140-49d2-812c-44308b379e5a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download