472a76ad1097f0672fc558e16b82f82388bb17c79043c3579bc4964576081af3

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 4KB
Sample261006-phpghayygx
SHA256 472a76ad1097f0672fc558e16b82f82388bb17c79043c3579bc4964576081af3
MD5 bb72c85e4ab2559c8430271e4401f932
SHA1 5bdcfeafb59c5f4a09db40d6e0d6bd3838fb2c21
SHA512 bf38cf0eed3daa9bfe1b27421583e56c1ed1856bd0c10b2b13fdcfc6b3ca4dfed812ba49531fbeaad97fcded76c0a756713d580697c05da2392e654d8fa9d899
SSDEEP 96:ZGeAwkQR0SFCFnFwFlUqR+Apg61z/1mhPjZcDUJJar:GyR0SFCFnFwFlUqR+Apg61z/1mhPjZcz
TLSH
T1C5914265286354052013D23C7BDF670C6534A2039B5BCC2AB7ECB34FCF9154DD9A3A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4104	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{99BAB95F-C73D-45EC-9868-422A632C0465}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2820	3384	msedge.exe	89
PID 3384 wrote to memory of 4104	3384	msedge.exe	90
PID 3384 wrote to memory of 796	3384	msedge.exe	91
PID 3384 wrote to memory of 796	3384	msedge.exe	91
PID 3384 wrote to memory of 796	3384	msedge.exe	91
PID 3384 wrote to memory of 6124	3384	msedge.exe	92
PID 3384 wrote to memory of 6124	3384	msedge.exe	92
PID 3384 wrote to memory of 4016	3384	msedge.exe	95
PID 3384 wrote to memory of 4016	3384	msedge.exe	95
PID 3384 wrote to memory of 4016	3384	msedge.exe	95
PID 3384 wrote to memory of 4124	3384	msedge.exe	94
PID 3384 wrote to memory of 4124	3384	msedge.exe	94
PID 3384 wrote to memory of 4124	3384	msedge.exe	94
PID 3384 wrote to memory of 4740	3384	msedge.exe	96
PID 3384 wrote to memory of 4740	3384	msedge.exe	96
PID 3384 wrote to memory of 4740	3384	msedge.exe	96
PID 3384 wrote to memory of 3700	3384	msedge.exe	97
PID 3384 wrote to memory of 3700	3384	msedge.exe	97
PID 3384 wrote to memory of 3700	3384	msedge.exe	97
PID 3384 wrote to memory of 2996	3384	msedge.exe	100
PID 3384 wrote to memory of 2996	3384	msedge.exe	100
PID 3384 wrote to memory of 4608	3384	msedge.exe	99
PID 3384 wrote to memory of 4608	3384	msedge.exe	99
PID 3384 wrote to memory of 4916	3384	msedge.exe	102
PID 3384 wrote to memory of 6092	3384	msedge.exe	106
PID 3384 wrote to memory of 252	3384	msedge.exe	107
PID 3384 wrote to memory of 4392	3384	msedge.exe	108
PID 3384 wrote to memory of 1496	3384	msedge.exe	109
PID 3384 wrote to memory of 1496	3384	msedge.exe	109
PID 3384 wrote to memory of 4672	3384	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe0b1cc188,0x7ffe0b1cc194,0x7ffe0b1cc1a0
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,2055881517377629256,8822260475802489539,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,16608733957798474559,16147656905720654810,262144 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,2582253233770648979,5690298894278958324,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4940493271413034939,2137842033918870083,2097152 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16538471932615967091,3775281178702924039,2097152 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5731874410035938243,2545593295289400316,2097152 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1206046704294292532,825587898301601371,2097152 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,9265932566841063934,2290351948692657947,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,17297606859712208483,13638226605448214519,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9751249008502294336,1779502871548302114,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9751249008502294336,1779502871548302114,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,12705111268095873967,5350828263553715017,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4967287815018615919,14485123404676143772,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13190471996904172356,13990857927697789,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,8230937283238043808,7481013462589684826,524288 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,12979208148484632285,12503104937611834732,262144 --field-trial-handle=2616,i,1584838014390768177,4359878724356967413,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

330a967e-21f7-412a-a628-cc0cc5ccedf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\330a967e-21f7-412a-a628-cc0cc5ccedf0.tmp
Size 34KB
SHA256 0aecd4b9e0602c8aa1836765a8a38edbe6891a4d9c678de3987c7c5f8ec5fa13
MD5 7f85cef4581f7305a8536dbe1542a284
SHA1 e4123175c73951d08afba30048294b67be1b394a
SHA512 e13dc2e252cd6d905ea20110a9bf21b198155058c17be0765f0a0d2a790d455f192d7dd41ae578eee846665700374774d42c685590207e2b8b6897acd1a58514
SSDEEP 768:L33XA7Z+2ieOs24KjPnUPO4Qp7cPAiSm2eo4w4cciGrTFlt4YGHLbJ:L33XI82gxjPwQpYoimeoR4ccFFD4YUXJ
TLSH
T1A0F2BFB1ECA4AE735CF2A285BA197B43BFF04153A5C91E84C5DD2F0D41876EA1317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75c20a56-f1d0-4b27-b3d4-e4688a1c7d77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75c20a56-f1d0-4b27-b3d4-e4688a1c7d77.tmp
Size 37KB
SHA256 da22b74f62970893789499f89c8348f2e288be2718a0e5fcce68de87dd386f97
MD5 7798b1b0d93a8476806947ac589af634
SHA1 de9c525b22139cee17ecec4470c79e1c11be3d3d
SHA512 655aa8a9f6a2edf2266aaedc4cab8abeb443400f7ba172ed8de958209ec1c69b8b6ffc998676012e9b71f084547db4593581805a7b9424fab3411570642cb242
SSDEEP 768:vw/UxvxjgC+5j3sV/d83ieOs2ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5sAgZbCMc:vdZj3+5j3sldEgojFwQpYoimeoR4ccF7
TLSH
T14E03CF75A8A4AE73DCF397843A1D6347EFF0416395C12AA4CAED1E0D42873AD5307C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f9289a4-58b6-4c40-9440-8492bd2fe3cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8f9289a4-58b6-4c40-9440-8492bd2fe3cd.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

01fc82c2-db10-427e-8f6a-6cc5d6cd7116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01fc82c2-db10-427e-8f6a-6cc5d6cd7116.tmp
Size 10KB
SHA256 640feda768a9205b8f451dca12db0134a9fbe0abb03dc8950421d85c64416792
MD5 09dccd9b1cf344c03212a6552f543ee4
SHA1 2e58f9ad750d3bd2e6438780d764389b8ad66b1e
SHA512 33a1fb345f1d4b642014d4ba50a03322c8960b9f031c59adb9f90cd976ba58c32f6fd8ff2cb232c8b79f4915d1553d1b5061f6339aef3bc2f9e3aba6a759b3d0
SSDEEP 192:sxRcRtbb/fess/wzoA8p4o/g6+WNIYckXniTBG/IgIJ:sxRcrb/fess/p9/5IEXiTUs
TLSH
T17932A6156D28A97B8CCBD20DBB65BF53D6F96033A0D51E48B6FC8A1C14E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c45e370-33d9-48d9-b7c0-beed16447bda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c45e370-33d9-48d9-b7c0-beed16447bda.tmp
Size 11KB
SHA256 80887dbac52df62f64804e7dd6a40512688c707ce11219090971f44297de1509
MD5 e640af3da2417122a161ab2ae1f2d979
SHA1 10f803e984e589a429e4b58e9c37019a511658b2
SHA512 f32d2290294f1138540e504b86fee1d0099e472866c568ea77d38e49cf91ec93565272f0aa4f40699549ebaf9e93fa705c72b253090881dc77f37c96c6b3da93
SSDEEP 192:sxRPRtbb/fessbwzoA8p4o/g6+WNIYcBXniTBG/IgDGJ:sxRPrb/fessbp9/5IhXiTUe
TLSH
T16132C615AD28A97B9CCBE20DBB55BF53D6F96033A0D51E48B6FC8A1C14E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66b68c4f-1efa-42e2-b2b2-91e2b243b792.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66b68c4f-1efa-42e2-b2b2-91e2b243b792.tmp
Size 10KB
SHA256 0c060911983f37e11edaeee79378897c99adb5e4c2147f72f1ddd6d1bd446ebe
MD5 f0096c7df57c9a843fcd9f06c34adafd
SHA1 9a081e8a5cf99cd07329239e607703d965e9bcf0
SHA512 fad3215b80f4784bbeb5c1cab82e6839d8fb1eca2d488c8e74718a49be02db6544fe778a726f9a5c7da1d1b305fc437ad90bb914481b461628bf15630dbfdd3e
SSDEEP 192:sxRPRtbb/fessLwzoA8p4o/g6+WNIYckXniTBG/IgDUJ:sxRPrb/fessLp9/5IEXiTUE
TLSH
T1AD32B715AD28A97B8CCBD20DFB55BF53D6F96032A1D51E48B6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8def6290-6a8d-436d-aa12-2a74e900d402.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8def6290-6a8d-436d-aa12-2a74e900d402.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4d3308c6729ca1bdcdf5001143861fe70710a95eb1b337a641302b73b1252813
MD5 3d11427610df780c85643fbe645d9838
SHA1 81775895f05c9d4c800744b90216692e6b6ec881
SHA512 d8545a25a85b53f1a59ec1a1fb0ee91ebff4be1261512cbb223564bc843f15e141bec584e89afffbddbdb79a78ec05e96dfa91ea295aa9c3f2e5ce8ae6b1465e
TLSH
T11751554A97A4A340C75CC13CC7C9C1CF3F3BD5B89A83BEC1A69AE5B55597BB8A04420D
MD5 SHA1 SHA512 TLSH

Submit Download

d89e650c-b8fd-4382-ae46-ef8c5ce2edc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d89e650c-b8fd-4382-ae46-ef8c5ce2edc7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

91117ccb-9719-457a-b7f5-7a0ba45e5236.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\91117ccb-9719-457a-b7f5-7a0ba45e5236.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

93799f43-07fb-4acf-ab0d-124e5d0add7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\93799f43-07fb-4acf-ab0d-124e5d0add7b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9c418450-8dd2-4cdf-9818-18b9f8cf516a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9c418450-8dd2-4cdf-9818-18b9f8cf516a.tmp
Size 2KB
SHA256 2adb58f675b35cbcaf1cd5158a91031e1d379f6280cd19879f4e8b58ecc671ef
MD5 4bc708c67e9468db834b4b98ad785cc3
SHA1 ddab5e53955cd5f6be4ebb8ac75c3bf9c09fe3c7
SHA512 66e4dee7c353932ae6bde79a21ea7ffd2c60fb912ce2e242927ffcfcb004c9fe126ab390cb9f0da8fc3a3d33a906afe62eec92f01200573de73262f0292eb4b7
TLSH
T1A6419EF3C7E8866D891156F4AA147E1BCE2D0915532C3C5AC8E4EE2B93F34B1E24199F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 084f9ba84c706e306447c1e943aadb864726b91ad11eef09c0d577b486678d8f
MD5 14efb2a3138adcf388fccd7b370faa64
SHA1 30d18fdb354deeceecbac5a4c8126b91f54e8007
SHA512 ced8445144de707a1488b566626ad0f5192197e5e32bf7e9f8983a7ce4e67913944266500a4361273aac3200e3fb1f9f1ccbdaf5e163f5abc0f320fa0d05354e
SSDEEP 384:D7JakElfCtg17Ff9tKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXn975RwhroMXl:DFakE5Wg1Bf9t8F1+UoAYDCx9Tuqh0Vp
TLSH
T1A0B2DA3F744CC77E8F804A9DAC196F976D9802C79A588D4087FE994C03C77EA92294DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dfc30e7e46e2d2a35deaa150d4da9100a57b9a7604682a5f6327c32afab00597
MD5 a7aa31d10396a8aae73ba5ec65cdcfdb
SHA1 f4e566ca39fbad78e486d7071393db9b39108407
SHA512 679123b68dc6a0ecc9f4d75676b0986f881e28d79141a09fbe74a9349e7e082ec501bd9172284140185b16e0fdf6b7a52dac09cef1e2b692312871160047a8fa
SSDEEP 48:KwZIFKCIAXyZuI/KjSEADeNBzRFPKNQGI5JPKwe43PELfLIdVEy6:KwZCKCIaKugKjSIkwKReil
TLSH
T1749173157036064038BD360441E8DA1A99A132FA3039ED7B7BBD85E65E3AE047EBD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a1fe9fd2-b0b3-4767-ad58-d0e2641a30e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1fe9fd2-b0b3-4767-ad58-d0e2641a30e4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2da7195e-6780-42c0-ab4b-fa966606fb47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2da7195e-6780-42c0-ab4b-fa966606fb47.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bb124f8b-3d93-40ff-98bc-1fe542098a6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb124f8b-3d93-40ff-98bc-1fe542098a6b.tmp
Size 34KB
SHA256 ad18adb5907a139fd5796548fb30a2b5a61bd36c8c9dc008ad5b84c10a42a9c2
MD5 8607ec489b519ece8dfe2aea228ce886
SHA1 78d5841991c4fb7cc626d39717d20e254b9d8346
SHA512 1a2b7df5b09839c4a0648176130d23598c2806b55a82e754385e38bc5f9d4239891c79c6ac1cd814871762371b4d60327cf3eb024014d2ca291f1de4895965b9
SSDEEP 768:DQ33OAKhZ+2ieOs24KjPnUPO4Qp7cPAiSm2eo4w4cciGrTFlt4YGHLbJ:DQ33OD82gxjPwQpYoimeoR4ccFFD4YUZ
TLSH
T15BF2BFB2ECA4AE736CF29285BA196B43BFF04153A5C91E84C5DD2F0D41876EE1317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1b8c016-3829-4ead-bae1-b1bd353172cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f1b8c016-3829-4ead-bae1-b1bd353172cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7bc08c1-93c5-49d1-8d72-aeadb746b35c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7bc08c1-93c5-49d1-8d72-aeadb746b35c.tmp
Size 36KB
SHA256 daaac1a60733ed8e8fd7aea7c01ced54ca0d6f46fd113e2f17862657709f5c15
MD5 67f35ec991aab64539e4d547b945076d
SHA1 1001cb10cc1532654443e6c41730defade15c99a
SHA512 1cca2464431a4933afb7d828ed784f655c86a40cdfc64fe24c32e5e4d16685ad6b056722526b6feefc91b7fbc34ef5f483bff82f20412f4fbdb2c054faaea9d4
SSDEEP 768:wFQd30wgMA7Z+2ieOs24bALnUPO4Qp7cPAiSm2eo4w4cciGrTFlt4YGHLbJ:jd3BI82gMALwQpYoimeoR4ccFFD4YUXJ
TLSH
T12903AEB29CE4DA77ACF69B85BA197702AFF04193D4C5AA84D6C92E0D41876EE0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download