hxxps://zapier[.]com/app/canvas/public/462ee268-2b65-415d-b702-b9e0e2e7f3d0

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://zapier.com/app/canvas/public/462ee268-2b65-415d-b702-b9e0e2e7f3d0
Sample261014-lvax4abs21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{89BB329F-3F01-4DE8-8144-C4DC53B401D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 2880	5388	msedge.exe	84
PID 5388 wrote to memory of 2464	5388	msedge.exe	85
PID 5388 wrote to memory of 5656	5388	msedge.exe	86
PID 5388 wrote to memory of 5656	5388	msedge.exe	86
PID 5388 wrote to memory of 5656	5388	msedge.exe	86
PID 5388 wrote to memory of 5964	5388	msedge.exe	87
PID 5388 wrote to memory of 5964	5388	msedge.exe	87
PID 5388 wrote to memory of 4820	5388	msedge.exe	89
PID 5388 wrote to memory of 5228	5388	msedge.exe	90
PID 5388 wrote to memory of 4820	5388	msedge.exe	89
PID 5388 wrote to memory of 4820	5388	msedge.exe	89
PID 5388 wrote to memory of 5228	5388	msedge.exe	90
PID 5388 wrote to memory of 5228	5388	msedge.exe	90
PID 5388 wrote to memory of 3216	5388	msedge.exe	99
PID 5388 wrote to memory of 3216	5388	msedge.exe	99
PID 5388 wrote to memory of 4680	5388	msedge.exe	100
PID 5388 wrote to memory of 4680	5388	msedge.exe	100
PID 5388 wrote to memory of 5012	5388	msedge.exe	102
PID 5388 wrote to memory of 3276	5388	msedge.exe	110
PID 5388 wrote to memory of 3276	5388	msedge.exe	110
PID 5388 wrote to memory of 3276	5388	msedge.exe	110
PID 5388 wrote to memory of 5252	5388	msedge.exe	111
PID 5388 wrote to memory of 5252	5388	msedge.exe	111
PID 5388 wrote to memory of 5252	5388	msedge.exe	111
PID 5388 wrote to memory of 5568	5388	msedge.exe	112
PID 5388 wrote to memory of 5568	5388	msedge.exe	112
PID 5388 wrote to memory of 5568	5388	msedge.exe	112
PID 5388 wrote to memory of 3412	5388	msedge.exe	113
PID 5388 wrote to memory of 3412	5388	msedge.exe	113
PID 5388 wrote to memory of 3412	5388	msedge.exe	113
PID 5388 wrote to memory of 4908	5388	msedge.exe	116
PID 5388 wrote to memory of 936	5388	msedge.exe	117
PID 5388 wrote to memory of 2396	5388	msedge.exe	118
PID 5388 wrote to memory of 3240	5388	msedge.exe	128
PID 5388 wrote to memory of 3240	5388	msedge.exe	128
PID 5388 wrote to memory of 3240	5388	msedge.exe	128
PID 5388 wrote to memory of 4724	5388	msedge.exe	129
PID 5388 wrote to memory of 4724	5388	msedge.exe	129
PID 5388 wrote to memory of 1076	5388	msedge.exe	132
PID 5388 wrote to memory of 1076	5388	msedge.exe	132
PID 5388 wrote to memory of 1076	5388	msedge.exe	132
PID 5388 wrote to memory of 2276	5388	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zapier.com/app/canvas/public/462ee268-2b65-415d-b702-b9e0e2e7f3d0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa22cac188,0x7ffa22cac194,0x7ffa22cac1a0
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,714667030208396266,10683883576044041005,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,684374034844338867,15143627542772383301,262144 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,4943150304640599852,16930567316476385805,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9930863508538568722,17019391808969749361,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6657010023564519193,3297933849501965813,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3956102866829224773,10918445204234622836,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5163426527279068543,846047725137011664,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11586579502774531296,5204795847967819095,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11586579502774531296,5204795847967819095,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6136,i,17399421750430001844,15775495940244268758,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6296,i,380396773560519667,9853767217347833072,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,7644453573190417109,2166024318710758617,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5952,i,7661798454460830551,11434068926418611320,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1289753922752253263,11399767245290224657,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,15186092508179122396,7353155894618890994,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,6397830746720000579,2202099673611570986,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2876,i,1582102465492007616,5376460147244392352,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,8173641906051023453,17267438247190997047,524288 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5064,i,6611077526874357710,17168481691302985839,2097152 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6580,i,5825603633143493527,8825618015764434038,262144 --field-trial-handle=2116,i,14087326277143968099,2953277792442193559,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a0a4b85-c60d-4d6a-9fc5-2aa252bd5fe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a0a4b85-c60d-4d6a-9fc5-2aa252bd5fe6.tmp
Size 25KB
SHA256 32dbf9d79ff1dad92bdba7b6cb84299e791a08a8f034b24569334841222d2d1d
MD5 f6bb9a50e2cb33fcb1652817fa8c96c2
SHA1 8a953a1e9d84daa4c248acab823532a3c3661682
SHA512 a7fd6aba06efb4d247209f64b58181dda79cfc9a75193de7eb47bc9e74b0237c9f348c6f6d304e2665943c35de6b506584560d5069899af40c331328f66bbd61
SSDEEP 384:nOiFiZcI63sNo8TUNTUlIm25mg51nK2fLBEUD4jiZHRmBIQ7O6R2Feo5MgL/7IzL:lFQ63NwgS23BEUJkBIQ7TRMGl
TLSH
T1F8C24B36EC94CABBEDEA8F9AA74A7A07DEF01163819C89C0D5D91E1D008759D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21b2f76a-a5fe-402e-8feb-4121cf7e26f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21b2f76a-a5fe-402e-8feb-4121cf7e26f6.tmp
Size 26KB
SHA256 9178cdb81d754dd93346425f3b0b4c41ccdf16250d3edb1b4669c839433677eb
MD5 2afcf7465e4d6ffd479bcb41c6881c84
SHA1 8b2fcd403b0e1bc1dc4e7dd03cd55fdc3db299cd
SHA512 a2bcdaf373bb7d6618cc9ab917350b126ac4f64bf895212a9a245c9f429072500f2d10a2793ea0360dcf1078f22dff866135aa447135585fe1db4def4aaf81d9
SSDEEP 384:nFiFzQkUSvKsNI8TUNTUlI4F5mgnWv0eP2K2fLBEUD4jiZHRm3bKOPJAxJfChvgd:MFdK1wgtAEKBEUJkrdPkJfCdLa
TLSH
T102C24A36E894DEBBEDEA8B95B74A3643DEE05223D98C4AD4D6C91D1C00CB2DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

2bae0118-df11-4fe5-8787-0cf58346b9d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bae0118-df11-4fe5-8787-0cf58346b9d2.tmp
Size 12KB
SHA256 e8d900a226c6c99373d490d1dbafe57d0edba89b871adfbdf7d7c125d569773b
MD5 9b5998f174426ab66c882515981e5cf7
SHA1 78f4332662c0f67977691f7339b3c836ba7c1be1
SHA512 b8a6f9650c106220c66c8758a06a1641baa39e8a45afa42276407ac11cae2d11e0925a245443a367df712edf9874f49bb71d517b9da4d6cf0d81b2a3a448ea1b
SSDEEP 192:sxZYRZkL/fis4QZZ5/BFodpcIEHW6+WNOCgXYbI3Y3Y+4Ig5QxcJ:sxZYgL/fis4OZ5/sUHbkXFSYDKu
TLSH
T13842E915AE286A3B8CCBD20DFB55BF53E3F95132A4955E44A6FC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83c3cff9-3c7a-4d3c-9eda-87e65b71c7ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83c3cff9-3c7a-4d3c-9eda-87e65b71c7ba.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96057f76-7eda-4d22-9df2-76b9bf590e66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96057f76-7eda-4d22-9df2-76b9bf590e66.tmp
Size 12KB
SHA256 0c493839eed55fb7694c881d66180d66b828d46e0f3e6a2cf88c8c31b08ef295
MD5 43772b33bc373f0650062df2a6062503
SHA1 b110394490d7f39e119324975d853fef26ca66a2
SHA512 e0e7287093fc05c1993ca87da8b441e1269f54f0f14dbea71a324b73e2cebb5f11efe809fc797cb16b1ff8a2982a53bc71028cc718eeb5407c341a40f8803bca
SSDEEP 192:sxZYRZkL/fisMQZZ5/BFodp3EHW6+WNOY3/YbI1Y3Y+4IgjxcJ:sxZYgL/fisMOZ5/s0Hbh/FEYDju
TLSH
T14042E915AE28AA3B8CC7D20DFA55BF53E3F95132A4955E44A6FC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 b4c88b32dad50fb7881f42eecd29112ce26c12e5f2de277817d3df153f6fabe5
MD5 0a3587d95c55086516624111b1a236e1
SHA1 38decc92940d534423e151b6a3cd945c43857a03
SHA512 29c4758585784c853ebae748231056363755f5ac061f04c7c8c1036043f1abe39eb1113385521eef12d34da55bd679b2616934b42088801f4ddad950ea2fedbc
SSDEEP 96:X2L2QvlAuhy8xzLSRdY4pYiihsogDR1er9R:GL28rE4/ODZwngoR
TLSH
T11291EDD161485CABFB683AB647D1B007353049FE2487AF6E85E7F43D6C9ABA7E380104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd6153f26dcf3ca8b124ca460686675224617b139d79e99f7aff22665be0da60
MD5 b917b15bc643e4ae9f90fb33ff0740a1
SHA1 bc02845aadacbaff834d220496ff80492c8f1cd1
SHA512 3b6461095b6b0785bf043b4938b3b1e6df92e1eab1153539b1cfcb92c797f801bf3734fb33305fb1b10f6f4dc8dcd3068fbd74d7b7364387386e7116903dadc4
TLSH
T1206173E1604964EBF76839B453E1B047393405FF5587BFAD00E7F57D6C5ABA69380208
MD5 SHA1 SHA512 TLSH

Submit Download

e86fa9be-3158-4362-9a93-8705ba300dd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e86fa9be-3158-4362-9a93-8705ba300dd4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

609665f4-2a18-4081-81a0-ad4b3fd7b576.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\609665f4-2a18-4081-81a0-ad4b3fd7b576.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6c7714cf-ef8c-48f3-8cb8-b26c09721415.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c7714cf-ef8c-48f3-8cb8-b26c09721415.tmp
Size 6KB
SHA256 1398e437dcbd98fc8de3a058502e3efeb46d9c23bebb6b66382de7456cc339e2
MD5 188afcbf673a1be1da6bccebffcef92c
SHA1 691d8958ac114b7a73f22c449fdc862090cab852
SHA512 1dd4616eaf4cda617b77725085bda6497bb2cbd1597fae4ddc30462f3e124f04d814469141d5742d3ed2ca6b3a8992f1c73e557ddab43b1adf376a7d8cd79ea7
SSDEEP 192:D1kLoWFqrfeOGfheEaaa1F5iS87uqqKYIRo0AoML+Bd7zaxvbhT:D1kLoWFqrfeOGfheEaaa1F5iS8iqqKYR
TLSH
T104D1AAE783E5852EDD1226F0AA14AD1BDF2D0514573C3C6A88D8BF4BA3E2471E34176E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

965bf4ad-632a-4e38-be6c-c8281cb988c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\965bf4ad-632a-4e38-be6c-c8281cb988c9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78b4a81b4a376d0ea93d7f968da6f731eb1c70170cb1acc8a9035726836c50f8
MD5 db0901f0d94dc1627d6ae0ad0e0360be
SHA1 d4f858f56f7aa6ea94f1e8dfe5feef940b2997e5
SHA512 c00cf9ff874626e1439ea4e6e7f26a72d3b46919048c44c046e5cd52e6847492819fef5627de683be7590c7174146ec351204467ea64f40aa9ec831bfeb002dc
SSDEEP 192:sxZYRZkL/fis0QZZ5/BFodpcIEHW6+WNOCgXYbIjY3Y+4Ig5QxcJ:sxZYgL/fis0OZ5/sUHbkXFWYDKu
TLSH
T11842E915AE286A3B8CCBD20DFB55BF53E3F95132A4955E44A6FC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 1eb1e529d70aa785de0c3d30ec42a0b0df0ca8e2ab994c15f8355a404bf0adaa
MD5 66bf4de8bc32feb6dfca0fd687862733
SHA1 3c9751f2b648dbabd0a0b5da67489adc285f5994
SHA512 be2c84b6046b007b726c5c75ad763415a43e47a957744ec22b2dc434f0f68e482c3b9af2f93cd008cbbd0f9bf7578087a722e6816fa13a44e8f50d9664ee2bee
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXmd3Irg:OtfFvpopPxrB4RhfmdIU
TLSH
T123B2311471BB021138FE390881B5972F064232B33159EA2B7FBD55A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a7859ce9-c62e-48aa-9869-2531bbb4e427.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7859ce9-c62e-48aa-9869-2531bbb4e427.tmp
Size 414B
SHA256 2a49893d11405ba60ed2e3e789fc24ce5faeddd5ecc009396e74f7bd02e95d65
MD5 585c537cb0ca70da243e263ab6410dc4
SHA1 ab46f5ff9695635b34b39c184d3646d79f08efa0
SHA512 4aeb40aea65e26415a6e51e12f5f0618b10fd27621143acdae6f9168591b5dd8b631b8ce9f66c98560e4e7d0648bb163544a6dd8b566dad2f0ebe09ed551aee7
TLSH
T1B3E02BF9CD15EC370CFD4B1950540786FB5103573A81984B773C801D8FB563A4186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

cbf14f0d-7f69-4e8b-bbfa-9f4c1c79b013.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbf14f0d-7f69-4e8b-bbfa-9f4c1c79b013.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a76f3d5a-2fdb-45c8-adf9-40116d25b15b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a76f3d5a-2fdb-45c8-adf9-40116d25b15b.tmp
Size 26KB
SHA256 db58e9faad6a2daaead9df104ede89a7436a033c1ee803bef4cf7d1974d21e83
MD5 46b592e66724f302d5f6ec58d0d715db
SHA1 a8345750a8ed080b95fa29edc03a69dea79562e6
SHA512 bc0c26e33fec63ac6ee456707e4af68bd3136db0253c7c3a97f8dbcd3328500ef3390a6f36f6e1dc724d3e57e6348fd33a39c0dcfdbd0b59170f4527ac67ddb8
SSDEEP 384:nriFiZcI63sNc8TUNTUlIm25mgDa7QK2fLBEUD4jiZHRm3nKO7O6R2Feo5MgL/76:GFQ63FwgSz0BEUJk3d7TRMGl
TLSH
T142C25C76E894C9BBECEB8BE5A74A7603DEF04163958C8AC0D5CD1E1D00DB5AD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb925936-46fa-476e-b2fa-948540ee90a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb925936-46fa-476e-b2fa-948540ee90a9.tmp
Size 32KB
SHA256 2dc118aa372a1bd13f382e6fb504f86f088ca7e3b13a3bb2fbdf800c17f94f32
MD5 da0e2555c97d9b1f280279ba391d838f
SHA1 d05ad761b48d80efd5a8f3fcd5ff83150b5e8883
SHA512 8f842c600c5dbf7ac5271817c966dfeb724aadc8b45cf01e1d012ab452dc92243347438e76b27f242c3c4705290e088023cc2d1a7893b11fb9edd0f491a8466d
SSDEEP 384:nhiFzQkUSvR5sNI8TUNTUlI4F5mgnWvDeP2K2fLBEUD4jiZHRm3SKOPJAxJfChvi:IFdf1wgtfEKBEUJkidPkJfCdLa
TLSH
T178E2B2F5A8D79977D8AE4B97A33E2D029AFCC123B5884A84B7C51D1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccc2d53e-b10b-4dfd-853e-bb48413407ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccc2d53e-b10b-4dfd-853e-bb48413407ec.tmp
Size 26KB
SHA256 f7e2fdc689fef6ac57e2dac40a33d458b1247af628d9b0ea2b23309c20f408e7
MD5 598e294492f10430e14d58d0a62340da
SHA1 ca714c1e04b0d875adb57884c681ccdf40c9d37f
SHA512 194d7e4698f65b4c397b97376a104732c6b1cdf64ce7284277eb7f4a821877962d45591451eb8a5525e906d012d889d9fddf6ed915480e26d21c64a75505fb91
SSDEEP 384:nziFzQkUSv23sNI8TUNTUlI4F5mgnyv8euK2fLBEUD4jiZHRm3bKOPJAxJfChvgd:eFd231wgtI7BEUJkrdPkJfCdLa
TLSH
T192C24A36E894DEBBEDEA8B95B74A3643DEE05223D98C4AD4D6C91D1C00CB2DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a9ffc23d039b164d1b6eda221e9bb272c02febcc1916e5fcbf72e6dd4ae87362
MD5 73230155fd305457704f480d1743da6c
SHA1 67ec93596e337f15d00148a3b5d39da7cbd2d134
SHA512 19e67a3ca3b9a32c037710614eb2b5a11231b150600888a6becba5d1ef51c573b27839ba45a9ba9c5908338eaa26453bdcae3becae61bde1851a8ecbd2b2ec0c
TLSH
T1A7411C5CA6F91158B3B37E569BF6A86E147BB9772E06D45E00110E4F0A62B40CCB2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5012-361-0x00000221C94E0000-0x00000221CA4E0000-memory.dmp

Download