hxxps://click[.]email[.]hrtrainonline[.]com/?qs=ABp7ImQiOjUwMjgsInQiOjIwMzYsInMiOjExfQALAAAAAAXElUAibeu3y8AOdHDCSdbvrSqDUnX0eOj_xEz0gWtP979OPlOBHdBypkAfkf1Yi_NGDikhBKUigNiF49oOz3Hoh6mxGEYub8_-5TFBJBQ

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.email.hrtrainonline.com/?qs=ABp7ImQiOjUwMjgsInQiOjIwMzYsInMiOjExfQALAAAAAAXElUAibeu3y8AOdHDCSdbvrSqDUnX0eOj_xEz0gWtP979OPlOBHdBypkAfkf1Yi_NGDikhBKUigNiF49oOz3Hoh6mxGEYub8_-5TFBJBQ
Sample261014-rxjwnset4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{56D24436-CF69-4C34-9FEB-142C755B384F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 5912	5788	msedge.exe	84
PID 5788 wrote to memory of 5616	5788	msedge.exe	85
PID 5788 wrote to memory of 3232	5788	msedge.exe	86
PID 5788 wrote to memory of 4296	5788	msedge.exe	87
PID 5788 wrote to memory of 3232	5788	msedge.exe	86
PID 5788 wrote to memory of 3232	5788	msedge.exe	86
PID 5788 wrote to memory of 4296	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	89
PID 5788 wrote to memory of 2044	5788	msedge.exe	90
PID 5788 wrote to memory of 2044	5788	msedge.exe	90
PID 5788 wrote to memory of 2044	5788	msedge.exe	90
PID 5788 wrote to memory of 5068	5788	msedge.exe	89
PID 5788 wrote to memory of 5068	5788	msedge.exe	89
PID 5788 wrote to memory of 1644	5788	msedge.exe	97
PID 5788 wrote to memory of 1644	5788	msedge.exe	97
PID 5788 wrote to memory of 1172	5788	msedge.exe	100
PID 5788 wrote to memory of 1172	5788	msedge.exe	100
PID 5788 wrote to memory of 772	5788	msedge.exe	101
PID 5788 wrote to memory of 772	5788	msedge.exe	101
PID 5788 wrote to memory of 5588	5788	msedge.exe	103
PID 5788 wrote to memory of 2424	5788	msedge.exe	113
PID 5788 wrote to memory of 5536	5788	msedge.exe	114
PID 5788 wrote to memory of 5444	5788	msedge.exe	115
PID 5788 wrote to memory of 792	5788	msedge.exe	125
PID 5788 wrote to memory of 792	5788	msedge.exe	125
PID 5788 wrote to memory of 768	5788	msedge.exe	126
PID 5788 wrote to memory of 768	5788	msedge.exe	126
PID 5788 wrote to memory of 4744	5788	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.email.hrtrainonline.com/?qs=ABp7ImQiOjUwMjgsInQiOjIwMzYsInMiOjExfQALAAAAAAXElUAibeu3y8AOdHDCSdbvrSqDUnX0eOj_xEz0gWtP979OPlOBHdBypkAfkf1Yi_NGDikhBKUigNiF49oOz3Hoh6mxGEYub8_-5TFBJBQ
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe2235c188,0x7ffe2235c194,0x7ffe2235c1a0
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,8335527815007288736,367118108263475399,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,3336646698187909886,1564621865378461197,262144 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,16697772355427131461,11731720016834397429,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,217959003224783350,1817600870984981240,2097152 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,15827115263126688268,4328657979220513661,2097152 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4841750181880829839,9712067022952551507,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,4568786184846438601,11509351566226717671,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,10394134172684959146,17699505902703815692,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4175911750263184330,12546401701792963152,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4175911750263184330,12546401701792963152,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,12736477928107478801,363331154357677569,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7347587247954244874,5876776371023308314,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,18139762913551987741,15608699299230294932,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,12018794282744836954,14416769837516453758,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10387825444951759233,16926358438474683033,524288 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5560,i,8304586700731863917,17959136231821605275,262144 --field-trial-handle=2828,i,10529534810855475854,18007752250205902791,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09ad296c-1e22-4192-b608-85961be95fd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09ad296c-1e22-4192-b608-85961be95fd4.tmp
Size 26KB
SHA256 ef3cd3dd405f809ce014e210df2736fc9683655b8a6d659fa6c74756152341b8
MD5 fb8a59fcc8cb5cb870d09db08e1ddd82
SHA1 f91ff0a558734fbbfc6e0df7ce9d5d217b64c0b1
SHA512 98e0a4153224791f31d24941e8d6a6f9b18fdb0ae0dabf460d81dd393027ba3c558689872a09a192c0a69d7fbe594dd32e24a4c49474c1f021c52e1a594d358f
SSDEEP 384:nJiFiZcI63sNM8TUNTUlIm25mgCnAMK2flBCupuSAiJJ3sa+VYqgL/7IzaoQ:gFQ63RwgSaiBnpft3hgCz
TLSH
T148C25C72E894CDBBECEA8FE5A74A7603DDE44263959C9AC0DAD85D1C00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d2fe223-9a15-494b-b612-9ca3d7c4148c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d2fe223-9a15-494b-b612-9ca3d7c4148c.tmp
Size 25KB
SHA256 322c4c80a7d15ffe21d960cee9b26dacf20e3a68f73aec65a5eeb7441b2c5676
MD5 538231bb9f3dfe0255b5c2cd2c113ea1
SHA1 542aae346a3d55341abbe3c497e8213481a610ec
SHA512 59490c3db31ad816a8f2587cfec8284d85cda40f4fc5b24312967e1d4b7ff64a5884118efec1cba92d67d71df873b3a325517a99a813e60bae26dfb16ab5c7db
SSDEEP 384:nSiFiZcI63sNZ8TUNTUlIm25mg5xnK2flBCupuSAiObsa+VYqgL/7IzaoQ:ZFQ63owgSOJBnpf4bhgCz
TLSH
T1D8C25C36EC99DDBBECEA4FD9AB4A7A07DEE40163959C9AC0DAD85D1C00871DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96642f6f-de97-4bbf-b18d-a03ce55d066f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96642f6f-de97-4bbf-b18d-a03ce55d066f.tmp
Size 26KB
SHA256 bbaa2b39588d763ffab3cc224f3c8a3d4a5d3418425fd87b487931d2c37dc9b4
MD5 0e6108cedb5238b45153a558571566e4
SHA1 926dcfc11df983c7166b3d08fde28e71313ca15a
SHA512 a418ddbb4d2a2cc14a3d22da956f72ca185ad2ff0e117c35b14441a9f274521db3a4e2f33c3dfff8ceed79c8e825bf5069b076cd42c5e824683f57aa19b7a1bf
SSDEEP 384:ndiFzQkUSvH3sNo8TUNTUlI4I5mg+fW5PK2flBCupuSAiJs3PJAxJSChhgL/7Izh:UFdH3BwgAmBBnpfA3PkJSCoLC
TLSH
T1BBC24A76E899DEBBEDE64FA5A34A3643DEE04263D68C4AC4DAC91D6C00C71CD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

0c896957-861f-47a9-857e-aa22aaccd255.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c896957-861f-47a9-857e-aa22aaccd255.tmp
Size 12KB
SHA256 59ac0342a0e1e9807fae24dba9cf82384f826e2897e62056d4f3b013f50bb68f
MD5 d5cbbc549dc82ba636109bd9c1538a22
SHA1 97bb31b9d88ea0abdc6141ec6d4ab660b0e87879
SHA512 2b375ade48bf557972c7ef239cabb0141e716db5d053b9b29eec6e2aafa4d3c95be1b06a9bb6682962292c259870fddfe080dac9a65cab290e5fae26a44cfe49
SSDEEP 192:sxZiaRRkAE/fgxsx7QZZXL8LzodpVPHW6+WNAdi/YbIsIkYnMTIgjBJJ:sxZxAT/fgsx7OZbL1Hb7/FcYqjB
TLSH
T14942D855AD28AA7B9CC7D21DFA55BF63E3F95033A0941E44A6FC8A1C14E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

375298cf-b66d-4d6c-b980-36d7eb970028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\375298cf-b66d-4d6c-b980-36d7eb970028.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f9f5aad2c0ab77b8aef100813a84896b2697c1ae878e2f5ef4d7534f2126700f
MD5 1bf566e33514f4a1daa554c004d22ac6
SHA1 ceb23b5a1190048df5471d233dacfaef587d461e
SHA512 6bcfe612957318b7028c3944afe1e02155d8ab9249d6c7ccadc4889aa608faad6b2e599eddce9ef1b1222b1a5a136faee72afeeecca6ad2fc5150ed30f01288c
TLSH
T14DE026D804C8C27EA3B8664B12BC570C93A0262EA7C0E90E2704CE84714E280A6E3B90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 761f8bd128d8b741778dcc786a4ee3d8d869e4370da72bb2c1b60b0202264a76
MD5 f75811dd79e039ef1e282d28daf111cb
SHA1 359e3e09741f698366938249cc9f12a762563142
SHA512 0483703266a170dc2e7d486b0b4da68c256a76049eb5a401bf43f2ee92b232c07479b23c5e8843b3f193f7440da2823e7ac59eafee821d5f6a3cfba226cf5463
TLSH
T173510C434A817AC9FFA415B385F11B4335F06442A68FAF721B94F33AA81374E71A8B34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e30e356be4c7fc38a05df72f22544f38737ae64bdfa9e9cd138f6a027b642f9a
MD5 c0ef2146d690451ba6608ef3f2aae738
SHA1 e6c4af20fae4abe9918ec788a30c1e8b000f3bdb
SHA512 c7b33bd0ccf6924cf5e7f60cfb3138b733df723c4145c7d21c1310cc5e885ab7841dce953c96250775575a38c7b0c4a464342fdeb648c0055862b530a72b5c15
TLSH
T112512F839A907ACDFFA411B385F5138335F1B442958F9F320798C3796853B0E5198770
MD5 SHA1 SHA512 TLSH

Submit Download

aa594cf5-aee3-4031-8e48-b14eee4b6d6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\aa594cf5-aee3-4031-8e48-b14eee4b6d6a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

021ea31b-3c2b-4a0d-85ef-c43772cf417d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\021ea31b-3c2b-4a0d-85ef-c43772cf417d.tmp
Size 2KB
SHA256 878adc5c082cb48e2c0b3786f05133d493fa78d2f5d31c643ed4072794f62ee8
MD5 27a99cd9456363fd9173f8c1fbdcaa21
SHA1 3d8baa51eada7b262b3e1ba5251bd0ee5f5fee2c
SHA512 d44835534e98aa3c361542f778336a4baba9e16626f69e980fb44b956c917a45185f01bc528b37e661248274ffbc21a94d52c6985926418076c5e1e1641122d9
TLSH
T15C519EF743B4956DCA1192F0E9186E1B8E2E0521435C7CA5C5E46E1FD3F25F5E081A8F
MD5 SHA1 SHA512 TLSH

Submit Download

bdb8c2dd-1834-40b0-a429-f55e27bb2962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bdb8c2dd-1834-40b0-a429-f55e27bb2962.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c5fc430b-56f6-494c-b9b8-a1baac80c635.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5fc430b-56f6-494c-b9b8-a1baac80c635.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 245d5f819ec3a426389c8c55b1923bbbf1e7749ecd5aeb3498713c210e0e608c
MD5 23e6bcdbccfeb745d1e4256b19835001
SHA1 a177245da480d5043930454cfd8b2e760fd863c6
SHA512 87a034cc36b9154a200795bac5a95cdd80bae95f15ba8d2e30a58a6362bff0858ea23865ec6d6bd32dbf8ecc462b3a7c55c128e3e85887982911da60e0b92534
SSDEEP 192:sxZiaRRkAE/fgxsuCQZZXL8LzodpVPHW6+WNAdi/YbI2IkYnMTIg5jSBJJ:sxZxAT/fgsuCOZbL1Hb7/FeYqkB
TLSH
T1E942C855AD28AA7BDCC7D21DF665BF63D3F95132A0941E48A6FC8A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bbc93ae550da7e7ac1d44fc1e868df58a484a417b1add0ee3b69a0299631a63e
MD5 6459005a5505507e789d678ed64df405
SHA1 d2901ad3988746cf06e69b58773d8a8db71a48c2
SHA512 769916594c1e6cae5be9a5512eca7d006cfb25026c1269f409fd08aae8d40a0465ec8c8f0a5d1ba0812965dd0a699259f3abf2512aacbe3681afc6e9f4f09217
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXSZDk:OtfFvpopPxrB4RhfS9k
TLSH
T13DB2221571BA021138FE690881B58B2F064232B37158E73B7FBD15A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c9971876-1a01-40eb-aed8-557bc4dfa1e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9971876-1a01-40eb-aed8-557bc4dfa1e6.tmp
Size 414B
SHA256 300aa38e8cc76cfc20e3ee31a8c3a12f9ece9715fa855f7ae1e70aaebb6d4bbb
MD5 cca397b7b31f58076eadc20eb1f29a61
SHA1 8d1d73397734b034dcfcd4e10f8f412a28468e81
SHA512 6b38720f593a1cd076660a79a803f9ef73f0569a24dedd7bdbcda3879b2be45de5b5ca91ce79d65084e890b914c9da09a129e4e338defdbbf10cd0dcd49de296
TLSH
T1CDE02BF9C81ABC3B58FC476850A40682EB41035B2A80944B373C911D8FF9676468686C
MD5 SHA1 SHA512 TLSH

Submit Download

cf9050c3-37b3-461f-9989-6d907c1539c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf9050c3-37b3-461f-9989-6d907c1539c6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dbdea331-d521-443a-882a-822ad3bbec86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbdea331-d521-443a-882a-822ad3bbec86.tmp
Size 12KB
SHA256 9486c5ed8a95a6dfabe50dd110e4c7ce9c107d6e74a817bcd2934e965722a7fb
MD5 88577cd0c813b8e9204f00d28e9532f6
SHA1 437f90abb7cf8f49315a26e2fab2357c54cdc2ef
SHA512 dc1978d4e54c95413924aefa3a902bd475ad2ed2b4916d8914cb09e4eafa713dd6bdffb4457e8db9631be6167dafd1ac0047cda5def8e1e38f73ed9e4b7bb55d
SSDEEP 192:sxZiaRRkAE/fgxsu7QZZXL8LzodpVPHW6+WNAdi/YbIsIkYnMTIg5jSBJJ:sxZxAT/fgsu7OZbL1Hb7/FcYqkB
TLSH
T15242D815AD28AA7BDCC7D21DF655BF63D3F95032A0941E44A6FC8A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc1d240b-091f-457f-90f5-c2117940b622.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bc1d240b-091f-457f-90f5-c2117940b622.tmp
Size 32KB
SHA256 1896b4690ec70c68abb8dae2be7953093b7e6bc3f66fe2f1606a838e88d50a32
MD5 0be47707ff82354929d9aa32ac5cd7b4
SHA1 f2b50e1c7e50e3397d7afbc7bc2e08ac345fb537
SHA512 38c5b68fa75faa99a2f9bf074b1a2e5896e5cda012d0cad9dd396af01c2ac1da27a4eaed750d0b25abcba6a92a243e2631d06d672534136fe9d8d1d2fb4d3bd0
SSDEEP 384:nHiFzQkUSvCm3sNo8TUNTUlI4I5mg+hWdPK2flBCupuSAiJn3PJAxJSChhgL/7IN:CFdV3BwgAsBBnpfr3PkJSCoLC
TLSH
T13EE2B3F1A8D79A77E89E4B97A37D2D0299FCC113B5884984B7C91D1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e236a6f8-5e78-4c0a-a33a-6a252263b2ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e236a6f8-5e78-4c0a-a33a-6a252263b2ef.tmp
Size 26KB
SHA256 e9d374ef4793a31d0eeb0287a12cacf1f028dbfefa7f579307afe68573124ba5
MD5 c8cec8d43d215072c441b4628adb7b9f
SHA1 552067ece6a5c14a0136d9c000e11ecaccc0c406
SHA512 879d694259b0756d0ffa080bb4e411d7d6acb50910fab76b4c8dad6b89ea4e0dace29d2a92946b6c7157c488a99c8fc5e1d5e8f382d006d4822aef3e5b4bca3b
SSDEEP 384:n+iFzQkUSvH3sNo8TUNTUlI4I5mg+hW5PK2flBCupuSAiJs3PJAxJSChhgL/7Izh:VFdH3BwgAkBBnpfA3PkJSCoLC
TLSH
T106C24A76E899DEBBEDE64EA5A34A3643DEE04263D6CC4AC4DAC91D6C00C71CD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 24e1c4d21aa6dce05b38d54989f4d0ebd30492af1270090d1f07396579281284
MD5 d99d009a7c833ae986cd9c0c9d1a5d1b
SHA1 88d2e1d24cb97e804b96b396f9ae23ad0c95e8e0
SHA512 d5721330e3be38070ce0a7c3beafa0bb55da42c92ba360a5f37c4301f9518ce5fcf0e366fbf3cb34375c1d967cf14a7793ab5bdc9085d716c0706fe5cbab46b6
TLSH
T1D4415B5CA6EA1118B3B36F5A9BF7A86D48BFBC732E56D45D10110E4F0A62B04C961B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5588-248-0x00000225099B0000-0x000002250A9B0000-memory.dmp

Download