1b3d56972568ca1e4d0feef650a188894957ff0c5b9032920dd425c687e0a637

Analysis

max time kernel
151s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261020-2207821-8kexdz.html
Size 96B
Sample261020-gzaexawsb1
SHA256 1b3d56972568ca1e4d0feef650a188894957ff0c5b9032920dd425c687e0a637
MD5 0cb5b5b0eadc9627695cc70a09eeb579
SHA1 024a1f5dee79e6e272ff2c50594120e8ff8d0efb
SHA512 3a00c93da7aca0f62694f3206a20319cfd9dd539c6af807d4ea9549b77cf12d5ee7dc12026f566b33a49e31167c440a02b80028c775b7fc41872ddef1f296bf1
TLSH
T138B012753005100C7C1DE6946EA500C00C55B5519C4C660160C05C7FE415315CC46387
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{B9DF50D0-1C9E-44E2-AB20-2BD5504D0F7D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4788	2604	msedge.exe	89
PID 2604 wrote to memory of 3716	2604	msedge.exe	90
PID 2604 wrote to memory of 464	2604	msedge.exe	91
PID 2604 wrote to memory of 464	2604	msedge.exe	91
PID 2604 wrote to memory of 464	2604	msedge.exe	91
PID 2604 wrote to memory of 5084	2604	msedge.exe	92
PID 2604 wrote to memory of 5084	2604	msedge.exe	92
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 4748	2604	msedge.exe	94
PID 2604 wrote to memory of 5884	2604	msedge.exe	95
PID 2604 wrote to memory of 5884	2604	msedge.exe	95
PID 2604 wrote to memory of 5884	2604	msedge.exe	95
PID 2604 wrote to memory of 4300	2604	msedge.exe	96
PID 2604 wrote to memory of 4300	2604	msedge.exe	96
PID 2604 wrote to memory of 4300	2604	msedge.exe	96
PID 2604 wrote to memory of 5976	2604	msedge.exe	97
PID 2604 wrote to memory of 5976	2604	msedge.exe	97
PID 2604 wrote to memory of 5976	2604	msedge.exe	97
PID 2604 wrote to memory of 1736	2604	msedge.exe	99
PID 2604 wrote to memory of 2692	2604	msedge.exe	100
PID 2604 wrote to memory of 1736	2604	msedge.exe	99
PID 2604 wrote to memory of 2692	2604	msedge.exe	100
PID 2604 wrote to memory of 5124	2604	msedge.exe	102
PID 2604 wrote to memory of 5552	2604	msedge.exe	106
PID 2604 wrote to memory of 2496	2604	msedge.exe	107
PID 2604 wrote to memory of 4772	2604	msedge.exe	108
PID 2604 wrote to memory of 5572	2604	msedge.exe	109
PID 2604 wrote to memory of 5572	2604	msedge.exe	109
PID 2604 wrote to memory of 1884	2604	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261020-2207821-8kexdz.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7fffc8a3c188,0x7fffc8a3c194,0x7fffc8a3c1a0
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,3950843601773219668,16028440855924262328,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15930060552064441194,3067062192176261502,262144 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,4996397024560562768,11011824150075315236,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,17858317459213446804,9884594594549520368,2097152 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,11976107582251766499,5407727781815465781,2097152 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,5357830211053723217,9945016494049329453,2097152 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4444,i,2863361561504069307,1420257967341702793,2097152 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,12330330647417618065,7609868847888476891,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,3394764417701497231,11585017036495561086,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11317516956014149109,13901319524080059380,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11317516956014149109,13901319524080059380,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,8439662653081746970,324201771759561482,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13934439871963694990,13288878171454860297,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9603011358809604788,5587618174040528399,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,13370273728514774664,4554232994756140977,524288 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5488,i,10889690250813949153,14085392131970290183,262144 --field-trial-handle=2728,i,15402124677598775826,10103449422085821401,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a447688-d7d8-44cb-8da4-48ac8ec58a01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a447688-d7d8-44cb-8da4-48ac8ec58a01.tmp
Size 34KB
SHA256 f4fbd4da6a352923d814936dd11a4dcaf16c03566828fca5a96d059aa585c9e5
MD5 3c8672d6bc03ada23af00f8e89123fda
SHA1 ecc6cf8004e8290a2f5417e8bb6535b8243ec657
SHA512 a116801976839ced4de670b30fcb1319ebb79048e5a6e7afe47916e1ca48b08da565a68f3f7bc6c7fc7ccde4cf7a084119ebfb878f6ec9b39099540de39fa771
SSDEEP 768:c23dmOUXf9cPftIqEyEMbxyJugQVTJ7vvmeXmbLt:c23dmOCqEyEmxyJJq17vYbh
TLSH
T119F2AE7168659D3389F78281B289B7C3AFE0426388C91BD4C5CD6E1D158B2EE674BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d34944d-a9e6-4f80-9432-98db17b74640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d34944d-a9e6-4f80-9432-98db17b74640.tmp
Size 36KB
SHA256 98cd7676757f21a6856bf1ff56b1d822b5c950d0bc60234015669fb19b53d1d6
MD5 890a1ede5c911b4eac523d2a2f97d801
SHA1 1362b2f87939b9c84fa6a5820ede3ba41f37e957
SHA512 77e58b1d6de1bbf33dccea44be0f4bafea216526b0eb5f9537c57e84f4a0648398ca5b829f64ae1119e884b624f706ce41c5c754003d6e477c9cf7b15e9dbf34
SSDEEP 768:4FdL3IwgDmOUXf9cPftIqMyEMbxyJugQVTJ7vvmeXmbLt:sL3mmOCqMyEmxyJJq17vYbh
TLSH
T1C4F29D725CA5CD379DB78781B6897283EFF142A3C8C96AA0D6CD5D1D108B1ED234BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55d3ca7f-acd7-4366-b3dc-7a1be86d5aee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55d3ca7f-acd7-4366-b3dc-7a1be86d5aee.tmp
Size 38KB
SHA256 1e7ebeb227589cb7e5f658b71b0934942edcdf64291770a0f0899bc74e5f253f
MD5 5e0f29f490164a9ef97e3b1f4051ca58
SHA1 2d64128b60da215d8236ba0bb3005b3f1a9c949d
SHA512 b15a474b156e5da6c42c93023184817904d04deea5575a9a7d9460b319fae3ed589cdcd51de6c7d6cbceeb59b7333ce86485ea8a17b3d1296eb778ddd89e9a33
SSDEEP 768:8/UxvxjgC+k3D5f9cPftIqtyEMbxyJugQVTJ7vvmeOmSHtBk:pZj3+k3bqtyEmxyJJq17v3Sbk
TLSH
T16F03C036AC659C7388F792843649F787EFF505A384C62AE485DD6E0E168B3AC530BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a35eb42-eab4-4679-9802-455cf0f7e404.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a35eb42-eab4-4679-9802-455cf0f7e404.tmp
Size 37KB
SHA256 aee296669053059c432c2de3d6449d3beef65cd698f9252789337023e1095bc4
MD5 f77e55a0c259dc7d1101daf7348688d3
SHA1 00baf651b7652f1779096628076e67d41bfaf56a
SHA512 0020f532b15157aae4c391050150523488fc4f5d8834c103ae5d3d0d7e5bda5e1bcaabb001771010ca2ad6c4afc60361eafbf4c948913173bff8e20b3a4cc431
SSDEEP 768:p/UxvxjgC+k3yff9cPftxyEMbxyJugQVTJ7vvmevZSHtBk:cZj3+k3cayEmxyJJq17vfSbk
TLSH
T1AC03C036ACA59C7388F792843649E787EFF505A384C62BA485DD6F0E128B3AC5307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

27a1cf6a-cabe-493b-b0e3-8697963e25d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27a1cf6a-cabe-493b-b0e3-8697963e25d4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b141fc6-fedc-494d-99ab-09a4ca702e96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b141fc6-fedc-494d-99ab-09a4ca702e96.tmp
Size 10KB
SHA256 6b391b1dbf20b535dec53b3df415504812b0100f8aa030771e11219c53cf69f8
MD5 5a8f4a4b65f811b69258c8ee3e6ca62e
SHA1 b4a8e49fc7dc46dbffced80ba04ec2374f4df24e
SHA512 3959ae96a6bd385218ad6ec3e6ba4f0cf17c16233647028f37332da5b7fb1e2a226eb87f323440c5515fc76b142c43f2d0f6ba3c75bdee0af9157fc67057671a
SSDEEP 192:sxRaRQb9/fDsInyzoA8p4E/g6+WNIYF5SU+GqIgIJ:sxRaQ9/fDsu/F/5IMks
TLSH
T1312295159E28A93B8CD7D20DBB657F53D2F95032A1951E48E6FC851C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a7e65fcb04739074430f50d4993a082b815c3450ff500109c15e1c21af3d238d
MD5 69e4235cf9b5be1d07855cb8223cf672
SHA1 efa528dadf5a64a2c023d1349554558199c44d4d
SHA512 5157037c43c7dab04f4d872f3297a36a5debdcbcc9e8351c6c4ae90a5d67a8fc80cba845983d2899eef67ab42bba3ff41bf0f3ef167efb37396a49adf20925d0
TLSH
T1E861B386654D93F5FBE8403188E39E8F3AFDC9D355832FC301C2E776A4463298065C48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c3a04e5a7fbdd94835548cd70b23530b8f0cbbbee380c7c85a7e3a5eb3109fcb
MD5 26b63c8a5553cc87e3798b59295f4ee0
SHA1 d13dc75d5343ad0f431f2bd1c8ecdb6ef10a30a5
SHA512 4a4e6ba2c6557ba6f2339bc1401c29af4894dbcef4c36d3b066acfec94f6ee4d51f403b16320b584fcc385b266f743eceaa43844c6c8704455b60c5ce50335b5
TLSH
T1C961B386664D83F5FBE8403188E39E8F3AFDC9D314832FD301C2E776A8463298065C48
MD5 SHA1 SHA512 TLSH

Submit Download

4a6903e9-5d28-44b7-ad81-a8f754b6d3bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4a6903e9-5d28-44b7-ad81-a8f754b6d3bb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d3180583-aba3-4859-a558-eeb241e54746.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3180583-aba3-4859-a558-eeb241e54746.tmp
Size 1KB
SHA256 9ab04a93004483a6fcc0fe31ea8f6787d883cbdfc19e7f801d8ac45dda76a557
MD5 a64b180ef233eeea4ca1a242d3d7f0b5
SHA1 6b34cb602baaf4de3c39ad3ad29fe0eb268dacf3
SHA512 07c7393dbed6a4526c9f0c48d6c043d4b5f9fb98462682b6879915ea56fcd91d55e087ef9658e9350c34176a44ffb9ad9cdeabcf5e9825cdab1a72be2601012e
TLSH
T14B319EF787F4856E8A0196F0AA14AE1FCF2C0515431C7C69C5E4AE2793E3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

ddf2d77a-6afe-4538-a5b9-f8298088ab24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ddf2d77a-6afe-4538-a5b9-f8298088ab24.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f4ef682d25bdf863d65b74ea8fabc4bfc46cf57cbb0ba0c50b399076cc558171
MD5 353b313e545ade3943427704b276e9c1
SHA1 4ac5219c087dba3a9c11798cfcbb1c85c6fab02d
SHA512 c928a1954f3eaa7cbab9abd7d7168ae9373659b364579e16ad815e03c371d2d2bac0a90364c2dd6e127e2b9bb4bdfdd63c7b90be53c2c47d48cc4c822918d081
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRn6ro+P0:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0Vy
TLSH
T177B2DA2F640CCB7E4F904A9DAC196FDB6DAC02C796588D4047FA994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 14cdeaf73bd1cab176fac91fb071d8e44b5ac4f48075109a611e457d1039fa45
MD5 211fad22b93680f53fb95ebdbd7057ec
SHA1 79f22e62cdb8ef9ca4c95b5a8508973c5d330b98
SHA512 639555edda287cb26e01403a34bf3bb279bf01302fc44575aa9d229df2d8c0fac7c137e18b6296f6f333ffeae4ad84790dbcb3a984dfbc1e3307162c774e958b
SSDEEP 24:KSEns8uIZKEhM1SShidyXcH4KydKkoIdKmhs1mSHY5yXxWpG4sItKyhE12SbQY:KgZIZKyM0DyITIdKQsQfy9jItKEEoa
TLSH
T121914721723A53023C7D2A488099D6D6557230B73128A56F37EA42F14F6BE09CDFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ccf1dac4-21b8-4a31-b535-5fbabd841aff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccf1dac4-21b8-4a31-b535-5fbabd841aff.tmp
Size 10KB
SHA256 2adbc2f48dffc59b38bb327626893510151dfbc8e78c6431cd0c03029c245e99
MD5 b7fb16c39a2533464837c41df209640f
SHA1 a46b8c5bfa652a9b302f029ddd5af9ddb56fef10
SHA512 c69f61f185f36387cd7433872db22362fabc917a9c0f0814202d296013853fcd4e5afdc261a7d082e801e361ea725f4d95ca3766a8aefb7bfe4b2d455cf20880
SSDEEP 192:sxRBRQb9/fDsLnyzoA8p4E/g6+WNIYFTsU+GqIgD5J:sxRBQ9/fDsL/F/5Igk/
TLSH
T183329615AE38A93B8CD7D20DBB657F53E2F9503261952E48E6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

facd0c0b-2627-4cf4-9ee4-e703d8a91b19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\facd0c0b-2627-4cf4-9ee4-e703d8a91b19.tmp
Size 10KB
SHA256 cfeda9c66bc1889cbc3a4394f5cb7e0e7875aff7c51b9ee521f5186dff7da948
MD5 f95cb591589583adeadb530e6431af1c
SHA1 6bfd4bdf36345a61abf43c6a50a4218a62999d89
SHA512 691b599ce5a236d9c3dcacd8702b073b6cb9d91d5d45f82326be23e3f400c7248eb86fdab9f36e496a9140b63f68878c0f6e1cd4e86f48da98aca36a167d6e65
SSDEEP 192:sxRBRQb9/fDs5nyzoA8p4E/g6+WNIYF5SU+GqIgDnJ:sxRBQ9/fDsl/F/5IMkF
TLSH
T1E7329615AE28A93B8CD7D20DBB65BF53D2F95032A1952E48E6FC951C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2088be12-7ed4-423b-9bae-f437e431974e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2088be12-7ed4-423b-9bae-f437e431974e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

688caa8e-d423-4786-9ca7-2e4a822624e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\688caa8e-d423-4786-9ca7-2e4a822624e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3ae17f3-ab3b-4909-844f-4b9510ebda1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3ae17f3-ab3b-4909-844f-4b9510ebda1e.tmp
Size 39KB
SHA256 962236100fe388816ae5e572ba7cd9e67da3c12a1a1d6953c8027fc81ec5a95e
MD5 6d713e24bc2f42dd7039e65b5ee3aa90
SHA1 ede87c71e4aebdd20bfadcaa04bd9afb8d158107
SHA512 3d24368c3f0299425ed004abde52066c6520df69d6a76ff42f60683ad792d58f6aa056fa72cfa6cdf62a0d9baa1c281d7dcb8d62bcf32015809130d7e9677a0e
SSDEEP 768:3/UxvxjgC+63dmOkXf9cPftIqvyEMbxyJugQVTJ7vvmeXmhIA:qZj3+63dmOyqvyEmxyJJq17vY2A
TLSH
T11903C036A865AC3388F7D284768AA787EFF4056354C92AD484DD5F0E168B3EC534BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6850f53-44eb-476f-8c1f-1723baa962fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6850f53-44eb-476f-8c1f-1723baa962fd.tmp
Size 34KB
SHA256 e03dfcd2adf1d47f71880fa95f5968bb034ef774f407256977a2433e3596a927
MD5 a8a3b4daa89bff2c9a128f3ee2afb433
SHA1 a65af05e620ac468c430d2ddac80457cc305e73e
SHA512 a683a5856d96c891c7c4e05218a19681153c22c3fda473cd180a10595eaba21b6d8aab7cc4402ef648552f2fa0968da47af700f784ce91e0f78dc715761508c1
SSDEEP 768:J23AmOUXf9cPftIqEyEMbxyJugQVTJ7vvmeXmbLt:J23AmOCqEyEmxyJJq17vYbh
TLSH
T116F2AE7168659D3389B78281B289B6C3EFE0426388CD1BD4C5CD6E1D158B2EE674BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download