dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample261023-pd6j8ast2p
SHA256 dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84
MD5 cb1fc49764c26340f3f059f7fba932dc
SHA1 dee6828bc5016de3a1f5fcffc7509ca040daace5
SHA512 a06e656cf0e0a49dee6ec593eb303b1660d7c64cdaf6dc8db2f3f4c1ab7d94f1f35921524a2d8e6733b7161e1a20a2ddf5e4d8d1c580461f3c01eb02628b52ab
TLSH
T1BB517272E192643BA127C5DE7070939EB0E6C402C7976A176DFD9378CACAE939B1134C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5344	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{660A8507-1985-4F97-B541-9965B0844D7C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4224	1820	msedge.exe	88
PID 1820 wrote to memory of 1144	1820	msedge.exe	90
PID 1820 wrote to memory of 5344	1820	msedge.exe	91
PID 1820 wrote to memory of 1144	1820	msedge.exe	90
PID 1820 wrote to memory of 1144	1820	msedge.exe	90
PID 1820 wrote to memory of 1628	1820	msedge.exe	92
PID 1820 wrote to memory of 1628	1820	msedge.exe	92
PID 1820 wrote to memory of 1596	1820	msedge.exe	93
PID 1820 wrote to memory of 4584	1820	msedge.exe	94
PID 1820 wrote to memory of 4584	1820	msedge.exe	94
PID 1820 wrote to memory of 4584	1820	msedge.exe	94
PID 1820 wrote to memory of 1596	1820	msedge.exe	93
PID 1820 wrote to memory of 1596	1820	msedge.exe	93
PID 1820 wrote to memory of 1300	1820	msedge.exe	96
PID 1820 wrote to memory of 2552	1820	msedge.exe	97
PID 1820 wrote to memory of 1300	1820	msedge.exe	96
PID 1820 wrote to memory of 1300	1820	msedge.exe	96
PID 1820 wrote to memory of 2552	1820	msedge.exe	97
PID 1820 wrote to memory of 2552	1820	msedge.exe	97
PID 1820 wrote to memory of 888	1820	msedge.exe	99
PID 1820 wrote to memory of 888	1820	msedge.exe	99
PID 1820 wrote to memory of 576	1820	msedge.exe	100
PID 1820 wrote to memory of 576	1820	msedge.exe	100
PID 1820 wrote to memory of 2316	1820	msedge.exe	102
PID 1820 wrote to memory of 2556	1820	msedge.exe	106
PID 1820 wrote to memory of 5596	1820	msedge.exe	107
PID 1820 wrote to memory of 2452	1820	msedge.exe	108
PID 1820 wrote to memory of 4580	1820	msedge.exe	109
PID 1820 wrote to memory of 4580	1820	msedge.exe	109
PID 1820 wrote to memory of 1116	1820	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x290,0x7ffe8f65c188,0x7ffe8f65c194,0x7ffe8f65c1a0
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,18111804921896165703,9205117416552737619,262144 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,2371091526112420309,4541422477069999116,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,15232900824452886140,1139509331878972526,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,8511238279206523176,5295028096108028398,2097152 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1985582922863171439,16982083469373207940,2097152 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12032060363756867066,741743252391678187,2097152 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,16821564221279961781,17197962688812019190,2097152 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,16760410399966896479,2844382850757284279,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,16552984173517408695,14689809985088940737,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,5416140987846483337,1482706584785037510,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,5416140987846483337,1482706584785037510,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,11464487068902941037,18195536678410016890,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16288558075328048424,18142016103855414199,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,6821423161540835186,6577600746341142981,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,1712436812778887163,2136418169435118774,524288 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,17017694268626418200,13326952496601235669,262144 --field-trial-handle=2244,i,9867331127355216124,4634861480142921730,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c73283e-044b-41b4-badd-30b002e591c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c73283e-044b-41b4-badd-30b002e591c4.tmp
Size 40KB
SHA256 a5c83a2cd1631a5dce897590cf0b09848b621d4a3f6f78d3272a3b45ee4f0ad9
MD5 a74ddd81933dead3ca60c1204c8eb9ff
SHA1 55d063b09b6a8dbe7cbb03c14304192e2fae27fb
SHA512 0a28aa2a9a0d0c6dc410bef2f4bb3e32824f1e560ac8061085f47ec9a5c0c96100878b2edda360be7c16c956b3ef478e9689a9d3a1c26d96ad24b57cade94b86
SSDEEP 768:P/UxvxjgC+U3+xyc7fZrKREb1tbp5XSwQs88uBkiT2y6PuY6:iZj3+U3+ftrZVILNBfwj6
TLSH
T10603C039ECD46873ACB3E3817B4A27479EF05043D4C40A988ADE661E07CB36D674B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

432f204d-69f8-43b4-a3b2-3268f3873c11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\432f204d-69f8-43b4-a3b2-3268f3873c11.tmp
Size 33KB
SHA256 f7899dad2e74199d37c39f0eb09b9ef36b4f5c0234cbeda6c55f84a719ca6ff2
MD5 d599fbc2e0aed2a7796037d3df5534d4
SHA1 85a577783ff60059c17188114c1418baf694e62f
SHA512 273e832d21218879e72903658b0ea114eb3ea4f3b861d73d1e16ceb3934b7b101b7419e149e536ac3aea7928cc05440b136570693a68e4715fce4ec79bcab70a
SSDEEP 768:zQ33vyyc7fZrKREb1tbp5XSwQs88uBkiT2y6Pu2LZ:zQ33vctrZVILNBfwHl
TLSH
T1E7F2AF39ECD4A8B3ACB29781764A37476EF09147C4D40B98CADE762D02CB35E274B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d5cbe00-8481-4727-9188-f14bd531a665.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d5cbe00-8481-4727-9188-f14bd531a665.tmp
Size 36KB
SHA256 ef1312b7c9a97ffafc845a939d8776cf8d3d47efd726d80284a353acf16c0465
MD5 f68c86ae43bee29699343792364e4561
SHA1 3dd34f9ff5853e057f7220d09e845a98779bccd0
SHA512 855fc84eb5cccdc77af0a076f9fec0d3a794983266dffed784936db234767cb671dbbee2e6000fcf7ef94b64e9123d9eabb3442dd7e7d2695650e2950289fd8c
SSDEEP 768:JFdj3owgovyyc7fZrKREb1tgSp5XSwQs88uBkiT2y6Pu2LZ:1j3hvctrZQsILNBfwHl
TLSH
T1C8F2AE36DCC498B7ADB69B81BB4A33039EF05147C8D44A94DBCD652D02CB29D238BD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c5aa8fa-5658-447e-a5f8-4f7576d8bf0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c5aa8fa-5658-447e-a5f8-4f7576d8bf0d.tmp
Size 37KB
SHA256 268a86793b343d6c39bc418b1723af58beb0fda93f59dd0df61f3e5e3617dfe4
MD5 d6b2bdc159fa8b3625947f97aec74a3d
SHA1 f28871174287b6808d5f3cec26d814fdc7ee8f47
SHA512 bd180c4930be38db68d0624bb66554f8623a98e3ac13c25ffad9624e24ef76f86caf61967d02df6cbfa4010511cafe0debecef4f7b862b138e5018c791e74316
SSDEEP 768:R/UxvxjgC+W3TCwvc7fZrKRIp5XSwQs88uBkiTCl/P84g:kZj3+W3uXtrtILNBkHg
TLSH
T11603C039EC946873ACF39385365A275BAFF06053C4C41B9849EE7A1E038B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

15233cc4-b871-4baf-b94f-bc4130550dbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15233cc4-b871-4baf-b94f-bc4130550dbd.tmp
Size 11KB
SHA256 de3318227aaa49470d2caa7d794eff3899789ab24c2d2b0ce562437b6573f932
MD5 c247af8b6cb5ba4ca6c35aa4b71a0d56
SHA1 e4b88ea103bc4fad1180bab7252d1a0ef49ffcee
SHA512 8d4e573af972104393c7e5b7c3af9e774a4bac5e0d515d3b1b999ae22d31017bbbe96fa75e9c8b75b1f60582158eba7d2a1003d2875c125b2a8df56f3e8ca107
SSDEEP 192:sxR6RQbfP/fjsuoHRcRzoA8p4d/g6+WNIYEG63GrIgDuJ:sxR6sn/fjsuo/M/5IEW
TLSH
T1A732B715AE68A97B9CCBD21DBB55BF53D6F95032A0901E48F6FC861C04EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28865e20-d1e7-40b2-8232-c83958775068.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28865e20-d1e7-40b2-8232-c83958775068.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

40a46afc-be3b-4c81-b384-34b8a6450817.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40a46afc-be3b-4c81-b384-34b8a6450817.tmp
Size 11KB
SHA256 08c34d5f0e79266c6b89940b24f4c682626b7aba452c37a8800ef51f1bdf7083
MD5 ed39c88e1216d6933993a2296a93ef2f
SHA1 ecfe3b5f750a824b1fb2edcff7efc5003a54653e
SHA512 1cd5bbbc5ca4bc173c2efc72d863551e3ac466661444c6ea3f5c221410bb9af3552154af4ee58bd7adf5d2e8c2a9c360c0ec6274ba567e0952c5cbc2f4a37032
SSDEEP 192:sxR6RQbfP/fjsu7HRcRzoA8p4d/g6+WNIYES23GrIgD0J:sxR6sn/fjsu7/M/5Iyk
TLSH
T1B642B815AD68B97B9CCBE21DBB55BF53D2F9503260901E48F6FC8A1C04EB6DE620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eed1624-1231-432a-9c72-dcc0af56f746.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9eed1624-1231-432a-9c72-dcc0af56f746.tmp
Size 11KB
SHA256 26eb60e91a40d1a4d485a8835f6a5ce0f1377dd531f60acf07e63bcaca90695f
MD5 a8bde8be0f314b20dc122b66882621b7
SHA1 13950c33982a5ff369ac92f5f5f7d2041e714437
SHA512 d42180a5c723da3accf918c63ea0f3f96ef74515bdfebf2f77ef07c73349c5eac60681ec843a84e45cf08bd8bbeae6cd19feed51aa5bd04d4d1a2353f339ac90
SSDEEP 192:sxRRRQbfP/fjsqoHRcRzoA8p4d/g6+WNIYEG63GrIgIJ:sxRRsn/fjsqo/M/5IEs
TLSH
T18D32B715AE28A97B9CCBD21DBB65BF53D6FD5032A0901E58F6FC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 e3acb9dea36e5b64974025f497a83d89ff7dd10c4d74b2931c0e24d28bde27c0
MD5 beb6649754991c90e814e1eea385b359
SHA1 3506d25861e22747569e74fa4d65a7de882bae52
SHA512 925ea2e45cca90c5697a5e49620f04554d48847b7577a705da2de389e985cfb32aa2424e3ed981d4be0c9284f102bf79d65094796454e27b7ba359a8540c4d83
TLSH
T14C210D83CAA81045F784B634C7D537733AF4F99E55431E810964C8B5BA46B9C7154F7C
MD5 SHA1 SHA512 TLSH

Submit Download

9053e748-4832-41d4-b947-3c458eb619dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9053e748-4832-41d4-b947-3c458eb619dd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

14a741b2-5ab9-4400-a5d7-1f1001290d30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\14a741b2-5ab9-4400-a5d7-1f1001290d30.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8b64ca2a-04fd-428f-bf6b-06087fda48bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b64ca2a-04fd-428f-bf6b-06087fda48bc.tmp
Size 1KB
SHA256 4ac09066293acfaed5cdfcb4c76b86c8d61d1f7b8f85b663d0598b66f0444332
MD5 615c5f8c646fc193148c46331135b802
SHA1 2ae03aff62d769027218dc1a952227c5ebaf5410
SHA512 2a29064542e84f4f6cd0eca623a1f022244a49734fd3d77fa840fa554456b6770f88e7dcb2aadd8ce73b25429637c4260c23d746deb34c8164c00841773731b4
TLSH
T17741E3F783B4867E9A0196F0EA14AE1FDE2D0411432C7C6589E0AE2793F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

b396afac-6701-403f-bdcd-62588ec85afa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b396afac-6701-403f-bdcd-62588ec85afa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2b1bd01635e6725952142d76b3e0bd527eee33ce280ff32f703c538c7438fce
MD5 65c172c94d7f8ae442eadf0743df80b8
SHA1 4b1ca534f17b1946d1cf05cf6d27e1df09b7ddaf
SHA512 8f770c7135035664ccf85880ca8e6a6224a9aa1a482b2827f079cd4fd4e3ebd0cfb61c4b2462b0b7b84b400e1b0eb524e34b7ba2a523b4486c666d874cd16489
SSDEEP 48:KiaSS+givlIxA+KyLKW+eYuHXGQfyZsIDKF6cTyFPsr/dhFkVhCPICHkKDBLlk3B:KcjyKo4CasQKF6iKEgK9mR
TLSH
T11991BF1572BE420138BF3A4A80B5871B524131B37058E63B7FBD10A68A67E146EBECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a0c61993-1ea0-4563-8b97-2b5df8669ecc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0c61993-1ea0-4563-8b97-2b5df8669ecc.tmp
Size 23KB
SHA256 27cdd5b53f9bee355e8991d6ccdbf24af76d1f8c3ad97f533676fdd18c98f936
MD5 6af02df5a1645c067d20d778504fff28
SHA1 ac1b441beccbe00c50f6e32de614b074ac27a409
SHA512 6f0da0fda377b214bbbbc647f092f91f5c1fffc1eb86249dd2fbe953e4da5e1953623bfb4adce2baaff05a54402c0c2df2d44149920fbba956236abd11c4e4e5
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXtroJeh:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VO
TLSH
T19FB2C92B640CCB7F4FC04A9EA8196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0a7a29b-f2d8-41ad-b09b-0218691fd1ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0a7a29b-f2d8-41ad-b09b-0218691fd1ff.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b00d2221-ef4c-4f5b-993f-25f038a1b4bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b00d2221-ef4c-4f5b-993f-25f038a1b4bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecff60ae-17b2-422b-8975-377c86b5b3f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ecff60ae-17b2-422b-8975-377c86b5b3f2.tmp
Size 33KB
SHA256 e7ba31b5e9997ccb5effef107ea0c16d7a0c2befeea595c8cff986c624f75aed
MD5 66e2f326f84b4144a29df297fabb7e02
SHA1 412ad919bb24466b56ff2b1a09e04db74048be45
SHA512 6da15010b56b0acd6682a144e1fae0abfcab28aa9b506b4c5f98929ca4b848451ac9b83cb2f0ef017fab1549a6d81f250535d95dd853c29e20e0edf76b34fd00
SSDEEP 768:0Q3+vyyc7fZrKREb1tbp5XSwQs88uBkiT2y6Pu2LZ:0Q3+vctrZVILNBfwHl
TLSH
T137F2A039ECD498B3ACB29781764A37476EF09147C4D40B94CADE762E02CB35D274B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5ec2549-e518-4edc-ba94-94fd8650da86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5ec2549-e518-4edc-ba94-94fd8650da86.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7ef0424-666f-4c18-907f-4498f507eb17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7ef0424-666f-4c18-907f-4498f507eb17.tmp
Size 38KB
SHA256 6865072d43a36796ffef7c50ae5d6ebdc4bb91f6a7024ad1fbcc4b51992ffc5e
MD5 e3412f08bbac279b1ecb25d7524f937b
SHA1 1e21826958384821fc210583cb913a960b6b77a5
SHA512 06701616491cebd461dd160bff2aa4f058ec6d79dad3decd8194a7de723da0bb38b333a3d933269ff76c2974ac6c563017292356a9b44adb1023c5f18128bf16
SSDEEP 768:J/UxvxjgC+W3g38c7fZrKREb1tRp5XSwQs88uBkiTzy/P84g:8Zj3+W3gntrZvILNBwHg
TLSH
T10303C039EC946873BCB39381365A274BAFF05153C4C41A944DEE6A1E038B75D6707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-175-0x000001E27F720000-0x000001E27F961000-memory.dmp

Download