b50b55f235a542186c01ba50a31e3f00045751f405753e5a706d5c59befc1982

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 12KB
Sample261023-ws4gqsty3l
SHA256 b50b55f235a542186c01ba50a31e3f00045751f405753e5a706d5c59befc1982
MD5 d2dccf1879884103bb261599a6936624
SHA1 b4fcd65402687ba4c561f46155a50f974439e165
SHA512 d0ffe3460a5b54c1dd5cbfe7c1308711d7797fc1222798e07dfed444fff39e7caf55b0f8c2c74296e2ab6fb4aecc73edcf9102ea9f6b70973d87f8f7d88518a4
SSDEEP 96:SbVIFZXQ28Kj596I9T+Qo8/SopuVq3B3iPg9Vq3BiCM9cqgB6h5w0k:2VCZXYg96A+ZHW3i2VWiCocN6h5i
TLSH
T1F952932192C0270E557E60A0F162AEDCEF95011B27921AE4F95F263B6F7E8A106537FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 6 IoCs

phishing

Phishing

T1566

flow	ioc
18	celanese-tx.sharefile.com
19	celanese-tx.sharefile.com
22	sf-assets.sharefile.com
23	sf-assets.sharefile.com
27	celanese-tx.sharefile.com
28	sf-assets.sharefile.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{03AF85F1-9307-4878-93C1-D7C260D1E3CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 3132	5144	msedge.exe	89
PID 5144 wrote to memory of 3328	5144	msedge.exe	90
PID 5144 wrote to memory of 1836	5144	msedge.exe	91
PID 5144 wrote to memory of 1836	5144	msedge.exe	91
PID 5144 wrote to memory of 1836	5144	msedge.exe	91
PID 5144 wrote to memory of 4604	5144	msedge.exe	92
PID 5144 wrote to memory of 4604	5144	msedge.exe	92
PID 5144 wrote to memory of 5236	5144	msedge.exe	94
PID 5144 wrote to memory of 2136	5144	msedge.exe	93
PID 5144 wrote to memory of 5236	5144	msedge.exe	94
PID 5144 wrote to memory of 5236	5144	msedge.exe	94
PID 5144 wrote to memory of 2136	5144	msedge.exe	93
PID 5144 wrote to memory of 2136	5144	msedge.exe	93
PID 5144 wrote to memory of 408	5144	msedge.exe	97
PID 5144 wrote to memory of 3388	5144	msedge.exe	98
PID 5144 wrote to memory of 408	5144	msedge.exe	97
PID 5144 wrote to memory of 3388	5144	msedge.exe	98
PID 5144 wrote to memory of 4496	5144	msedge.exe	102
PID 5144 wrote to memory of 4028	5144	msedge.exe	114
PID 5144 wrote to memory of 4156	5144	msedge.exe	115
PID 5144 wrote to memory of 5084	5144	msedge.exe	116
PID 5144 wrote to memory of 4384	5144	msedge.exe	118
PID 5144 wrote to memory of 4384	5144	msedge.exe	118
PID 5144 wrote to memory of 5124	5144	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcb19cc188,0x7ffcb19cc194,0x7ffcb19cc1a0
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4050089686755779182,9114300187520634674,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,7925180009978843585,9016626159641367220,262144 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,16283290804251270292,15425063754113895277,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13331063721432445526,5881112856945724154,2097152 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3078613409524126106,13678788363025123101,2097152 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7836550081606243064,14337021365308931734,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9957494069828338817,1492040276877263240,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,5505375323612649599,3373168226155587696,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,5505375323612649599,3373168226155587696,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4715113613392592338,15026448488168168417,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3131295399166988339,10774197168803104654,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16057707196485326678,8104005522909270143,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6055596898680935400,908088551280616371,524288 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,9009636203649647068,699719732178500558,262144 --field-trial-handle=2272,i,11226793752451546100,18052363635414446719,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21ca5c52-f2b5-4d18-beb7-2640a498bbfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21ca5c52-f2b5-4d18-beb7-2640a498bbfa.tmp
Size 27KB
SHA256 897648dfb6200bd393d79ca7bda6a3fd24d0a0607f99724eb2322bafee8d4475
MD5 f46ac3bfdc24a7bf158455985417ad9f
SHA1 922362cbdabfd853b8e2cc794068757e0bc9552b
SHA512 8db484d764b27322368bdc901880c76b3aa7c60b74d906555bda2760cfeb7676c022d2a8395b275fc13d66812d9d5c2a3c70bd2996dd51a746abbc0f0a8bf7f0
SSDEEP 384:nfiFzQkUSv73sNx8TUNTUlI4c5mgDLIK2flBE8noQz7rEv2ICtgL/7IzLIIlv:qFd73UwgmcuBE8oG4v5cLB
TLSH
T1BBC24A76EC94DEABECEA8ED5A34A7643EEE04213D69C8AD4DAC91D1C00C71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e8fe468-4841-44a8-a70d-0700b1889b80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e8fe468-4841-44a8-a70d-0700b1889b80.tmp
Size 26KB
SHA256 976c4f82a7eee6e3391a754341e16c3a54520ef4723d7a5ebce1a544707a6ce1
MD5 af86bba3f75f71c595fbd1c25d6a8d92
SHA1 6553a0b1f0f5601fa9db346eb291d3849c2ab3c7
SHA512 037e5e71b81e1b10a07c32bbc9ee19ac4591d3f569a04968ff42e397edbef842da1c272587dcc2332b9f49bdcd8c09c5d5e8630d57bc343f723cdde48773248e
SSDEEP 384:n+iFiZcI63sNV8TUNTUlIm25mgHPFK2flBE8noQz7rwv7O6R2Feo4gL/7IzAoE:VFQ63kwgSEvBE8oGUv7TR6n
TLSH
T17FC25B72E8A4C9BBECEA8EE9A74A7607DDF44253D68C9AC0D9C81D1D00D759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6745a752-d8cb-4663-8e0a-51f3d756c03f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6745a752-d8cb-4663-8e0a-51f3d756c03f.tmp
Size 27KB
SHA256 e29a9c7a9ca5720ff2493adcbd35ef7f19c55e65cbcc3aebbe3d6e1f075b4a70
MD5 80af2061593f94154715c82acedc1348
SHA1 b687a7ca7a1d50e3ee6f6db8870c1951ca3c35b1
SHA512 5e2b876e15d29456a5fc7322c51862966c10d16380f9ccd85f6e82fda362ad430c868f8e13bb9e36ebb892a258cee24ff088ec85d12591dff525a7c5d3373b74
SSDEEP 384:n3iFzQkUSv73sNx8TUNTUlI4c5mgALIK2flBE8noQz7rEv2ICtgL/7IzLIIlv:yFd73UwgmvuBE8oG4v5cLB
TLSH
T1BEC24A76EC94DEABECEA8ED5A34A7643EEE04213D69C8AD4DAC91D1C00C71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c22cd5b-752e-47bf-8533-aafa6e54c290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9c22cd5b-752e-47bf-8533-aafa6e54c290.tmp
Size 27KB
SHA256 deff6bf5978e588347f34207461c45082192a22a951d9a43de31b2eba44788ec
MD5 6154642ebaee25ca06b1b6c1a925a17c
SHA1 973f7a3b631b94eb58b35d152789c2ebbd78c4b8
SHA512 81821f9622ca79c1b8b9dc7b393d2e37dcbbf7cd9deb5248faf011780797d592152e5f0b970898c059fe7b6b1f1c363ff5e7ecd44faf284fbd729ce187a9dde9
SSDEEP 384:nziFzQkUSvkC3sNx8TUNTUlI4c5mgALIK2flBE8noQz7rJv2ICtgL/7IzLIIlv:eFdv3UwgmvuBE8oGNv5cLB
TLSH
T10AC24A76E894DEABECEA8ED5B34A3643EEE04213D69C8AD4DAC91D1C00C71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

6246e524-1067-4bca-abd6-413bb43023e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6246e524-1067-4bca-abd6-413bb43023e0.tmp
Size 414B
SHA256 ca67864b609b8d6f67968363357976b9eb7e126ca0c4881d0e95b28ff38e7e5f
MD5 73286484a418eab6107de75d705360e2
SHA1 0cca1144213b7b87a6b9b59e5d089aac253ccd8a
SHA512 21e334deaec86224c0df9169c9ed388b1a8cd1e2ab3c1692cbfa1bb45d09883e4e6a551e69a83e0c25ce2d3cb7a233844773cb4f433264c88c8c92daf8e98e26
TLSH
T178E022E9CD2AAC3B09FC8B2850541785EA51135B3A90898B773C810D8FF1A76858AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

63eee46b-3d8f-40cf-b7ee-d81800a5b4b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63eee46b-3d8f-40cf-b7ee-d81800a5b4b1.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

785b5182-46d8-41bb-b94c-146bc26f1ed1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\785b5182-46d8-41bb-b94c-146bc26f1ed1.tmp
Size 11KB
SHA256 70b6f786b4954d855755d1e2d848f01b718da1e4b723a3f6df181702e74a0c0e
MD5 5f8c8f99e3ec01eae999e9943cbdecef
SHA1 dfca1cf1bf0db55c7deea62629c9bf12d34ffd06
SHA512 7a36d034f2388b6b9ac64088b0bf2e413bd545b50aec918a67e5288a643cd36b899488dd3d2613f11ae10377a41f255108b75e7732bad63600473d6a3dddf8bf
SSDEEP 192:sxZ6RikA/fWsZQZZWTzodpHUYHW6+WNGYbIHwuYZhIg53QJ:sxZ6bA/fWsZOZWIHHbGFjY7t0
TLSH
T1D242D755AE68A97B9CC7D219BB55BF53E7F91033A0941E48A6FC8A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0d2cdf9d-5e7f-4f85-97b9-fa7760ea666a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d2cdf9d-5e7f-4f85-97b9-fa7760ea666a.tmp
Size 1KB
SHA256 684760f68372f39e61faeba888099d577651954cf9375d141b8f59a0297822f6
MD5 b89a9729429a31b0ea5b63ffa081182d
SHA1 99537bd20c81e3a830302fdffb9c53a28c0e22ac
SHA512 5f6e07858b93931ca23b2da12310bb7559f9143dcbda34a841cde14f75317c1bff6017869c2263788dd932221698d2df213e9b328e342025746def54c6b27825
TLSH
T1D731A0F787B4856E8A0196F0AA14AE2FCE1D0515431C7C9A85E4AF2793E3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

83e41b44-6c52-4839-91ae-1be27eb108d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\83e41b44-6c52-4839-91ae-1be27eb108d6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b0ccbd24-b3e7-4bb8-be98-88b6d40badba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0ccbd24-b3e7-4bb8-be98-88b6d40badba.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6d5f023dd44c36bfd6a57bb0d370e67f562739db158b855e0139c7909650c731
MD5 047eec27a189192a561a5945f0b39302
SHA1 9057a3b5ca164b86cc1c44b2c83127e297288c1c
SHA512 3952c96df3d9d785d1f086743c5a5cdfed6fa9ecfd1a0997b438d6df9fa39b2b5e061882b7f4301f202605990277192231001838a9111e39f28c43b9e7197805
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXWFnr:OtfFvpopPxrB4RhfWdr
TLSH
T1B6B2151571BB021038FE690881B6871F464232733259EA7B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bd27046f-df71-43ac-86c5-a67174f73509.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd27046f-df71-43ac-86c5-a67174f73509.tmp
Size 11KB
SHA256 bed20e6668be214d2548cb6944c7bff2f8836a5fc5aa6092371a220af19a752b
MD5 d6da57bf4e0177abe0e996601ed37298
SHA1 70e1d6e5e4286888773ac4c792ca61cc577c1f04
SHA512 226ac7f9346f14fca6a853f09b77a32d7c66b4a0c7b7a6597e4dff69540d4053855de66b6d68df59062021a1a1741e4c9d9d520ea6e223cb1fb289f4c02f1281
SSDEEP 192:sxZ6RikA/fWsnQZZWTzodpHUYHW6+WNGYbItwuYZhIg53QJ:sxZ6bA/fWsnOZWIHHbGF5Y7t0
TLSH
T1BC42C755AE68A97B8CC7D219FB55BF53E7F91033A0941E48A6FC8A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2bd7002-8661-4d6a-b7a0-699ff91393d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2bd7002-8661-4d6a-b7a0-699ff91393d6.tmp
Size 11KB
SHA256 c2b19602ec22e77d207b43bc63d79e7517b0e2000fdc720c8deb1dfee1fe21a2
MD5 79957261cae7f5e53379380bfd12ae0b
SHA1 c51373e3fab023d0cd2183b8ecaece84e45a9fe4
SHA512 0d8df02a3f17639430873714b95164d650eda48c5bc4e23f0df314a6f605b9f668681cd008efd14716c9be9d1098f96508be1bcf49d5c0208b876821fa258f78
SSDEEP 192:sxZ6RikA/fWsCQZZWTzodpHUYHW6+WNGYbItwuYZhIgjQJ:sxZ6bA/fWsCOZWIHHbGF5Y7j0
TLSH
T19D42C755AE68A93B8CC7D219FB55BF53E7F91032A0941E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8a6ab5e-951d-445b-b884-ce9c0ac0175f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8a6ab5e-951d-445b-b884-ce9c0ac0175f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c90ab12b-666d-4fb1-9a2f-bf7d207fb17c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c90ab12b-666d-4fb1-9a2f-bf7d207fb17c.tmp
Size 25KB
SHA256 d6cf8fb58cd82c3e1da5e407d5b8fc1ff5ac5ba258982861ed4392fd0dcad2c2
MD5 874ba78dad899b67a37b0689bd2ad97c
SHA1 991822f66c3ee525b5cd6fc161e9dd844dfeade2
SHA512 5d9ab35b9ccaa63f07e704da011ef883934676b0b4e9c1c07eced73dc7bb9d01bc3c93f75adbbeb431d0d9666263ee5690e39a6d253f34914c917b5f969a646c
SSDEEP 384:nyiFiZcI63sN48TUNTUlIm25mg5anK2flBE8noQz7D37O6R2Feo4gL/7IzAoE:5FQ639wgSJJBE8oGD37TR6n
TLSH
T1EAC25B36ECA4C9BBECEA8FDAA7097A07DEE40163959C89C0DAC85D1D009359D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2bdfafabe73ddebc86e443e01e9be9846d68f31172d3ddfef2b9f7c2a55e4283
MD5 04610e9e900cb0ca2027e40d210ea146
SHA1 21fd843893736971212b9d65fcc4b5dbda3a821d
SHA512 83738d9402fbc303dfb729196296a8122b71fdc6b2d6b70f6d90b853d879a7198f1a0cd7a6cd372533e90884df41a2d4bec90d1a2a1a837f625fad5d6c128662
TLSH
T107412758B6FA1148B7B76F5AABF6986E487FBC372E1A945D10100E4F0A22B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4496-200-0x000002B2680E0000-0x000002B2690E0000-memory.dmp

Download