75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_2_/Features/x/interface.html
Size 1KB
Sample261024-1tqdqaxtbw
SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{991BA68F-E6D0-4AD5-905C-7FA006A2BCC6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 4908	5544	msedge.exe	89
PID 5544 wrote to memory of 2448	5544	msedge.exe	90
PID 5544 wrote to memory of 3508	5544	msedge.exe	91
PID 5544 wrote to memory of 2448	5544	msedge.exe	90
PID 5544 wrote to memory of 2448	5544	msedge.exe	90
PID 5544 wrote to memory of 472	5544	msedge.exe	92
PID 5544 wrote to memory of 472	5544	msedge.exe	92
PID 5544 wrote to memory of 5112	5544	msedge.exe	94
PID 5544 wrote to memory of 5112	5544	msedge.exe	94
PID 5544 wrote to memory of 5112	5544	msedge.exe	94
PID 5544 wrote to memory of 1880	5544	msedge.exe	95
PID 5544 wrote to memory of 1880	5544	msedge.exe	95
PID 5544 wrote to memory of 1880	5544	msedge.exe	95
PID 5544 wrote to memory of 4780	5544	msedge.exe	96
PID 5544 wrote to memory of 4780	5544	msedge.exe	96
PID 5544 wrote to memory of 4780	5544	msedge.exe	96
PID 5544 wrote to memory of 4668	5544	msedge.exe	97
PID 5544 wrote to memory of 4668	5544	msedge.exe	97
PID 5544 wrote to memory of 4668	5544	msedge.exe	97
PID 5544 wrote to memory of 4940	5544	msedge.exe	99
PID 5544 wrote to memory of 1260	5544	msedge.exe	100
PID 5544 wrote to memory of 4940	5544	msedge.exe	99
PID 5544 wrote to memory of 1260	5544	msedge.exe	100
PID 5544 wrote to memory of 2768	5544	msedge.exe	102
PID 5544 wrote to memory of 952	5544	msedge.exe	106
PID 5544 wrote to memory of 4792	5544	msedge.exe	107
PID 5544 wrote to memory of 4360	5544	msedge.exe	108
PID 5544 wrote to memory of 4132	5544	msedge.exe	109
PID 5544 wrote to memory of 4132	5544	msedge.exe	109
PID 5544 wrote to memory of 3456	5544	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$_2_\Features\x\interface.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffb47e1c188,0x7ffb47e1c194,0x7ffb47e1c1a0
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,17665118469903248942,893448381589863724,262144 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,8681747075437038064,5968791452081598269,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,346065389530978897,7701156941065838391,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:13
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,3499632636596141940,14432121067024630268,2097152 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15271356669752306788,17338851293140651720,2097152 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,16782019076535891595,968664378667197070,2097152 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,17998148021092422251,14796023091654659725,2097152 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,7437799059680354217,15057502385363988040,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,13246566376456363344,14548795691468199764,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7358561212830387704,6797721274754944039,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7358561212830387704,6797721274754944039,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,921107604094983582,11329740769113981671,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16983135551142924657,16312995948371196992,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6591290662403972173,1990314403267123756,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,11840023762261291506,16016949226825526075,524288 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6532,i,696388204274599278,15014329086180889706,262144 --field-trial-handle=2272,i,7348769022401453507,12598971619522217215,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0344a6b2-dbe0-41be-94a4-8dd589ca3743.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0344a6b2-dbe0-41be-94a4-8dd589ca3743.tmp
Size 39KB
SHA256 b549e0274c58f57566676e5b6c1844fd1eba6fa9274e1be5576926ead47de9c5
MD5 bd74b6ab2b2d002c56631bbdb8cbd6f9
SHA1 6b9582ee550e544bed480ad2da0cbcd6797446e7
SHA512 7db8c757117720b3c9852f6da9c5848a0f036fefebe8e330584894a6186b6ae66889d8a6a281a6b4d3d1fda37079453a58bea0971387d553d828943fcfa939da
SSDEEP 768:58/UxvxjgC+h3hrZUSO5Xvx0MIYNa8S5oYklnA+KoJu:/Zj3+h3t6/ATWRdA1oJu
TLSH
T11403B039A9A4AC739CE6A3C4730A6397EEE51223D1C55DE88DEC1F0D06C77AE4703856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28dc2885-c2d2-4996-a5ee-29c9d6dadfdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28dc2885-c2d2-4996-a5ee-29c9d6dadfdb.tmp
Size 34KB
SHA256 fd418892ea362451aee1671edfcbd3d88515d1d87fbd4cdaff0c4dc816182af4
MD5 c631b8b2455396daccbab6e37ff797a7
SHA1 91d97948c82155f821d62479c400ba47f6843a2f
SHA512 0cce300dc46617b1fc4cabfd626f0edcc70c82bfa9beeb5101d75e1bbbceec3a808726e146d9ff8445bbe2422f1787f0b9d852992a2626a64d1a370fc940e153
SSDEEP 768:j93htMUSO5Xvx1MIYNa8S5oYklnA+K6YUMLV:j93Hv/lTWRdA1jUMp
TLSH
T1C7F2AE3598E5AD73CCE693C0B20A7783AE905213E1985FE8C9DC2B5D06C76EF5707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

521ad4ac-d7b9-40d1-9a0b-a177a403c11c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\521ad4ac-d7b9-40d1-9a0b-a177a403c11c.tmp
Size 38KB
SHA256 3c82ef3269cf17ffa8c0c1745a200161412be6233cb4acc7fe1cde434df58e14
MD5 542a319533d146a8685ca25151c90b65
SHA1 e43950e27d4e9f09f883a63075b171a8391598cd
SHA512 04e76a8750667b76607fe9b770c58f78602664054fff91b0bd3fb4256f6c21835cee61c06cb1d4e185bf89f225e52a0467e862f35687ec7335462dbdad96d434
SSDEEP 768:do/UxvxjgC+23hfGSO5XvgJMIYNa8S5oYklnAacSH8L4:nZj3+23hS/gHTWRdALS04
TLSH
T1D603C0399DA4A8738CF663C4770AA357AEE55123D0C16AF889EC1F0E17C73AD5303456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58e6a21f-1cfd-40cc-9c0e-7a9a50d1b3af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58e6a21f-1cfd-40cc-9c0e-7a9a50d1b3af.tmp
Size 38KB
SHA256 b71bd27626f3334bfd7a663051366481ca797b09b1a7deb771a74718af48c9f8
MD5 3754d6b2336a1e268581d66fbf7deece
SHA1 92af07629b8cb8772592352dbcd1f859e88ba887
SHA512 7fed7a68f1da8c89d5822843d42d1c3308f579cf2b98697709678dae44135d502cedef5549ebdf1df5e57699a84f670fed191a92a62e48e0493264d77401d4c2
SSDEEP 768:dI/UxvxjgC+23MlCSO5XvxwxMIYNa8S5oYklnALKSH8L4:TZj3+23n/iPTWRdAeS04
TLSH
T14603C03999A4A8739CF663C4720AA387EEE55223D1C56EF889EC1F0D07C77AE5303456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

12e3157e-b74c-46fe-a8d6-f008fe963ba3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12e3157e-b74c-46fe-a8d6-f008fe963ba3.tmp
Size 10KB
SHA256 806f59bf61a00b86d72ec692ebf5785de52fb539b65faab856733fff32797790
MD5 41b42894018ac825eec643ba72ef27b3
SHA1 5126900f362e45b3a793948219c3a02ec5ffe224
SHA512 9f40ec5cd2798bc9af3fca9c39ad30c0c824481ef265ab67212e679b5428aa7d2a26cad881781017f39a7dc915abf12b6dd906b18b0d569540868d6766e27d88
SSDEEP 192:sxRQRfbR/fPsE/zoA8p4//g6+WNIYueqiPGFIgDfJ:sxRQNR/fPsEW2/5Iv1
TLSH
T15732B855AE68A93B8CCBD20DFB55BF53D2F91032A1D11E58B6FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

508aa8fd-80e1-4e5b-99df-9c2c6e76af51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\508aa8fd-80e1-4e5b-99df-9c2c6e76af51.tmp
Size 11KB
SHA256 2625984642ed161c38496c2b9da2596a47fd47474339f4b7d2c5ee9332b4b6dd
MD5 75363d68a0a3bf056636c2b62b8e94b3
SHA1 21ef2a5e7215ebc58db0c2f21e7238f3b725bfde
SHA512 8d2155f2e6d797eadc3c61885fc5bef7dfe1447ab058d906a5d3feb6316cc04a261dd9b516c65edd246b6012382a8fb25ffd9f2b38eafc3c721cf1e527239461
SSDEEP 192:sxRQRfbR/fPso/zoA8p4//g6+WNIYuKEiPGFIgDBJ:sxRQNR/fPsoW2/5Ijv
TLSH
T1FE32D955AD68693B8CCBD20DFB55BF53D2F91032A0D11E58B6FC9A1C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ffa0498-2052-4a6a-9f40-cf61c0ea91a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ffa0498-2052-4a6a-9f40-cf61c0ea91a8.tmp
Size 23KB
SHA256 d3e36c393d2c76f1b949a566ccfc3ec964a4a8dca099feec92c764b89abc812d
MD5 3d3872acb3eaad2b15c3f73b1191e0ae
SHA1 2fbc6fc45310fc3e35ef6b3aa7112290e984dba8
SHA512 48788510b041eb599821dac9a0ade06fc27ae3e19d12eb61b5dc0925d6dfbb6d12eb34d61895a06ebcd16b407797eb23c119724a9348cac501300baf86de3e8d
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6LrocbV:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VJ
TLSH
T1E2B2EA2B644CCB7E9FC00AADDC196FDB6D9802C796988D4047FE994C03C77EA911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 a98f934eb7b1b24974f4d5a241599d0161d2b20859975e52f3a20f40ccf2316c
MD5 7dfe76fe1d9f7da70829d776c1ca0229
SHA1 e385afb643dbb28f313c63275ea4ead5fceb8df2
SHA512 d365a99337a9171b46ce07287a580ecbb75582f31c99eafa045645460b18e66fe92be56c4df52226d31e342990c566e5122863ae2609a3692ea0acec4e4dd5cd
TLSH
T10F51B69686D14E97FF540031B7D48E673637BE8E5B833F120154D6BE6A4AB6041BC0CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 78bacc2a3585be45483096e94bf170327ccc17f2a97da71b8108ecfacf1859a3
MD5 f73bc9a47c23250d4e4c8ff4c13561cb
SHA1 1e52d73d5dcdf4e78201fdaf2aef6fb5340783b0
SHA512 f90ff0f3c4784cc8370b5f812f86a9cc2b29805e0a8f22d4877180610cc322abbe7bc4cb5e9af57c8397948092aedb83e19267834d68e932a0e739b6eddfd9bc
TLSH
T15351A59686D14E97FF544030BBD48E673637BE8D5B833F120154D5BE6A4AB6141BC0CC
MD5 SHA1 SHA512 TLSH

Submit Download

b9eaa433-da67-411c-a75c-2227e709d9c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b9eaa433-da67-411c-a75c-2227e709d9c9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05bbe2f5-efd0-4b65-a079-4af78e570d2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05bbe2f5-efd0-4b65-a079-4af78e570d2e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

1030939d-7165-4955-b49f-71cbf5e7d5b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1030939d-7165-4955-b49f-71cbf5e7d5b6.tmp
Size 1KB
SHA256 fa78407984bc019cdadf5255337beae53f26da28b48811e7eecf66be45d75753
MD5 eeb2e48f7f5fcbc93a980fa41ffe825a
SHA1 de528bd500bc8adcf3381b3d2f860b4b3249c88e
SHA512 8c16b46223cd62495f3dc692d559a5fbd72d901ad9b59c89f60c8fe3df52ddc5c0f5253c6aa54cf03881329e375d1230cc2ffb196d722f7e4a925a0c9a1065ae
TLSH
T19931F3F387B4857ECA0196F0AA14AE2FCE2D0511432C7CA685E49E27D3F3472E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

ea505736-3d1e-4ddf-b132-4dd123b600ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea505736-3d1e-4ddf-b132-4dd123b600ab.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a7926aab4dde3777f4e2a97f823e111e68023ee502c9f71154357526300a15f3
MD5 faf8bf6cfeaf4db05d2395d7cbf5d845
SHA1 e83adbf625aca6fd4021a26e9889f319c04b25e4
SHA512 ece79c0c36f327b9f6e0c39e3f455f3a499e80769833665e54ee53f8d84c73a84dfc11150073bf99377cb077efa4da4711bfdfb8b4d912db9645e3f6ae835a8c
SSDEEP 96:KoWlWKmcK6qcK3qGViJF/LPQbTsDdNQKVFd3QJ9x:TNvcC
TLSH
T17F91FE35323A0A41797F650882D5A72B8641316B3029F52B7FED5162DF3AE481CFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e9348879-88fb-4335-86f0-0241d9e0c437.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9348879-88fb-4335-86f0-0241d9e0c437.tmp
Size 10KB
SHA256 d221f72d2d7d827d4137e4a675dcff387a965996ec4392e72e8709f9457e5087
MD5 648631a21a7670243e764cdcf7ea60e2
SHA1 119b92dded918acc8bf23617278cd1993f76c6c6
SHA512 2ca5824c60e2bbddead9cb03a0c1d17b252edf48235a041794eb78d0160dd3bcd58be5c88e3861e3d957f78906574ee58ae2c5751cfdaa2e4240538fb0cef72c
SSDEEP 192:sxRrRfbR/fPsW/zoA8p4//g6+WNIYueqiPGFIgIJ:sxRrNR/fPsWW2/5Ivs
TLSH
T1BF32A7556E68A93B8CCBD20DFB55BF53D2F92032A1911E58B6FC961C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdec538d-6fb6-47d0-b6ca-c3cdf18990d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdec538d-6fb6-47d0-b6ca-c3cdf18990d2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6da15542-6d3b-4233-8098-84fba7150ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6da15542-6d3b-4233-8098-84fba7150ff8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0d8dce9-f157-4540-b1a6-ba53cee4c0b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0d8dce9-f157-4540-b1a6-ba53cee4c0b1.tmp
Size 34KB
SHA256 490747504ef0bf7db48b2a208e53c86aa5a3ad5be6e1909bf1114c82e0014f5a
MD5 efff4b610d8b583cc964cfd811de0ad0
SHA1 64279959a7a596805d174c3214f184f781f25573
SHA512 0a48ef3dcdabb9635bf807ce4797dd71555b46970efd4bd3bfe05353846f025dad6043d778c3f282c4ad2fed7c034a3ff4b86d0c55ca6328028c81ea0b481127
SSDEEP 768:5B93h4MUSO5Xvx1MIYNa8S5oYklnA+K6YUMLV:393ev/lTWRdA1jUMp
TLSH
T1FAF2AE3598E5AD73CCE693C0B20A3783AE905213E1945FA8C9DC2B5D06CB2EF5707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb171ae6-ebbc-4c7f-811e-6fd0786ccdfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb171ae6-ebbc-4c7f-811e-6fd0786ccdfb.tmp
Size 36KB
SHA256 8dfdd0d6934c7e82723f4fbc93f6589805a384a8d601f28e1b62fdf9db6b83ed
MD5 428eaa2effbf1b82dfdd5ff5076f1ab0
SHA1 c5453e3a90aea3190dc8c4adbdd0d7c1854adaaa
SHA512 4c0845b139f5f3ee68edc5430386638c512f376b87cf3b7ecb30933413c75e288fc6a546db0140112dd68a034076ed830501ba33a54e0a8d34c3afff2986a1c5
SSDEEP 768:nFdY3hNwgPMUSO5XvxQMIYNa8S5oYklnA+K6YUMLV:3Y3Bv/YTWRdA1jUMp
TLSH
T11803AE3698D4D977DCEA97C0F60A3342AEE05223D5949EA4DADC6E5D02C72EE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1667c976-3ee4-4917-a7d1-9c36f69067f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1667c976-3ee4-4917-a7d1-9c36f69067f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download