72a13f85d46ba9e3389a039b49d3a4ac24e81e84020d3a9bd775c6a0c6621d0c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
twentytwentyfive/parts/footer-columns.html
Size 64B
Sample261027-28ca3shs8n
SHA256 72a13f85d46ba9e3389a039b49d3a4ac24e81e84020d3a9bd775c6a0c6621d0c
MD5 2f43c9be8afce24bbdb1e0a014497041
SHA1 0338423fa45cf80b898add206b2695c147627893
SHA512 7dd4bb65ce3529cacc88c158f65a4304cde4515c06f57965aabc1a5b2cb02bf085b3b61033a2a5b6cc1db24a36eb747e31f519c7c10adf5f15aecbccdeb14089
TLSH
T19DA00222BD8485B05651250EA744D0A0AB998076DD95469E75CCC952046B905096050B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1676	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{A9DCBF38-5E80-473C-A75F-945C458005F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 3736	5912	msedge.exe	89
PID 5912 wrote to memory of 3108	5912	msedge.exe	91
PID 5912 wrote to memory of 1676	5912	msedge.exe	92
PID 5912 wrote to memory of 3108	5912	msedge.exe	91
PID 5912 wrote to memory of 3108	5912	msedge.exe	91
PID 5912 wrote to memory of 2772	5912	msedge.exe	93
PID 5912 wrote to memory of 2772	5912	msedge.exe	93
PID 5912 wrote to memory of 3900	5912	msedge.exe	94
PID 5912 wrote to memory of 3900	5912	msedge.exe	94
PID 5912 wrote to memory of 3900	5912	msedge.exe	94
PID 5912 wrote to memory of 1816	5912	msedge.exe	95
PID 5912 wrote to memory of 1816	5912	msedge.exe	95
PID 5912 wrote to memory of 1816	5912	msedge.exe	95
PID 5912 wrote to memory of 236	5912	msedge.exe	96
PID 5912 wrote to memory of 236	5912	msedge.exe	96
PID 5912 wrote to memory of 760	5912	msedge.exe	97
PID 5912 wrote to memory of 236	5912	msedge.exe	96
PID 5912 wrote to memory of 760	5912	msedge.exe	97
PID 5912 wrote to memory of 760	5912	msedge.exe	97
PID 5912 wrote to memory of 1004	5912	msedge.exe	99
PID 5912 wrote to memory of 800	5912	msedge.exe	100
PID 5912 wrote to memory of 1004	5912	msedge.exe	99
PID 5912 wrote to memory of 800	5912	msedge.exe	100
PID 5912 wrote to memory of 3140	5912	msedge.exe	102
PID 5912 wrote to memory of 4740	5912	msedge.exe	106
PID 5912 wrote to memory of 2064	5912	msedge.exe	107
PID 5912 wrote to memory of 3680	5912	msedge.exe	108
PID 5912 wrote to memory of 2268	5912	msedge.exe	109
PID 5912 wrote to memory of 2268	5912	msedge.exe	109
PID 5912 wrote to memory of 3256	5912	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\twentytwentyfive\parts\footer-columns.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffb0427c188,0x7ffb0427c194,0x7ffb0427c1a0
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14465031883711247305,7938541482576935068,262144 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,5032234799743157991,10768284339398154547,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,14215399813953350797,7711989469945825318,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3292,i,68466414616602802,13106128724520849188,2097152 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3832,i,9317341192187043743,3695934690653406008,2097152 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3896,i,1371911065756079795,11549265546932226033,2097152 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:9
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,13807772036440230489,842819380322769521,2097152 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,16548950839932581926,7344167285219677025,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,9675991544278240609,9716682219266606095,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11869152815561873438,796423407400295253,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11869152815561873438,796423407400295253,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,9189018545592059050,5374786948855355655,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,8060647746230301396,8441807643959836580,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,11752406690641683973,897341763556837303,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,16932135078625606185,15788344129207738578,524288 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,5151693299455018800,7491212771698389789,262144 --field-trial-handle=2332,i,10747005446584087248,10147949300150347006,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05043cba-e8e9-413d-98b7-858302f3f2ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05043cba-e8e9-413d-98b7-858302f3f2ab.tmp
Size 34KB
SHA256 d7e084107a60c880118c6eb94cbb032b813a24d98cd729a99ab59cf473cbc8ae
MD5 d4c3195eae518a1e1755c071de799676
SHA1 d06ab64f0f0cdf0fd1e265d1dd88827c7c2342bc
SHA512 556a12c4298173c0b3d95303f683487bfa3f25a62041da3ddfee4177c941a7aaee4cb50adbc6656f74afec1d3844aabf2b79d49deddf84ba82c5af990ebb92d7
SSDEEP 768:1039Ylg2wOUp0O5fgGM1TnXMqOas6hU4LG:1039YJ8fgt1TnxOf+U46
TLSH
T16FF2BE35EC99AD238CF2D280F31A7652AEF18157D6841F98D9DE7E1C05CB25E034B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14ca5299-3da5-4968-9ff2-63841a3d4566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14ca5299-3da5-4968-9ff2-63841a3d4566.tmp
Size 33KB
SHA256 eb5f3e9005302d540d82aa8b81c3c20d40f2ec084d6fac3eb9b99f3ca6b693f7
MD5 cbe2b7fce8603ab5e2b37e5620d0f0a6
SHA1 4d8a13c3200b279452aad0e20ba521c257757dcb
SHA512 5d65408b75f2c29907c3721c0812ef118eac981671ca4209443a2149cd5be6e450bee6f092371273a40383f7c4993af26e15bec601aaa39c5ff83daac20fd35f
SSDEEP 768:i036Ylp2wOUp0Z5fgGM1TnXMqOas6hU4LG:i036Yubfgt1TnxOf+U46
TLSH
T115F2BE35EC99AD738CF2D280F21A7652AEF18157DA841F98D9DE7E1D05CB25E034B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51d51a6a-b77b-4818-b702-b9fc0b2bdefb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\51d51a6a-b77b-4818-b702-b9fc0b2bdefb.tmp
Size 38KB
SHA256 a398e5f2aedf9d108eecada88f72f79ec1f4f0110edf21b6acfd9cdadb573a14
MD5 f01944cf3c0ff93256131aa11877566c
SHA1 b520b1091974d278fc5fcadeda786d17202d2e6d
SHA512 7c13c6a97c49905f49287d99db476b4ebc62b11b664008ad44b96752a0118fcc96b88230eb1d91826ee8f911fabe51b38675481e2d93a4a44ee8592c5d0d1eb0
SSDEEP 768:4/UxvxjgC+930YwOUp0u5fgGM1TnXMqO/sAaP8:FZj3+93hcfgt1TnxOEAG8
TLSH
T13003C036AD596C639CF2D384731EA257AEF544A3C5C51EA889ED2D0D06CB35E430BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8988b5cf-f234-481f-8f0f-e402fd24209d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8988b5cf-f234-481f-8f0f-e402fd24209d.tmp
Size 36KB
SHA256 f015f516b7db536ce2ce4fe3cea9eb80cb2ea3d1677355097160117a2d31b6db
MD5 88032e22b0dc87115c75fc794353847d
SHA1 4c8780ef6d03b5c8070a55b5bc237e3a895fa614
SHA512 2e0fc4541bc2362270572360575d715339321d60b510380c02faf099db2d8b79806775f9d9e75255aca9984d8734d47824b2f1a0709a4aae9feb6fadb9716078
SSDEEP 768:mFdQ3YwgoYlg2wOUpo5fgGM1TnXMqOas6hU4LG:2Q3TYNfgt1TnxOf+U46
TLSH
T14EF29E36AC89D9779DF2D780F61E7252AEF18157C9852EA8E6CD6D1C01CB29E034BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

5fdc9997-bfdc-4d5b-99fb-a3f43fa91e25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5fdc9997-bfdc-4d5b-99fb-a3f43fa91e25.tmp
Size 11KB
SHA256 34d41ffba5d55f9d2477738b0334eb49828dc1b2cd89d216f1dd1ead902b1caa
MD5 c7af34528c1623ad1531c294e99baf1a
SHA1 1466a217e720f45f1e3c2d29991e595880771128
SHA512 413023cad1497e37894f83bbe5a064b68151a545a8019ed33f4949a8036e82bc68caa6a6b7ba7ad403e7b4af32957c78e5658aadb337e884680c2f3dd0d76900
SSDEEP 192:sxRWRPbU/fxszqXzoA8p4Af/g6+WNIYRLFD3jIGlIgIJ:sxRWpU/fxszzTf/5IuNs
TLSH
T19A32C815AD28A97B8CCBD21DBB657F53D6F91032A0D11E48B6FC8A1C14EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f54b31b-906c-4aa7-9b86-438be43ec0ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f54b31b-906c-4aa7-9b86-438be43ec0ac.tmp
Size 11KB
SHA256 3e3462ba54b44987b005c7661736223a6c95e51f14b6d47e03545a812d5a84d6
MD5 7b3f30cd6b57dcac70a9adb7b8431bf8
SHA1 53979ef65209ba13701807e913f5afdf895e3837
SHA512 baa70268207b363000177079d13b9a4c6773cea05a836d9d0e59c28029694a62207e43deca16fc7f41bc8c27898867902606d7afef2bbf44328bd0926933b200
SSDEEP 192:sxRxRPbU/fxs6qXzoA8p4Af/g6+WNIYRLFD3jIGlIgDbJ:sxRxpU/fxs6zTf/5IuNR
TLSH
T14732C915AD28A97B8CCBD21DBB657F53D6F95032A0D11E48B6FC8A1C14EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5f8f9925ce4a9fd79143d48f8fe0af80a878252a04ee793d92b34a289e2daaa3
MD5 bd6b0cb948a4f64dfb7bb4a1c42bc6c4
SHA1 746f0e425408983bdd63994304119f08491f52f6
SHA512 0cceadcc1b407d1020c76ac473956c4d227f15fe60968578d3581f16179c29443d6332d47964aec678cda915abd74fb344232468206670adbed5ec1a479dca09
TLSH
T1B761C9504962A086F7B99137D5CC2CD33EF9F69782633E5D879CF6B8644E3191960C08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 95237131702379b48ad9ab1cc1b14b2bbbcc0a5a217ad36b6c716179cdb1a016
MD5 7298e4775fd7e35f61abfd4f2a7f6297
SHA1 ac1c179f378cc1dc651bdf75e5d62fa79f671923
SHA512 ecb1f299fd141154a223590304d07f03d3aebcfc16b0bb5827c927c380b9e29bdc164d06c7711ae42731bf8631d565aa0bd3b0889aec65b459634b1f116996b7
TLSH
T12B61D9504922A096F7B89137D4CC1CC33EF8F69782633E5D879CE6B8644E3291960C48
MD5 SHA1 SHA512 TLSH

Submit Download

43b914ae-ef25-4bcd-8e54-b9dc81ca9a40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\43b914ae-ef25-4bcd-8e54-b9dc81ca9a40.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

23181087-937e-47dd-badb-f5b0e951dccb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23181087-937e-47dd-badb-f5b0e951dccb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

5fef9254-68c4-4dc0-86ef-6cb848fba75a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5fef9254-68c4-4dc0-86ef-6cb848fba75a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6e585b45-99b8-4f4a-9dc1-8649478013cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e585b45-99b8-4f4a-9dc1-8649478013cb.tmp
Size 1KB
SHA256 122119da672ee0727ee67b7b880478ff49062595410370f52ecb5438d70902bc
MD5 0ff56131bc403683a7f55ba090151dc7
SHA1 b76e41211aae7de75aef8edd9e029244daa5d475
SHA512 b838dca7e6490418b93d9293c184bf1c3b28f053ed0eb88136dff707cc34a26d376a85ceacc266a14fc1044e8d2d654a5b1202864a5b14beb5ccf5c4e25b2317
TLSH
T10B31C0F383F4856E8A0186F0AA14AE2FCF2D0515431C7C6AC5E4AE2793F3472E041A6F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ac8f925b-03c1-423e-8292-5792157141f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac8f925b-03c1-423e-8292-5792157141f2.tmp
Size 11KB
SHA256 adcb8c5724247d225778a309f031893d7a4ea877a1436ea411834d493aa3ebe6
MD5 ded757b1c8be94263f0fc48fe3534191
SHA1 4ae45b199f20a7c58611e7a27275e7de24bff5e4
SHA512 6d0a4967cb9010185de2c085dd96f9d1e8cb15a25603119766f0fd1b35a3cb212b3f97c3abd64cc8841e82bc67f39378ffd02f8189c82931a4fd197876ad416f
SSDEEP 192:sxRxRPbU/fxs4qXzoA8p4Af/g6+WNIYRLUZ3jIGlIgDtJ:sxRxpU/fxs4zTf/5IDN7
TLSH
T16F32D919AD28A97B8CCBD21DBB657F53D6F95032A0D11E48B6FC8B1C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9b57443-b91d-4632-8a43-1f64d948624d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9b57443-b91d-4632-8a43-1f64d948624d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc590595-9ebc-4917-a413-cbd5756529f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc590595-9ebc-4917-a413-cbd5756529f5.tmp
Size 23KB
SHA256 4f850d2312a645d51ef49f1793bdfd9e69b9d77efbbbc2ed8647a651bf8f5770
MD5 d42cf52adb09a4f3254a461ac04eb165
SHA1 cb00ef212310d783df8b622f3935bd98071b8959
SHA512 c0d58efebb4d1f59a12a1f329ce2d21eb6fcc8cdf936ad650128c5a011292c12699e55c2a447867f1be771e73907a93f262d3f02b44724558e3fb5c259f53028
SSDEEP 384:Ua5g+TcfCtgflFfXHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRkZroqYi:UEg+TuWgf/fXH8F1+UoAYDCx9Tuqh0VB
TLSH
T168B2DB2F644CCB7E4FC10AAD9C1AAFD76D9802D797548E4047FE994C02C77FA921A4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a09c95a-499a-49cd-b483-4e92a8d4fd26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0a09c95a-499a-49cd-b483-4e92a8d4fd26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d293a53a-6a00-49ca-b66a-d3dcd3ab0d42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d293a53a-6a00-49ca-b66a-d3dcd3ab0d42.tmp
Size 37KB
SHA256 19fb3be5df0be13c21380c10f5b08112b295218bae9128add851e5b14db2fd35
MD5 184ecdc3db22570cac1226b433032568
SHA1 20fcfbd17a93caf49e34ccb82f3af87bb7cdca22
SHA512 40bf4203dff2745a59f5e88fc03579b5b45531e776ff064ad998cba8b3a9d27a648cec95e11717f86098848738cccb4a94156c44e2722b93ded779d1dc9d8d55
SSDEEP 768:5/UxvxjgC+938BwOUVu5fgGM1TnXMqOebAaP8:sZj3+93Fcfgt1TnxO8AG8
TLSH
T1CA03BF36AC556C738CF2D384721EA296AEF644A3C6C51EA889EC2D0E02DB35D430BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21b0838e-d5fc-46dd-81db-68b481c9c4ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\21b0838e-d5fc-46dd-81db-68b481c9c4ef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download