5f66ec63899ce500050a931d99fccc58cee0b6d9058e769e0c70438a757da2fb

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
twentytwentyfive/templates/single.html
Size 1KB
Sample261027-28ca3shs8n
SHA256 5f66ec63899ce500050a931d99fccc58cee0b6d9058e769e0c70438a757da2fb
MD5 d148deef805d62d64b4556b4b6d061b1
SHA1 6daedb0115765d3682a1fae3e9d125afda96ce99
SHA512 c45fadea328854b65ff1222b74e41311b9eabc095b52c24d2f60beb33a5a494bd6cb0ccb000fb15e059918920ec762738c234668e37cee66daf29b31a601df25
TLSH
T16931C0A25980CFB6493B05DFD18C70F59AA509BFCA4A9ADF42EC4A035DDED68163010F
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{596B55E5-DEEF-4BE9-9F13-4CE09DDB1B76}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 5272	5128	msedge.exe	85
PID 5128 wrote to memory of 5860	5128	msedge.exe	86
PID 5128 wrote to memory of 6124	5128	msedge.exe	87
PID 5128 wrote to memory of 6124	5128	msedge.exe	87
PID 5128 wrote to memory of 6124	5128	msedge.exe	87
PID 5128 wrote to memory of 1700	5128	msedge.exe	88
PID 5128 wrote to memory of 1700	5128	msedge.exe	88
PID 5128 wrote to memory of 2896	5128	msedge.exe	89
PID 5128 wrote to memory of 2896	5128	msedge.exe	89
PID 5128 wrote to memory of 2896	5128	msedge.exe	89
PID 5128 wrote to memory of 3356	5128	msedge.exe	90
PID 5128 wrote to memory of 3356	5128	msedge.exe	90
PID 5128 wrote to memory of 3356	5128	msedge.exe	90
PID 5128 wrote to memory of 4896	5128	msedge.exe	96
PID 5128 wrote to memory of 4896	5128	msedge.exe	96
PID 5128 wrote to memory of 4128	5128	msedge.exe	97
PID 5128 wrote to memory of 4128	5128	msedge.exe	97
PID 5128 wrote to memory of 4264	5128	msedge.exe	99
PID 5128 wrote to memory of 4608	5128	msedge.exe	111
PID 5128 wrote to memory of 2140	5128	msedge.exe	112
PID 5128 wrote to memory of 2372	5128	msedge.exe	113
PID 5128 wrote to memory of 1164	5128	msedge.exe	115
PID 5128 wrote to memory of 1164	5128	msedge.exe	115
PID 5128 wrote to memory of 3944	5128	msedge.exe	116
PID 5128 wrote to memory of 3944	5128	msedge.exe	116
PID 5128 wrote to memory of 2936	5128	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\twentytwentyfive\templates\single.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9e55dc188,0x7ff9e55dc194,0x7ff9e55dc1a0
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,311387460506550272,16746910117402167738,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7790027339888970208,2960651854669245143,262144 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,7918182987170929016,1702781221650600173,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6109250869050001215,17933648150291789582,2097152 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3577088141814368343,9254608115904001204,2097152 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,15285370149633260178,17322268984679939408,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,5896381561638463599,14650699137003676893,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2627512786680007425,1288850349923760374,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2627512786680007425,1288850349923760374,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12480811359599936097,5109022729437102167,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,3763858953931359661,12993921083408586299,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3106382826296024829,14973819614456876989,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8235288698483640899,6182227871262081312,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,5909803463741717140,18016004717413840285,524288 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5024,i,14655772347295788121,13607613447917706886,262144 --field-trial-handle=2248,i,4555519195219785609,1347504556340376387,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1354a30b-248d-4602-953a-10c8cee389fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1354a30b-248d-4602-953a-10c8cee389fd.tmp
Size 26KB
SHA256 48494c4d625e2d4aaae5ab025a89019203abb0daae64fac52807b1e1df5a7787
MD5 0332d7a88598205cc7d8880cbe1d6f8f
SHA1 28539ac29f239dd7a60272313d27577b164367a9
SHA512 88dc299f56843230ffbe68801c24f253ac5a4665e9fc29c2c01ed7cc35936a3f9bec8f03376ef8f30dfe7fa4ad8c90eedb76b76f09197363158b529c601e2d3b
SSDEEP 384:nWiFzQkUSvF3sNw8TUNTUlI4K5mgNzeqK2fMBWCk/BEOJdAG2IqMtUSgL/7Iz/I8:9FdF3twgk0eTBnzSAG5/U+L7
TLSH
T176C24A36E898DEBBEDE78B91B70A3643EEE04153C69C4AD4DAC95E5C00CB1DD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50c55be1-c5b6-40fb-a680-8e8d40f9af5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50c55be1-c5b6-40fb-a680-8e8d40f9af5d.tmp
Size 25KB
SHA256 7f5f21d216450c7f23e1fa81bba7b7390442159d6b8d6ac9969e006c65fa0f5a
MD5 801af2d21f125e32c4eb78b95e2de0b1
SHA1 f50332505d6e8d0b6a61d1c4ceeae2b8f1328fec
SHA512 ff7ddc8f5a5fb324f93f99a2881e3f2eaeee74367fa5793774bf7781f867cf2dfcd0edabf66f41942a6742f3432cb51c9a633d7cf6bca3032dd1b5eb5930c386
SSDEEP 384:njiFiZcI63sNbZ8TUNTUlIm25mg5anK2fMBWCk/BEOa67O6R2FeoggL/7Izcop:OFQ63wwgStQBnz567TRyC
TLSH
T17BC25C76EC98DABBECEB8F99A70A7A07EEF00163C59C49C0DAD85D1D008759D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85e10454-8af0-480d-b5b7-aebbcd4fa962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85e10454-8af0-480d-b5b7-aebbcd4fa962.tmp
Size 26KB
SHA256 2c3c40e748ac57325656145b5eb50611b204247441e491ce98a2aa11d84f64b0
MD5 938598db9224073092dd8082c49f2ef7
SHA1 05fd17ec6b9fac3e5756737f9c3aa98d70ea3e8d
SHA512 1b3933cbd851ccd074eeac475bc3e720d64b465effc2031d5e9c81d1bd1113d251bd2575a4cb8f1cb91a87364c276863683abc7a9202cd92030e5fb7d81803e5
SSDEEP 384:n3iFiZcI63sN08TUNTUlIm25mg4ZrK2fMBWCk/BEOJdQG7O6R2FeoggL/7Izcop:yFQ639wgSlEBnzSQG7TRyC
TLSH
T1FDC25C72EC94CABBECEB8BA5A70A3607DEF04153C68C9AC0D9D95E1D00DB59D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e0522d3-bd3b-4f53-831f-8e533b15ceee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e0522d3-bd3b-4f53-831f-8e533b15ceee.tmp
Size 27KB
SHA256 29bf674d1449725f5e2344d77ed2ffeed955e2d0c059f14a765cf64e8466e318
MD5 f32a5fb088164b5d82e8c9b2bd79683b
SHA1 39826e5afeb276decc4fb7e78b1dc578fbe9435a
SHA512 25f2ee939d1a8d2d28ccb7d881f3049378fa63ce3c0d4ec3af6f3c14cede30c29902fba5f43be805a62fe224fd4a8381836da25e3f3ee8eccb82e331ab78d43c
SSDEEP 384:n+iFzQkUSvqE3sNw8TUNTUlI4K5mgNzeqK2fMBWCk/BEOJdNG2IqMtUSgL/7Iz/f:VFdb3twgk0eTBnzSNG5/U+L7
TLSH
T1A8C24A36E898DEBBEDE78B91B70A3643EEE04153C69C8AD4D9C95E5C00CB1DD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

00f9b1ec-6f52-476b-b458-8738b30f1cea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00f9b1ec-6f52-476b-b458-8738b30f1cea.tmp
Size 11KB
SHA256 0fe334d1e4aee303d738b00de8ec58503277de945fef80bb1e892b8c2e5e7c96
MD5 ea4f198590ecd2608f8e676fe30053ec
SHA1 9222f52e7eadc69fad736b5a25fa791b65e0872e
SHA512 b431f75b93449857746c003388075270df42bdd8b4f3c54ffaaabc0465b8761eca6775f8601e850d3e6a2cc3d7a6df9d91102526de1c7a1d642e46fd73a46669
SSDEEP 192:sxZCR1Tk2/fbscQZZB5zodpHzHW6+WNGYbIt/rY74IgjfJ:sxZCM2/fbscOZByTHbGFlYYjh
TLSH
T19942C8156E28A93B8CC7D219FB59BF53D3F95032A0951E48A6FCCA1C14EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ea0012e-763f-432b-a0d8-4233abf8b8a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ea0012e-763f-432b-a0d8-4233abf8b8a4.tmp
Size 414B
SHA256 ac2f8567cb8674b9a730ab3f5fc59aa8acb7e285fb553ed7c670baee7cdf215f
MD5 d8fc06e3c64cd6f3a6515e37da8a92ff
SHA1 b1fc6568ac66e4c783b9cde197594b157ae91d6a
SHA512 b1feba8f8e56b3ba797fb2d583ca073139b39886c535e4c8b565e33e99bce8a95ea289d73aca2db15f58eb6ce2e156f3f53c8d6a5eba398ecfcefb001c5d2977
TLSH
T104E02BF9CC55EC7709FC176890680645EB41074B3A80848B773CC11D8FB1A37558696C
MD5 SHA1 SHA512 TLSH

Submit Download

41a1e1ce-22e7-4577-861a-a974974a581d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41a1e1ce-22e7-4577-861a-a974974a581d.tmp
Size 11KB
SHA256 2a7f08c1299d775b5aa83385f930db7b201e5024657bd715591111d85f3cfb1b
MD5 2d0e3a893582bae01a7a859c93d316b1
SHA1 ba8160c84ca3679cbaeaf7af5a8864c2faccdb6a
SHA512 2de8e9c6aecb8de03b4120939a91191ae753795e1226e364efece3a570f8f2661980aaeae1d507078dc5b714a4f57d7f05589f950fae450b440433c6d47543fb
SSDEEP 192:sxZCR1Tk2/fbsZQZZB5zodpHzHW6+WNGYbIt/rY74Ig5dwfJ:sxZCM2/fbsZOZByTHbGFlYYzwh
TLSH
T1AD42C8156E28A93B8CC7D219FB59BF53D3F95032A0951E44A6FCCA1C14EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81935f11-5794-46a9-9a3f-38bd0884d2da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81935f11-5794-46a9-9a3f-38bd0884d2da.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0f5fe0d6734973913b2452bde6fc75560fa6eeb2de7c252c8e1b26165f8b9767
MD5 222855a5208304dbaede7006ea7c36e9
SHA1 2b88d654136822b380b24b300c19e09bff47b086
SHA512 af2e65e930464579395e0c105f6a254350506f7818b9a97afa5df2699cb631da93e240b1e7f3850ccb6f04b5af7de5c3f231b62e0cafb37c81c390d384043921
TLSH
T1A9E07D8D15CAC32FF30874C7016C438C8382361FD3F0691E2708C989708F164B3C66A0
MD5 SHA1 SHA512 TLSH

Submit Download

28f6b3c7-f0f1-4a72-a444-3e7024b35174.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\28f6b3c7-f0f1-4a72-a444-3e7024b35174.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

82a8afbe-966d-4981-ac97-234b2175e320.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\82a8afbe-966d-4981-ac97-234b2175e320.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9c3b25ba-5c67-4634-b9cb-1e3787c4c40d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9c3b25ba-5c67-4634-b9cb-1e3787c4c40d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ccf06a3f-94a3-4740-974d-2dcc1ca8b425.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ccf06a3f-94a3-4740-974d-2dcc1ca8b425.tmp
Size 1KB
SHA256 618e21c2982d0832a556a6fee63eb7730386cd30e10fec33d68eb2a94808a51f
MD5 b43653cea3e34daa1db8edf1348b8c1c
SHA1 9d7c0c17d951b76b982f16eb9497b414848696b3
SHA512 651d4010b0352e01848a52ae1230e87bc09b453067d2baeccae0ef3f83564687184a0ecd2287cb11ab131c6ad79f7131d30204940ced28b0512c19735e5b5765
TLSH
T10431AFF787B4856E8A0196F0AA18AE2BCE2D0514432C7D99C4E4AE2793F3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d04533477564f8670f5abf8a2245e256fa4e4894ee71ce60f0258d0324024501
MD5 fb26e7987bde2e17fac092a3b88cca5a
SHA1 f8feadf9ab12c1e5c8ab8a5530d3b847bd3f285a
SHA512 786c2630bcad3b7cc82bdd919a7caa34846cb80e00b39e16fa921be3c848e9db8a962b8e4f5e3671d30b5cd76641511578a8f31cd5e59f2b33533ca97ce09c4e
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYH10:OtfFvpopPxrB4RhfYV0
TLSH
T124B2361571BA121038FE790881B6972F064232733158EA7B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a90490bc-0c04-47ce-9da0-01ebe5f1e485.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a90490bc-0c04-47ce-9da0-01ebe5f1e485.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d09f42ec-a8f9-4ffc-83d7-77f358366df5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d09f42ec-a8f9-4ffc-83d7-77f358366df5.tmp
Size 11KB
SHA256 8927a15beb7a49adbd9e7b6420b0127c48515e95208d4d44553a4fc1a806dc95
MD5 4fb0d4a1792b32b5212466064c25eaed
SHA1 106614befa7d8b009ecfbf56b4cc1c5eb924a301
SHA512 0aac02b6dbe05cbcf2087212ba286dbafcdfd42e1c997c3a63bbd586cfc10051a33202c2958907566b13a5083160038cf28b5e147b3096c8b49cf96610409103
SSDEEP 192:sxZCR1Tk2/fbsUQZZB5zodpHzHW6+WNGYbIi/rY74Ig5dwfJ:sxZCM2/fbsUOZByTHbGF0YYzwh
TLSH
T18842C8256D28A93B8CC7D219FB69BF53D3F95032A0951E48A6FCCA1C14EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daa00595-9d98-47a4-9010-64638d4ce693.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\daa00595-9d98-47a4-9010-64638d4ce693.tmp
Size 26KB
SHA256 43cb044031fcb0e1a743779b41232638d4cf29709671645167113342ced9ee1f
MD5 e1d76d9172e13a8875acef594f226fb5
SHA1 90c16b797c163b561f28e6a4427f128592495ca5
SHA512 3a53980769632b895dee22ebf5439f3cb2e73a9a8c6a41d1cbd2dbe9bb0ce89e5df50570f555f48a9b7f2b2ea5412b10d855c6e9f2ec00c1d1b4f0e15be1450c
SSDEEP 384:n8iFzQkUSvF3sNw8TUNTUlI4K5mg6zeqK2fMBWCk/BEOJdAG2IqMtUSgL/7Iz/I8:nFdF3twgkleTBnzSAG5/U+L7
TLSH
T179C24A36E898DEBBEDE78B91B70A3643EEE04153C69C4AD4DAC95E5C00CB19D130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3b3e82281529614f861855f5daeae22e6d4f74b8879be15393c727a73d250cdd
MD5 c5ec5c41c27ad1ff70402c6f94d83350
SHA1 3ae9794326777e85154898af873fc1cd2df7fb33
SHA512 2f1449dc4813981526f05987757dea0f2028babfde464b0f8bf2ed2e356b621e2a078875bd5fc5644132898a9600602183fe1ad340dd4301de390169a2b6d493
TLSH
T1CC410758A6EA1108F7B73E5AAFF2A96D487FB8772F0AD45D10110E4F0662A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download