hxxp://www[.]dlevans[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.dlevans.com/
Sample261027-vbg2qsts2p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{6514011B-B812-4A5C-A346-22E3A9DA1698}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5196	4648	msedge.exe	84
PID 4648 wrote to memory of 4440	4648	msedge.exe	85
PID 4648 wrote to memory of 900	4648	msedge.exe	87
PID 4648 wrote to memory of 900	4648	msedge.exe	87
PID 4648 wrote to memory of 2000	4648	msedge.exe	86
PID 4648 wrote to memory of 2000	4648	msedge.exe	86
PID 4648 wrote to memory of 2000	4648	msedge.exe	86
PID 4648 wrote to memory of 6028	4648	msedge.exe	89
PID 4648 wrote to memory of 6028	4648	msedge.exe	89
PID 4648 wrote to memory of 6028	4648	msedge.exe	89
PID 4648 wrote to memory of 5008	4648	msedge.exe	90
PID 4648 wrote to memory of 5008	4648	msedge.exe	90
PID 4648 wrote to memory of 5008	4648	msedge.exe	90
PID 4648 wrote to memory of 5420	4648	msedge.exe	93
PID 4648 wrote to memory of 5420	4648	msedge.exe	93
PID 4648 wrote to memory of 5420	4648	msedge.exe	93
PID 4648 wrote to memory of 4144	4648	msedge.exe	100
PID 4648 wrote to memory of 4144	4648	msedge.exe	100
PID 4648 wrote to memory of 5868	4648	msedge.exe	101
PID 4648 wrote to memory of 5868	4648	msedge.exe	101
PID 4648 wrote to memory of 5088	4648	msedge.exe	103
PID 4648 wrote to memory of 1908	4648	msedge.exe	111
PID 4648 wrote to memory of 4000	4648	msedge.exe	112
PID 4648 wrote to memory of 4352	4648	msedge.exe	113
PID 4648 wrote to memory of 1672	4648	msedge.exe	122
PID 4648 wrote to memory of 1672	4648	msedge.exe	122
PID 4648 wrote to memory of 5464	4648	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.dlevans.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8ae91c188,0x7ff8ae91c194,0x7ff8ae91c1a0
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,1656592102749000937,14989566094823197555,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,18230418812067929506,10127139246634537698,262144 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,13609681086857094444,12321276628238270266,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,11058049388730785583,15624929297053925481,2097152 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,5038983237292463703,7760648983545472985,2097152 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4884,i,8677651279404926018,11460579880218008775,2097152 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,17983207214695125732,11793057550527111572,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,1249058992504070106,5946669657221386186,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,1998783457679268806,7292605320421892486,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,1998783457679268806,7292605320421892486,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,5676333412542361088,16568684182624513072,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,12611988446943733163,8900075300789816130,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,15137002541654193914,6441203027827837139,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5418222455456686482,14996782753893084812,524288 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=1212 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,5065251285572742507,6584955290374891906,262144 --field-trial-handle=2296,i,8449489259775552937,240742488850362355,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f5d6228-a908-4240-b648-f680ffc2ae79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f5d6228-a908-4240-b648-f680ffc2ae79.tmp
Size 26KB
SHA256 e8ef5913d5a6796b7a71e65f370bbba2880968c80f6e5f2513de8f665473cef8
MD5 1f085cb255c18b1540a90b266364c80a
SHA1 d32eeb8418e9c4d7988d0e4ef12d09c90fd05cde
SHA512 477c73bf5a7a82317f44c7c7ade19d8735307de65c40ad652008813e663586862d70f5608d1f954d021f246a67ac420c5d5dd5baf764d9b97ce79f2af537297f
SSDEEP 384:nziFiZcI63sNc8TUNTUlIm2aKMPHFw2fiBCfkhEyjGiUjsa+VYwSgL/7IzLon:eFQ63dwgcRKBCfkhDCiAhgAc
TLSH
T168C23A32EC94DDABECEB4BD6AB4A7A03DDF4426386CCAAD4D5D91D1D00971AD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33fd79e3-5914-4972-bc15-58da4d48a5dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33fd79e3-5914-4972-bc15-58da4d48a5dc.tmp
Size 25KB
SHA256 789837b52fb89f2bc2dd84ea0e2c0b704bc77351ca1fe357b1680cfea37d9313
MD5 836e024faf65970e575acd042a974698
SHA1 bb4fa836951f6844a372b8e6e38d5065196a72d9
SHA512 03f01e53c7ee2ab8ef3c09bc450b0812e5f8fae25b5a5b9c38bb74fa6fd939c30dda0d9e15767976ca3cf384a69b7482f0c337268aa82afcb7b76a3dff59dcbb
SSDEEP 384:nIiFiZcI33sNw8TUNTUlI4JaKMDyIw2fiBCfkhEyjdiUj38hogL/7IzzNo7:TFQ33Nwgvc3BCfkhDxiAZ8
TLSH
T13BC22A72EC94DDABECEB8AD5B74A3A03DEF44223899C9AC4D9D91D1D00971AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74cce7df-a36f-4f3a-bd4a-ca318d56d8d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74cce7df-a36f-4f3a-bd4a-ca318d56d8d8.tmp
Size 31KB
SHA256 1c5d1e2009c950d7ce237c44dd3373d384851f0a4e0415e9a5ca2e2563c3bcad
MD5 4dbf030bca393a30f59875321f32204d
SHA1 4ec811deebcb8fa453682a4ac2bab9a10f9b42f0
SHA512 8274a01e286e226ee33794e82e435504d7b8e3bb77bbb62fcd6a5ca5910fdce8b28cbe1a87c99ecd82af9107e5c5aa2d71a6a8ebdb2f1cc4aa7982479ebe4e04
SSDEEP 384:nEiFzQkUSvuR3sNw8TUNTUlI4JaKM/1Iw2fiBCfkhEyj0mUjvaTZcIgL/7IznIIv:fFdq3NwgvH3BCfkhDAmAvaTZc4Lv
TLSH
T1E2E291F198D79977D9AE4B87A33E2D4299FCC253B9885A84B7C90C1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

801c597e-650c-4c5e-ab3e-6b95c8b8f39d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\801c597e-650c-4c5e-ab3e-6b95c8b8f39d.tmp
Size 26KB
SHA256 fa4764e134fdc1922500733643465a308d272a043c06005376281f62e10f824f
MD5 b81e1fd9b7e99b52a7dea0b53189851f
SHA1 506e3e361ca54533ebb7c3f9e860ae8d7efdd109
SHA512 1b62798acc2d942fbf212adbe39700f13a2848dbb8c4fdbe8122be18dfcceb9c3e7fba2feb0477cf352e2cd6a73ab9b6b7c38641eaccd71e81dc96b1a1ba462f
SSDEEP 384:nEiFzQkUSvo3sNw8TUNTUlI4JaKM/yIw2fiBCfkhEyjpiUjvaTZcIgL/7IznIIlR:fFdo3Nwgvs3BCfkhD1iAvaTZc4Lv
TLSH
T149C23B32E899DDABADE78B95A74E3A43EEE04263C98C5AD4D6C91D1C00DB19D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b868a1e-90c3-4ecc-906a-226c8c26f4c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b868a1e-90c3-4ecc-906a-226c8c26f4c9.tmp
Size 26KB
SHA256 efb368c6cd4633b2046cdb6edc104b0d9410bb46cc4e7c6a2b6433ffc435502e
MD5 1a122adc79d8fdc77f82dba2389a9465
SHA1 4d7731661a7940f76bf4caed4d71a62785407ff9
SHA512 a3a7a7c0718eb7f60b79ac30d3284625698ba483b0f1bae2dc0b495faf7dccc741fbd8742741089697ccb896a834c21f8ca51369f6918d9cf5c9635b7dafd5c2
SSDEEP 384:nIiFzQkUSvo3sNw8TUNTUlI4JaKM/yIw2fiBCfkhEyjpiUjvaTZcIgL/7IznIIlR:TFdo3Nwgvs3BCfkhD1iAvaTZc4Lv
TLSH
T110C23A32E899DDABADE78B95A74E3A43EEE04263C98C5AD4D6C91D1C00DB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

18c99c1b-7520-419b-b390-f09ba82c0bfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18c99c1b-7520-419b-b390-f09ba82c0bfd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

248daf84-8658-4da5-b35c-f2ff38311791.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\248daf84-8658-4da5-b35c-f2ff38311791.tmp
Size 12KB
SHA256 2b6b51e09311566b3e4af7bd8e5be9a0bf9eb4477359daa55f7adaf44eac1d03
MD5 468f86bfb31804c47df4e96c77c8ce30
SHA1 6c345dbe3b2f6c4d694d396431f650426abc453b
SHA512 0f94dd1c8f9db5cf1a7cc90181733a4bef2ce9dbcd4b5f1d3638c4df2210ee32947d2a6e84b30b1f72ebd7e6a8eabe3cd1e03d76acbe396d97091e9439d179e0
SSDEEP 192:sxZLR//ke/fEsraQZLu8EzodpzqHW6+WNnFq/YoYy7SCKIgjt6J:sxZLBse/fEsuOh3mHbw/fSNjt2
TLSH
T1C842D7156E28A97B8CCBD21DFA15BF53E3FD503291950E44AAFC8A1C15E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38c830f9-891e-419e-8f7c-0984462904fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38c830f9-891e-419e-8f7c-0984462904fb.tmp
Size 12KB
SHA256 656fed57d863ca261ae2aa2d41461e35c1d928c0a537d38ea32b4f8ba4dacfaa
MD5 4035eefe4eeb1a5a4fb6cf4bdaaef876
SHA1 63fdeaafbdbf5f0658c3c448d6e6685ae08f60ea
SHA512 4cf06f37d20a34cb6abb227f681c71ea7587f57ddb9b6f2ff0093c50d6dff417ed487c511b9e35da0a9f2fbff66495aca2e291e4bea4f80172a689a34fa07452
SSDEEP 192:sxZLR//ke/fEsQaQZLu8EzodpzqHW6+WNnFq/YoYy7SCKIg52t6J:sxZLBse/fEsJOh3mHbw/fSN0t2
TLSH
T18642C6156E28A97B8CCBD21DFA15BF53E2F9503291951E44AAFC8A2C15E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

920f41f4-11ac-4c0e-b944-b17d629e2cb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\920f41f4-11ac-4c0e-b944-b17d629e2cb1.tmp
Size 12KB
SHA256 86aec21c320761c440026d94609bb66afcddbf93f91740a784b41f3fed6884c0
MD5 426492aed4cf6e334b479017608c33b1
SHA1 b2f64a09e8a54bc627c9dc474fa4b8b4b2021426
SHA512 b44a16b8700431f1b810c45c908b4d8476df27da356f8753e0597f8256615bb2fcd49015c0b76b916241f8a9ac4eeb883b9204242e36e0bf9b9d745cc56fbe3d
SSDEEP 192:sxZLR//ke/fEsqQZLu8EzodpzqHW6+WNnFq/YoBy7SCKIg52t6J:sxZLBse/fEsqOh3mHbw/USN0t2
TLSH
T10442D6156E28A97B8CCBD21DFA15BF53E2FD503291951F44AAFC8A1C15E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000035
Size 33KB
SHA256 72f064e607a3ce9540a36486cf7b625881c948319022583f9091784ffe16668a
MD5 0a660cfa8c9bd1ef32a67d5314a3ba21
SHA1 4e708e8020ad3dc110e0d91ee8cb76d038d5b300
SHA512 0daadbf61933349f881d58f0dcc9540e46a2334d2c5556452ac3a2c69e97f9a8b5d1c89b1bf38e6636a847fce1c1ee0918c7c1d6cd058ca709585366427516ee
SSDEEP 768:Q1vYQH2tj1QdWsF3M7SB66E7wWPR87Wif:Q1vYQHW+hM7SG7Eqa
TLSH
T1BCF2F1B518ACE60BCEC2F58745680A839A02F11DCFF0D25E27955538495B3FD9B24FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000038
Size 24KB
SHA256 f48ce507789215087358bb4b75f8c39cc0311ac6d561b183337ec649d21163ab
MD5 75189db4f22f5e16974663b09467105c
SHA1 decbfdaada1507aaf449ed65f340e0529299c8c9
SHA512 6fcaca4c93e38dc5a104f97509954c35d974dc26d7bec7a29b4cee89dee26e98a41c375088571683a0f14fd88da742553d627168a1e4d67a75eaf3134780fd5c
SSDEEP 768:9BXGmo9zF9LlI+z/m0Jr3uTw4qHFsklZ5Ei7kXQS:991oBF9LTzV3qYHikZ5EmS
TLSH
T108B2E1995A967E28C12B1B03427211E0E713CC4CAEDF179E57E5ED81740740DBFAE8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 71KB
SHA256 20680cccccf86474d154aa66913ae9caa1cfe46c5f7cea71bee9f85943d09643
MD5 5fb4f9b40b4d2e8d148271d0cad8f109
SHA1 fba75bd15aca1344dd6706610a4b087ab16a9251
SHA512 36d2b4dc0b6ef90fc62a0865c53d34a48aae215a756b16a7231d394880ec32e7548278c183212ab429b2e4fc9919fafb686c1c7d19e669bad5aa56a211d9412f
SSDEEP 1536:iEZv5e9IQEMvI7ZxbeogfXH3/4vtY+949dT2oaH/DGfNgKC/YP34X:iQ5rFQI7Z1eogfH3lnTQDGfNgKCW4X
TLSH
T11A7312C3E12B2794601A49F5B259E06DCB3B01610B21BF251D1AA05B0B8EC58FBC7FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 175KB
SHA256 00c6a574702d41652d8bff879c6d0b91168c1a3e81de1e7586e200b8ce612c41
MD5 16ed0a48092259daf364c17854f25484
SHA1 67f5b21d6d4d74ac72ddb227f37ef9f2f1946889
SHA512 256f4a931ca1e9ddeede74eee0138ac9ad5cb1d1647e16c43519f2d3f3952a738d0eb117508c58c0efbcfcd4553feb44374fd42cde92ed64e4245a8e879fcfb0
SSDEEP 3072:0P2fofLS3yqF8iy3mNjrtXAKgxzvoAgbInrpN6ziBLiPGmeFAJFDko:A2wTmNVAKcvHnN6WsemTFDB
TLSH
T1C7041262F81733371F28487AB6BDC9FDB80509D76B38D1CEEA17147A04D40DE15A7689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 161KB
SHA256 dcaa85ec7c2a84d1a49b773f5902e3581e69da83a4d0d84776f7ea87c9ad717d
MD5 72b8acbbe416aa35ba72a43d8444ef9a
SHA1 0362b639bbacd3a9c3f4ac3e56185ab2fb18b84c
SHA512 478c52d74ba70b115aca7fea1e63e8c82daef5bde787ac7030fc54f0d63dec85a667ef13fdbc5453d3019940f064aecef263efcbc7d136b4875c39bc333255d9
SSDEEP 3072:04iesnPeI+SHWIfiDZR2pijljastbe7FmTRm5LtaXycip9ucgTaB:jsWzy7iDZRsijljastbe74TRm54ivp9P
TLSH
T182F3124766AE4DBC8FC9D9D926B48120C7640D7C15E7C8C43D8E6867BC0F0B6B89C69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 a306ea83491c449324fa5c6cd076ef30b74efed1382b26b91c49eab903babb12
MD5 be0297898e5712b53bca92246f0f26cd
SHA1 b41637330be3db7413fcc87e5db8540a0beef0a9
SHA512 a7d18f7f59c8d72a4c64d41c2934a46afdba7d23262505fbc9bae37681e38fbabf455912dd15536729cfd4e72969e933ebc9515a5b058ec39f87c012557367df
SSDEEP 48:3G023R+OIDouosjXoGXAOep6BZU+ZZcJA7aeX/p8dxUbp7s1MnVUIeM8UUu/6rbV:WF3opjYAU+UJY5X3MUVUIHEoGm6tz
TLSH
T14BB18509C6C030A1DF5BCB7981A11D7621A685F06AE2EB0725ADD6B877033CDF780B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 70739e69638340fe3986d24417f1b364746743d917d3e06e799290c9aa7e8fec
MD5 59c0d4249d3680207056560dc5043154
SHA1 2f34936d637d3b820c783b9ef1338cfbc7007875
SHA512 64f4323e3f8052d653209153f39481dbb1c27ab447d27a7418d9501965b05bf14a720c29f19acb520c462986a15da6332e8dd5588952bf4d236bd3802d208a2d
TLSH
T14D412049CA80B8E5DBA80FB1D2E622FB747059F0A647ED0E08ECC6BC774B315C500350
MD5 SHA1 SHA512 TLSH

Submit Download

6bb643a3-775e-49af-9f7b-dfbd817f283e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6bb643a3-775e-49af-9f7b-dfbd817f283e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

65045edd-4df7-44cc-bd04-c56e569d21b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65045edd-4df7-44cc-bd04-c56e569d21b7.tmp
Size 10KB
SHA256 df14c9c662165ffdfc3a28fcadcd8fe0f324419f3a5904d006869a88f4735ed6
MD5 044cd97ecb5b933defb1e648b9f482a1
SHA1 fa66ea43d816334e18c582e6b6cdbce68535709c
SHA512 6db417b248a9ad94951f5caf15c542524f19b2c0be17484a7d557f9f4acb2d0e89464c626e1922463b3ffb39c90e8417964c17c1729c8ac061288ba7698512b1
SSDEEP 192:D11saJehH/eezn1ihR+BeWJaaq/FS49gcbVs93xsno7u7yCJypUsbeb/74Bcvb03:D11saJehH/eezn1ihR+BeWJaaq/FS49y
TLSH
T13A326AE783E8822DE81152F8E6543E2FDF291925436C783AC8D59E4BEBE1471F18464F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a4b77c3-7b0c-47ed-8f2a-6a60086e7e09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a4b77c3-7b0c-47ed-8f2a-6a60086e7e09.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

973a5323-d953-4f96-a35b-a254962b84f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\973a5323-d953-4f96-a35b-a254962b84f9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 063360d2d35c76cdce7b57f520be3b9b042041815abafacad9afdc23c6b5c3b8
MD5 910963d9a288c4c06134fb293f589ffe
SHA1 30c49c536d9934aa0b529118c5cef88faadd3953
SHA512 5a1b29cfb758814f2d8d13937667a59bf8d73c46cb8ef8623e3860a6973cbbfc308984b06cbfb50177f680001391591f3fa0a0699c43723b83b29c7d97a98c7e
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg8:ST/2dXOJhJlpfnpp3tNXVrN3AvDV
TLSH
T15DB2225571BB421039FE291C91B6872E064272733219E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bbdd1150-0fa1-487d-a485-9b07daf02f57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbdd1150-0fa1-487d-a485-9b07daf02f57.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e23e5303-54e9-4910-9ba3-262ea388b7a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e23e5303-54e9-4910-9ba3-262ea388b7a5.tmp
Size 414B
SHA256 0cc7b2f0f51d75b3ef3a4a63dad5097643efda6cfad1c8fb531eeac824955775
MD5 867d3adc31a2d71fec2f1fdc1406e834
SHA1 dcbb78926a30ad219a712d148568a97e645d0164
SHA512 e5656baac20c499c9520c168489dba894a629893028f6aec064adbc83b77e9e985f68ba02965eadea3aca3ad186918a5b2b916e8d666dc2c0dc33fd227996d78
TLSH
T112E022AAE825FC3B08FD0B7C64940346EB55236B2A409C4B3F3D80088FB0A364286D6C
MD5 SHA1 SHA512 TLSH

Submit Download

b4f5257f-b90c-4a6a-911c-d187fe107a34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4f5257f-b90c-4a6a-911c-d187fe107a34.tmp
Size 25KB
SHA256 96493f8b1d5a632ed7e184b5588d20ba6c8ea500d737205b2fd1823edab26f05
MD5 8b875e2effcd1d747ca36c11bc307548
SHA1 0c696015fd6554ba299148fe2d9996e8b75355ec
SHA512 b48b501c0fe925291572cb606a30d16a87705a906ba9abad8047934446e35e9027b90f0c101468cef1e04a5ccbe743e53fe70ab23a2bf84cd41fdda73d995831
SSDEEP 384:nKiFiZcI63sNB8TUNTUlIm2aKMiA4w2fiBCfkhEyPFtsa+VYwSgL/7IzLon:BFQ63UwgcHnBCfkhDPFthgAc
TLSH
T189C24B36EC98DDABE8FB4FDAAB4A7613DEF00163959C5AC4D6D81D1D00871AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1019ec5b0f1158157d2646b3a90d15fcf40c2ffd4b5fc781e261e7c9bbe7bf31
MD5 5ad25505e2dd802dbf5125d7abd17fb4
SHA1 472365ed63d70b127fc4ad5ac1b51e9d6089c6d3
SHA512 9da17fbf29c787d35814198850a52d7065c819f0137ac9c5d904841192e608c32e4b418dcfee1571d7ea9648dd0e6e04d84e83cc8944965a2d8954d02ed31337
TLSH
T1E9412B58BBE91148B3B76F5AABF2686D487ABD732F0AD45D10110D4E0A27A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5088-577-0x00000197098E0000-0x000001970A8E0000-memory.dmp

Download