hxxp://clientstream[.]launchdarkly[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://clientstream.launchdarkly.com
Sample261029-w2evqs11ax

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{7EF80254-F297-45E1-91EE-170E1581BC8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 5020	4280	msedge.exe	84
PID 4280 wrote to memory of 3204	4280	msedge.exe	85
PID 4280 wrote to memory of 1384	4280	msedge.exe	87
PID 4280 wrote to memory of 1940	4280	msedge.exe	88
PID 4280 wrote to memory of 1384	4280	msedge.exe	87
PID 4280 wrote to memory of 1940	4280	msedge.exe	88
PID 4280 wrote to memory of 1940	4280	msedge.exe	88
PID 4280 wrote to memory of 3368	4280	msedge.exe	89
PID 4280 wrote to memory of 3368	4280	msedge.exe	89
PID 4280 wrote to memory of 3368	4280	msedge.exe	89
PID 4280 wrote to memory of 4584	4280	msedge.exe	90
PID 4280 wrote to memory of 4584	4280	msedge.exe	90
PID 4280 wrote to memory of 4584	4280	msedge.exe	90
PID 4280 wrote to memory of 4792	4280	msedge.exe	91
PID 4280 wrote to memory of 4792	4280	msedge.exe	91
PID 4280 wrote to memory of 4792	4280	msedge.exe	91
PID 4280 wrote to memory of 4604	4280	msedge.exe	92
PID 4280 wrote to memory of 4604	4280	msedge.exe	92
PID 4280 wrote to memory of 4604	4280	msedge.exe	92
PID 4280 wrote to memory of 4012	4280	msedge.exe	95
PID 4280 wrote to memory of 4012	4280	msedge.exe	95
PID 4280 wrote to memory of 4012	4280	msedge.exe	95
PID 4280 wrote to memory of 4044	4280	msedge.exe	99
PID 4280 wrote to memory of 4648	4280	msedge.exe	100
PID 4280 wrote to memory of 4044	4280	msedge.exe	99
PID 4280 wrote to memory of 4648	4280	msedge.exe	100
PID 4280 wrote to memory of 4404	4280	msedge.exe	103
PID 4280 wrote to memory of 3380	4280	msedge.exe	113
PID 4280 wrote to memory of 2256	4280	msedge.exe	114
PID 4280 wrote to memory of 2884	4280	msedge.exe	115
PID 4280 wrote to memory of 3976	4280	msedge.exe	117
PID 4280 wrote to memory of 3976	4280	msedge.exe	117
PID 4280 wrote to memory of 3096	4280	msedge.exe	118
PID 4280 wrote to memory of 3096	4280	msedge.exe	118
PID 4280 wrote to memory of 1656	4280	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://clientstream.launchdarkly.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd1508c188,0x7ffd1508c194,0x7ffd1508c1a0
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,5450955987770028273,5590568921865602007,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,9196276865671936027,10481992285271061117,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9109551615532420564,10914844665836117891,262144 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,1965842178056459564,6750628690507198207,2097152 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,5766417574485225505,12644136476359592648,2097152 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,17089787594927701822,3754026730323183268,2097152 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,4799581055654803549,15986085436446012746,2097152 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,9410558126862021555,8789696980423506379,2097152 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,7116356238317852507,8332755424000827674,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,3285234740679864596,13859977800642518977,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15344082537995658946,3612685792637304235,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15344082537995658946,3612685792637304235,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,401007519579856231,9632012036201022010,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,9906497971174452120,7044768955243526763,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,10082230210062008966,3124266627391565863,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5314644686394058344,11463816450424162390,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,11812277186244030179,8573899126340617311,524288 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,12344487991031075046,10746302897909760233,262144 --field-trial-handle=2412,i,14009462385071322640,6294348073302612497,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43bdc991-d727-4b45-8731-937fff25fa2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43bdc991-d727-4b45-8731-937fff25fa2b.tmp
Size 8KB
SHA256 2bf87bf85b7c95f24676d3f7f7c5f3de6448c76e9a80ee14e63c6eb0cd16b2f8
MD5 e025d9bdc3f09fd1e73812e10407db7a
SHA1 1b4281cf41cb04aaed6ddafe8c0818796f238f35
SHA512 749a1ff26b19cf8df717a7d755b1c471ef6529a87a1fe96915974c53429bbc0ad8abddc9fb2d8d4e3540aae5130fcd36758a08e6960cb9227fd46cceeeb685b4
SSDEEP 192:SOND6ygpQmiUygytOCTVgFpOsR0XzP2BSU6:SOND6lH8tOCTVSpOsGzhU6
TLSH
T16C02C735B8686CBB8EF3AE45F48B37139FE4106BD9512B84DAE81E1C01D765C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54eaa83a-4eb9-415e-8ca7-59403791deff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54eaa83a-4eb9-415e-8ca7-59403791deff.tmp
Size 18KB
SHA256 d45ebfaf44d36d859a04c2683894aa24ccd00aea40c14a014bdbd9add1cdaab1
MD5 f64a3198b7914c5268bdf8ceccf954c5
SHA1 d4b3a146702db1127535a5fa61e3e8981a5425fa
SHA512 fbdba470c577cafe039e08d30aaad9744d6b3f8ba8ffd6b3edf94a6357b1dd683326ac5526ff2a48660b21b9a025e179471870512367d5463c30b1c2de0bb05e
SSDEEP 384:1QkUSv0sNaBw/1SM0jfbYpOjTVSpOsG5bjknfvaTZcZ3IIlv:P0/7AEnAOrjknfvaTZchLp
TLSH
T10B827C31B878AC7B4EA6A540F14B3743CFB48167D9853B94E5DD6B1C02DB29C231BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

909ebb7f-5f74-4999-bd6f-60d38443df3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\909ebb7f-5f74-4999-bd6f-60d38443df3a.tmp
Size 21KB
SHA256 0fffc6def327b7b343f42a39881531775cea68fee31e929f2e3dd35bcf9c551b
MD5 8ccd01ececbce88ec2523deca7efbe0b
SHA1 b39a99449f960a846ab69867e9b7d66a516a3726
SHA512 ba4d7af53659b36bd967372e8c36685e6b9c4e67faa942d749dc2ed8d4e7226b4a01c0a26598888189bd0a36c150a4a83708dd636df59f564034f0008c7d53fc
SSDEEP 384:QiFzQkUSvPzsNi8TUNTUlIlAw/1SM0jfbYpOjTVSpOsG5bjklfvaTZcZ3IIlv:rFdrXwgA7AEnAOrjklfvaTZchLp
TLSH
T12FA25C3268A8DD7B9EA69A40F54E3303CFB441A7C985BB94E6CD5E1C01DB2DC234BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d939e99-5d8a-45d8-8854-1d3fdc052a65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d939e99-5d8a-45d8-8854-1d3fdc052a65.tmp
Size 18KB
SHA256 387fa04b9d597619b4c51eacf77cf6717663ea6fd03fda948a1529a6cc840fd6
MD5 da8b4db22a1f4e573f6fecc79604fa11
SHA1 6f6863d0fa4a3e8e6771791fc47f786de386f615
SHA512 8192bcae799b246691eb4582c8635181987e8d29870561e844819a68038e8405298fd3b96d6be77d83522add1013fce0c502633fe4a64fb106b5a30ffc222581
SSDEEP 384:oQkUSv0sNaAw/1SM0jfbYpOjTVSpOsG5bjknfvaTZcZ3IIlv:g047AEnAOrjknfvaTZchLp
TLSH
T174827C31B878AC7B4EA6A540F14B3743CFB48167D9852B94E5DD6B1C02DB29C231BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

089da094-5f6b-42a6-a877-3f1f35f89166.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\089da094-5f6b-42a6-a877-3f1f35f89166.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f5a2dda-a1a1-4a31-9016-16dc611a9a22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f5a2dda-a1a1-4a31-9016-16dc611a9a22.tmp
Size 10KB
SHA256 97a07739df238862531e0fa7be144834133f501e995fb96fc9d304c422cfc4bc
MD5 58896e1e26564622266f1738bf226d02
SHA1 5a4bc25317b1c0a4265bd916069a6d9dca2d35d6
SHA512 ce80a01d8843ddc5ff6d9efb4b4172ed9a9ba1c762cb1d21b93d952588f1a69002c974b0687b5dbe64ef0721e2b53edfea3bdee9ae03ade4bf60cc69b714ba9b
SSDEEP 192:sxZhReWK/ffsX0Idp4qHW6+WNYx+/YRPk5+iIg5YJ:sxZhXK/ffsXtzHbr/mOK
TLSH
T12422C9526E28E57BCCC7E309BB157F53E6F95432A0951E88A6FC861C04E76CE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0000b3-6e18-4b58-868e-92c0da167575.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d0000b3-6e18-4b58-868e-92c0da167575.tmp
Size 10KB
SHA256 afda0ab3dcfba25e6fbcb280a2b21f1c829dc542a54eda9a6477ac2a3687a0e6
MD5 20d53058a4fd2cf2de124edf6fc90066
SHA1 98011803ae56dab926ff25a144a8485e1f2ca25e
SHA512 6d25d7868e5a50b2dd8065983a3734d539a32733b37d9403a001f5d51f1a86dc8d70bffc0874aad3f90641d4de8fb6f44117c80d8727e7fd218f41e2ab530c58
SSDEEP 192:sxZhReWK/ffsd0Idp4qHW6+WNYx+/YRPYH+iIg5yJ:sxZhXK/ffsdtzHbr/mWw
TLSH
T16022B8526E28E57B8CC7D309BB15BF53D6F95432A1951E88AAFC861C04E76CE231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76d84c9d-e240-4658-bb07-d9924231d812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76d84c9d-e240-4658-bb07-d9924231d812.tmp
Size 9KB
SHA256 0818832c8ae8555214c172e123c3d72bd64ba2c56dc171bb39c87759f2cae385
MD5 c5e1b3f06bf602fabd626ff760d40011
SHA1 d649f7fec3d06f5f56529c1c39e7c318a8733aa7
SHA512 17c66f6ad413c93686ad7b9b5eda3a60cc0e551c0971b6f839caa51c2942d8954d901c183624aa39116f28d8509bdad763f0bd8596a9ad710fcf06407f04b838
SSDEEP 192:sxZhReWK/ffs40Idp4qHW6+WNYx+/YRPYH+iIgrJ:sxZhXK/ffs4tzHbr/mW9
TLSH
T18822B8526E28E57B8CC7D309BB25BF13D6F95432A1911E88AAFC851C04E76CE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86003a57-ffa4-4535-9956-a39ca0230264.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86003a57-ffa4-4535-9956-a39ca0230264.tmp
Size 27KB
SHA256 e4221b844b97b1fcdc82e4b93a5b01ba96682cd058d31b630d9b7e43052acea7
MD5 49ee49ce323d3f3baa789cdaa5571be4
SHA1 e26ae2b218b6645e238be13ac10b58f3f4d8eb6a
SHA512 c9b1e3172d11a978d6f6db7ea027287cde4a0c4f54e9e6def20927988f2a0f44ce99b76b7db64abe2213d6353d8090271a28ee8483bd20e7f04ffac2b0dc559c
SSDEEP 768:/NtK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3gCrop+oH:/NtK9uzYWvcQWsu1ja0HL7Q3gZp+oH
TLSH
T1A6C2093F640CCB7E4FC01A9DDC5A6F973E9802D7A6588D5047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99f9a737-ace9-446e-b3b4-cb2782c4d19b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99f9a737-ace9-446e-b3b4-cb2782c4d19b.tmp
Size 10KB
SHA256 1c650c3e74250927162f0ea0897eab30c13200913aaca1bd04e113462ce781ba
MD5 ba53d4ea31c071e65f6bae033feedb74
SHA1 5b1438f29451ac2b144d8cd5efcac86b17d0550f
SHA512 37470eadf86d1fb08ee741ddf369291cd29bfc0f6fd569c23155b3b2eff5edc75f836be98f15b4ed19f1b8e71b7152ff433aaa2f9e63be04d8c1b819f0139b6e
SSDEEP 192:sxZhReWK/ffsX0Idp+qHW6+WNYx+/YRPEO+iIg5YJ:sxZhXK/ffsXtBHbr/mLK
TLSH
T14E22C9526E28E57BCCC7D309BB157F53D6F9543261911E88A6FC861C04E76CE220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 a578398916eaf975db7440245793dc1f32271b92e537040fb8cdf71b116ee756
MD5 cee8755046abb1d04cfdd30808168ff9
SHA1 d3017b4102c2d58158be55bdda59efdee6de70b4
SHA512 f6153caba0b9504704d9487f5b8bca706349173d6d330a27aae3f14b51e5a81e8bd79abd0386da6b1f49fe4a386d5d0012b8eac20d4427641d57034edeae9dde
TLSH
T1E0E026CC04CBC23EB648B487017C970CE3A0365BDAC06D8E2700E58E7406258A2C3698
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 710835bae27b5962897994e2b0bed40b51af43874d7660e57e754f4797240a86
MD5 4ac6465c0518afbdac4a334ee25b523b
SHA1 698dcf7096a272e810c98b270d19554d733c9597
SHA512 a22d6d47f4cb93e7dececa4a1bd972f09984b666fe28d6ef72bc582027f2e5a50b66f6ea82b6aa6c84ad3278c89569f686ee674f6fbd6c9c1f3b39ee6870b5a6
TLSH
T17161B58215440E69FFA8D97889FE27873635A58124872EC240ADECFA580EFD5E37037C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a6b1c73cb3b30dc8ca31b04359de6bb8e36a66fb1991019def5b7f2947c871d
MD5 cfc086a05bec49528af93b1765942d6b
SHA1 8a6af66b06a8fb703978c1399b309148c8b87fc1
SHA512 fbd1db61a5feb1208cb408577f3923e31776a6ae042189aa8b54522100fe34b073b1441dd1bd6465030924abff684a1c157acc8cbed096b1f6664439b43fd6a5
TLSH
T11161C68215440E69FFA8D97899FE23873635A58524872EC250ADECFA580EFD5E33037C
MD5 SHA1 SHA512 TLSH

Submit Download

4a1b738e-9823-43fc-aaac-73d7c222300f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4a1b738e-9823-43fc-aaac-73d7c222300f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

10c07dad-1428-4692-b5cc-7dd1c4c183a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10c07dad-1428-4692-b5cc-7dd1c4c183a6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5688fcde-c734-4e31-b753-3f1bf68c2944.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5688fcde-c734-4e31-b753-3f1bf68c2944.tmp
Size 1KB
SHA256 f6201f0b5d20874e918da6f37fa4060f6a254f50f7f41538e82a399528da8049
MD5 4a5757dc0cd46047926933454dbfe158
SHA1 d601b0e36c58891cbfc2fe8e206f1557bb4178c7
SHA512 d28a532af6694995cd6f9412f0e186aaf087e705735db386a12d03bc9457d11c9171369282cea699d1db6fc9b7840c5ef53ec6f0d031154d28239435e3afc0b9
TLSH
T17911ADF3C3E5856E890156F06A28AE1BCE2C0606431C7C5A85E4FF2B87E30B5E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

d2e89cea-694e-4d71-a264-4456d30c5dd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2e89cea-694e-4d71-a264-4456d30c5dd0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9411bccd-d0ae-490e-8b16-1f12d923129b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9411bccd-d0ae-490e-8b16-1f12d923129b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d82a8b46-6871-4f01-b1bb-c4f10b2e4707.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d82a8b46-6871-4f01-b1bb-c4f10b2e4707.tmp
Size 8KB
SHA256 46e4a0ce47a4eef1c363947aa8c54f15a50e3099d24734e4df9df67168c6aff3
MD5 82a02698b70424a11cb60e2ee60a2ae1
SHA1 86fbaf3aa6b631a23232d5519d835b8574a86c9f
SHA512 e7d0d9f3c9b7d6b081d94130b197a2af4f052c6864814d4f6cf7ccf5c999f89b40323899351da5fd4a7c6a5f2eb0b553cda11c42d788f59661fc46d9a5548238
SSDEEP 192:DONb6yAQmiUyyyLOCTVgFpOsR05bjHEY3UkqBU6:DONb6/eLOCTVSpOsG5bjk9fU6
TLSH
T1331217317878ACBB5DA2A545F48737038FA84167DA467BC0D5EC2F1C01EB6AC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75842daa-3cb0-44e4-9df4-32cb8eb97bed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75842daa-3cb0-44e4-9df4-32cb8eb97bed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ea62eb2bc320da696e154c8bcfbc248d159aa3e92d7c1eb3ffeea598eaef652
MD5 c5e9f45181ee779ba58c3f1964490355
SHA1 9d42be06c5666098e77dd390d85043edafce7448
SHA512 4bd42a1cb4f1a47115ac09dd1f85be2a64dbf6569ed0e2fab5bd13f7f7f46faaff93571e8ecd5d6629f18f5f37a2ee24bde77d7431f5e990925526be0a4f46ea
TLSH
T1B1412958BAFA1148B3B36E569BF6A82D487BBD372E07D49D10010E4E0666B00CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download