dcd9b605230a4ec6a27de6983269d3987344f5d23b508a350d18c4eb761fa610

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261104-170170-avb2k6.html
Size 96B
Sample261104-tr1ncabv4x
SHA256 dcd9b605230a4ec6a27de6983269d3987344f5d23b508a350d18c4eb761fa610
MD5 0503a988a2936718db07455893b36ac4
SHA1 ca05fd3c6bc7c698e346749ae4a525a3dfea7e8f
SHA512 c62555ca98b1b54d662cd4d5fb9cc63bde5c5648e2a1f6f0baca1874769090e2ce6d2c39c2bbed1eaaeeb9dad250c49261b78f35fc9864733bfefda1c2c343b5
TLSH
T15DB012767005000C6D57C1E47AE100C00C05B0631D4926002080A87FC415154CD453C6
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{29265225-B164-405B-A8DC-1CE7A1339F00}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4344	6052	msedge.exe	90
PID 6052 wrote to memory of 4616	6052	msedge.exe	91
PID 6052 wrote to memory of 3040	6052	msedge.exe	92
PID 6052 wrote to memory of 3040	6052	msedge.exe	92
PID 6052 wrote to memory of 3040	6052	msedge.exe	92
PID 6052 wrote to memory of 1052	6052	msedge.exe	93
PID 6052 wrote to memory of 1052	6052	msedge.exe	93
PID 6052 wrote to memory of 2708	6052	msedge.exe	95
PID 6052 wrote to memory of 2708	6052	msedge.exe	95
PID 6052 wrote to memory of 1472	6052	msedge.exe	96
PID 6052 wrote to memory of 2708	6052	msedge.exe	95
PID 6052 wrote to memory of 1472	6052	msedge.exe	96
PID 6052 wrote to memory of 1472	6052	msedge.exe	96
PID 6052 wrote to memory of 4844	6052	msedge.exe	97
PID 6052 wrote to memory of 1408	6052	msedge.exe	98
PID 6052 wrote to memory of 4844	6052	msedge.exe	97
PID 6052 wrote to memory of 4844	6052	msedge.exe	97
PID 6052 wrote to memory of 1408	6052	msedge.exe	98
PID 6052 wrote to memory of 1408	6052	msedge.exe	98
PID 6052 wrote to memory of 2976	6052	msedge.exe	100
PID 6052 wrote to memory of 1856	6052	msedge.exe	101
PID 6052 wrote to memory of 2976	6052	msedge.exe	100
PID 6052 wrote to memory of 1856	6052	msedge.exe	101
PID 6052 wrote to memory of 5836	6052	msedge.exe	103
PID 6052 wrote to memory of 3416	6052	msedge.exe	107
PID 6052 wrote to memory of 2420	6052	msedge.exe	108
PID 6052 wrote to memory of 2660	6052	msedge.exe	109
PID 6052 wrote to memory of 2748	6052	msedge.exe	110
PID 6052 wrote to memory of 2748	6052	msedge.exe	110
PID 6052 wrote to memory of 5664	6052	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261104-170170-avb2k6.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2b8,0x7ffe3edac188,0x7ffe3edac194,0x7ffe3edac1a0
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,12665236674737208944,118770070803286017,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,13203566942076862974,13522678291204430377,262144 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,10743004765352052581,4359839259346292648,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14218532259710972239,1848050218663466215,2097152 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,4259796020095794331,11500880486716179876,2097152 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4396,i,267465120497813558,9392728655049717619,2097152 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4416,i,13808139265602513476,12806937817966305609,2097152 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,6393982863612542240,6625448381045666554,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3508111388816223616,923544316083042573,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5468509148920495755,17651721961187788028,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5468509148920495755,17651721961187788028,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,18434687106807196387,17523421267815357169,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,13304408433390066286,10526011549182036995,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,3699457649524309208,2328786275098340561,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,9828121141362253638,18408075964810366346,524288 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,10221676319580951886,17594949171552899618,262144 --field-trial-handle=2444,i,17218199618602359780,11419867296970306791,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5bd38c6d-f37f-4ed8-8e14-7a96d4055422.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5bd38c6d-f37f-4ed8-8e14-7a96d4055422.tmp
Size 34KB
SHA256 ce926694e29b7f8be9d49bd08b41d6b451b42935c88109daaad0828d7e6b8bbf
MD5 510d053506c4edc9a530a07b8b2c29fa
SHA1 55f7ad336a405b592c8aaae20aa210b995d1890d
SHA512 b68ed382b3981f470c050d7275b3ee4b556d41333d70f97711d238333da2f38a866ab310ac6e4896ee45004e3bfe6f475eedd46a39814a0a682b09adeb139602
SSDEEP 768:aX3kBlfKvHgE57Y0GZxJsXBdK8ZJE75EKvLZ:aX3XX70/JsXf7rkXvF
TLSH
T147F2B030E8A09E774EB7D7A1B20A3787BEF48263C6C90E94D9DD5B4C01C719D138791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74c242b8-326b-4907-a70d-b9ec833ce395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74c242b8-326b-4907-a70d-b9ec833ce395.tmp
Size 37KB
SHA256 76f1bea07ae5ca78b0c9e90f2e39dc7889257cde6f965316202e10e085bb785d
MD5 02898026505dca1d4a98e69915e53a1c
SHA1 59f3c3ecba0d1906a441e10185d91c04c077e557
SHA512 2904db16d9085269293355d600b7f18129f00f3f23d179b4059fe4fdb9d9f455d8540efb7252024c4182eeb7a2c62d4714afe52e06245700e1cbc909830630ed
SSDEEP 768:A/UxvxjgC+I3L/DKv3E57Y0GZxJsXBdK8lPSHUPpMs:tZj3+I3V70/JsXf75Sfs
TLSH
T14503C034E8A05D775DF7D3903A0E7397EEF446B3C5C55AA88AED6B0D028B26D034391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75455ea9-e21f-41c5-84e1-3a7c3b753944.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75455ea9-e21f-41c5-84e1-3a7c3b753944.tmp
Size 38KB
SHA256 7969380ec4e5453133061a4482cb07a7861113f1133ecc01abb7fd2c2a1b8d4b
MD5 722a5d72cfbb4e3349d2b09313810bd9
SHA1 ee65d2def90cb37eb159f80bd2840cf24f5eeb43
SHA512 faa74ea13dd172f768805117069abc7f2c0602044f2b931852360078919dd44e2167f00185a9feb67586eef46fa5c8c8282e74e1fdff49837b28197bdeac708f
SSDEEP 768:M/UxvxjgC+I30PllKvH1E57Y0GZxJsXBdK8EJSHUPpMs:5Zj3+I3Pc70/JsXf70Sfs
TLSH
T19203C030E8A49D775EF7D3A0364E7787EEF486A3C6C549A44AED6F0C018B26D034791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f24fcf0-bb11-4412-80be-41f2ee42b828.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f24fcf0-bb11-4412-80be-41f2ee42b828.tmp
Size 36KB
SHA256 e3229927953e02c78cce1ff3b76447f41f4144e82873ab6d6e4fcc3b56467bda
MD5 3dad6179191199b0d9664821481c86af
SHA1 e6e993109d161d4ebbf1cdae844d28a55bede447
SHA512 3665e8213bd52c44297f2282b47a4cde6385016a35a401f2133fdf6b9c4148a3f538b02fb7706560308a07c7c990aee67e376f3064957a8aec4a90e21fa6c43c
SSDEEP 768:dFdz3ywg+FlfKvHRE57Y0GZxJsXBdK8ZJE75EKvLZ:Jz3Ow70/JsXf7rkXvF
TLSH
T109F2AF31D8D0CE7B5EB7CBA1B60A3647EEF482A3C6C54A94EADD9A0C00871DD1387D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

2029af61-b8db-4691-a9ff-dc586119fed3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2029af61-b8db-4691-a9ff-dc586119fed3.tmp
Size 23KB
SHA256 219d5ea2d12dd56146d3b839a84b0c964fdcf0655132d9900a6d1c6684e6efd9
MD5 a07bcf608fff22e0cdf556bfafb3e658
SHA1 4a512558a33999bc65e455812abf00921af3ba7e
SHA512 3a8596b41aba23bda1a8005377c359603591ad543fcd517b5d4d3eb56a52ee21499192adcd5f2b2cf5f33c4f6b36c32cb85af26ebd4b6f0123525dd08841c233
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRuXCrc:6JajXKWgm0fsO7n8F1+UoAYDCx9Tuqhw
TLSH
T1DDB2DA3B640DCB7F5FC00AAD9C19AF976D9802CB96588D4047FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b008cfc-6ba0-437a-8c0b-e6495ac364e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b008cfc-6ba0-437a-8c0b-e6495ac364e3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e04cede-d031-4393-b0fb-a77c795ed89a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e04cede-d031-4393-b0fb-a77c795ed89a.tmp
Size 10KB
SHA256 6cdf178a7e9309b5118b2eadbb285b684e5273265f1b23f1306b5037b8b074bf
MD5 cfc094f37dd1d00f497970d7dd1ba128
SHA1 d534fa13087a4cb03985a874bc3a24df7192772e
SHA512 79d012a296d907d4daae3df1ec854690505fe82fb634353719312d696b01f772784962c9c3b28319e6da4fa2dbb3f91a5f7a618c30de260b830ef8730f0e4766
SSDEEP 192:sxRWRFpb2/fSssJ3HzoA8p4U/g6+WNIYU2RfkRYGlIgDwJ:sxRW52/fSs43uN/5I1o
TLSH
T154328515AE68A93B9CCBD21DFB657F53D6FD1032A1D12E48A6FC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8702eee5-eed3-4011-85ce-9c554d558f9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8702eee5-eed3-4011-85ce-9c554d558f9f.tmp
Size 10KB
SHA256 3cc803ec4a3be18ba73d6f917f29e53045e180f428b0f52dda77f5b79a700f45
MD5 865288f9025bc2e59049751656282ee6
SHA1 3092e40457ee4a082ff5c408c85be665a542e725
SHA512 6ff7ed736f4a7ad5d584007a71ac960e24ea687f72c068b76ad8a58ce4e5b7af95b8e8d5ee1952de1231b0fceecc7ebb9c347e5d695e1e6fe5ed4e93b4a18e25
SSDEEP 192:sxR1RFpb2/fSstJ3HzoA8p4U/g6+WNIYU2RfkRYGlIgIJ:sxR152/fSs/3uN/5I1s
TLSH
T1DA328615AE68B93B9CCBD21DFB657F53D6FD1032A1D12E48A6FC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 24df7be92ee16bce8071b67022829c76577cb62a5ed1b24f6771cfabf5cc0c33
MD5 9bbae98fadd129543a88d70ba64942e0
SHA1 4638f530f10b6285977724968516fba55d121e7c
SHA512 0acfabc00a119203fb26c50b0eaf2521ce9a27f049d4a106a6ac49bfc0cbd7622d711581602dc73077c102df91996b8bd207cd1fb2d8154e72f3182b08ceb063
TLSH
T178619769A280C0B5FB5E4474DADF8D973A34DA8FECC31F520698D43AA4C63278758798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ab3e0c946bc36f307d78c9a18a01a8484ceeb2a75307af79f47e2873e8dc9b17
MD5 1bfcb6a65eb520e771d7e835df03ff36
SHA1 8c55000d7163e3c5f0b102b36edce3b40c2131d0
SHA512 7b5920f9e165add5d1fb59d67ba03d32e850311cbe911088580b6bff9111ef29eed820350ee1fdecfd60344fb44b3a9412a7f701d748ed933f34f901712858b0
TLSH
T16A61A869A680C0B5FB5E0474DADF8D973A34DA8FECC31F520698D43AA4C63278758788
MD5 SHA1 SHA512 TLSH

Submit Download

b3e62145-17c1-4f6d-a507-2d99e3053c2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b3e62145-17c1-4f6d-a507-2d99e3053c2e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c24b7411-36ef-4314-b1e3-0acba893393f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c24b7411-36ef-4314-b1e3-0acba893393f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c55fbf9f-cbde-4dce-9336-668ae2caf0c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c55fbf9f-cbde-4dce-9336-668ae2caf0c8.tmp
Size 1KB
SHA256 b89edd10ec04751fd685370c853c92761a82df199f87889d89d3c88c06c45a6a
MD5 db60c3a7e70d3eac762df901d5870467
SHA1 1ac558302185a687139b390912fcc0cf155b94dd
SHA512 40b69c210a460f6a58c925385b613199307eb9e2fe01b792828bfcdc5e98c909bebc02aa4424910ebaf79158785a165478ad6abba39f64d52e69fa334d1a8c54
TLSH
T1ED31C2F787B4857E9A0186F0AB14AE1FCE2D0515432C786985E4AE2793F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

d3ca3944-7cf1-4614-8d44-910642089d5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3ca3944-7cf1-4614-8d44-910642089d5d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

aced9908-19b2-4ea9-a047-89ad8f7aea72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aced9908-19b2-4ea9-a047-89ad8f7aea72.tmp
Size 11KB
SHA256 3f89ec3e2f83188e7b6353d6f94b50f90710e796d84936448139a38ede4152f6
MD5 83fd6ce097abc031afe27ecf8fda50e0
SHA1 c07beac176e43590b0d9342865370703e1674440
SHA512 8084d17ec7f8abcaca848416dfb1282e6e2cfde18bf0b2a88a0b2256a11e0de53d31e571ed0f537a5bb22e9c3767e3d03d84a51069455de39c205a3d79b0e0ff
SSDEEP 192:sxRWRFpb2/fSss+3HzoA8p4U/g6+WNIYU2RbYRYGlIgDSJ:sxRW52/fSs73uN/5Izi
TLSH
T131329515AE68A93B9CCBD21DFB657F53E2FD5032A1D11E48A6FC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b0e008c-7443-4649-8e4a-f1cd03e29bdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3b0e008c-7443-4649-8e4a-f1cd03e29bdc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7710ce86-3dd2-4466-91b9-cb7f020a7287.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7710ce86-3dd2-4466-91b9-cb7f020a7287.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f933203a-e21d-45c9-bd47-08f03bc0ba96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f933203a-e21d-45c9-bd47-08f03bc0ba96.tmp
Size 34KB
SHA256 31d21a7d26158a31005d7b3bcbc1daee3f3e0fdd57e59d00c303e60a7591310a
MD5 dbd28747f52f2a305f77d886d1a0e8e2
SHA1 8b4ed1d9a6b54716153d9d3abff0f0f985c57dbb
SHA512 c4d547c84a032db75327beaee4d87c24a1d75d7e6059e00390dfd33dabba570d1736d1a70b6c7c4ef27a0ae9206cd655b06040d0e4f41436268c7bd5980be7e9
SSDEEP 768:xX3jFlfKvHBE57Y0GZxJsXBdK8ZJE75EKvLZ:xX3cg70/JsXf7rkXvF
TLSH
T1CEF2BF30E8A09E774EB7D7A1B20A3687FEB48263C6C90E54D9DD9B4C01C759E138791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download