ca5deaf200c3df7308c1c49ab464bea98af779f5133ca8ad60ca52c6727a4164

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app/Polystat.html
Size 564KB
Sample261104-w1b3fsec62
SHA256 ca5deaf200c3df7308c1c49ab464bea98af779f5133ca8ad60ca52c6727a4164
MD5 1676475ac668c72022f1b6c27d3d6d94
SHA1 9dfbd29afec4ca706f9a4f49320deebc1da7b6a7
SHA512 5068922c5d132b8b44dadf2b155fa8c7008d545bf0c85cf64f435671196a5ce38a732db6b681bc15b3f065315afd5d6e28499782bda8e5d470b78abf613d57f7
SSDEEP 6144:9PCqNkT1I/a3WQ/g8oEBDnBLvBbLqd5J7x4mkfrwEPP59w0B8lv0vjJKodSuyul9:9PjNkT1a7EBDnBGZGv1F8lvIn9D3z
TLSH
T1A3C48E61B3A912368AF350D0295F0295F6388417B545C8C4FDAE85D20F8BD7291BFFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2964	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{003ED158-6C09-42A1-A8F0-C1C6464464DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3356	3772	msedge.exe	90
PID 3772 wrote to memory of 5768	3772	msedge.exe	91
PID 3772 wrote to memory of 2964	3772	msedge.exe	92
PID 3772 wrote to memory of 5768	3772	msedge.exe	91
PID 3772 wrote to memory of 5768	3772	msedge.exe	91
PID 3772 wrote to memory of 5144	3772	msedge.exe	93
PID 3772 wrote to memory of 5144	3772	msedge.exe	93
PID 3772 wrote to memory of 1932	3772	msedge.exe	95
PID 3772 wrote to memory of 1932	3772	msedge.exe	95
PID 3772 wrote to memory of 1932	3772	msedge.exe	95
PID 3772 wrote to memory of 1116	3772	msedge.exe	96
PID 3772 wrote to memory of 1116	3772	msedge.exe	96
PID 3772 wrote to memory of 1116	3772	msedge.exe	96
PID 3772 wrote to memory of 5588	3772	msedge.exe	97
PID 3772 wrote to memory of 5588	3772	msedge.exe	97
PID 3772 wrote to memory of 5588	3772	msedge.exe	97
PID 3772 wrote to memory of 5108	3772	msedge.exe	98
PID 3772 wrote to memory of 5108	3772	msedge.exe	98
PID 3772 wrote to memory of 5108	3772	msedge.exe	98
PID 3772 wrote to memory of 1864	3772	msedge.exe	100
PID 3772 wrote to memory of 3504	3772	msedge.exe	101
PID 3772 wrote to memory of 1864	3772	msedge.exe	100
PID 3772 wrote to memory of 3504	3772	msedge.exe	101
PID 3772 wrote to memory of 5752	3772	msedge.exe	103
PID 3772 wrote to memory of 2624	3772	msedge.exe	107
PID 3772 wrote to memory of 4832	3772	msedge.exe	108
PID 3772 wrote to memory of 3288	3772	msedge.exe	109
PID 3772 wrote to memory of 5776	3772	msedge.exe	110
PID 3772 wrote to memory of 5776	3772	msedge.exe	110
PID 3772 wrote to memory of 5856	3772	msedge.exe	112
PID 3772 wrote to memory of 5856	3772	msedge.exe	112
PID 3772 wrote to memory of 2952	3772	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\app\Polystat.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x320,0x7ff9fc48c188,0x7ff9fc48c194,0x7ff9fc48c1a0
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,6727385749680888862,10096901153693566520,262144 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14700074939168839518,2320269827593443774,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,15643122905540569363,4825644938565785840,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,524522086993881737,7191870442452308130,2097152 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,5315873026065955047,1118724255850494706,2097152 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,12693718523778455507,7557283778321930667,2097152 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,8821058630475693245,12994820745505112483,2097152 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4688808794770930921,8725489302289384051,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12573280598697825446,2810489243584010231,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6555794816302536974,8927542102478415991,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6555794816302536974,8927542102478415991,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,9253556411348188887,4821840812537074079,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,6893322858009140938,4840852498325014883,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10453682840565025072,17095949300590208131,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,14884265842841806564,4554986733425844491,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2236375655604404674,1202537543643283434,524288 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3656,i,3945016605722895726,15772398784725036697,262144 --field-trial-handle=2452,i,11431248477345033191,4442468642534853793,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5cda6e7c-ee4c-4b6b-b433-a85bd40c3961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5cda6e7c-ee4c-4b6b-b433-a85bd40c3961.tmp
Size 36KB
SHA256 f8c95466a6ae22d3a5b2c7e639944a6f4ed956baefbaccb09968986289c50518
MD5 076edfe5884da1b818a2498cabe3a109
SHA1 ce9fd587217aa00cf732e27fdb22b5ee5d6b7ce5
SHA512 5785681093e0f3aa54ad0c85c8ed8dd86d29ac983fa137c810b346d6f80bdadb45e6fde59621869a0ffb04a5d76ceb74db70ab7ad2897f355abec839d626dc0a
SSDEEP 768:lFd33XwgvVkKEAJE57Y0GZxJsXBdK8ZdPE75EzPL4:h33Ro70/JsXf7jPkUE
TLSH
T145F2AF31D890DE7B9EB7CB90B70E3247EEB482A3C5C54A94EAD99E1C01871DD1387D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

626dc4d1-50d7-496d-9a6e-1455894afd42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\626dc4d1-50d7-496d-9a6e-1455894afd42.tmp
Size 39KB
SHA256 4f1e8147e519aa6ee82c06f857eed0f69d57a8e88437a1888737c74818d46755
MD5 e468de3e5b0f92cfda9f099a264cfa13
SHA1 7f10267ff4328609014908b65513d8bd97798fa6
SHA512 eff4998060dd0c32af4d8dc6ecacf5ae40041f5c46192b1a5243669ead045bb0b75c1cc2aee201be73a3ef4f7de8d1a55902bbb7dccd5adeddc3ef7c53b3492a
SSDEEP 768:O/UxvxjgC+A3BXpkKEAME57Y0GZxJsXBdK8ZdPh5Yd:DZj3+A3Bj770/JsXf7jPcd
TLSH
T19903BF30A8A46E735DF7D690360B7787EEF446A3C5C54D988AED6F0C058B2AD034791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6919bec0-e737-4312-8fe8-b6936715975a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6919bec0-e737-4312-8fe8-b6936715975a.tmp
Size 37KB
SHA256 8685002742fbf66d1c12a4c3ad295082449f2d771a7ecbc6a78abaafe1c1e393
MD5 e8da3f4bdf2368ca26f1f741e0aee46b
SHA1 dcfa6d3ef5ab3d006d095efe89c93cf789b71674
SHA512 de3fd5592486bac28bbe6e7ac5758382e52989b139de23f28abfb1d2ca1c5497dfd85667d0519dc417afc0dc44ddd9f12c1ab12fa5f79b7784cec555ed1e7d10
SSDEEP 768:A/UxvxjgC+I3rRKEoE57Y0GZxJsXBdK8leSHUPpMs:tZj3+I3N70/JsXf7sSfs
TLSH
T13503B034E8A05E735DF79390360E7397EEF446B3C5C55AA48AED6F0D028B26D034395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

2d9b9d8c-02d9-49e4-9a4c-b6c137036f70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d9b9d8c-02d9-49e4-9a4c-b6c137036f70.tmp
Size 23KB
SHA256 67cd1cdc8e5877e5de20506f290cc7aec38cfb0b168705cd9c1efecf8f727038
MD5 f60b82a5461e50f53bd1a9ab27b9bcf2
SHA1 fae7bfd218ffb4f350653dd048c4303c9d52729b
SHA512 453a68b610fec05cb25df92aeff364d80b98d906ede32316e6e9af1ebc3b5491a4692ae99c6319cba0570cfc40503610a3bafb25149d40ff3061912e1e93ece0
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRu3roU:6JajXKWgm0fsO7n8F1+UoAYDCx9TuqhK
TLSH
T197B2C93B640DCB7F5FD00AAD9C19AF976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f4ed78a-e5ad-4780-8b3e-e2445393d6a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f4ed78a-e5ad-4780-8b3e-e2445393d6a3.tmp
Size 10KB
SHA256 1ecb74cd1634773b40992bc4c8ce8646bfa416402434b79ea5da982867c3692b
MD5 5bfa628bdb1def6beec001eb9da32e05
SHA1 2b1b96ddc551979efdbe2b19fe9780b1a0a36155
SHA512 b76381174de56f8e320ed3690a1bba3e1fa4c259fe5991901792a81bee05eb739b57c14ae2921771ea47a6e5711c1de6cdf708ebddf23aa34236b974ac11aea6
SSDEEP 192:sxRGRBbg/fSssStzoA8p47/g6+WNIYU2RfWR2GvIgDIJ:sxRG3g/fSssSgG/5I3Y
TLSH
T1E032A515AE68A93B9CCBD21DFB65BF53D6F91032A0D51E48B6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b79a8dc94861ff1eba19f9ae69b4de1d21af7d8d9c4e856e609385aececde502
MD5 b08c4a53ff055619af6458a4d550f872
SHA1 a003879ca47a67f26898df46e6ff3096f3610b25
SHA512 8124d5fb4e0a65246588cc2b5df17ef7d5f84e6bc90c0c653b192026872008dd802e06b32588f02dcd90bfe95f135d397cdcd1e90c9cac0be61ab653569b16fe
TLSH
T163E026C484D9C23EA628B44B03FC670C83A4361ADFC46D8E2F00C4C874C1280E7CEAA1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e13f7309877732ff386ef9632a6717d886075c3357ab5a3371bca362615c4f73
MD5 7a86a0a4a0bc55d4f8aef32c78d36aba
SHA1 2224426419c4fceae7520f295966f4be6e361702
SHA512 327041a3e3c96672c28f04cd555d64bc71234067d57a7bc2962eec611822df63e75026620cf80b0e2d59652a2882caa8ea6392238f04405707e3c4949ccf507e
TLSH
T1726130F615905163FF98163ECEE04D8F37668D94AC932E2104A9CE7B7B4A326F1752C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df2664bf99704351735819dd7eca4aea32cdd13d9d970a2999fc585d20c60191
MD5 a104c04393f126fa291f4a52585b96d1
SHA1 f0ac34b183d69c39707cf10bdebc61a29322f0bb
SHA512 18e262c5ef9d9754f694b77487ca1765ebff5e48d7af109987821af8b29bcb156fb32e3815b1045c738f61ae13ead65a6796d3f6e554b3a32916af3e1e90966d
TLSH
T1B16130F615905163FF98163ECEE04D8F37668D94AC932E2104A9CE7B7B4A326F1B52C4
MD5 SHA1 SHA512 TLSH

Submit Download

614f35fe-fe10-4743-8953-f425125cf1b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\614f35fe-fe10-4743-8953-f425125cf1b9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d8e195f-27a0-431e-8d42-041a936cb3bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d8e195f-27a0-431e-8d42-041a936cb3bb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

af1b68b2-35c1-45bf-a7e4-7f8fad838d80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af1b68b2-35c1-45bf-a7e4-7f8fad838d80.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c2a88d46-2e2d-4633-9786-62fbe0bf1b2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2a88d46-2e2d-4633-9786-62fbe0bf1b2e.tmp
Size 1KB
SHA256 78370e1b81c4629821be8a627ed3311380ba2a852b11e77d07d0b73bbcc38bae
MD5 6119595f40839de134ef25246dc0a40c
SHA1 e2127f58fe1ad39a381802a219a3be52b7bf3d7f
SHA512 5cb2b90eb358a6bceaaf0a26a97b6446149a003bf1b5dcbfe37c6efee23ed02354c06b10e2387fe627ae5551c47ea1f72fd516a446a02895049536411150a7bb
TLSH
T12131C0F787B4857ECA0186F0AA14AE1FCE2C0515436C78AA85E0AE2793F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 37b5982b8b876ca29fe7a68c89996fc68dc0347a7828fcc7c3c36ff048d959c3
MD5 7b4ca88a870211eaedc9d7ba6ac528de
SHA1 04a3f3fec8524910cf2c088908aff404d7b8a4fa
SHA512 e2664617ef84b02544b1c272def42cb1cd97cb274e0be7be3a5af1faabd5a3ac2bb951a9c490e8f6a8b1487a5fd706ef7621a7d96be03da2151527b0409024ff
SSDEEP 192:sxRxRBbg/fSsSStzoA8p47/g6+WNIYU2RfWR2GvIgIJ:sxRx3g/fSsSSgG/5I3s
TLSH
T19732A515AE68A93B9CCBD21DFB65BF53D6F91032A0D51E48B6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dace8724-dfc3-4c48-a16f-ff4b3858ca47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dace8724-dfc3-4c48-a16f-ff4b3858ca47.tmp
Size 11KB
SHA256 29b7e9f07b8c027728374ebbad6cbe778f70304bff61d34896e6926e0c926cbf
MD5 1c266ffbc4fe99d3f3230a3d08673639
SHA1 f22b9719387046b1e704c2ba46d38ca5854c9216
SHA512 383d68927b0eaa0923ceec21cc0edd950a196ffc3ec00b08aa5817d6cb72cca8de9ea5922a6c237ea8de0075d999666e8c889a68aefd2afdb366049ff9a51fd7
SSDEEP 192:sxRGRBbg/fSs+StzoA8p47/g6+WNIYU2RzeR2GvIgDaJ:sxRG3g/fSs+SgG/5I9S
TLSH
T17F32C615AD68A93B9CCBD21DFB65BF53E2F91032A0D51E48B6FC8A1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fb33347-6622-40f5-bbfa-94e586866de6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5fb33347-6622-40f5-bbfa-94e586866de6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d02b1d96-da7b-40d2-9251-233cf6990309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d02b1d96-da7b-40d2-9251-233cf6990309.tmp
Size 34KB
SHA256 9dffb9654568725769561036ee49d220f1aaefe39c02a9372f004beaa01bd2af
MD5 05058a6874d93d188a13f2eaedd29162
SHA1 fc463b731000fecdac80333b530433268397def2
SHA512 ffa43dc7eb9e4311b03ed9d2a7ba4cf3ba78ae7757ad233a87b7b313f3ba516d72ab20e00aa7271fb8f61a784c021c3e80d271183b2a8fa759056e9b5a074032
SSDEEP 768:HE3nVkKEA9E57Y0GZxJsXBdK8ZdPE75EzPL4:HE3/k70/JsXf7jPkUE
TLSH
T103F2BF30E8A09E774EB7D790730A3687EEB482A3C6C40E94D9DDAB5C01CB19D138791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d41c874c-741d-4af1-b23d-48471630afc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d41c874c-741d-4af1-b23d-48471630afc4.tmp
Size 34KB
SHA256 ff9da769267d7e2eb0ce1a61267f66c55d61993e6f709620a5861987bcb08ff3
MD5 517d2c1ba702dbff2e460023a307674e
SHA1 fb1ee526232de77f4db196bb8e7597b322e723fb
SHA512 27a61e96a7572c0552c980fcdf4719c6a00f84faea3752e1fcad5e5e2c115733150fe809058cf3cb391b926880fe164aab331c3f96707c3e7fffb7d6cd4fc77b
SSDEEP 768:jE3YVkKEA9E57Y0GZxJsXBdK8ZdPE75EzPL4:jE32k70/JsXf7jPkUE
TLSH
T103F2AF30E8A09E774EB7C790730A3687EEB486A3C6C50E94D9DDAB5C01CB59D134791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1e0bff0-c669-42d7-b2ae-6dc782cc234d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1e0bff0-c669-42d7-b2ae-6dc782cc234d.tmp
Size 38KB
SHA256 17c0b6e309886ed738ad006f56995c728b23680d95d014e03b7746c61afa4e97
MD5 1bd8ffd567fb2f32f0540c2ccd647885
SHA1 77a48bb0f4f2683d08498f1f136d3edfae9c492d
SHA512 5f850e15e85af0fa9b1f1ba09bfc7716093b53bc8db026451ad1d8dbcd819a6fea85483f36b3765428ab67bdc83289318caeec9a4a6339597d03fb010ed60b9c
SSDEEP 768:c/UxvxjgC+I3tr2KEAYE57Y0GZxJsXBdK8EdPSHUPpMs:JZj3+I3Zv70/JsXf78PSfs
TLSH
T11A03C030E8A05D735EF7D790360A738BEEF446A3C6C159A45AEDAF0C028B26D034795B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84886afd-eecf-4973-9870-25b4450b538f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\84886afd-eecf-4973-9870-25b4450b538f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5752-181-0x000001F116C20000-0x000001F116E61000-memory.dmp

Download