81fc9f613155335d86fcb961206929349a880aeef0a6f921caad8bdbea2f25e7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 101KB
Sample261104-xdfb2ay13k
SHA256 81fc9f613155335d86fcb961206929349a880aeef0a6f921caad8bdbea2f25e7
MD5 03d767a86e5ed5d532d48612d20ce528
SHA1 015e9439df8187e3ef7e9012b2cca3d1c202c657
SHA512 f5887e60295e3c7e7fb1e73c0b7789133a392e5bac8870228ffedbcd3bd1d1d97753fb31db37c53392ca4138dd0a47c5b39003708ac9f45224c06b1fa55920d4
SSDEEP 3072:TxhleiE6Mhmhh9BIQKZjiD4BJALjjbmoVR3DP8waPj0TZipRO:5/
TLSH
T1DFA3C54722041668C2B349FC90F079D0328BDE1ADA5193B097ED5C399FD66A913B2F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{F1C2D329-0EF8-4D63-BEAA-544029A0613D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2408	2564	msedge.exe	88
PID 2564 wrote to memory of 1492	2564	msedge.exe	91
PID 2564 wrote to memory of 5000	2564	msedge.exe	92
PID 2564 wrote to memory of 1492	2564	msedge.exe	91
PID 2564 wrote to memory of 1492	2564	msedge.exe	91
PID 2564 wrote to memory of 4644	2564	msedge.exe	93
PID 2564 wrote to memory of 4644	2564	msedge.exe	93
PID 2564 wrote to memory of 3036	2564	msedge.exe	94
PID 2564 wrote to memory of 3036	2564	msedge.exe	94
PID 2564 wrote to memory of 3036	2564	msedge.exe	94
PID 2564 wrote to memory of 3208	2564	msedge.exe	95
PID 2564 wrote to memory of 3208	2564	msedge.exe	95
PID 2564 wrote to memory of 3208	2564	msedge.exe	95
PID 2564 wrote to memory of 4796	2564	msedge.exe	97
PID 2564 wrote to memory of 4796	2564	msedge.exe	97
PID 2564 wrote to memory of 4564	2564	msedge.exe	96
PID 2564 wrote to memory of 4796	2564	msedge.exe	97
PID 2564 wrote to memory of 4564	2564	msedge.exe	96
PID 2564 wrote to memory of 4564	2564	msedge.exe	96
PID 2564 wrote to memory of 2724	2564	msedge.exe	98
PID 2564 wrote to memory of 2724	2564	msedge.exe	98
PID 2564 wrote to memory of 2724	2564	msedge.exe	98
PID 2564 wrote to memory of 2588	2564	msedge.exe	100
PID 2564 wrote to memory of 5972	2564	msedge.exe	101
PID 2564 wrote to memory of 2588	2564	msedge.exe	100
PID 2564 wrote to memory of 5972	2564	msedge.exe	101
PID 2564 wrote to memory of 4380	2564	msedge.exe	102
PID 2564 wrote to memory of 4380	2564	msedge.exe	102
PID 2564 wrote to memory of 5028	2564	msedge.exe	104
PID 2564 wrote to memory of 3336	2564	msedge.exe	108
PID 2564 wrote to memory of 3880	2564	msedge.exe	109
PID 2564 wrote to memory of 2604	2564	msedge.exe	110
PID 2564 wrote to memory of 4216	2564	msedge.exe	111
PID 2564 wrote to memory of 4216	2564	msedge.exe	111
PID 2564 wrote to memory of 4200	2564	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffafeb3c188,0x7ffafeb3c194,0x7ffafeb3c1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,4406878005765938273,7483378243349685145,262144 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,15433093329306972426,9755475381866561784,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,1089206395930400634,17759718430400086900,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,13575448121964699412,6368597405080840182,2097152 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,446877460065353596,11667749870208778319,2097152 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,13090345685875831659,3348658300349274903,2097152 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,3371277735356256353,6398393234193710982,2097152 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,13130406789587976654,7709998688738233240,2097152 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,18401819752600748093,2821802748463625947,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16083110572122035913,5895526645736516590,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3096,i,18276504641311053736,1574558323493586627,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:12
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,6736727057908962227,14771740450930990630,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,6736727057908962227,14771740450930990630,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,17739038366588037604,4015218160432999348,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,65064412094287836,5338694293067572481,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,8840923193315720728,8777135408269529456,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4393215992895779461,16871717721403093924,524288 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,3330625010637581882,4827438953674681406,262144 --field-trial-handle=2848,i,540868496869907732,14225349150092835061,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03605737-08d9-4b72-ad36-1e9922517352.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03605737-08d9-4b72-ad36-1e9922517352.tmp
Size 39KB
SHA256 d27b8ec5d4b913c8db8fbca0f94f646a3e5afbcc82fa9a8a4a740b4cde99042a
MD5 d1040ab36796bb0a1eddc339997abeee
SHA1 b873733b9ff6de9a0ce9d9a00054ee63715b8a95
SHA512 97492849f53d060482d14fb97e38735e09406eb30d1d743c1c79862c3d78dced0eeac700a34b758838cd744acf1c9e98d4a197151d59bf4fa7c88bfc9a9e6642
SSDEEP 768:U/UxvxjgC+B383ngm1l+OZtLFDmGA5b65Q92RQMPqSFj0O:BZj3+B3+PPAF65dQiFQO
TLSH
T19003C036ECA4EDB39CF552C1364BB35AAFF94563C1C951E009E96E1D05C768D430B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ff6f2f9-1925-44dc-bebd-c2819bce5e44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ff6f2f9-1925-44dc-bebd-c2819bce5e44.tmp
Size 41KB
SHA256 5082074205174ff88562ff7d6df9c23bfdb4a06980ec1989eb5b743f19fac182
MD5 267c9fdf909052ed140c9b69fe072fbe
SHA1 c6800502b345905e3840ebc001ab82588d2ce234
SHA512 3b44b89d8e1c323a1656d52ce1d55e5fbf9ed8e9fe152294d8da3244bdd9662ec86ae9792fdf4b8dc5ea9b35c64136a0dfbae8d6a5a21e72c07f62ed74a14201
SSDEEP 768:3/UxvxjgC+k3U1+tgm1l+OZtLFDmGA5b65Q92RQMPbSZ75Eb8:qZj3+k3ciPPAF65dQ5d+8
TLSH
T11713C032EC94EDB36CB5A285724B7356BFF84563D0C952A058EE6E0D01C7ADE430B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

304bff87-539e-4866-b6f7-63ffb8af2af7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\304bff87-539e-4866-b6f7-63ffb8af2af7.tmp
Size 11KB
SHA256 f1ad0ab1be7eeb41ce9aa9719a1a3d419967eb9aa357760b6f794dd46e7b944d
MD5 7d34ddc3de830f623b2d75991bbd4dd9
SHA1 a622dc9b78966f3e6d53178da0c1280e39e6373f
SHA512 6bde685545f45f71709df1021e6e1e51394ad7c7fcc55a9ca3a0be332421bcc0e4a2c8b68ddce9cf69389949c96246405854d59bacb13827f539c9c8497ff233
SSDEEP 192:sxR8Rtpb9f/fsqswyYhjzoA8p4q/g6+WNIY2FEccG9gIgDLJ:sxR8B9f/fsqswbSv/5It2x
TLSH
T1AE32C815AE68A93B9CCBD21DFB65BF53D6FD5073A0901E48A6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46aadef0-6917-4195-86ba-9d16765fde77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46aadef0-6917-4195-86ba-9d16765fde77.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c7f5fe6-84b3-4ba9-aa33-83625c830565.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c7f5fe6-84b3-4ba9-aa33-83625c830565.tmp
Size 11KB
SHA256 8f57b5c6530075fab795eaee6dcb2ccfdeb5a062c3d79cdc86f55d83b7b24e00
MD5 d23b5ba38eea3ba51f320c19483951df
SHA1 3e8192e9dfef5b6c0c6af67514dfeb1384522b3c
SHA512 2e43a284b7d14777c93b19244db5dad5457c5ae6a82b29ee344d93cab96775e187eddc9a6407282adbb13c4f89d8a7acb3fbe9b59af970ea647c0ca2e337ca14
SSDEEP 192:sxR8Rtpb9f/fsqs1yYhjzoA8p4q/g6+WNIY2H+ccG9gIgDdJ:sxR8B9f/fsqs1bSv/5IR2b
TLSH
T16532C815AD68A93B9CC7D21DFB65BF53D2FD5073A0901E48A6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91d28685-096e-4b88-8849-d3f0311d776d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91d28685-096e-4b88-8849-d3f0311d776d.tmp
Size 23KB
SHA256 cf310adc92f008c58122db670d218476114b94eac1ab3bfd60cacd424d8b6d55
MD5 2167cceae4646d4636342cdcc60cf869
SHA1 212887af9208d809a93c69e3f07c2946d8ca4fd8
SHA512 b01adcc07b7408b6298b352088949eb11f1cd6428aa3ac5ab75d30633e9f3d06a30b908a2e2d31a68589a4a987e04b1d9b54de60c18b2514e2d81a48bb82e42d
SSDEEP 384:LbnaaCTfCtgp/FfrDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWrroHr9:L7aaCDWgptfrD8F1+UoAYDCx9Tuqh0VK
TLSH
T1DDB2EB2F640CCB7E8FD00A9DAC596F9B7E9802C796588D4047FE984C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3ff7918e540fe5daa5bf379925f46be9966924ab3ab310ad9021b0d59ed39a48
MD5 fe5d2a1207b01559144e04041f24bc57
SHA1 1fea494e0020961e52bf2c1d8b040dd7c2a3f7f2
SHA512 966a650c859e0f3100222671b2d177e0e62fd44a78e8c623cd7c28089853cf0c1a196e63a6f5f9327d260fbf52cb44d79ee1e8038cf1a7de244be2cd92c13f8c
TLSH
T1F961ABC258479AEBDBD292398DDD1F43B13C117994B72ECA4856CCFD1702F6C8A008E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 93d96377595eebff80338e479ba8a28f7330ea1e989a291d45fcc06c5f02d8d4
MD5 cb5b21fa98800f6a3e0d3d3cab29a621
SHA1 81f7e279e276c0ed1944e5cfce852b96da8948ca
SHA512 80fa6529e35fb7ef19bcc38e41d96204a8c434a01dfbe917b98ed2fa640d95521e9a9c8173a522a2ee517159d8953ded2e147866319932db74e771cef6d8a878
TLSH
T10661A7C2484399DBDBD68239CDDC1B87B13C1178A4B72ECA4896C8FD1706F6C8A408E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

12e1ca56-737b-48d1-b50d-09c3b1c0b6d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\12e1ca56-737b-48d1-b50d-09c3b1c0b6d8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

2dacb29c-b0a2-40ee-8941-8a7f720fff18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2dacb29c-b0a2-40ee-8941-8a7f720fff18.tmp
Size 3KB
SHA256 7d49b48a663ec0d4e852ea51368a48143cb10f8622602bade4c0661f53211229
MD5 d8e5cc2b2fb2e7303c3dfcb51fbbe048
SHA1 7786c83ab878dd48a6a972bf6633876419431f70
SHA512 2ecb9fad0db8f2c62965ae2689f56ef700da9e3d3b0dfb20aed85d57ca9de3e2f18ca2e78832e3e1d1aa4e7564a24d69eefe203ed653ecec6d853b99d9f10b59
TLSH
T18C71ADF783E4837E891196F09A25AE1BCD1C151B432C7C528DF4AE5B53F2472D1426AF
MD5 SHA1 SHA512 TLSH

Submit Download

f9285021-5d2a-4a38-9369-85722352592b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9285021-5d2a-4a38-9369-85722352592b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 55ac12cce3e840b794f7c77ef003a3582cc44f88529945809c9b3d8b204a3125
MD5 b1c19c2c22bdb604b8a8ce576851b493
SHA1 39081434541942a6a01c7ed2fa438c3590af5bd1
SHA512 4462ba4a06edc918e737399d9efe87d7a65b00875c01bad0d11d28f4293820e53ea6a5401706de1b7eb3890e3c3e976c2b234190f58130574662719013e65d8c
TLSH
T109217D10713642506F7D350841F88A179A83F1B2311EE77E77B8C8651AA6F245DFC4C9
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000004.log
Size 834KB
SHA256 82c5f671d77a8caefbfb2e436db76d5bf36c7891e9aa1fd4198476224d135b23
MD5 0f6cea60a0585eccdeadb0ee88381989
SHA1 13e9753fdf35bbaf86c81cf1a5f4e8370c51813d
SHA512 fd94df522316374e141c9621070fa5db37f019f7327bfe495b520cec50e98db79ea9609abfd8f4f3d844489541f9636934498e4d124d1f991ff02696e7091f86
SSDEEP 3072:Hbk8RysQ7eVeE+e2n6ws7gBpjHleQE28QS81W0ZteniJc6ADiP88v7tmorOd63Dh:g75FpqanKXVwaYu6efxFadlBd
TLSH
T16405657AACA09033DCF38379B9B517C5BBA1674278494C1FD2E2B7440E77B272986D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 77020e532935fc6242f49b03d9e2a13fa4f4e2d112008c6dc2c7a8060052db12
MD5 9b98a673ff89622be547882700795e96
SHA1 93a1c90ff5a1960ac2d7a90435fa5891a31f4dd8
SHA512 922192727682c5e2a49ee1737d0169d93543688533ea0204b4ff5b0d13bbe570b73f76194de650e4455d38487dd3eb0b333820b02cf0514670a20261417f4300
TLSH
T1C0319603EA5C4879C4504733D0E216DFC7F1F28A260563DAFB157524542DA078DF7A0B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\LOG
Size 654B
SHA256 71d6e00a385b8232ac522b8f60dffaac56ae6da7f4d83d654876628812d76a09
MD5 edcaea4336736b54c5a8f73a9365ccad
SHA1 a5e60f661d2590cbf9469009c49d2da338487597
SHA512 41e614da2277d01893d7dd28055107fc77889f010ab1ad193dc0de0fe21e369d7833793db33e960c84e8d9470363f85edf1dfa568843228d62f349a61b628fa1
TLSH
T1C5F07B8BC6F1C9394529F0B285B8372B95575025AF887F485FD4F3897DC0605900D0BA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 84B
SHA256 cbf87e8bb03d5194db3edf42c3c943fd4452f83d289197d6b5c85f3946745fd7
MD5 716ba22fde5a1432bc5c6abad365453a
SHA1 40121a32c2072a01b1818ab2d5e86800c0bda0af
SHA512 f97bb41e77394cb7e8a1390f1735999fd588709248a0a43a2f8741e0e5da007adf3051cb40a609356665a8bca980abcc45d021eafdb7060303b20ec7996022f6
TLSH
T1ECA0123593C01B96D4A00431887F4100C61375840002F30A2025041802006000E35419
MD5 SHA1 SHA512 TLSH

Submit Download

f07301eb-472e-4930-89b3-ac95305916f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f07301eb-472e-4930-89b3-ac95305916f1.tmp
Size 11KB
SHA256 f337a459424adb8cd28c0b62cf3fecb0a69edb93fe0b8e8684a68e71f7e54f7a
MD5 75ca7d7b454cb8f201f357431ddc5dd2
SHA1 d89d60fcc838d62bce284c7320438a5314ac1d03
SHA512 f8c9efd3c47b27a6db3021da6a40d7ca4ac8212a6e64ff4350d59da959d369bc388a6a01be1b823a440c2c9d3e1e874e5c666a8217fb25fca84461db1e2172e4
SSDEEP 192:sxRfRtpb9f/fsqsCyYhjzoA8p4q/g6+WNIY2FEccG9gIgIJ:sxRfB9f/fsqsCbSv/5It2s
TLSH
T15B32B715AE68A93B9CC7D21DFB65BF53D6FD5033A0901E48A6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a67c1d5-7e6d-448e-87d3-3329ba24a562.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9a67c1d5-7e6d-448e-87d3-3329ba24a562.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aeae11a55131ba41c56c4dcd74357d4144865a10558369c61ad563246a84233d
MD5 c41463d0453de917d0178364483cbefd
SHA1 fa5151f0162ab4138e5a8da5cf9437fc3480d403
SHA512 ee83fabc352a72cfe061a98676b0946f71d556cd5294feca44f4a482d723525bd2f90664d2a99feed329c2f431914dbbe5f552cc83feb2e87e29b03e827217a3
SSDEEP 768:cY3U1stgm1l+OZtLrDmGA5b65Q92RQMPbSZ75EKL9:cY3coPtAF65dQ5dx5
TLSH
T1CFF2BF31EC91EEB35DB59281B24B7256BFF48153D5CD4290D9EE6A0D00C7ACE134B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a9c56f7ee42669d52a51eb67a667524b3bb89a7614f2231388277c1d99b82773
MD5 46283cb51f763099b6675ccd2ea507bd
SHA1 9127ccae37e105ac050b90acaca32663e4e79b59
SHA512 fdb5d6cd9862f7bb69b2d2f5e270bdc8cbaea326402011689f3f68eeae88c65e6940c567fd82730a132ffd07ae8345a314d381f6a9fb9a5030a75f963b63b3ef
SSDEEP 768:fFdP3Qwge1stgm1l+OZtyDmGA5b65Q92RQMPbSZ75EKL9:/P3ZouAF65dQ5dx5
TLSH
T1B703BF32DC94DEB7ADB99B81B64B7255BFF48163C4C98290EADE6D0D00875CE034BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e478d0f2-751d-4f54-afc8-14fdda654794.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e478d0f2-751d-4f54-afc8-14fdda654794.tmp
Size 35KB
SHA256 f92eafebb45757b9c84af39e0ec5637171a12ce194ae1ccfdd0cdd9ecfcd7c25
MD5 14b3d48efab3d016f5a3cf590dabd1ab
SHA1 7fb836a2c15899954f76291ee5b74f2b8d3f2be7
SHA512 47730138769a387eeff45c65c82d742edfea61b673032e4051e623b13c41fb79a2bc0c139ad3fd519990e5e45a23c044bd81b59883f9b595353d306f0afd3d5f
SSDEEP 768:NY3h1stgm1l+OZtLrDmGA5b65Q92RQMPbSZ75EKL9:NY3/oPtAF65dQ5dx5
TLSH
T1DCF2BF31EC91EEB35DB5A281B24B7256BFB48153D5CD429099EE6A0D00C7ACE134B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62a5b205-13cd-4275-9f19-b6014dff7dbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62a5b205-13cd-4275-9f19-b6014dff7dbb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f95682f8-45e8-4381-81d5-b2aa5bd3e7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f95682f8-45e8-4381-81d5-b2aa5bd3e7a9.tmp
Size 39KB
SHA256 fe7815e9da5ed8a966f9bbb041185f9b2a0064b3a1ff7fe335e73c016548914a
MD5 aa1bab83f5a93c73c742f8c8c8132544
SHA1 c625bb8123453898b4d2c40a17c1eacc18644c14
SHA512 6fab961c54be6360e7150399d4e7707ac738d884a4add21e92fc014771421e5a33c974a07cbd508d6935035b7c0761efa531f1732e2415afa1698d8d554e0c46
SSDEEP 768:U/UxvxjgC+B3sL4igm1lJtDmGA5b65Q92RQMPb2Fj0O:BZj3+B3EX3AF65dQZFQO
TLSH
T1F903C036EC94AEB7DCF95280374BB35AAFF94473C0C952A049E96E1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download