hxxps://docs[.]google[.]com/forms/d/1mX2GDZl_wLRKeq035rG9srdvD2rxtEBUdWNuFg1hTOQ/edit?usp=sharing_eip&ts=6aee7bd1

Analysis

user interaction
yes
max time kernel
175s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/forms/d/1mX2GDZl_wLRKeq035rG9srdvD2rxtEBUdWNuFg1hTOQ/edit?usp=sharing_eip&ts=6aee7bd1
Sample261110-eekzsscf99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{337DE7EB-26D5-4429-97CA-2118D95AA7D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4848	4660	msedge.exe	84
PID 4660 wrote to memory of 4916	4660	msedge.exe	86
PID 4660 wrote to memory of 584	4660	msedge.exe	85
PID 4660 wrote to memory of 584	4660	msedge.exe	85
PID 4660 wrote to memory of 584	4660	msedge.exe	85
PID 4660 wrote to memory of 4340	4660	msedge.exe	87
PID 4660 wrote to memory of 4340	4660	msedge.exe	87
PID 4660 wrote to memory of 5476	4660	msedge.exe	89
PID 4660 wrote to memory of 5028	4660	msedge.exe	90
PID 4660 wrote to memory of 5476	4660	msedge.exe	89
PID 4660 wrote to memory of 5476	4660	msedge.exe	89
PID 4660 wrote to memory of 5028	4660	msedge.exe	90
PID 4660 wrote to memory of 5028	4660	msedge.exe	90
PID 4660 wrote to memory of 2192	4660	msedge.exe	98
PID 4660 wrote to memory of 3516	4660	msedge.exe	99
PID 4660 wrote to memory of 2192	4660	msedge.exe	98
PID 4660 wrote to memory of 3516	4660	msedge.exe	99
PID 4660 wrote to memory of 2908	4660	msedge.exe	101
PID 4660 wrote to memory of 464	4660	msedge.exe	111
PID 4660 wrote to memory of 3212	4660	msedge.exe	112
PID 4660 wrote to memory of 2112	4660	msedge.exe	113
PID 4660 wrote to memory of 2736	4660	msedge.exe	115
PID 4660 wrote to memory of 2736	4660	msedge.exe	115
PID 4660 wrote to memory of 3384	4660	msedge.exe	117
PID 4660 wrote to memory of 3384	4660	msedge.exe	117
PID 4660 wrote to memory of 1552	4660	msedge.exe	118
PID 4660 wrote to memory of 1552	4660	msedge.exe	118
PID 4660 wrote to memory of 2024	4660	msedge.exe	119
PID 4660 wrote to memory of 4812	4660	msedge.exe	120
PID 4660 wrote to memory of 4812	4660	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/forms/d/1mX2GDZl_wLRKeq035rG9srdvD2rxtEBUdWNuFg1hTOQ/edit?usp=sharing_eip&ts=6aee7bd1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdd87ec188,0x7ffdd87ec194,0x7ffdd87ec1a0
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,16654776375559436998,8723370773988230552,262144 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,8390636681517846822,15312566623267915184,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14095353810619257993,1938343602784882776,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,9019986114215581399,16174876457839277175,2097152 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11485381092242001642,12275593291867059464,2097152 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4284756821802873692,13378677133272884118,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12390138228920687397,8258439061752212821,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,379442039586038287,14201510637681679035,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,379442039586038287,14201510637681679035,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,289525567921765063,9524736522216563507,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,12469120512687044434,788981747659985174,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,10052327170244785048,4827496388800717481,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,3765926895561451169,16749702850032597625,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6413851147371857717,37050870774248537,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,7877682012979579184,12531409810815684229,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5572,i,6192351177849306848,10025023226999300133,262144 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,17129076662167536735,4333002357203061796,524288 --field-trial-handle=2028,i,16285300051860415301,1373257905032640864,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

574f3310-6e1b-474a-9622-c283294cd01e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\574f3310-6e1b-474a-9622-c283294cd01e.tmp
Size 27KB
SHA256 2e3b285163b9043b2d03ffa2bca76a5271ceba58f27d893eac3464231504d363
MD5 239ceed97eb3c4ed6a3b2d9fbda7f6f5
SHA1 b6e9ec500b4f5008a39309f529ba963f64631e4d
SHA512 64ed466c68516e7ea7f1d71358ecc209d918f02ab60594055b1e781b24fb365d5e21d326479b249cca635a2ade9d4dd13156ff1d798fd0126037cf31acbea760
SSDEEP 384:nziFzQkUSvn3sN98TUNTUlI4oaKMxyHwzWfLBCW/Cv5wJuOMiNvaTZcsgL/7Iz37:eFdn3MwgIyiEBC2ChIyiNvaTZckLH
TLSH
T1D5C24A32E898DDABEDEA4FD5A64E3643EEE04253C98C5AD4D5C81D1C00DB1DD174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a59e912-219e-4d4c-8924-00c712c7fb24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a59e912-219e-4d4c-8924-00c712c7fb24.tmp
Size 32KB
SHA256 f4f6833539494f17e7fe46ad82082001203887b11c1c2da604e479081431371a
MD5 ea9403f5938808136b5d7a91d8cdfc6d
SHA1 6de4bdba5822ca75e0a8d3cb9d601483ff9ad4fa
SHA512 3e39ab7ec9811d9236742e4c4e0c5f6b2202623bdb4720f1d88fd025806e5a0d988633e56aa84be838db960bb1c023461e570377b6c3cfb40ae1067ddd69aa64
SSDEEP 384:ngiFzQkUSv8G3sN98TUNTUlI4oaKMxOHwzWfLBCW/Cv5wJuOSmNvaTZcsgL/7IzL:7Fdb3MwgIOiEBC2ChIsmNvaTZckLH
TLSH
T10DE2B2F198D79977E9AE4B97A33D2D4299FCC113B9884994F7C80C1CCC961BFD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c5aabb0-eb2e-40ae-aba0-76e14717aafd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6c5aabb0-eb2e-40ae-aba0-76e14717aafd.tmp
Size 26KB
SHA256 fc17fbe344393d30328496524e4f66b5902f25f0c926a62411380b8b6848c3e8
MD5 4e497a1dd4d7f4a23880c418551d1f38
SHA1 7e8a1127e2dc48524c0145e30c7513081c165f06
SHA512 16b6bfe5d4fcd3ec59e2ecad0ffbc80c86daca8fb59a1f8a58663f0c3272184728b33eb456abcf433ac040fae14486693e9618901cecda5b3926d4fb0320b69e
SSDEEP 384:nmiFiZcI63sNx8TUNTUlIm2aKM8h0wzWfLBCW/Cv5wJuO9iN7O6R2Feo2bgL/7IQ:NFQ63cwgcEzEBC2ChIPiN7TRDsJ
TLSH
T167C24B32E894DDABFDEA5FE9A64A7607DEF04263C98C9AD0D5C81D1C00DB59D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

225b888a-7943-44e5-902c-a97cbfcba1d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\225b888a-7943-44e5-902c-a97cbfcba1d6.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26847372-a1c0-4429-a3ec-8dcfb394faef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26847372-a1c0-4429-a3ec-8dcfb394faef.tmp
Size 414B
SHA256 c89126ae5e5f31e1673dbfbe33e69e84f82f944027584d55015614ff38b82b51
MD5 09b8d43a62088fe63eb2cbb4246e3ba8
SHA1 dfd4ffd264365a6576b76a9f20745562a8a26411
SHA512 2a8fa31470bd7c0d49de5dadf2521290948577b19c1559baaa9a394807144cbdca8e2f3bb6394e4b1aa08a496d1d124f09178a7f27bdd7e8480c384efdf27262
TLSH
T1F3E02BAAD951EC3B1CFD1B7854950746F790236B2A40994B3B3D80188FF16365685D6C
MD5 SHA1 SHA512 TLSH

Submit Download

2b9b87af-444b-4139-90da-a0515b0ee3e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b9b87af-444b-4139-90da-a0515b0ee3e0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4a1286a2-5577-4dcf-a9f6-5394196c5352.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a1286a2-5577-4dcf-a9f6-5394196c5352.tmp
Size 12KB
SHA256 7c11009956803cf2b73583ddef253fb5a8077e5d1cb01ff68d0e3456fd6423e5
MD5 d2fcc8a9e3106b2cf09e05e6343e485b
SHA1 a110c6b3dd87a8a165d2f3711e2b8974043906ae
SHA512 67c37a29645519a3ca944b332bf3e1344def465944f5328515b1672418d7ff66dd9a18f5e52f666352c77677208569a064b652730015d879ada18c35df37ebb7
SSDEEP 192:sxZRRo95/ffs4QZLX8LzodppyHW6+WNfz4ZYoLHIVSY+y2Ig5rytV1J:sxZRc5/ffs4OYQUHbsZOSYdOYtR
TLSH
T1C642D815AD38A93B9CC7D219BB557F53E3F9103291911F44AAFC8A2C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65c61159-4cbe-406e-af99-a7b6fd671da4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65c61159-4cbe-406e-af99-a7b6fd671da4.tmp
Size 12KB
SHA256 4e860b73a850f9b4d6c17a6c7edf93971e9b2da01e754b724c852cefcc0e8c94
MD5 8188f2d526c4456ba366e0841b12a3a4
SHA1 a4a75ffe7da14e5accf8853e99645332ddd10c61
SHA512 1da052e304bb911bba75f01a5d508a184047cb7125a9d266396152795c7a5858bf4de96441120cc0987002cd948881cc80db09465c448abc6234e6b4931e548b
SSDEEP 192:sxZRRok5/ffs4QZLj8LzodppJHW6+WNfif/YoUHIISY+y2Ig5BtV1J:sxZR55/ffs4O0QTHb4/KSYdOHtR
TLSH
T11742E8156D28B93B9CC7D219BF557F53E3F9143290911E48AAFC8A2C05E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6e6e8c1d2fe30f78d0e21426445f0936e9a3cc237b314929ce7bd52974e1464e
MD5 1a5eca78b781578a320f699c7eac1863
SHA1 d550287efbbc3c11843b0bf1cf87a986a9e0bb05
SHA512 1174e7259c2277dc3fa5461aa874571231f9ab06ff95918ee1119ce2963ba87895a358092063c7139f61b2986de43485f4c7a5b293ecaa7a37da574e0a4fced3
TLSH
T158E026A914ECC22FF718766B02A8570CC2E1369F93C87D0E9B48C5CCB602240F2B76D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6daa2e00d8cacfd623fc4933eff6feabbc8aeb2e5fe368217cad4414abb6eace
MD5 c164c7280f983c136635c37949f05913
SHA1 0e298df66462138a5914ea11f75fecdbdf054ffc
SHA512 cdf79e60c63d1ce93a9834abd8d0aa84b79d9b0bf52c687b68b9b7c71d52ba8e271b6bac0994f8a19606d8918f8f297b1b80f26c27e5cd239cb5873951685b25
TLSH
T178E026A925D8C63FE308679701A8932CC6E0379B9BD86DAE5780C4CDB542054E6F3BD4
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 170KB
SHA256 c58e9744deccb4cd5ea172fbab08cbac4aac682d6d69d5142e3c4bdd0a88eb8a
MD5 ff1383fd69c495dc6648de2b5579155e
SHA1 a3f0da8e19bb013c7c7d9e3d2b090c8f5b828cf4
SHA512 578aff8aa9e531d69ff5d8c0cd8fde30f7d210e4247e78505c9792e04945e2ef442b0b8f0052a8a726b756bf64c06e814b5ab3461984e0e151bd5556f5b9c781
SSDEEP 3072:TbaAh/KNxrldrXS77FbzqMGTTI/8jYygH3YXlkDCHcEL:CsKldSl/tN/8jvgHoGTk
TLSH
T12D04124025B09E3252AD756291B2C827C31B2E8415EED4EA3BA84C1FE21F57F267D637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 79KB
SHA256 53448ce82d29be11e8e4bc03605525291b61dc22d28683157978b52f561b853e
MD5 8250d26c1d0d615aef6e57c65d5977c0
SHA1 9c4b4352adc900e9ab84bc1a35d9e64a4d618074
SHA512 ac4d52cbe89389edf3b38e16f060a745ed3e2949e6b5f3507722835643535c6738b615afed1173198dc170e272a2be1cbe9fa5c6fc0957137dbbdb3a2fd9e660
SSDEEP 1536:7uI6Trl+UsHy6q1pJJiV6UQep5nmAuMuyYl2kJKtixd0/rTp9yn9SLDfRvyva3Iy:t6Th7D7iVjQeqyuxl20KtKC/XHy8LDJN
TLSH
T19F831348CCBB5E33F5F563655B058BDC28AB910BB84885DB1B01D676A079B4804CFF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 67675786a64abed22f50fae7c4f7535ca6408256f21c5215bbd62bbb13d323fd
MD5 b9cc9895c8ea412dc49a51a594c6192e
SHA1 c9587c0400040755cf9ef065396686dcb110fc4f
SHA512 b53d62dc0ae71a0401190ad543973731d1015d38a35ba72ee1b8419c419c268ff05e38903e471325b6b91af0d4969e9e06c0572bb27fae088ed24d60e597e943
TLSH
T1B661D549CCA1C1A7FFAECC3099D81887BABE4D83A5C3EF1204AED4B4AE67350990C154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 161ea167d2a4cee05f70f405f8e06a78e36744c94254980be871e43ef5fca946
MD5 f5b019615d60c5046ac4c4221c10d432
SHA1 00d229dd2e655aba1478dae8cad43c48dffefba5
SHA512 f2808b654c720ad66d4dec9a128c3b0150e276e451e3d0eb363ef42e336bcd89ad190542f09164f9fd78b90b5db197eb3f8274a4eac2d88dd24b574c0befe9b8
TLSH
T17161C749CCA0C1A7FF9ECC7099D81C87B6BE4D87A5C3EE02049ED4B4EE67350590C254
MD5 SHA1 SHA512 TLSH

Submit Download

84aa542a-8203-45a5-bd5b-1490260caca3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\84aa542a-8203-45a5-bd5b-1490260caca3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3e955901-4f5b-4e64-af4c-ba2eb36a2824.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3e955901-4f5b-4e64-af4c-ba2eb36a2824.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

90237fd8-c164-444e-8e61-c5967be671b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90237fd8-c164-444e-8e61-c5967be671b5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1d5cc55-c257-4b71-adc9-5e3a9c87dea8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1d5cc55-c257-4b71-adc9-5e3a9c87dea8.tmp
Size 3KB
SHA256 8a162a116d1105f6549fda28c12434d71301856abe2339fb746414235253ceab
MD5 d7414257a6f71e69ce493cc9ce11db76
SHA1 cdb2102966344261b91fdb69d6c6546ae0ead4ce
SHA512 9542f48766e190f30533b247722ce537e8fe20823f0694028f579c58ded5f026ce2947aebc614bbb6ae40a03b3619dfcecec7c24bfac5fd5bb0a6b63ac935ede
TLSH
T19A818CF7C3E8C12DD90156F4A715AE2FCE1E1928432C3C6AC8E8AE5B93E2431D15575E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 10332ef5cbedcb406e4dbf828b4416e1eff1df44245120e6aa08d929524cc5f7
MD5 2022a0d07e1166ef89982b8bae3295bd
SHA1 f94247e2f07d6efbe6553932662223ab21279e98
SHA512 d1ca5dc4b7ea963ad0b15c1a44b2f7e8a56e0da895ec0bbddcc01682a0aeee3dc9cb0a680f6168cc565089aefd96332d4b4c51021260cfdda605df9e439b1161
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgR:ST/2dXOJhJlpfnpp3tNXVrN3S9Di
TLSH
T180B20F1571BB021039FE391892B5972E168231B33119E66B7FBD44B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a331e763-976a-45db-aacc-1a39baf71a26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a331e763-976a-45db-aacc-1a39baf71a26.tmp
Size 12KB
SHA256 92fdc1af540c4d0fa002ff12b2fa2240b3e586e9a8242a7ed419f41682bb1003
MD5 af3cad733ed1d20b2c8d0868f44ab496
SHA1 9365d8382d95f09e39ec579eebd75305125f2669
SHA512 8a9a0305786ed048fd4aba5766c3790f78383a6c5d9cb86abfc9380b1b64b2115ba55a61fac09bac6b825297fb606ff5d437068f7d6bed4c24f05cb12e2611c6
SSDEEP 192:sxZRRok5/ffsUaQZLj8LzodppJHW6+WNfif/YofHIISY+y2IgjtV1J:sxZR55/ffsNO0QTHb4/jSYdOjtR
TLSH
T15342E7166D28A93B8CC7D219BB157F53E3F9143290811E48AAFC8A2C15FB6CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c622ead2-ecf5-488b-bac1-139a034ed484.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c622ead2-ecf5-488b-bac1-139a034ed484.tmp
Size 12KB
SHA256 dc257e4346c47a1d962e8488ee94306bb5fd6c11d7f4a5efc3f0ee43ab6e1535
MD5 ab59a3291836d8a4f8d6c13d1783ece3
SHA1 942a1dcfaaf5b37c67be03588cf67ed79d4604d3
SHA512 f979bb17e211f2d996d4c82bc485c95026796b5fc8b1fcce0d0a7c67391e0e54b596c0edc4679b8ac8ad120b19a455fc4537b29af42946ae3445d6b52c22c464
SSDEEP 192:sxZRRok5/ffsAaQZLj8LzodppJHW6+WNfif/YofHIISY+y2Ig5BtV1J:sxZR55/ffs5O0QTHb4/jSYdOHtR
TLSH
T1AA42D8166D28A93B9CC7D219BB557F53E3F9143290911E48AAFC8A2C15EB6CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc149d02-9813-416e-a6c0-c7da04d11081.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc149d02-9813-416e-a6c0-c7da04d11081.tmp
Size 25KB
SHA256 f630d9c5aec19a83fa944ac9e46d7da137ba0258f69b4a027b2d91662922fd03
MD5 4abc7e3b656b160239fa152ace6646c0
SHA1 459655754b265e9c3e45a919e688177ad3ccda18
SHA512 2da98f37af20dfef3a63b98dddcf6839f39d08fec13b5e246df21d3d99f8b9a88831b39907276c1637b0cade73c9485968f193fcd84f0d2b2034e665e35ac7c8
SSDEEP 384:nuiFiZcI63sNu8TUNTUlIm2aKMiF4wzWfLBCW/Cv5wXFXy7O6R2Feo2bgL/7IzwJ:FFQ63rwgc8HEBC2ChqFC7TRDsJ
TLSH
T1F5C24A32EC98CDBBE9FB4F9AA74A7607EEF00163959C8AD4D5C81D1C008759D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f203a116-8881-475b-bd73-575ceb9693a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f203a116-8881-475b-bd73-575ceb9693a9.tmp
Size 27KB
SHA256 d99a68a2525f06ea952a8f1eb17e5b67f09538c3defc1719510357577a6780e4
MD5 53f1a74b9a757ac0a231a34652cbc017
SHA1 7be3a1a2a80bd73f47b019a9c02fcf0530e84e4d
SHA512 eebc30a925f6279446c33a82c46a0a1f213368e99c72f87ede4066e8b94da7aa231124f954c6dc5c9df695cc83ff9496e71b732357f2a4c36bde8d81632cadd9
SSDEEP 384:nmiFzQkUSvn3sN98TUNTUlI4oaKM1yHwzWfLBCW/Cv5wJuOMiNvaTZcsgL/7Iz37:NFdn3MwgIeiEBC2ChIyiNvaTZckLH
TLSH
T15EC24A32E898DDABEDEA4FE5A64E3643EEE04253C98C5AD4D5C81D1C00DB1DD174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0c2faaca046c2fd846066b4d25251c357dc71c736c66d7d095305f49bedfd75d
MD5 ebc824629958c3f9046c2376bb473f01
SHA1 e16d36849dddda1b308e90cb8238d5124d92677b
SHA512 dbf6eaa26b9041aadb10af032c176995869c04a0475543a5abb3256bddaac4d2940c027d649a463c7d83bfccb12ad52b42350e3f98cbbb560f673c8dbd40247c
TLSH
T1D1411A58A6F91148B3B72F1AABB6A8AD547FB9373E07C09D10110E4E4A66B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2908-326-0x0000013E57D20000-0x0000013E58D20000-memory.dmp

Download