8c498a9492881e673ee8c9861c91c32dfe7902a722a693d01a9445a5230770e2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1/include/header.html
Size 646B
Sample261113-al4chax18p
SHA256 8c498a9492881e673ee8c9861c91c32dfe7902a722a693d01a9445a5230770e2
MD5 9d171bfda7bf2882c26b20439a91b729
SHA1 7818e7db15bc36dd7de9b0370c770118634bd684
SHA512 aacc8c1fa9cd1a58567358f088f958a0abafc17c3490515c7c241990d2397f1d25e8b497c466ef6a73af97859cf85e0c59ba058c4f7f8cefc6e530b2e28e9667
TLSH
T142F002996F4E061CE22301BA538C6244D7B17D87E5653934F62CA223BFB580A286919C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{C6F8BD13-510D-49B6-8A72-109F9A5C71FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 3020	5428	msedge.exe	84
PID 5428 wrote to memory of 440	5428	msedge.exe	86
PID 5428 wrote to memory of 4884	5428	msedge.exe	87
PID 5428 wrote to memory of 4884	5428	msedge.exe	87
PID 5428 wrote to memory of 4884	5428	msedge.exe	87
PID 5428 wrote to memory of 984	5428	msedge.exe	88
PID 5428 wrote to memory of 984	5428	msedge.exe	88
PID 5428 wrote to memory of 1420	5428	msedge.exe	89
PID 5428 wrote to memory of 1420	5428	msedge.exe	89
PID 5428 wrote to memory of 1420	5428	msedge.exe	89
PID 5428 wrote to memory of 5208	5428	msedge.exe	90
PID 5428 wrote to memory of 5208	5428	msedge.exe	90
PID 5428 wrote to memory of 5208	5428	msedge.exe	90
PID 5428 wrote to memory of 4908	5428	msedge.exe	102
PID 5428 wrote to memory of 4908	5428	msedge.exe	102
PID 5428 wrote to memory of 4924	5428	msedge.exe	103
PID 5428 wrote to memory of 4924	5428	msedge.exe	103
PID 5428 wrote to memory of 1468	5428	msedge.exe	105
PID 5428 wrote to memory of 4916	5428	msedge.exe	110
PID 5428 wrote to memory of 4064	5428	msedge.exe	111
PID 5428 wrote to memory of 4568	5428	msedge.exe	112
PID 5428 wrote to memory of 3428	5428	msedge.exe	114
PID 5428 wrote to memory of 3428	5428	msedge.exe	114
PID 5428 wrote to memory of 2036	5428	msedge.exe	115
PID 5428 wrote to memory of 2036	5428	msedge.exe	115
PID 5428 wrote to memory of 1708	5428	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1\include\header.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa1643c188,0x7ffa1643c194,0x7ffa1643c1a0
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,7648614563626443472,1299475444790851893,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,13853706940451315907,12086023333035288367,262144 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,14626186105436359195,13516214197534936541,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6716774932040998568,16014689405930407533,2097152 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2464091270233369565,5960527425236198121,2097152 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2768016634242784070,17178946691099248892,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8989397557079139884,9428515152152410228,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5211637215653448288,893799447036415369,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5211637215653448288,893799447036415369,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4692033241747307005,17036122179530078316,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,15550401359729934911,9498862378992694411,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12505016626476835534,11210748900748035488,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3503116930937126793,7733245041835052243,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11601197416380545311,16712557346125673009,524288 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5356,i,11498146356247139088,8057179608062596267,262144 --field-trial-handle=2348,i,13211130967731975776,18165016591800897627,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

068b2379-46d6-45ef-a5e1-d3b8a652fe83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\068b2379-46d6-45ef-a5e1-d3b8a652fe83.tmp
Size 26KB
SHA256 cca561467502ec2582090f798c7531caaff249f9f72073751d20adaf56c4e648
MD5 5e6b7b1120ce8852f3727b7e1ae03867
SHA1 bceca58fee1c667da42c7f39a65ddd12f5a0b503
SHA512 dd19cf1f5c00ee7223dcc786e9f6fe47c0db4b46a3d3c32eccea8a2ab6c2f30c47fa5b111ec11fb531d6b531acc2705345fa85787f2a315f5301ff2bcd2ad88c
SSDEEP 384:nBiFzQkUSvp3sN18TUNTUlI4Q5mgRLBK2fLBEUD4jiZHRm3lLH7vBExt8gL/7IzP:oFdp3wwgOSxBEUJk1LH75EPIL3
TLSH
T1ADC25A36E894DEBB9DEB8BE5A34A3A43DEE08253C9DC4AD4D9C94D1C00CB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

212f3b55-c1aa-4287-a1a8-bdc8d57840ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\212f3b55-c1aa-4287-a1a8-bdc8d57840ea.tmp
Size 27KB
SHA256 60801ee6168b7cf93bee0edf5db97fb16893178ec37794535aad17be7781dab2
MD5 fac94587b44a672518aea38067770709
SHA1 bd0bb16906ac64164964c40573bb8e0e3bfde6d6
SHA512 f08d9abf6e25f30139c80fbc1923d6ece34d853a46cb03a8ba14bb3dc9fca26f19bd8a56ab80089c165716a4ed47f315a871d08a61df266a2a24f8e0ce53cd8d
SSDEEP 384:nRiFzQkUSvwc3sN18TUNTUlI4Q5mgmLBK2fLBEUD4jiZHRm3JLH7vBExt8gL/7IT:4FdR3wwgO5xBEUJkZLH75EPIL3
TLSH
T113C24A36E894DEBBDDEB8AA5B35A3A43DEE0825389DC4AC4D9C95D1C00CB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22c236e5-292e-4b57-b8e2-e634776be39e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22c236e5-292e-4b57-b8e2-e634776be39e.tmp
Size 26KB
SHA256 83ce194286393462dfe076c8f3440d5a8c981c33056cd01ddefb6bc4ae5e117b
MD5 ee638633ac44e78e2316811e5c28c865
SHA1 8558a14e2218b523b368b71c67e1c0196b58baeb
SHA512 c2e441da6170f13081fd44b917e51a3f8913ac290c7739c5028966e5c1eea54381043061866cd99b94dd556b756b79a7308c43e67d0c1f482030333b1222c7e3
SSDEEP 384:nIiFzQkUSvp3sN18TUNTUlI4Q5mgmLBK2fLBEUD4jiZHRm3lLH7vBExt8gL/7IzP:TFdp3wwgO5xBEUJk1LH75EPIL3
TLSH
T122C25A36E894DEBB9DEB8BE5A34A3A43DEE08253C9DC4AD4D9C94D1C00CB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a1f2c2a-00e7-40f4-b96b-4bbe6c77af89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a1f2c2a-00e7-40f4-b96b-4bbe6c77af89.tmp
Size 26KB
SHA256 5e5d4feaecfa2b0ff240e2702855cd666d979dff4143d6c2be3bc32ad0e6eb98
MD5 ef4e714de43ef1d914769bac0cffdb6b
SHA1 9c78ae94d506bd6b853463ff026d46ebda3014b7
SHA512 095501f6309851e6b42a3e7aaa0fd3007650aef0ede5f2b42d489c6dca45d34d2839060ddd667c6990a56041b317685adfbc08483f0a0e58929eebf79d8fa604
SSDEEP 384:nRiFiZcI63sNZ8TUNTUlIm25mgmqiK2fLBEUD4jiZHRm3nL7O6R2Feo5MgL/7IzL:4FQ63AwgSYOBEUJk3L7TRMGl
TLSH
T127C25C72E894C9BBEDEB8BE5A74A7A03DEF04163858C8AC0D5CD5E1D00DB59D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

2be708b2-6f34-423c-bff5-93e40dc91362.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2be708b2-6f34-423c-bff5-93e40dc91362.tmp
Size 11KB
SHA256 07bee5d93b33c03acbda5ddf337ba3da54dd78b3cbd6c844751ada7dc83e1027
MD5 1de6ba94b8d64c1dc81c1198e3d7a927
SHA1 fe34334096d228e3b69a8d5b590e9416ea3344fb
SHA512 9f60064e0d47e231dd36f442ae638c425981e53fff71e8d226b822460d45698ba6c1e0b4483783c74ba751d02a55b3a9a5a826f67c485e9881b32cda6938342a
SSDEEP 192:sxZkRWku/fesEQZZqZzodpHQHW6+WNGYbIaFYnHIg53xcJ:sxZkzu/fesEOZqSwHbGFwYHhu
TLSH
T1C032D815AE28A93B8CC7E21DFB55BF53D3F91072A4941E48A6FC8A1C15EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dfe6fb2-65f4-4bba-9497-a2c0042eacd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dfe6fb2-65f4-4bba-9497-a2c0042eacd6.tmp
Size 11KB
SHA256 5917929002ea519153cb7d2b79fefd0f554dd7d6511ae0b0e3045fe922ecccca
MD5 3dda51c7c8643c21fb360b49c0c9bf01
SHA1 354d33365f48c54023269e03b2eb0f24c2fd263b
SHA512 548e5af9bd9a42b000bbfcecaa598189ff93f16951f1483c29ff90f640d029e4dd0785fb61b19415826a81b418963f0adb068d0a156aeed2ca04781564a6373a
SSDEEP 192:sxZkRWku/fes5QZZqZzodpHQHW6+WNGYbIaFYnHIgjxcJ:sxZkzu/fes5OZqSwHbGFwYHju
TLSH
T18D32D815AE28A93B8CC7E21DFB55BF53D3F91032A4941E48AAFC8A1C15E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8964ce53-464a-465c-b020-cb0ac9ef4260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8964ce53-464a-465c-b020-cb0ac9ef4260.tmp
Size 414B
SHA256 ab34cb1671912fa606fb4464a896e05d61e78add28d52378125cffa52d090401
MD5 52c2566e728ffabd377978a1e48dac28
SHA1 cc9afd49298073320440f72dc758598b0aef13e7
SHA512 8ace8bb02899c40372797097d4cfe30f85dcaac19623d173921f67aca2eb81be55f26b2824bcdb95b5ac4322435a5615ac06bbc641f4e07962dbb8f1209414c1
TLSH
T1D2E0E5B9D925AC3B09FD172C50541686EA4513872B80848A3A3D810D8FB1B36428686C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1d78949e950147161393ef402749e78bcfe7cf1df097069626afda5d058abdce
MD5 d23ea568f032502ae3f9fc26e702cafb
SHA1 ab6cd4318025049c6d3ce68c0030024b214e271a
SHA512 906b8d2ce0c9ae6510093551f4825b3cf5f3dbcdbcb2c816ad1860692aef93b06c1757ce41d4c2ab784bfd497b4e2c9689a8384f6e1f452030e088313037cd5d
TLSH
T165E020B5D8C4CF1D53046487019C470C83C02A5BA3C0694D9740C8CCF7063A4E7D5D61
MD5 SHA1 SHA512 TLSH

Submit Download

4169de79-8897-4a5e-a547-ad2f3145cc8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4169de79-8897-4a5e-a547-ad2f3145cc8b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6ace98ae-ac1c-48f9-81f4-8d42090f366e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ace98ae-ac1c-48f9-81f4-8d42090f366e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e3c67d4f-f905-45c3-a392-98c307fa3e24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e3c67d4f-f905-45c3-a392-98c307fa3e24.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1216c29-5783-42d5-8fcb-1cb07f06cfb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1216c29-5783-42d5-8fcb-1cb07f06cfb7.tmp
Size 1KB
SHA256 04c292cc318d7dd8b653a811be927669ad08f077644cd2c45bdb520aed5153c1
MD5 5468adefcaf62352f1e6abd10d41edfa
SHA1 91c4cc41fa14879d15d3682b09809476b6ed3d5e
SHA512 497c9aa2b94913d3e9352d3a1b6146ed08aa7dfcf0dbd73a3c5c3fcfa3e186ad8806aa52e5f7994f1db795078d00e160ce0bdaa1787fa0b602c39fc645687680
TLSH
T14031CFF783F4856E8A0196F0AA18AE2FCF2D0515431C7D9AC4E4AE2BC3E3471D04165F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 158070456a96d831e7df2ccd8b034639050abf48efd382e3a1315c2363c1cd46
MD5 1d1c4900529250ed04a71501ed5e54f9
SHA1 7edc5bb25cc3d6d8de00d15c7de76fc5f9d9ed51
SHA512 24434bdeb4cafecba151da34f5977b67bac93c55a81716249b70a21ba225b45d951b60154994fcb972ae3cdaf6b532271135f30eee541d3421270c84cb3985f5
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXmd38:OtfFvpopPxrB4Rhfmd8
TLSH
T1EEB2341471BA021038FE790881B6972F064232B33159E63B7FBD55A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a1f195dc-b99e-49e9-bea0-363eca785ada.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1f195dc-b99e-49e9-bea0-363eca785ada.tmp
Size 11KB
SHA256 877a193b22983bfe8b7951b1c38c57384c6ab26772bcfcb14932f0242c7e7865
MD5 c16ce382e649f58b08cf32c966b4a9bc
SHA1 775f4ea3cbfd4a8b8c2f559ab945158b33dd4728
SHA512 69da60290d542cb20d4dce46b3013f222d9c0b5ffc52d9134c46fd48e4fe01aa6f9dc378f97407c05068cb80fd4c39c8bb98c8818a951c981339783fb240bd04
SSDEEP 192:sxZkRWku/fesJQZZqZzodpHQHW6+WNGYbIXErYnFIg53xcJ:sxZkzu/fesJOZqSwHbGFWYJhu
TLSH
T15542D715AE28A93B8CC7D21DFB55BF53D3FA1072A4941E48A6FC8A1C09E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a42c88b3-dd19-453c-bbeb-f70b3887c8cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a42c88b3-dd19-453c-bbeb-f70b3887c8cf.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accb3164-85df-4992-abc0-88f4c6bac40f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\accb3164-85df-4992-abc0-88f4c6bac40f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cc7bb108-fc5b-400d-8ad7-041f5a930b24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc7bb108-fc5b-400d-8ad7-041f5a930b24.tmp
Size 25KB
SHA256 6567155f03cc29ebb3a3d43ede0b7a47b97f292ca2a831197fa40750028842dd
MD5 f20ae498f71adfbacb1e09f4952cf7ea
SHA1 15cd3913e691e16bbc46011ad3c95a8b8aed1f3b
SHA512 1c71ebd1d151a5902e467c79581f61e8f7e7c5d530b3fcd1a4bacef7b88f35dac25f4d901018b3c0f665505ae2a7cf2cc95228edf7c6b8e331c61350e1668bed
SSDEEP 384:nBiFiZcI63sN18TUNTUlI4d5mgRLBK2fLBEUD4jiZHRm3lLbDlgL/7Izcof:oFQ63wwgXSxBEUJk1Lqw
TLSH
T1A9C25C36E894DABBECEB8BD5B74A3A03DEF04163959C8AC4D5D95D1D00DB19E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa2a5c0e-51cf-41fd-9e9b-26eb1336dbc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa2a5c0e-51cf-41fd-9e9b-26eb1336dbc6.tmp
Size 25KB
SHA256 a7c2e189a8f6b21d0a33c1432d316d3c3e27808d6f630e18ad35fc59f09c0b43
MD5 b07869ad455343156e39b7a327993b54
SHA1 7a2b965ed1310ae14ec32880f9637b4dccb5faf0
SHA512 125649a8222b4cf82f554e46c805003aace73916c233dd529dbd1c1923d21ae6e61bd7a1e365ae16ada495ea22951c1fbf49e6de0f2be2373db5764dd0689c10
SSDEEP 384:nOiFiZcI63sNo8TUNTUlIm25mg5pnK2fLBEUD4jiZHRmBGQ7O6R2Feo5MgL/7IzL:lFQ63NwgSC3BEUJkBGQ7TRMGl
TLSH
T1BBC25B36EC94C9BBEDFB8F9AA74A7A07DEF01163819C89C0DAD91E1D008759D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c5ca241b2602144bca62a4908087ecdda51546a1514e852198690d1444c5af1d
MD5 a7570f49b9a5d6e6361db855817d574a
SHA1 a7b24877774a998d9e4486eb97619001afc97725
SHA512 f10cf0a6be6e603d0fe1c1f13b2ffb88aa7015a42214e98a245d23bf0d275b58c01556c80e6f4e6e8e4e913729c1748ba381a8647e369c82fc935d05c8276dbc
TLSH
T109410698B6E91108B3B72E56EBF6A8AE487EB9672F07845D00010D4F0A63B41DCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1468-221-0x000001B2040E0000-0x000001B2050E0000-memory.dmp

Download