1d8803bb173614df799779db9b8a9340f9dfa96ea0e77475ceba0189eca5d7e0

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1/admin/codes/index.html
Size 769B
Sample261113-al4chax18p
SHA256 1d8803bb173614df799779db9b8a9340f9dfa96ea0e77475ceba0189eca5d7e0
MD5 4cda85e014d020a30708b1895fd28f82
SHA1 31a0d5c686bdd63d640b4ea9256724eeb58849cf
SHA512 1717608c7fbd452c59e7578d613016945c7c494412ebf5078b5014e4abac51251fcc01430d8f428d344c5a0bb186a26445a317cf5aff0d66346f1e526254cb88
TLSH
T1D701FDAB2C29866C1B5BAC9C6039F8185026F2363004E902FCD0B0CADBF23CCC5B9184
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4160	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{172932F5-DBE8-4BE1-8BB9-E27AC46A2A5C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 4636	5480	msedge.exe	84
PID 5480 wrote to memory of 5220	5480	msedge.exe	86
PID 5480 wrote to memory of 4160	5480	msedge.exe	85
PID 5480 wrote to memory of 5220	5480	msedge.exe	86
PID 5480 wrote to memory of 5220	5480	msedge.exe	86
PID 5480 wrote to memory of 6112	5480	msedge.exe	88
PID 5480 wrote to memory of 6112	5480	msedge.exe	88
PID 5480 wrote to memory of 1036	5480	msedge.exe	90
PID 5480 wrote to memory of 1036	5480	msedge.exe	90
PID 5480 wrote to memory of 1036	5480	msedge.exe	90
PID 5480 wrote to memory of 5864	5480	msedge.exe	89
PID 5480 wrote to memory of 5864	5480	msedge.exe	89
PID 5480 wrote to memory of 5864	5480	msedge.exe	89
PID 5480 wrote to memory of 2156	5480	msedge.exe	96
PID 5480 wrote to memory of 2156	5480	msedge.exe	96
PID 5480 wrote to memory of 1960	5480	msedge.exe	97
PID 5480 wrote to memory of 1960	5480	msedge.exe	97
PID 5480 wrote to memory of 2948	5480	msedge.exe	100
PID 5480 wrote to memory of 4484	5480	msedge.exe	111
PID 5480 wrote to memory of 4192	5480	msedge.exe	112
PID 5480 wrote to memory of 2368	5480	msedge.exe	113
PID 5480 wrote to memory of 2456	5480	msedge.exe	115
PID 5480 wrote to memory of 2456	5480	msedge.exe	115
PID 5480 wrote to memory of 4220	5480	msedge.exe	117
PID 5480 wrote to memory of 4220	5480	msedge.exe	117
PID 5480 wrote to memory of 208	5480	msedge.exe	118
PID 5480 wrote to memory of 208	5480	msedge.exe	118
PID 5480 wrote to memory of 1224	5480	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1\admin\codes\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffca658c188,0x7ffca658c194,0x7ffca658c1a0
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,3532195936672547998,2099145359278246822,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,15931222153284446750,482952671925351894,262144 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6331664965001782595,5608522265640753639,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,5023136014821505372,6322986533613374217,2097152 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15431285360473584814,4294902955809531170,2097152 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,3802337422147610677,8865477546139232731,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,7755046641726079612,3572665829626444764,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,1453447190945560038,8851137845267505773,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,1453447190945560038,8851137845267505773,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,12389218046647424896,15892810915357512649,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4691359147287587869,15354045106454503097,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5800433595446863303,5527744376028958452,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7110203203740312581,18131382752181754403,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2327562813717297016,3969017000566737097,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6079611045771835826,7295741760584195641,524288 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,16982179797517999952,12711481477100014883,262144 --field-trial-handle=2120,i,13269253891176664617,2714640536227368178,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12887f82-f4a0-4020-8bbf-982150a6cbb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12887f82-f4a0-4020-8bbf-982150a6cbb9.tmp
Size 26KB
SHA256 d5d162fd3adee88beda514fa707fab157ea1895ae136b838ffdc449e2201e706
MD5 08247beb69587bcf6b81abe7e665892f
SHA1 cac9c43dfd51813fa3f674dbe3960c5146583a3e
SHA512 2c6648bd63b47546b354384d61a7ac91fc12f75247b2b1328c6f44bad3fdd8a1cdc6a1a59d5c5895181cfb4d34314a6eb0ad1569c88f1a72e4f7da7fca7a1a90
SSDEEP 384:nvqiFzQkUSvA3sNx8TUNTUlI4Y5mgDrvK2fMBxrN74CwH7vBEx4gL/7IzBIIlu:vhFdA3Ywg28YBxN7pwH75ExiLc
TLSH
T115C24A36E894DABBEDE74AE5A34A3A43DEE04153CADC4AD0E9D95D1D00CB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60b3e9ce-4e43-436b-ab1e-2a6ad3a14d04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60b3e9ce-4e43-436b-ab1e-2a6ad3a14d04.tmp
Size 27KB
SHA256 b39b1e491de120456aaf0ba2d1f1208cccc07f726d287c8d1c01b6530c9e40df
MD5 4750e49cba17a2702f8ce3f0e37cacf9
SHA1 ecdf5c684ed15b8b8850a6fe532c34525f56115d
SHA512 fb0fecb69dc250ed3bfd36a6ed16ab88bf74ac0a4b1331e3debf3a0f59f7577473202599d0dab0f69294497bf76914ef32246b4b6d5fb7a42532044b4a80d33e
SSDEEP 384:nziFzQkUSvAZ3sNx8TUNTUlI4Y5mghDrvK2fMBxrN74OwH7vBEx4gL/7IzBIIlu:eFdI3Ywg2CYBxN7bwH75ExiLc
TLSH
T1F0C24A36E894DA7BEDE74AE5B34A3A43DEE04193CADC4AD4E9C95D1D00CB1DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7676c425-764b-49b1-bf0d-60e6d8bff67d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7676c425-764b-49b1-bf0d-60e6d8bff67d.tmp
Size 26KB
SHA256 87acbfca547956c34e066e96e57a142bfcf0f95da5c203686c4352de140c56aa
MD5 50976e3e69cc6b9e97d77e4bd1cfc0c6
SHA1 95ae961bcaa5fe845f33118b2e5fa29e3ae357b2
SHA512 e63197b54a8e355dc07aeea2deef42a02de7973adaad56bd84ba2b7425ff36ff4613cef38199b4f911385cb4ac57ec00766815a762861c2466232b0ab1dfca11
SSDEEP 384:n4qiFzQkUSvA3sNx8TUNTUlI4Y5mghDrvK2fMBxrN74CwH7vBEx4gL/7IzBIIlu:4hFdA3Ywg2CYBxN7pwH75ExiLc
TLSH
T138C25B36E894DABBEDE74AE5A34A3A43DEE04153CADC4AD0E9D95D1D00CB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

06136bd4-13cc-43c2-912d-46ba883e5141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06136bd4-13cc-43c2-912d-46ba883e5141.tmp
Size 11KB
SHA256 b507a985d30d87ac2fdb9249fb4bfbe01252c225f65a46b6a86b3bf9216cf785
MD5 75eb09df6f2f603c46ecac15ecb6c48e
SHA1 d28880ce2dacac8493c3d95473e65279658e54f9
SHA512 972bcc2985a9ff267d7325e59c117bd64c235d1e9d57f1ee35b222976439f8b73e9098357498051b2cb76432d12653a114aabbfb86b83b4f285e9f2b8c08fc06
SSDEEP 192:sxZQRBk5/f+sqQZZ+WzodpHBHW6+WNGYbItMtYI8IgjhJ:sxZQg5/f+sqOZ+thHbGF2Y9jr
TLSH
T14F42C7156E28A93B8CC7D219FA55BF53E7F91033A4941E48A6FC8A1C14EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c217dcd-f6a3-4f53-9ceb-3cf71df0aea0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c217dcd-f6a3-4f53-9ceb-3cf71df0aea0.tmp
Size 11KB
SHA256 54deb2379c80329a81440b39d5b052e23017cfed712140352bae1292132115df
MD5 af1c8581daae7c122146038ac84aaaf3
SHA1 33e271d1e261669d4954a5dcb63c047c1f393612
SHA512 4c99e5ece5acafff39be099fe1dcc9eca86332d4d7b25cc45a7872e54b9f82fedc94e2856a0c9b02992daf50b0e62b21e6640158e718014ef967144728d66c3a
SSDEEP 192:sxZQRBk5/f+s5QZZ+WzodpHBHW6+WNGYbItMtYI8Ig5chJ:sxZQg5/f+s5OZ+thHbGF2Y9Gr
TLSH
T16842D7156E28A93B8CC7D21DFA55BF53E3F91073A4941E48A6FC8A1C18EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e684d5c-07be-488d-8bc6-1e34b87c9908.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e684d5c-07be-488d-8bc6-1e34b87c9908.tmp
Size 414B
SHA256 95f25fa9efaa21dfcff9dd40fb07d9d8ec559be3461e18a69ec12ee103c481e2
MD5 9f4f0d99bead5dfab0fc044e195e8ecb
SHA1 1f1255b705c01f8200fba3efabab666fdb4df54e
SHA512 0ce51d93ecefe4cc7624818e28aafcd4cff2cf0112e2aa3abb4907350f483f73045cb83ad810e104c648624c5219040a5d4c2b8fc1838fdce0c76e286434ac31
TLSH
T1A3E02BE9CD25AC3709FD076950541681EB51138B2A80858B373C810D8FF563656868AC
MD5 SHA1 SHA512 TLSH

Submit Download

682ea418-8cd4-41e2-86b5-1cf2b8c832da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\682ea418-8cd4-41e2-86b5-1cf2b8c832da.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e03d017f0833700e798bd246154bd7b91b07ace2f04a4ec434eea7bdb6fb1403
MD5 eef7de92ef9382f80fdc88007f947bca
SHA1 730a68dc7c0430b81bf78c564899eddd8a227ccd
SHA512 515cbd0d8196e3c38d5573c5e8ca405356c33991828047027f7cf8b886e1fa32e85fe538a72292254855c7f6160fa10137a48b4816d23ab01be0bab16663dab6
TLSH
T194E026B804D8C36EA308F46705AC430CC282765FABC0A99E2B40D8CAF0410D8A6D7AA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 147ae39d90689a7e53b316d4f44b7a4c5faa1f99468dd184595191e9b139b06a
MD5 26ffa22db6161ac4d173c5b4aee380a3
SHA1 9f509c754ddbd42f7e9087dbc8df3ace7afc2ad0
SHA512 fdef5482be3b148a511332e40865f19faa7b7dbb70dfdb5570816b254a19b2020959e0ae8065be81aa9790376fb29a360c10c62bcc14653ec0d9e5e8a097f1da
TLSH
T162E07D8418EAF22EA318689741FCC30D92803A5AF3C0698F1F40C4C8B0018D0BEC6FA0
MD5 SHA1 SHA512 TLSH

Submit Download

d4e27f47-2e22-440b-a662-41a84ed8508f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d4e27f47-2e22-440b-a662-41a84ed8508f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4f06167c-764b-4b86-8a81-a0a47e66b46f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f06167c-764b-4b86-8a81-a0a47e66b46f.tmp
Size 1KB
SHA256 085753ae14a7cbae2c809522d0a604bda8f5f0f7bcb297768d37ee2f949e75ab
MD5 acd4ad524eeb2b1575fecc6ee535b902
SHA1 2feaa2c1da66708f225007c322544de6afcdbe33
SHA512 96ca27f5b73d21f566970feb7da6159370d25fff8f7f77528f48560bf6241d84fc009021dd5de61dbd9ab18270f629f149c2a79071755b9a9ffa792719d8b943
TLSH
T1C341CFF7C3E8866EC90196F0AB14BE2FDE1D0515432C3D5A89E4AF1B93E2471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

5a65d9b7-48d3-4eab-a7d6-4b22e72f522a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5a65d9b7-48d3-4eab-a7d6-4b22e72f522a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f0b555db-ef03-4383-8317-5d7f5be4a658.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0b555db-ef03-4383-8317-5d7f5be4a658.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 570167def2eb6c10ba53bdb315c738afe9e7d61185b849f806a2be3c25a3e27e
MD5 3dd03824e4e7d04535346d5cf0e9b7c6
SHA1 d01e22ce7a3cf41c6b9653e5333faec5b69b59fd
SHA512 0e2146967934eba348e1b1c8e51314da8945131baaafad1875c6e448534c966ebda57d3ca18ce6c41bef1c3c2e8bdb365a67aa5696d912ff43dbe51e9a0eb87e
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIL/P:OtfFvpopPxrB4RhfIDP
TLSH
T168B2111471BA021138FE690C81B58B2E064232B37159E63F7FBD54A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bda78657-92f6-4972-a903-d4dc74420242.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bda78657-92f6-4972-a903-d4dc74420242.tmp
Size 11KB
SHA256 83b46d2347f69d507a27c703ccaef997a70225a12eebb672b7fab3933420045e
MD5 c9a800993c84acc217de091794501461
SHA1 8583dceb6f0423b9d26dcfd20624453a105fc900
SHA512 d8a8e65606d2951bfe2f30151d07a34d88adada67c6a391d6692957ccd85c8cafa71be7ca466e5640abd6939f1f7c1f7132355c250202e06c59379ce84ac661a
SSDEEP 192:sxZQRBk5/f+suQZZ+WzodpHBHW6+WNGYbI4MtYI8Ig5chJ:sxZQg5/f+suOZ+thHbGFlY9Gr
TLSH
T1A642D8156E28A93B8CC7D219FB55BF53E3F91073A4951E48A6FC8A1C18E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7c06e22-198f-40b6-a0c5-b7a69fef0a8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7c06e22-198f-40b6-a0c5-b7a69fef0a8a.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9d2962b-10cb-4dc7-bdd0-53e8b0f54c37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9d2962b-10cb-4dc7-bdd0-53e8b0f54c37.tmp
Size 26KB
SHA256 c5598111e71d3aba867fda73784d3c561384544bfc1f17c20e53e4abf44f5a9e
MD5 8fb82e70270ae102016f9efff75fd214
SHA1 92680000eba5ccf8769fad3f4dd573f878615332
SHA512 30e33974ffc9ac352aa24da4e4afb17776c9dc6d8d2999f3b7e341009ae591b3d4dd0f03278a06176bfabaf3f1d7030d62fb3b44f40f8bc207c99cf03f7f5135
SSDEEP 384:nxqiFiZcI63sN18TUNTUlIm25mgrmsK2fMBxrN74vw7O6R2FeoKgL/7IzmoJ:xhFQ63owgSpFBxN7Kw7TROe
TLSH
T12BC24C36E894D9BBECEB8FD5A74A3947DEF00153C69C8AC0D9D85D1D009B59D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc81af1f-4585-4423-973f-a8e9e0482688.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc81af1f-4585-4423-973f-a8e9e0482688.tmp
Size 25KB
SHA256 0bc93b91a1f5a74bfe849658f513381948ffcc0fac981c100a4c07a192ade564
MD5 733958760a1d9a75f3a4db75de6eb235
SHA1 04528e70c5abdbc3be9b0900b20d4a0d313b348c
SHA512 de4c9dcc9d7c54b887b551d9d8470aa3036656d02d255968404d425678667faa9783ecfab847a80099776644bbb539f5759e18637b8e3e3285f0263a561de1e4
SSDEEP 384:n0qiFiZcI63sNb8TUNTUlIm25mg5jnK2fMBxrN7J27O6R2FeoKgL/7IzmoJ:0hFQ63ywgSMQBxN7J27TROe
TLSH
T1A6C25B36EC99D9BBEDFB8F9AA74A7A07DEE00163859C49C0DAD84D1D008759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e6c09eed41f21aed357692e3a40cb8adc803fddf40fed2f655c0f1afbe6fa1f
MD5 9dabfdab10a297f967f829f1750c7645
SHA1 4117c237291566857ae8f745dace8799df18c68e
SHA512 e664814ea1b3704b40d8ed09cd4292290743c3bba194379ad53ce4bdddcc6aa9620402f875639701948961e39daa33f0875f29a153d7c1e9820b6877cb52afdb
TLSH
T19C412B5CBAEA1148B3B76E5A9BF6A86D587F79732E07D45D00010D8F0736A40C971733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2948-206-0x00000203B3110000-0x00000203B4110000-memory.dmp

Download