c5a76f481fedd2a98f620df242084e433532b500503473f8bb4221d3d4e04b12

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/1033/HTML/IDR_OEMPG_AR.html
Size 2KB
Sample260707-cf4gesfx81
SHA256 c5a76f481fedd2a98f620df242084e433532b500503473f8bb4221d3d4e04b12
MD5 6c4ac1eb165de3ef72ab6b2011ea1627
SHA1 dda0572869ee022ca47f8c9b8fd69c8dc6f34f5c
SHA512 3449d69d579cbb87b5d76a77ffa63341451d787d727ac92097894df9719d9cd0727467e8fff4ae86c009a5b6f9fb5b1e309c4c281e518390fa9d073a445bb041
TLSH
T1424101623AB055294550D495E2D17E1ADCE19C23C707A860B0EF16B60FDDC8399AB7BC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278633340059308"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B0530A5E-8AF6-462C-B3A0-F34B8C21F79E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2816	4888	msedge.exe	85
PID 4888 wrote to memory of 4732	4888	msedge.exe	87
PID 4888 wrote to memory of 4548	4888	msedge.exe	88
PID 4888 wrote to memory of 4548	4888	msedge.exe	88
PID 4888 wrote to memory of 4548	4888	msedge.exe	88
PID 4888 wrote to memory of 2180	4888	msedge.exe	89
PID 4888 wrote to memory of 2180	4888	msedge.exe	89
PID 4888 wrote to memory of 1064	4888	msedge.exe	90
PID 4888 wrote to memory of 1844	4888	msedge.exe	91
PID 4888 wrote to memory of 1064	4888	msedge.exe	90
PID 4888 wrote to memory of 1064	4888	msedge.exe	90
PID 4888 wrote to memory of 1844	4888	msedge.exe	91
PID 4888 wrote to memory of 1844	4888	msedge.exe	91
PID 4888 wrote to memory of 4960	4888	msedge.exe	92
PID 4888 wrote to memory of 4960	4888	msedge.exe	92
PID 4888 wrote to memory of 4960	4888	msedge.exe	92
PID 4888 wrote to memory of 1752	4888	msedge.exe	93
PID 4888 wrote to memory of 1752	4888	msedge.exe	93
PID 4888 wrote to memory of 1752	4888	msedge.exe	93
PID 4888 wrote to memory of 2620	4888	msedge.exe	97
PID 4888 wrote to memory of 2620	4888	msedge.exe	97
PID 4888 wrote to memory of 3352	4888	msedge.exe	98
PID 4888 wrote to memory of 3352	4888	msedge.exe	98
PID 4888 wrote to memory of 760	4888	msedge.exe	101
PID 4888 wrote to memory of 2428	4888	msedge.exe	109
PID 4888 wrote to memory of 4504	4888	msedge.exe	110
PID 4888 wrote to memory of 4964	4888	msedge.exe	111
PID 4888 wrote to memory of 1104	4888	msedge.exe	115
PID 4888 wrote to memory of 1104	4888	msedge.exe	115
PID 4888 wrote to memory of 3048	4888	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.rsrc\1033\HTML\IDR_OEMPG_AR.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc705dc188,0x7ffc705dc194,0x7ffc705dc1a0
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,10632946789039037476,13880226225312325776,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12239055709489455128,11187920265863050823,262144 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,1309378253456089486,8567625505100865714,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6214214607689169569,13542333519942377196,2097152 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1290323898503157835,755089838859302940,2097152 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,14517740508398418989,18101971177865820901,2097152 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3488180091811190845,7154141296180548693,2097152 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,12787911234191314153,13509769835261932114,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,9781152693811004575,16678086994350055586,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16566396056534338900,11731002471511404619,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16566396056534338900,11731002471511404619,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,1248013815336123444,12190001565566649138,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14932189985351890220,13512255727183304926,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16181340180164578645,10913007304174571661,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,15759262622090598744,13260057635378930974,524288 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,9978627813649234349,2086080044250634154,262144 --field-trial-handle=2472,i,3901197533057659517,15021151134280178898,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cfbf02c0289012c6b0931a72194e56cc07df3c7cf18b6318775769ffaf6356db
MD5 f0417201b4aeff6311353b21ef904ca9
SHA1 9e72f0ef35a72e8a4682c0bf3b4155333251d27f
SHA512 ea14d6f479491215356773fd965ebad43c770981dc9de0747ac20f2f44d5509ee645a34c27311213fedd8bb8ff28eb51b57b066db6e2de58e026e00aa2389889
TLSH
T144613B7402427242E3E21530D3CA160137B248BDBBDBDD1927B0B87D7536F5A851943B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590517.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590517.TMP
Size 3KB
SHA256 88aa6579d3863cc4e007abfaee9c0b7adfd5c15dd90d94173afa0a7a2319d21b
MD5 858dfafe9665a341cf7cef2b63dbb2e4
SHA1 370259ef74172b3d9d4b30347f627280524e1d7b
SHA512 4ead7544c88a2942c5442eea9bd89340e44b2d870e788fdefb97c86c89d329370530298256ba6cc1fde412ca4c32a54dcea5b242d129208191beb88845279d36
TLSH
T198613C7402427281E3E31530D3CA160537B208BDBBDBDD1963B0787D7536F5A851953B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7b3c102574e371d8a0228a16f533b5186b9829bd2e522e0a7afcef2d3f0de35e
MD5 8719635455c81165e57fdd60344152b1
SHA1 946398e50db17546a09cfb7c4f240175338fe9ef
SHA512 3cb25645fd504172f3c01f951b1bed63e5fc7bc0825a790c5a0d09ceea220e4364f3a1f2ebe07ddc5093994bc0b1143d8939784cc01f3dafa9bee064794ac39a
TLSH
T13F21D0F3C3D1856EDA1146F06A28BE1BCE1D0515432C3C19C9E0EF1BA3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 365373a69a90a8137d15147ddcfe7a11b9144a596bd5068b62efcae57631c013
MD5 38f5f4f60b7d699087ac9b475d3daedc
SHA1 b7b951a4dc0a74bc879c7a55909f472bd57ef403
SHA512 73d2a62372041aa7aeb35a72170a65322e953dd5f2a7352f1a8ad62bfc6f41b6a94c087054e63617a26a19a0c72dba55ffd400ef0e5d66e4f6df926825b459a6
SSDEEP 192:sxZWRJPyM/jK1Ml8UQkkyJ/fessHUW9IdpHqHW6+WNGYw6ukLIg5hJ:sxZWxq/yJ/fesEh+KHbGMB
TLSH
T14352D816AA349977CCDBD209FA81BF53D6F5457292900E44AAFCCB0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 33f43499c8281de8cadddbf527b7a5ea3b052f4cd224e75785f48abe0b7de63f
MD5 3aac451a693f9b34250235bac5512212
SHA1 7d0536970a43d5a37113a9c7a02845b11262cb79
SHA512 990bec88e84fe2805ea96718ae1ab2f4f478383d126d064d88d11fbb0f1ec8ad09b51b464a7650542f02e507fa5b6be1f3c8a2468e84f205df486b02ca2368ed
SSDEEP 192:sxZWRJPyM/jK1Ml8MkyJ/feseHUy9IdpdqHW6+WNGYwKFkLIgrJ:sxZWxMyJ/fesCh+sHbGn9
TLSH
T1FB42E9166B34997BCCCBD209FA55BF53D6F90572A2900D44AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3ddb214e0bd6df19a944d0bb21540dea9ce8cbdd248a75a4c1b4dac7594a8abc
MD5 fe55d96d9a062e9fe8b37acadfa89be6
SHA1 010f3c60eebb386e2c4fc1dc11300e97685cba09
SHA512 41078dfd6b938b7ccbf64ef794fbe4597758653eb0179b5e1f27244655131ed7dde7165b54fa894ffcb9712fb4da84a986a8459c8645b7e2411b410117b7587c
SSDEEP 768:EZ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+drrohCcZfak:EZ4jeXmWvmKLEu1jacPLZQdY3h
TLSH
T119D20A3B240CCB7E4F844E5DED26AE976ED801CB6A984D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e131d60-005d-4695-8748-bba6e2055dab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e131d60-005d-4695-8748-bba6e2055dab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c5753a1106a820e905c1dfacc9d01b0d62c2a1a1add0e16656b09baf15b45d67
MD5 040427b9c7968791fb0983bcfcdc9240
SHA1 753e1eda9da43091210f6d1717aa6f98f58a6414
SHA512 191599d056edc0522c5ee832a566d3835ef1261b7716dacf5bcea75f898fa84138650c97f1a6439f79cf9299d0cb8c8296664f581b4199011af7e916e4afa3fe
SSDEEP 384:ltNn/s3n9SfsNAgBDVHDe9f+W86nX6DF/6MOObjI9G6w7tUF:lj+9UaDVe93X6x/x29My
TLSH
T11D928D32AC28AD774DD296A5F58B36178FF8416B97C53F84D6ECAF0D01CA6EC1316812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2c931a1e4d7d6b6b302f4802a9119fab8dcbd12a23bdf4e714878fa96f81d9e6
MD5 0bb2455c32d2279c763fdd470cad0431
SHA1 2e4c651b5d4f94e245b000fdfbdff9ad72aa36ff
SHA512 e4354dcd198c679a2d919ef9956745e79e983c3452099dca4b9c26a5bb721baf23fd45c569e215e7a057500524df5130d8422b4824f457173ca2a5c802787322
SSDEEP 384:riF1tNn/s3n9SUzsNA8TUNTUlIlRBDVHDe9f+W86nX6PF/6MOObjI9G6w7tUF:GF1j+9/BwgxDVe93X6N/x29My
TLSH
T11AA25B3358589D7B9DA28B95F58B36178FF841AB8AC5AB84E7DCAF0D01DB1EC1306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02649a518079a03d958b34178e13df0f49ec35cbc8d238b5fcdc9068a9e7504c
MD5 62dd1471f585b7342f6fc15c28d027dc
SHA1 9fa25a1bba6381e786681ace9261b7101cfca7dd
SHA512 0c821768624bbb1c1e0467c1c3b5666e246463389e1a1b5202101633c7e6555f732541928575670db607cfff419766b31149645ad67a1356c4634b48dd7e0195
SSDEEP 192:EONz6hZ0QmiUyi0pc/+jV8jzorxoE5wOZ/btU6:EONz6oOpu+W8672/hU6
TLSH
T1FB02D93568786C778EE2AF45F48727139FE8116BEA956B84E6F81B1C00C769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 87f56ed5d91d56f1dab85d54ab9c90ad7d3387f909c0401bc483223208926af0
MD5 9ddce68a8c0ea2ca83aceacaf12ef733
SHA1 260428c1d3e65298bd6a38834c0372a7863a4d30
SHA512 aea7f77403f45a7c21353b4746bc1ac3ef6095a5e86ae50eaf2e438c01921ea904e7bf15ff0e5e4fcf4d7a0bf5742bbc0a75bd5d71e2e7a16e54942740f0ff3f
SSDEEP 384:NtNn/s3n9SfsNARBDVHDe9f+W86nX6DF/6MOObjI9G6w7tUF:Nj+9UzDVe93X6x/x29My
TLSH
T1E1928D326C28AD774DD396A5F58B36178FF8416B97C53F84E6ECAF0D01CA6AC1316812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9ffe0d5fb00ddcbbe590fbeb0348d10c825d4e8c7930ce7482b3b949e2ad44d
MD5 68bc86ac18465240040c8111ada167c9
SHA1 1ac953990b77723b7c55da2ee0f17c259c1ba5a0
SHA512 f4d2f9978a331b2282d4ebea080f910975e321e85e1212dfdac23fde3cf178364bb34492797fb01537fa7c60ba648b36a9a6e73cfa43fa51d665db2199c42309
SSDEEP 192:sON56hZ1QmiUye0kc/+jV8jzorxonX6+5cOq/kqQMU6:sON56PQku+W86nX6x9/6MU6
TLSH
T1EF12EA366868AC675DD2A595F4C732134EE85127EFC5BF84D6EC2B1C00DF6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f23bea881e29a0e898cdb69ad9b6d7ba604f300bb9803700dbafab7455aba78
MD5 b6701ae455213ecaccffb9123dec7e8d
SHA1 e778dc6f6f849590ee3543b3e7829e0c09c39362
SHA512 1308e762e428014482677a9d9cdd02efb71f816294420ee3d538099f47daddffd78c97e273f0ce62c24d8796d97d6a23c11bb400759c42a8fec6d4a98f30ee5b
TLSH
T1B7412858B6F90148B3B76E57ABF6A86D487B7C772F16949E10110E4E0A32E40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download