hxxp://listserv[.]legis[.]iowa[.]gov/scripts/wa[.]exe?SUBED1=REPRESENTATIVE_GRASSLEY&A=1

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://listserv.legis.iowa.gov/scripts/wa.exe?SUBED1=REPRESENTATIVE_GRASSLEY&A=1
Sample260727-tree4sxtdz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296426388829784"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{792A7CB1-A14D-4DD1-9651-BCBE222DE3C6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1540	4508	msedge.exe	86
PID 4508 wrote to memory of 4820	4508	msedge.exe	87
PID 4508 wrote to memory of 4520	4508	msedge.exe	88
PID 4508 wrote to memory of 4520	4508	msedge.exe	88
PID 4508 wrote to memory of 4520	4508	msedge.exe	88
PID 4508 wrote to memory of 4696	4508	msedge.exe	89
PID 4508 wrote to memory of 4696	4508	msedge.exe	89
PID 4508 wrote to memory of 1068	4508	msedge.exe	90
PID 4508 wrote to memory of 1068	4508	msedge.exe	90
PID 4508 wrote to memory of 1068	4508	msedge.exe	90
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 364	4508	msedge.exe	93
PID 4508 wrote to memory of 364	4508	msedge.exe	93
PID 4508 wrote to memory of 364	4508	msedge.exe	93
PID 4508 wrote to memory of 5112	4508	msedge.exe	94
PID 4508 wrote to memory of 5112	4508	msedge.exe	94
PID 4508 wrote to memory of 5112	4508	msedge.exe	94
PID 4508 wrote to memory of 2196	4508	msedge.exe	98
PID 4508 wrote to memory of 4188	4508	msedge.exe	99
PID 4508 wrote to memory of 2196	4508	msedge.exe	98
PID 4508 wrote to memory of 4188	4508	msedge.exe	99
PID 4508 wrote to memory of 4256	4508	msedge.exe	101
PID 4508 wrote to memory of 4888	4508	msedge.exe	115
PID 4508 wrote to memory of 4888	4508	msedge.exe	115
PID 4508 wrote to memory of 4888	4508	msedge.exe	115
PID 4508 wrote to memory of 1180	4508	msedge.exe	116
PID 4508 wrote to memory of 1180	4508	msedge.exe	116
PID 4508 wrote to memory of 1180	4508	msedge.exe	116
PID 4508 wrote to memory of 4528	4508	msedge.exe	119
PID 4508 wrote to memory of 4568	4508	msedge.exe	120
PID 4508 wrote to memory of 3312	4508	msedge.exe	121
PID 4508 wrote to memory of 952	4508	msedge.exe	124
PID 4508 wrote to memory of 952	4508	msedge.exe	124
PID 4508 wrote to memory of 3636	4508	msedge.exe	126
PID 4508 wrote to memory of 3636	4508	msedge.exe	126
PID 4508 wrote to memory of 2548	4508	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://listserv.legis.iowa.gov/scripts/wa.exe?SUBED1=REPRESENTATIVE_GRASSLEY&A=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffad1c8c188,0x7ffad1c8c194,0x7ffad1c8c1a0
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13879718138475999837,7364284580629236996,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,4981337077983071234,17712733367035813537,262144 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,5751719291941389194,14243857942008494034,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,15594337274657303363,12509532530895166063,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16958430651108876436,8586013500395382225,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,11481002519788930116,17775361589774106680,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12383713072319079368,1618999649313837672,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5975619714612238035,11280066904960915428,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15649541150296742729,10385914788939616683,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14196380587306048028,9561549272526564432,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14196380587306048028,9561549272526564432,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4304,i,890235141787371675,1530886568326535569,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3500,i,18218353942505572442,2261725164594406687,2097152 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,16250359136388017667,9912675917197007221,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,17023408389049265820,16477081104338580389,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,11062796774427408529,5576171755527033094,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4920175406440461398,7447867279987032473,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,15679102745546585908,7738695080265776238,524288 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,18034845586969129417,9012870919611719250,262144 --field-trial-handle=2376,i,3681903367977744185,16860628844014559805,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b37dd0063332d6da8f4f589d7792a7de5f166d4a0da7d7e19358d5006ed20a4c
MD5 e349adc70344d9362cb0b996638c7c20
SHA1 3f8ec97f788c6716dc02885e2b207663016567ac
SHA512 abb40c4eab52ac123bd64ba9a4cca8eb43a48479fe85444d200d220febb69584adb0170bcc231ccaa7dce8c378ff6807b0cdd13865d838c44f739faef1c2736e
TLSH
T1B6710B388D464AE1D79D2A3046DA00177032C3EBF6673E5ECD6C4DBC6111B2F3E26019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f20beb1ad00d1b57516a646223bea1342d22e4b38979388c4d50dfab623ad2be
MD5 08a225e985f8e4cde72f113e1ee23267
SHA1 092eb1432cc8387c25d0af499a690f15ceb97063
SHA512 e012ea201b0a361845cd7a8954071d0311ae36d62d215c2d8ad0b17821d9e8c378d0f44e068411e4cb7664b01a44b70ff170715a9bbab9d2e73dbb7aeec896a8
TLSH
T11571EA388D0646E1E79C2A3182DA01177036C3EBF6673E5ECD6D9DBC2110B2F7E25009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a004.TMP
Size 3KB
SHA256 f0e001cb479eb5a0a5b111b61e078426b9ad5c804b6aed6510cd3a1226187034
MD5 5487d8bcbf16f5c34243c842754b92df
SHA1 63a01c8442f74d5265d3c92d41dbe3df310ada13
SHA512 07cc825b2ecf45b60e0c0335907fa82ad14f3b5e05053af23113a7df607cb5efc53291e5780893fa5b620998ccf3cc5cb4bb108f45eb9c6bfa76d85913e25215
TLSH
T16B71DA388E0646E0E79C2A3182DA4117B036C3EBF6677E5EDD6D5DBC2511B2F7E26009
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 79f86498579e8fd358a10fcf6b4a633aed0096ac7d247a4beecdb1730f8677ff
MD5 2ee3a6d89302fd3a89c0681a982fd1ac
SHA1 f921f4d78aff5b88e4e09b8936af9d3e68e485f5
SHA512 7b48f81537570d35bcb148a9ee911e7f6d757c8013130cbcf2a8705ff44ed7ad594d588963ad75625b691afb728e45587f5beefd3b1c1e5725aa45bd6feebff3
TLSH
T101319DB3C3D8856E8E1156F0AA246E27DD2D055B43283D2988D4EF9B93F34B1D20194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e9a8acfc18ccc03bef797cd07b43586b26a49715affd00496dea422dbec4cbbd
MD5 cbaef849723e1c0cc14dde2e37200358
SHA1 3ff51a7b679af21ff1dd96a1b37a228a2b8e44e8
SHA512 a613a1ceecf5240967f0e113b40dc2dd5633ab50b3e4e0f70135d1589b2f51b37e0794a1e3be369a67d10a030252782a6e99cdb21184a30375ca5199de796f65
SSDEEP 192:sxZcRrkU/fBs8a7IdpJH6l6+WNGYCIQrYLIg58J:sxZcSU/fBs8akJHzGtmG
TLSH
T1BF22C7166E3895778CCBD25DBB15BF13E6F9503291A11E48E6FC861C04E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 59d39c3d3358da188e72709a05c2f9400001c37cc75c3aa4b21fa548f64305d3
MD5 10b90fea1daddd5b5e43fcdec39341b3
SHA1 381bcbcbe3cc122ed23ff058d1e068e90d018a96
SHA512 5c948242473a1e250c5cb6b2947ff11af0a2373d7973232ae2e6e7d8c00815188e048acfe71efd3f9aa76031dadc7ad04c37691b4b562b38c60bbcc2011afd57
SSDEEP 192:sxZcRrkU/fBsOa7IdpJH6l6+WNGYCIQrYLIgrJ:sxZcSU/fBsOakJHzGtm9
TLSH
T1A522B6526E2895778CCBD25DBB15BF13E6FA5032A1A11E58E6FC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 28e835b4470a5256e4177c6d1d49771fff8862bf7b5fbd2a81820bda698bf19c
MD5 2ec81cd5573932ed0f654544c8ee8950
SHA1 963f897ae1a8b70cd1d8b3ab3aae54e6a24dc80a
SHA512 4561294b41ea149f6b4782d06d941c89ec221aa1fbf54c0ca91c4edd3fcf2f1483a50e0fe3c458a767341e9eca0112a08fbce3a7e9f0884b51c6adda03bfea5c
SSDEEP 192:sxZcRrkU/fBs8WgIdpoeH696+WNiG1/YCEWrYLIg5uJ:sxZcSU/fBs8WhzH79/JmE
TLSH
T1C132B7166A2899774CD7E25DBB55BF13E6F9503291921F48E6FC861C04E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6fefa0abb3a94fb3cf4f50da153da86740035fd8403bbfcf3fc2e9f1f251b85a
MD5 4dcf7cc215d314b4a4412db61f72fa6f
SHA1 852cae4fb18f640e5bcbe7e290fdd678d0644c4d
SHA512 c9aa1947888f28d6255a121c7d913fcdae8d5db94d3547513fc4837ee59072073fc8827fb4873e91650a71bb530a63741ef7800f1957848eb52af542a6ae0557
SSDEEP 768:TRqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrEroP:TRqbUj+WvSCs6u1jaaZLbWrPP
TLSH
T1E0C2E83B340CCB7E4F801E9DDD5A6F972E9802C7A7988D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593c15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593c15.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 133628590e008c2b87813a3772812adf0c936df7f57e197b8d4051d272b9e013
MD5 7155a5ff7d11fab988eeb305acb9cf4e
SHA1 6d240f5685ff42c939360ac17bf621dd1f97a62e
SHA512 4b1f9a9fd75c3a5ec842cea6f433f89830d4e8cf09bcdba1434278bc2acb7ffe997394c14d3373982dc69e699408e8286437f38d88a72ba9f116be78e3df309a
SSDEEP 384:viFiZcIrzsNA8TUNTUlIl/EVGGin8Ea+XOkjBbFO6AV5XMUkb3:6FQ/xwgfnauOuBbFTAV5XJe
TLSH
T1A0D219F258E78876D9AD5B87E77D2E024EBCD067F1859A54B3D85A0CCC9617FC30A810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 86bbdc90a074460bebb8e7fa3ce6eddc80cf3a793db27c0266ade386035a3bd4
MD5 8f665e5f29119cc7e8b321c89b8fc28c
SHA1 e4d043f8c61ad231b1435ae205c489e97f5438b9
SHA512 8bb4a3d54fd1bc7178ff34f1dfbeec8dc40431eb5e6813838256c5513b3287ce1c2f02d44af9e2e4692c314cc8284fb601ad6f4cf6a57b384f1a9ed0a8acf8fb
SSDEEP 384:UZcIhsNA/EVGGN8Ea+XOkjebFO6AV5XMUkb3:ShynauOuebFTAV5XJe
TLSH
T19E929D316D385C7759B2A589F8463A079EF8A067D3C65F58E5EDAF0C00DBAAC031BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2aab7570123218a2aedb585327c86fef8d1530ce7c28ec4ae1853e985ce585c
MD5 2307b003bd58f0c334ab22bb7a5b37e4
SHA1 dd62786be33e20fcdd79d0552c61f39ecf3bad61
SHA512 dddd016722131774641e6043b594c5fa5a372c5479a2bc41ec9af16681a379657e2899d33c0cf66f42be730102b25f73266181a5f2948fc3e51c3c7c7714b687
SSDEEP 192:vONi6Db6QmiUy/8kHBa+jLOmLtmVERgNcU6:vONi6uKHBa+XOkUiU6
TLSH
T16B02E93969786C779EB26E89F88737175FE8207BD9562F84D6D81F0C00D765C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 725d279bf95a2dc6b332473f1df4e486413d4468111cfa7e9c875b3dde86e214
MD5 982b47155aef08f1a90f39d5b76c6702
SHA1 e52cc06d48508e93f2922d816259d1432790cfc1
SHA512 5827e3edd9322e1bb006634e871a39aa464ab39a0978068daab6214cd6f8a478e67e234a6acd36af87b3d07d03377623d5a767f3b51d8bfc2c2ed5ab983af0fc
SSDEEP 192:OONx6DblQmiUy/BksBa+jLOmLtmVyFNzbrqTNiU6:OONx6bPsBa+XOkj7bU6
TLSH
T1B112293679789C775DE2A9C4F88736179EE85127DA8A7F90D5CC2F0C00DB65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5507f17a6267412264f8a70882334d808d9e9217ca2f263a4555fcab9b73f939
MD5 28cd18a8ed12e69d483b33e71d48ea5b
SHA1 ede15e7d6c7fcaea03af3df57d114d6e85857728
SHA512 7ea1b65553a8d70ce570f3514d8a62d32918b37971cad2d18aea286408244e8315b5a72279de6b4ce39b06782f5b1e9958afde9233184b5f4f7f60420e1f954c
SSDEEP 384:5ZcIhsNAKEVGGN8Ea+XOkjebFO6AV5XMUkb3:RhHnauOuebFTAV5XJe
TLSH
T10B929D316D345C7759B2A589F8463A079EF8A067D3C65B58E5ED9F0C00DBAAC031BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ab132c2-3f78-4def-919b-738c660c5a61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2ab132c2-3f78-4def-919b-738c660c5a61.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 65e610b4bf7e0fec979fd8f9541884b59a56461b8f57d19dd406e21ade1e8fa2
MD5 ad7d19f80e17862db00f441c350ad621
SHA1 bfd3a2e9aff2fba12960ed1742a8a4ccf9756a95
SHA512 1bfcaa3444cf6835bf0480f7324dad0d4439ed5a986c86cf73e31fda425a001348f46a2a0251d6aba119951e43b2ff212892a7908acdbaf218d1d7a6e296c7b7
TLSH
T177410758B6FD1148B3B36F5A9BF6A8AE447BBD372E06C49E10110D4E0A26B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download