7410898b4a65277235fe611401167ceb96fa5a069245c4dcba93350a2a4cad98

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.htm
Size 7KB
Sample260910-prgs1stbna
SHA256 7410898b4a65277235fe611401167ceb96fa5a069245c4dcba93350a2a4cad98
MD5 8d152e987416645b11e41926b6324487
SHA1 3cb258dbd0a351b7c07dd21d15794e2d90bff221
SHA512 ba02a18761a0095f2d02549f7364c7b5e2ea1016a25f33741c57a16d148c9fbd648ee6c81d96360e4446460b3aa0c8245c648f8d5d8bd9b52f739e1e37c3fc4e
SSDEEP 192:qxYTK6WSeJi472EZg4miDixBnUlzEZTR8+H:zFeJi472EZbRDixBUlzEZTi+H
TLSH
T1E9E185A77381BF380651066372271AE4FF97606473254ABC343B306F278DA55583E7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335172325873348"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{65DC60AB-4A77-41E5-AF72-A7039985786A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2552	4888	msedge.exe	87
PID 4888 wrote to memory of 3360	4888	msedge.exe	89
PID 4888 wrote to memory of 4608	4888	msedge.exe	90
PID 4888 wrote to memory of 3360	4888	msedge.exe	89
PID 4888 wrote to memory of 3360	4888	msedge.exe	89
PID 4888 wrote to memory of 1368	4888	msedge.exe	91
PID 4888 wrote to memory of 1368	4888	msedge.exe	91
PID 4888 wrote to memory of 4760	4888	msedge.exe	92
PID 4888 wrote to memory of 4684	4888	msedge.exe	93
PID 4888 wrote to memory of 4760	4888	msedge.exe	92
PID 4888 wrote to memory of 4760	4888	msedge.exe	92
PID 4888 wrote to memory of 4684	4888	msedge.exe	93
PID 4888 wrote to memory of 4684	4888	msedge.exe	93
PID 4888 wrote to memory of 1636	4888	msedge.exe	94
PID 4888 wrote to memory of 1708	4888	msedge.exe	95
PID 4888 wrote to memory of 1636	4888	msedge.exe	94
PID 4888 wrote to memory of 1636	4888	msedge.exe	94
PID 4888 wrote to memory of 1708	4888	msedge.exe	95
PID 4888 wrote to memory of 1708	4888	msedge.exe	95
PID 4888 wrote to memory of 1856	4888	msedge.exe	99
PID 4888 wrote to memory of 4676	4888	msedge.exe	100
PID 4888 wrote to memory of 1856	4888	msedge.exe	99
PID 4888 wrote to memory of 4676	4888	msedge.exe	100
PID 4888 wrote to memory of 3628	4888	msedge.exe	102
PID 4888 wrote to memory of 4288	4888	msedge.exe	107
PID 4888 wrote to memory of 4732	4888	msedge.exe	108
PID 4888 wrote to memory of 4280	4888	msedge.exe	109
PID 4888 wrote to memory of 1264	4888	msedge.exe	111
PID 4888 wrote to memory of 1264	4888	msedge.exe	111
PID 4888 wrote to memory of 1976	4888	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5934866203967822204,12728140867710110057,262144 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11665280764791683043,13734916302900566294,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,731239832779106217,10153752938521304357,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13250899871056704878,10352318207040401656,2097152 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,9207460889799240967,3176456397614793842,2097152 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,582181135047603862,16209966052324203100,2097152 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6299138480849829619,12861868345032674606,2097152 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7502561237273126275,7272311618099628673,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,11794975206169032561,9955977565733527315,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,431515522627305567,15614106384718152104,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,431515522627305567,15614106384718152104,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,9286077647873797640,13807458038367601196,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,7634028227406129950,12154309286306273258,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,205133002899041236,2792120764601360963,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8907967052907495803,2424689826510644272,524288 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,10900698856106077222,7307678489806413861,262144 --field-trial-handle=2320,i,14579673776475995286,17653216575216152648,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a39b059c3421ae984b5acb02d54af418d7f7f57dfbb2f4334092544928368f55
MD5 3a989f7601985c38be89bdef9c5350f8
SHA1 6300b48ca5404d33b7520cffbf029ae055850b0d
SHA512 66d0a5d55a89e5039c9eca9888ed4ddc8f638a29883ee5132f59d0281fceae814d60fe9630c1ec18921919334c742e47ae6bb35c2b182e27cd87130aa23ad05b
TLSH
T118812A38715612C8EB6686BD73D1D24032F0A4E8F8931E02918B59BC3A0A7D143FF4E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d2bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d2bc.TMP
Size 3KB
SHA256 a1fbc100ff1a4833f5d3a84c983aa36f1e19ca5cf62ce24ba53dfa35a7412025
MD5 b6cbb72820ff556ae0fce0ff86eef98e
SHA1 8ed84e5068aaeee978939f1e6fdc9769b21e08b7
SHA512 4585b3a5afaccd29fd0494878cd5776912474b4a9010c0d0c0f68f2fc3b9b9e4617b42169c0b6fc4d8f6e0290c9d91af5d511c2bd7f4394cefee067d111e73f3
TLSH
T104811939719612D8EB6686BD73D1D24032F0E5E8F8931E06918A59BC3A0A7D143FF4E8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 392b4b83db67e6a6e8e638ff22410c6be07326f130b10925bc19bb1d72ddfa8f
MD5 5cee4050a5cd961acc646ee1d0b94222
SHA1 909e9dd3bd4a0e44911c9452e101a8730de6f612
SHA512 378c4bf2db37a2d37ba4d5f7de5f70897bfa3a2a0520bde7842085cf874d50937368d6a40567b68b36cd78743feeb908a8a8f77854ad62eb4db48036e9606662
TLSH
T1C611BDF3C7D5856E8D5116F09B24AE1BCE1D0902421C3C1585D4EF6BD3E3479E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fa69997d76271cd540353082d9f1c4269c0bb7c05fd46582dc9b359dfd46555d
MD5 fea4bcb92c0878bfa3a1ef3a5c8679bb
SHA1 cd5608fa3745bc1e103a74f63d8e436cf84f8e04
SHA512 c2d87a24b80623f92b7f6c0d77a6976c4602d53fd2ef2efb8ef12a47332b38d9fe72b27aed846b8e3a3f8dfa18334f15cf1f19014bc531f9b38acfc981097591
SSDEEP 192:sxZKRwyM/jK1Ml8UQEWw/fasDj6IdpHQHW6+WNGYzlu4cIg5/J:sxZKuqPw/fasDvwHbGHD
TLSH
T13852D615AA349977CCDBD20CFA41BF53D6F9547292940E44AAFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b3f31de61d42187d6361b3174ded7d1d8fbaa270b706f7660c0ceef7a1e610f5
MD5 590ffb22e32d4605c80817ca105c9305
SHA1 4a16eb9f6c9e6045c97d5ac77902a7d2e65ed4fb
SHA512 bbbfdbed572b97a42665fdd3c7091e6737454bb059ba4af0005c7854822ab4e13ef7b5e634dcb3c770fb13c2ea80bfce8ba6629d6c6702b5b9e74be815777ca2
SSDEEP 192:sxZKRwyM/jK1Ml8MWw/fasaj6IdpdQHW6+WNGYzQH4cIgrJ:sxZKuuw/fasavaHbGp9
TLSH
T1C242D801AA34A97BCCDBD20CFA55BF53D6F9547292940D44AAFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2c0dd30a335472b24dcb1ddbe9e83c272a7e9a109882be941733b861794495b0
MD5 d87e3ab2318e3a59939d66b797549c3e
SHA1 1f595ec8aaebc0a89ca37d05e1abd9c88978a7c0
SHA512 5bb8df265f7c355ed0accc3f9801533d9ac5574c2a0e8791a5c7e1781b682bb1c41fce80cdeb1dd54be04e9c18d6db58b17246b9406dd8fda40dfca080618fa8
SSDEEP 768:hoW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjWroIXnisYv:hoW7kf0Wvqidau1jaa5LA3jtRv
TLSH
T1B0D2FA3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 93e81ffccc46f75fc72edfe42a97f44ef96f6af8a5ef05d3d81dee430fc17886
MD5 c074b72a3aac0360a67bae2c8edc6c6b
SHA1 ac8be5d5e7fef3649e00715c60e2e67e1d9281cc
SHA512 9b234922accc06296c8c9efa63a284fd65a1d938a33f112a13cf813c1ce92ea7adb34a0711c27d6e4b29fcb2df021f0f4b08d381ff3d2c9887dda134f4aaaa96
SSDEEP 96:KIbCKcrGgKLSuC8IKR+qMf6jvVRlgx5ozXXgKvT:sgTzr1
TLSH
T1BD9124127176579139BE290C92D6D72B8F4232B33519E66F7BB804624E26E214EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 238cfe930f6c1704320a04a8dbb09ed1347dba9d79afa3743d7c42cb364152b2
MD5 b813da6a2dc8ceff439fc8eff6063936
SHA1 99e935176f6b0e5f95130208f77760d2e8e19765
SHA512 a6fb0af41f429332bef3e1e12c895031db8e0e7d7f26ea36e253dc366b94f3ff9b0cae6b27ec597af8ac0060fc18434dea7a766464e0bd3e0c1a8125f587d6a6
SSDEEP 384:1ZcIhsNu5TbgKKoDFDHFvxuvzxV+MhdpoB2oG:NhzjHRFv4184powl
TLSH
T126828E71BCB96D7A5CF6E140F48633074FB88177AAC85F40A5EEAB1D009B669132A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d5c9615bb98a85c8439b337e78d750b8a4309b4ac5a768676f691d3e89a95e01
MD5 23f617ceaefac2d8a05a837e5812af6c
SHA1 29efa699244246cff07bf6cb58e912cc73bd1524
SHA512 6b8a20345828d96309fad22da6045b9230fe0902525ae4fb9288eb88ab424b4dd52f30e7482fe4d6eee7d13ca75dc8e5c7ec84da48c20dd5191b1bb32a860f57
SSDEEP 384:uZcISsNukTbgKKoDFDH8vxuvzxV+MhdpoB2oG:MSAjHR8v4184powl
TLSH
T1C8828E71BC756D7B5CF6E140F48633074EB88027AAC85F40A6EEAB1D00DB669132A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27c7f98085350a563178f9ffca694309ed855780241c3f5c6a7c2e8421edcb09
MD5 e6eced5c1eeeb985fd14aca8f2f8a35f
SHA1 13c695cac1e733b724ebc026597a33a0c906ca84
SHA512 ed14a087819b1c1d1e068cfa3658f0a77a87bba504b0569b20e51f29512cc3ca532b8e5a0ccba58a262ccf4669ff7b136342d0c99e370266d8e8128605d5777d
SSDEEP 192:MONH64BAQmiUyL1GW5GBPKulCx9FUaDa0U6:MONH6eAYQW7DFFzU6
TLSH
T12D020B356CB96C7B9DB2AE44F58637176FE4117BE5945F40EAE42B1C00D724C234342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 847a24b6ac193582bc7eecbd8c353872567c3b0c76a9138940724a9d2c20316f
MD5 2896246d2b304459d1cc913cd5067164
SHA1 3402e3940fd74d73af0750d911636005daf69c68
SHA512 f0cf3686aac636dfd33766f4e0afe24e1714e9bb553d476284e1acaabb088763cb6974d0de44c670f43e775af23c9765c7afa2054b37e38a1cae93465b8ade00
SSDEEP 384:OZcIhsNukTbgKKoDFDHFvxuvzxV+MhdpoB2oG:shAjHRFv4184powl
TLSH
T183828E71BC796D7A5CF6E140F48633075EB88077AAC85F40B5EEAB1D009B669132A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8463f6993f2ab39eb744c03575d5e00c1e13cc56d4ca7614b7ede95d66a04de
MD5 4de0ed5b27613ec57b00e15cf74c2d86
SHA1 a80eb01c43653814a91883fecc1e0a38335082a6
SHA512 d294f0dd1684ff7a2f40f019a52f410e8824eed357f051fa76f3532d9af4778eba9c3d7d8d0f996958ea3e7335a7710bfc32e5787438aac69f9617499ff0290b
SSDEEP 192:/ONf64BgQmiUy1GW5GBPKulCx9FLvG2fWwSqLrU6:/ONf6eg5W7DFDHLvU6
TLSH
T1B612F976BCB96C3B5DA2A550F48632075EA5423BFA846F40B6ED3A1C01EF66C231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8727b526-7dca-4ebb-8cac-dd32dac2e35e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8727b526-7dca-4ebb-8cac-dd32dac2e35e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 796bfd91114d666f2711753522695efddb749af3c1aad9ff33347e2eaecb9f41
MD5 07ac7ecdc0da6d9df35c1cab7b6421b5
SHA1 58b1980c1364810d145901e7d98242a4a789199e
SHA512 e66f932d2f104902bacc14a33933ac79e3eeed7ed4eddbf9d3db73d7dab90b787a18f3cdee7f631c55d1e6db966f47904a17f076861a9d3670e5cb6df78ba6d8
TLSH
T1ED412658AAF91149B3B77E5AABF2A86D587EBC372E07D55D00110D8F0662A40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3628-172-0x000001D9E78F0000-0x000001D9E7A39000-memory.dmp

Download

memory/3628-171-0x000001D9E78F0000-0x000001D9E7A39000-memory.dmp

Download