hxxps://support[.]norton[.]com/sp/en/us/home/current/info?entsrc=redirect_pubweb&pvid=f-home

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.norton.com/sp/en/us/home/current/info?entsrc=redirect_pubweb&pvid=f-home
Sample260925-wa1ywsseqf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{D1B6D389-1F58-4741-87B6-BEDBC0E0FF63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
788	msedge.exe
788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3612	4528	msedge.exe	88
PID 4528 wrote to memory of 4824	4528	msedge.exe	89
PID 4528 wrote to memory of 1260	4528	msedge.exe	90
PID 4528 wrote to memory of 1260	4528	msedge.exe	90
PID 4528 wrote to memory of 1260	4528	msedge.exe	90
PID 4528 wrote to memory of 5076	4528	msedge.exe	91
PID 4528 wrote to memory of 5076	4528	msedge.exe	91
PID 4528 wrote to memory of 3300	4528	msedge.exe	92
PID 4528 wrote to memory of 3300	4528	msedge.exe	92
PID 4528 wrote to memory of 4072	4528	msedge.exe	93
PID 4528 wrote to memory of 3300	4528	msedge.exe	92
PID 4528 wrote to memory of 4072	4528	msedge.exe	93
PID 4528 wrote to memory of 4072	4528	msedge.exe	93
PID 4528 wrote to memory of 3044	4528	msedge.exe	94
PID 4528 wrote to memory of 2536	4528	msedge.exe	95
PID 4528 wrote to memory of 3044	4528	msedge.exe	94
PID 4528 wrote to memory of 3044	4528	msedge.exe	94
PID 4528 wrote to memory of 2536	4528	msedge.exe	95
PID 4528 wrote to memory of 2536	4528	msedge.exe	95
PID 4528 wrote to memory of 2836	4528	msedge.exe	102
PID 4528 wrote to memory of 2764	4528	msedge.exe	101
PID 4528 wrote to memory of 2836	4528	msedge.exe	102
PID 4528 wrote to memory of 2764	4528	msedge.exe	101
PID 4528 wrote to memory of 4712	4528	msedge.exe	103
PID 4528 wrote to memory of 4712	4528	msedge.exe	103
PID 4528 wrote to memory of 4712	4528	msedge.exe	103
PID 4528 wrote to memory of 3408	4528	msedge.exe	107
PID 4528 wrote to memory of 820	4528	msedge.exe	111
PID 4528 wrote to memory of 820	4528	msedge.exe	111
PID 4528 wrote to memory of 820	4528	msedge.exe	111
PID 4528 wrote to memory of 1188	4528	msedge.exe	116
PID 4528 wrote to memory of 3024	4528	msedge.exe	117
PID 4528 wrote to memory of 1768	4528	msedge.exe	118
PID 4528 wrote to memory of 5612	4528	msedge.exe	126
PID 4528 wrote to memory of 5612	4528	msedge.exe	126
PID 4528 wrote to memory of 5716	4528	msedge.exe	127
PID 4528 wrote to memory of 5716	4528	msedge.exe	127
PID 4528 wrote to memory of 788	4528	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.norton.com/sp/en/us/home/current/info?entsrc=redirect_pubweb&pvid=f-home
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ff82b3fc188,0x7ff82b3fc194,0x7ff82b3fc1a0
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10515872991653950157,6399551825608842907,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7485548645931867409,15473290174989967726,262144 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,5218577294167029592,9524339963502874289,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17839210682734862115,8562218108546385826,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,5047123724470295968,5602935977089503546,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7369013515241984960,2520138236820721996,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,1616066563012820308,17148600669521626372,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14201553247225766419,5473419243501680476,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7424288856681144260,4377605039807874111,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5620,i,12463258301797147197,9327630167995159477,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9585991814974140633,3208439499045404077,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9585991814974140633,3208439499045404077,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6604,i,3825665291781473789,15644767448578524369,2097152 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,10459102090624269904,4938230323218822640,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,11664894123681111278,13868631409564362133,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,8199918966551359220,16414305857512967695,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,17732291062795202453,350682452334128303,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,16551538516135622270,3169288877119520413,524288 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,14468248414425598431,7334618926889362187,262144 --field-trial-handle=2352,i,9239624278781134687,17526995924718280764,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bef9735a7954ef09111d92bdd3851eee5a39ef24cf2dc91918cf61a034c41c35
MD5 cc611fe953aced030d83c7992ba3745f
SHA1 75dc2734e825e7ee67d9ff27799d5f4e2ab5db45
SHA512 d4b410b38f53bc9a822302bc69b32383bc1295068ba9752579d11bd441865ab48e7dcc07b00d0ce7ed812866eeb7fda4dcc14c71a46df31e9c6136731d2b6add
SSDEEP 48:NSub71fCYqXJECiNL7YQMCXsGDzxQRfpUNuCq0msoW/BTRM3uLy7UZOXa0rKt69j:1hjO+CiSWXsAi6kCq01Z697r1KY9j
TLSH
T19391974A6590F4D4DB58F0789DDE08BAB13525F8440A7F32139DE4BD3B4E7D8B2044B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597584.TMP
Size 3KB
SHA256 351ec1d86f6bcbedf39734d07ed17ccd69614d3088d783fae244f2a0c2ab94af
MD5 0b59819c173a468a7da0bea9935832af
SHA1 60c2c2996089ffd6c4cb10fe0786efa72ba68ccb
SHA512 751dbae6ac963ba26fba84f4aba6238a1a2a24cf7b0ce8d4c06a20eae0657c88655b10f9c17c4d819cdb03d0791c613bb38ce686489a5377bf3b9a0ee3eaaf38
TLSH
T19061B88E6950F4D4EB64E1B98DEE18BBB53A65F0504B5D32125CE8BD3F0E3CCB208061
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1efa2f47743f434b6dd39abf98997bafc21667f7b8e4f0fcc5436b6fd58f5ce6
MD5 a815b514cfff21c4553e1768cea077c4
SHA1 82cd12fbc3159a4910fca598d05ec25d8e604521
SHA512 bd5ed9692ef5274c37c59d651a8b021b97626fd0363e45a9c02af5536f6144bf1dc8cecef4ce3e65820511e799d321c03dbf5f77bda72908e71bcb3ff6fe1def
SSDEEP 96:DnOwsAEg2zBhDxsYA+UtqdkBoufEdcIBBf1wQ:DOwsAEg21hDxsYA+UtqdkBoufEdcI3f1
TLSH
T1FDC14AB7C3E6C57D9A0166F09A15AE1BCE1D0624431C3927C9ECAF46D3F2962E201B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f46d967de4c19732a23d6e5a52d5e66976f3e0648b8743802de351f46ba638f5
MD5 628862dbe5e63f912fe029024ecd7beb
SHA1 0ceab4d829d8f5665943bbeda732689979559bf3
SHA512 c5e364e8bd133ec78051357e6b97e017849cd5b8c5cc73ccf00a94e56b637103e4114c8fd96682aee196654a3834ba9bf6f3ccb716d5d3c9f432dfbe32cd96f9
SSDEEP 192:sxZLRKLWb/fIsr2IdpwXHW6+WNYms/YYBeJOIgrJ:sxZL7b/fIsr3SHb2/fb9
TLSH
T1D322B8196E38A57B8CCBD20DBA15BF53E5F95072A1905E98EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9820370d274fbd3ae69a44e9103bf1c20f92089c2dbced4affcee60f58306d78
MD5 7e79c9cba7e546902b914cafcce8f588
SHA1 572c5a3284433428a57ac828db9dddeacfd6f17e
SHA512 a8cccc948777f81efa7f0041e6be8f793b061f30a7deabca3351e2e4dd9d393953a8747a5f7e68588eb5c8865a98ed8547b9e3f80b6b49b286bef808832cade6
SSDEEP 192:sxZLRKLWb/fIsW2IdpwXHW6+WNYms/YYBrJOIg5+J:sxZL7b/fIsW3SHb2/foI
TLSH
T14622B8196E38A97B8CCBD20DBA55BF53E6F9507291901E94AAFCC71C05E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 376be5ec3715f25e98564c65c701598572712cbbfb5dc8cf0af6788aa326e01c
MD5 98ca5f2a3b8d94b2a8b9b6fc53e583ff
SHA1 912ac7ec43f3e58c23ffb9a5817f7fb69247689a
SHA512 c6b0974facea87235190c8352ddfb05745bd4f2cea8a0aba389cbdbf86d02af34f680cd675cd7ab13ce03f41ba417f19d2084bb10f407042a5a035987435bcd9
SSDEEP 192:sxZLRKLWb/fIsC2IdpwXHW6+WNYms/YYBeJOIg5MJ:sxZL7b/fIsC3SHb2/fb6
TLSH
T1C722C9196E38A97B8CCBD20DBB55BF53E5F9507291901E84EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6838662414e33dd8545a0e93aacc3ce8052cc026dcdabe06bd44d2927271b2d3
MD5 0f82175a6b6424c8787830fa278bf659
SHA1 b223a341200bcca314bf9b401b6ab0cf18ed1904
SHA512 075573d38d5581010f08fe705ad0a7c0e25294683383dabeae71522176f797067e3cf258ae2d97d65e9c2599bd2d4dad921b85710d65e74033bad7dc51809404
SSDEEP 192:sxZLRKLWb/fIsW2IdpKXHW6+WNYms/YYBZJOIg5+J:sxZL7b/fIsW3oHb2/f6I
TLSH
T19022C81A6E38697B8CCBD20DBA55BF53E6F9507291901E94AAFCC71C05E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6a05e1751da7e2fb43e77242cd78797da69e4c9bdde116ec1e1606f1f26cfa36
MD5 727bca5bf17ec1180f70afde2ce1b80c
SHA1 97937448f782cde6c3343cce88a85da26b796893
SHA512 24d6a42766700b0927b0e4200d45cf2a661bfbfde94b16739f1043c28052e5eb50b66cd81ff7bb8907f87311bcbfdd04b055b7dcd2d01cc45f4ea1ea0006f80e
SSDEEP 768:LUyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXIropGo9:LUyYR7jWv3NpBu1ja/CL8OXzJ
TLSH
T191C2E92F640DCB7E4FC01A9DDC5A6FDB2E9802C796548D4047FA994C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e33b1627-492c-4f79-8e30-626005e0e529.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e33b1627-492c-4f79-8e30-626005e0e529.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d40f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d40f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 20fd6d1d18534cd15287a51e0e013b671c44178e923f4d34e834956c0244fa43
MD5 d9e56eb171fd04b808762fc51bbd1366
SHA1 5604bf0afd78e43f1dbb47b3274af52241582c5e
SHA512 73ae65276a5114eeae317256fb417d5811662c0196bed1839f4e65075ac6ebcf40a8e6d81c1806481cf683db5798d107a51ae62c5c4ea795b01b59d424ca00d6
SSDEEP 384:wZcIhsNJ4XN3TicR4qQX5+DtyOO/Hq89qdVtgOIwZOy1do0:OhlN3TG5kDIOUF9qdVXsuD
TLSH
T160828E36A8B89C375DFBA145B58732039FB85077E5C9ABC0D5EC6B1D01DA5AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9f34a57e493ac0633c85d00e63bde4f7aabbf01725acbdf26e112af5366bec6f
MD5 f1fb35afb523215bbf147a30b81238a1
SHA1 8ca77d7b8888b477b5ee17cea35faa6f6bb36b82
SHA512 9d56c059a3a77b83ccade30072c9f36446e3b6b5680f0969c5ca2279a9fc8f6dd7d6b13162e06e86db50358b4f921b28bd10e0aaaedd7504000b522ca1cb3816
SSDEEP 384:3oiFiZcIpzsNr8TUNTUlIl5XN3TicRXqQX5+DtyOO/Hq89OdVtgOIwZOy1do0:jFQJKwgXN3TF5kDIOUF9OdVXsuD
TLSH
T18AC229F658D78936D9AE5743B77E2E038EBCD067B484A680B3985A0DCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b70d7f2276aefe5e306bbd0dbbff90d1c3eaf47c24b72170a96775651959d98a
MD5 9d8d0b594e4e5df46360ae3f16fc5664
SHA1 5b8d478a6a886fd64a47c58fa15a9b7a2e0c4d31
SHA512 b0493c2fa5a594352fcc7ff1ffe91467d7484d8d2e2211a88eff516a855c144207fb0bcf898f7f15f6c8b1adfcf9d8487f8e12cabc80c647c1c5a6cf2c41cddf
SSDEEP 192:EONs6nnHGQmiUyEzQYcX5hQDP1yOO/FMcxWU6:EONs6nCXQNX5+DtyOO/F4U6
TLSH
T19102DA34BCB86C778EF7AE49B58A37135FA5217BA5946BC0DAEC1E1C00D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee110c39c27daa1e251f3c8b3805479ef428f8671894c9044a8be1464ead67a9
MD5 da196ea1deff8e31e23c2043478494f2
SHA1 0668a09c2545ac73774fe68853a16d0c79c7ac12
SHA512 3c6b867deb7e74dae0cc4ef649c29ee7ec4759bc6b93150e3122506a8086551b332af0a784da3ace8f3233aa7aa1437c44bd603c452abda074e2c027517f9469
SSDEEP 384:lZcIhsNJ5XN3TicR4qQX5+DtyOO/Hq89qdVtgOIwZOy1do0:dhEN3TG5kDIOUF9qdVXsuD
TLSH
T18F828E36A8B89C375DFBA145B58732039FB8507BE5C9ABC0D5EC6B1D01DA5AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d51646a4ccd976ad9a90618061c0729bf485b77fd09b298ef4297d42d8aa0d1
MD5 dcde27791dbb14e8a13690de18d81e7f
SHA1 aafd491cdce5443dcca14b88df5d1dc4de7388fb
SHA512 15d549a88351f0cf269741b008fa3bf4ad25f9551751dd1eebaf86bb44462d2bf35ee723a1ac0933656815489c9f091b72a8f75083f0fe4c0a9d81e0450f1ddb
SSDEEP 192:EONc6nnHMQmiUydz2YcX5hQDP1yOO/HGFfE9xg3j/5VU6:EONc6n8A2NX5+DtyOO/Hq89GdVU6
TLSH
T10E120B35B8A8AC375EE2A595B08731139FA51127E5497FC0D5DC2F1C01EFAAC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a444cd69-9566-43a9-8c88-87ec6780e702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a444cd69-9566-43a9-8c88-87ec6780e702.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1df0c9f3dcfca9a514d1a0e990e87a9baaa7123b0e3d165c3c507909ad672054
MD5 4b11b783351181d0674f898617cd3a9a
SHA1 ba9aab02db1aeac0b5500cc8e97c4c939926a79a
SHA512 3fb37c84cbe782ce4ebb3d3258fbe2567aedd89de6b47e9925ef5115cdacae4197b44dda8443e9f4d2d9e819c355173b2380dbbf683836af605713efa4538d85
TLSH
T1CA41165CBAEA1158B3B76E5A9BF6A86D487FBC772F47945D00010E4F0723A40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download