3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-1h6u1d.html
Size 171B
Sample260930-2pgfpatgka
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5016	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{64834255-875E-4DFB-B94D-3C2B4EF59F66}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 2008	3084	msedge.exe	86
PID 3084 wrote to memory of 5016	3084	msedge.exe	87
PID 3084 wrote to memory of 2860	3084	msedge.exe	88
PID 3084 wrote to memory of 2860	3084	msedge.exe	88
PID 3084 wrote to memory of 2860	3084	msedge.exe	88
PID 3084 wrote to memory of 2652	3084	msedge.exe	89
PID 3084 wrote to memory of 2652	3084	msedge.exe	89
PID 3084 wrote to memory of 5032	3084	msedge.exe	90
PID 3084 wrote to memory of 1680	3084	msedge.exe	91
PID 3084 wrote to memory of 5032	3084	msedge.exe	90
PID 3084 wrote to memory of 5032	3084	msedge.exe	90
PID 3084 wrote to memory of 1680	3084	msedge.exe	91
PID 3084 wrote to memory of 1680	3084	msedge.exe	91
PID 3084 wrote to memory of 2392	3084	msedge.exe	93
PID 3084 wrote to memory of 3124	3084	msedge.exe	94
PID 3084 wrote to memory of 2392	3084	msedge.exe	93
PID 3084 wrote to memory of 2392	3084	msedge.exe	93
PID 3084 wrote to memory of 3124	3084	msedge.exe	94
PID 3084 wrote to memory of 3124	3084	msedge.exe	94
PID 3084 wrote to memory of 5024	3084	msedge.exe	100
PID 3084 wrote to memory of 2452	3084	msedge.exe	101
PID 3084 wrote to memory of 5024	3084	msedge.exe	100
PID 3084 wrote to memory of 2452	3084	msedge.exe	101
PID 3084 wrote to memory of 3484	3084	msedge.exe	103
PID 3084 wrote to memory of 3484	3084	msedge.exe	117
PID 3084 wrote to memory of 4844	3084	msedge.exe	118
PID 3084 wrote to memory of 1124	3084	msedge.exe	119
PID 3084 wrote to memory of 1516	3084	msedge.exe	122
PID 3084 wrote to memory of 1516	3084	msedge.exe	122
PID 3084 wrote to memory of 2440	3084	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-1h6u1d.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa2243c188,0x7ffa2243c194,0x7ffa2243c1a0
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,14267521819656437800,9358368455628503194,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,15497255414914845188,1359412457667661212,262144 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15237164542923545304,8852553639713298332,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4772790821623396888,1313981454976130768,2097152 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2839529519975203829,10079448262605282371,2097152 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14333194918302540058,8001702624397666319,2097152 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,8693861263606640331,16836665334938859622,2097152 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6859840815435281740,2958092072010271277,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5343744523814084836,6319902319271723550,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,807535144973787431,10450166356925502304,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,807535144973787431,10450166356925502304,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,8299786996063110352,753180305343324846,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,16824418571601811486,4813756372807623350,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1835882191318817524,14278349990773786011,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5906928229670980060,248239674868285662,524288 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5688,i,9726605677292355641,7129111428939585150,262144 --field-trial-handle=2276,i,9045053690260742285,15459097288542637197,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a27c447b393d9196210c297feee6b894adc0264c00177b05c0dbcc3c3a71124
MD5 f15cb565861397bb7f46646114bc5b7b
SHA1 9cfdf8764b8cfcea31bda1aaa2501fa94af25ebd
SHA512 a26dc5325414c2bb47caa334908357e03e9e1abdfd0b8b2a0124901fed6d4d3ba0c2d2b51a108d741a6abea15b1f9ef8a35496c0f4fbad8b2c576d90dd5bf453
TLSH
T1066183A559E45A51FBA04C70AAFD32433B3B97F147C34F821954D978D619F3130D6E82
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 938fe4fe6311636b755589d11c3d4b884ff6ed0b639eb2d7ed2981902ea2ceba
MD5 95211bf7b1636fa145ae55d32cefd0f4
SHA1 cca87343fa082bd8094ec7d6540ed73809298371
SHA512 2f79e1e03bb363c63207379792f69e1a6e6b02507a014d4968a9f46e476712e0e4776bd6d289d3baa580f8909898435c9f38202803a27f58c6431f509a3427d7
TLSH
T10A117DF3C7E585AE891116F05A24EE1BCE1D0615421C7D19D5D4EF2797E3075D00269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6f1c42f652bee87f92463536b8eea6d1f9f5881b4a2535239375b675b5509abe
MD5 b2e5c4897fefc1218ca6865417471c7e
SHA1 ae4fde29a55779d3be9680694fa753f8316399e2
SHA512 ef4dd8fbbb8ca0c12b3d6b680ff96bf543b48538261ea3cd9d790b9a71905d9f230a3397f0bdd5cbd7894744ab7efeb266410ac93936028594e6ef9016e500df
SSDEEP 192:sxZrRYWx/fWsvGkIdpdsHW6+WNGY3RuPIgrJ:sxZrhx/fWsvG9GHbGP9
TLSH
T10822B8126E68A97B8CCBD20DBA557F53E6F95032A1D41E58EAFC851C04E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 40e73bcd3d6b5931e472fde289dceca438f5792960ca884b1a6208aa0aea8359
MD5 c9695b35425928e2aa5ced6dbf96e212
SHA1 37e0fee5f3ab9430a9c825e0d1075f4eddbc21fe
SHA512 e018e595e8ef8e6d3ba2e6eb255cd40db42569da2a31477b4a3e0eb218e1ea20e03f5f7d9eb6863d08cc5b736e27c74df8a03f9931d4ba28aad7838a5e1be92e
SSDEEP 192:sxZrRYWx/fWsQGkIdpHsHW6+WNGY3TuPIg5kJ:sxZrhx/fWsQG9MHbGx+
TLSH
T1CB22C8526E68A97B8CCBD20DBA55BF53E6F9503251D01E48EAFCCA1C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 940d415f4e08778fb60617d9e45a1b35915fbccc6def7759aef8d9b948c18383
MD5 e0a70b7302394e19b46cbd71ab1e4592
SHA1 bc710bb72f5b395964513140a5ef554772b76761
SHA512 4feaec8b1b28f5938d227a2a483b10292852320d2c8a3339a97c9e3c15e7633e82cfa32573226ef0c8c53d3919779fa232cb18bd456c54de96dc4178e258bc0f
SSDEEP 192:sxZrRYWx/fWsQGkIdpdsHW6+WNGY3XuPIg5kJ:sxZrhx/fWsQG9GHbGT+
TLSH
T13522B6526E68A97B8CCBD20DBA557F53E6F9503291911E48EAFCCA1C05E7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2cf5d8cf09a223b0fffbf0eba98d3e30f975e975d1d86b1d5675ec90f03b45d5
MD5 a6fae6ad06231c5c33c750ca7c35eaf6
SHA1 599f3fffd2f09f332c3e564992544ce19be02e34
SHA512 ded9c00e20ad025221ec6408ae9979cfaf8fc27b75f714e17735389f60c0cd4bb9b3a94138aded38ca3c24203744750ec8afa5d1e60f09780caf1640aed104dc
SSDEEP 192:sxZrRYWx/fWsqGkIdpdsHW6+WNGY3RuPIg5OJ:sxZrhx/fWsqG9GHbGPU
TLSH
T15F22C7126E68A97B8CCBD20DBB557F53E6F9503291D01E58EAFC8A1C04E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 50f6f3ae2f3ed64b2e8c89e2fc58630da3bd745810910a1e10b2a1caf1a34c6a
MD5 bf00cdaa1d560372a2fe36b48df19686
SHA1 634d9cff75a4af95c91a8751bab2e9e71a84ca18
SHA512 8af1dccca2d1506be524dae86e377740802832f64378eebc38b236db01e3d05cff0f22d9992e4b988be83b5d8f64a1204013ba619ba79541634e671d036bd351
SSDEEP 768:Rf30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72SrolZMY:Rf30AbSWvS2l9u1jaLmLZ12JL
TLSH
T1B8C2EB3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0a805d5dac8567372bd7635113bc0ad016b2ff794229ecb756dc6b23d5a5e9ae
MD5 7f4cd2199fcff27d8020bca8a211e7ac
SHA1 dc85918ddae4526410176a640afef4fd148daeea
SHA512 fa7ec4e7769b88006abda880aa0ba9b0674f0bf9e8c0314c95e8b5e031cc1bb378cb48885464df8e15f08ee50c52dfe3843e8a5b1836d9e62e2d2a8ad1f61c97
SSDEEP 24:K24ngUOItKkhg1eSBudyXhGxeAsIVKahU1+S7Y82so202X25p22O2F2l2qX292Cn:KA5ItKSgIPylrIVKMU4UjIBK4QUbyK
TLSH
T18491120271BB165139BE792C84A5875E46823A737018EA2F7FFC54A25E2BF040DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e1eacd6-184d-4f99-afb8-2430f26f745b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e1eacd6-184d-4f99-afb8-2430f26f745b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c24587ddbabadea59b9397ba583cefb68c1c9ed7b222f11491dba7f557fedefd
MD5 79166fd71df7655652b733b4a9a150bd
SHA1 61cdc26b279c6187c225ff6797cbdab2825ba97f
SHA512 1bb50fc32fd3bac8d21ae2d1ef92367f93dc5be7d85bdb8aa576374d4727755db8a3f4429a047811b118f9f5d5c1481d90c83a6d1a33f5919d16686db9aab864
SSDEEP 384:jZcIhsNa7AxpunO89iX5FF+UcUT9tgOIwZOyMojol:7hkL4aZBRT9Xsoje
TLSH
T1BE827D329CB89DBF9DE79144F18736035FB8842BDAD8AF94D8EE671C05DA594030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e4cb94a0b40fc5c72d464069821b056f69f19778d06001c31426f8b08298ff76
MD5 d7ef1cbd30cb17b3d1ab81a0ee200e58
SHA1 ea2d4605455b23d90a52cc9ef8a4f9dd205d6777
SHA512 0f800c11aa88c52c58e9df624d3559b3a6e5e07192021fb6c2b773f9673022891527c66f984888c54d1d8f8698592a03450323477e61d08c3515c0764249ae31
SSDEEP 384:iiFiZcI/zsNi8TUNTUlIl2AxpunO89iX5FF+UcjT9tgOIwZOyMojol:pFQ7TwgTL4aZBoT9Xsoje
TLSH
T19CA26D339CA8DD7FADF69A84F64A36038FB44067DAD5EA94EADD5B1C019B1D8030BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b63b7c7570708b6b29d133ce35c9093f799aa17a960bf94144c8475ea868030
MD5 967cb46470cc9cffa6642add8ea1f40c
SHA1 78dc636f6039a2fa4546a023917ed7a88fb1d21c
SHA512 296976f586bfc220f6f18413937a2e4ca7618b609f2b7fe6e4d37a6c4f4eacdb9238fc194c726e09f0c731be7b4c7ae95a9b82d91b50ebf7f956a6b3ba21cdae
SSDEEP 192:LONm6AmwprQmiUyM46siX5FSY+U9JihaU6:LONm6ipdo6siX5FF+UqwU6
TLSH
T160020B35AC786C7B8EF2AE55F58B37235FA9116BEA941F84C9E81B1C01D768C1346832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 759a89a3b8c843f208bf17d86c0dafc177b12396696a15ebaaffbd32aae00fb1
MD5 3017fbfabb396f1e322fa23db8521ca4
SHA1 09dee9f94034d905b0d6b2721a6d9a332454ce65
SHA512 9b27c01981ae0403b97a5bde41298739ffe2874c60e42217e50bbe991f1910f2e831b1db410085e9a91584973fe2ba2c075d26147aec79f6307c6aa0031bdf37
SSDEEP 384:zZcIhsNa2AxpunO89iX5FF+UcUT9tgOIwZOyMojol:rhXL4aZBRT9Xsoje
TLSH
T1B6827D329CB89DBF9DE79144F18736035FB8842BDAD8AF94D9EE671C05DA594030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d7bc8b38e8f8815a34c8d73a0acedff3eb9084a36e9afbd0fe74a017a315e04
MD5 91a8c51c5ee6e891781aab324a7e6ead
SHA1 292a432f889aa72da838779ab8dcaa7b63a1f309
SHA512 d0447080aab57895ba48a93458e98c7ad7dac9fb37e1b3e3f047d052f76e0468f73d731cfd83c969680c529c4be72fd82d30b836ab1c18a25713a3fbbc1d3cda
SSDEEP 192:LONL6Amwp8QmiUyT4ssiX5FSY+UcXeQlRiqz9U6:LONL6ipMRssiX5FF+UcbT9U6
TLSH
T15F122C36AC78AC7F4DE2A550F08735135EA55127DF886F94D9EC2B2C06EF598530BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72fc124f-5e55-4cba-b0f6-887e6981b430.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\72fc124f-5e55-4cba-b0f6-887e6981b430.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d3ac5c5a768d1ab27847b7285ad490f21875757ea764f6c34e42c72febc0869c
MD5 a84106e867818c2528a02e929e3efa74
SHA1 2107c449b6258302daec6471caf3e880e165d78c
SHA512 5cc22b3f3ef359a3b4bb88ccb517aa15d655d712f3e056d9cebb978cd8184c8650b8c04bff83b35ddd5d7a380d1c485bb39106ef7bf9ca2cee2f4777fc9cffc3
TLSH
T14B411768BAFD1108B3B77E5AABF678AD447BB9372F0AC45D10110D4F0522B40D9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3484-167-0x0000024394400000-0x0000024394549000-memory.dmp

Download