5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-xmamgl.htm
Size 194B
Sample260930-a78jcabc29
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{F0D21CAD-8F7B-42C8-9240-667958397D16}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2576	1940	msedge.exe	85
PID 1940 wrote to memory of 2136	1940	msedge.exe	86
PID 1940 wrote to memory of 2480	1940	msedge.exe	87
PID 1940 wrote to memory of 2480	1940	msedge.exe	87
PID 1940 wrote to memory of 2480	1940	msedge.exe	87
PID 1940 wrote to memory of 1788	1940	msedge.exe	88
PID 1940 wrote to memory of 1788	1940	msedge.exe	88
PID 1940 wrote to memory of 556	1940	msedge.exe	89
PID 1940 wrote to memory of 556	1940	msedge.exe	89
PID 1940 wrote to memory of 1712	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	89
PID 1940 wrote to memory of 1712	1940	msedge.exe	90
PID 1940 wrote to memory of 1712	1940	msedge.exe	90
PID 1940 wrote to memory of 396	1940	msedge.exe	92
PID 1940 wrote to memory of 396	1940	msedge.exe	92
PID 1940 wrote to memory of 396	1940	msedge.exe	92
PID 1940 wrote to memory of 1784	1940	msedge.exe	93
PID 1940 wrote to memory of 1784	1940	msedge.exe	93
PID 1940 wrote to memory of 1784	1940	msedge.exe	93
PID 1940 wrote to memory of 5028	1940	msedge.exe	99
PID 1940 wrote to memory of 1720	1940	msedge.exe	100
PID 1940 wrote to memory of 5028	1940	msedge.exe	99
PID 1940 wrote to memory of 1720	1940	msedge.exe	100
PID 1940 wrote to memory of 364	1940	msedge.exe	104
PID 1940 wrote to memory of 5432	1940	msedge.exe	115
PID 1940 wrote to memory of 5440	1940	msedge.exe	116
PID 1940 wrote to memory of 5448	1940	msedge.exe	117
PID 1940 wrote to memory of 5620	1940	msedge.exe	119
PID 1940 wrote to memory of 5620	1940	msedge.exe	119
PID 1940 wrote to memory of 6076	1940	msedge.exe	121
PID 1940 wrote to memory of 6076	1940	msedge.exe	121
PID 1940 wrote to memory of 4620	1940	msedge.exe	123
PID 1940 wrote to memory of 4620	1940	msedge.exe	123
PID 1940 wrote to memory of 3360	1940	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-xmamgl.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a0
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,14022132189379494437,18338781119270027678,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,892593482929946253,12864754128101943022,262144 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,15193177714810051190,3876819957784417306,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8228829333300730713,4625732443124333080,2097152 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2177643801908014761,17658965316560883459,2097152 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,16368355939071501181,14730874957400598412,2097152 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13025881519397082125,9857417856507378740,2097152 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,5334208341655966755,15717581147093013656,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,8895325995436064773,11323379186965884179,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1543800096804062708,14855260934074287019,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1543800096804062708,14855260934074287019,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,3326051917423877852,10136871707592771831,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,6692466053528761786,2186323836718379697,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,1947927519368524633,16503172520697395267,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2884,i,4421751904833024519,2908824709660796441,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5608482695737479869,15166358522740696504,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,16113772437113196912,2085194463098521004,524288 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,16947820266991039671,9118358831434566629,262144 --field-trial-handle=2328,i,6294744838347916251,13154764456652557164,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

2abc064c-4780-473f-ab19-a20c1dc987fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2abc064c-4780-473f-ab19-a20c1dc987fc.tmp
Size 9KB
SHA256 cdc30a7800eef846cd7f93963227fb2e4bb821b5631af97566bce9c7c7d653b6
MD5 c5b9d0ed136aa0ece2389ba22b2f6ca1
SHA1 e62c3735fbea0702c0fdc469a855946eaf8dbc9c
SHA512 c2400cd33dc59e703d7f98898058baf39a0ce186d75fbbce1ce6e0f78edf15b11fc864adcb9574445578020a0709eb8fddc6cb6c69b39c20d8e513d5818c61fc
SSDEEP 192:sxZtbRGWVr/fYsjIMIdpdlHW6+WNGY36aqNIgrJ:sxZRnd/fYsjWvHbGXR9
TLSH
T11112A7526E38A57B4CC7D209BA25BF13E6FA507261D11E58A6FCC61C05E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e356ffb2ca103c686b208d0bbfc25ff0bb6b556d07efd694359eff378db62901
MD5 b0f54f8ccacdc83f6e39ef27f3a43d7b
SHA1 689272e78399ff974df0bd455ded9e5b71ae0c4c
SHA512 ef204fd73c3f49481d8ea78eb603aedaa838a431170e4b30b47034d6045d8a00c8bc1557263ddd727b77a3234f685ed5ca8226bf0cf75223b6148dfbb88d26c6
TLSH
T1C8E020F55AC9C65DD300784F43687B0CC1803B0AE2CCAE4E170084CC7446454E6957F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 554e47c6becbed790b9d496cc667b53aa7fe1b9667e4b133a39c21610da29156
MD5 0161890b07226edc86f01355f383e8ca
SHA1 9a2a9ba74bd6b3144bb67f41b71c6c8c6ad3afeb
SHA512 fb13f88276f5d6f04e0fbb819137043722e93999c516cfbe7f8231b6dd504c4f1203cfd03d88aaf109ea30eb979ea545b30054ac78eef3b9f8b0e023f7bedf90
TLSH
T10961FD806C404E64FF965F78A3F622FF35B5F0815AF3AD9D31B8C4799466758920434C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b8d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591b8d.TMP
Size 3KB
SHA256 578fb37f085a1be84d7d5325a06c865ef94859913b661376f8e0cd055b2377ca
MD5 b494eb003c98e6efde141d32bcb7761d
SHA1 e33bd8459df4d56636fde7ccde805b91a154cba3
SHA512 9614c2a9f73982a1af86fb09b92780de844dda0ae61082613951edbd64cd2117ba5df2ed56e73761eff5709a3aa0dcce60569cda605fbb0d9460d0d3a4bfaf0b
TLSH
T10861EB806C408E64FF965F78A3F622FF36B5F0815AF3AD9E31B8C479A466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1c5db02d975c63cd74ea73b1394c20d618b42ed275ad0adf052c42e768844af5
MD5 fad3bf042149b64a07ee89a1222c5091
SHA1 b6cd0e497af52b91513a66ed4adb892b56930f18
SHA512 6a474819093dde2678640b47771629d44361d01c76a68ffc0915b16ab942297293cee4eff04b11a24914e4661cdcb51e5651ceb4c5b3d8114b1dfc8eed247615
TLSH
T1ED117DF3C3D585AE890116F05A24AE1BCE2D0506421C7C19C5D4EF6B93E3075E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b42143396a912e4b75a21386614dc1b8aa777db85b600be9365795a8667c7ce2
MD5 4819b2e562acce345b385f955f845424
SHA1 bd278ac8f17dac2012f6583a0fde710fca57754e
SHA512 506c0e5eeebe58d0224639aa2ab019e8d12191c00a1943cf04135ea8b7ebe006b0a0e9b344e18ef0dcc18e51cec5589f3bef8d11a094e78818fd063aee7aa837
SSDEEP 192:sxZtbRGWVr/fYsUIMIdpHlHW6+WNGY361qNIg5sJ:sxZRnd/fYsUWFHbGXwy
TLSH
T18F22B8526E38697B8CC7D20DBA15BF53E6FA507261911E58A6FCC62C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cba2097645ce0c6d77a1d7876571247da2b78d10b9132f8d52d2fc91a4826134
MD5 a3c8d7b7521e07562526ae14ebc5acf8
SHA1 b5a47e1dbdd3476e69a5103983503fc619b8bf8c
SHA512 3138bfd1a2ae32b8131596acbb8dfa52bee094743eac90cbe8b4bdcad5b8c82d7b868b747d9ebc5929fe8b2b790e56901e421c9cbd550e1e4da09a436c625762
SSDEEP 192:sxZtbRGWVr/fYsoIMIdpdlHW6+WNGY36aqNIg5GJ:sxZRnd/fYsoWvHbGXRI
TLSH
T1F522B8526E38657B8CC7D20DBB15BF53E6FA5072A1D11E58A6FC862C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8c0bb8f763a87338fe1dcf5c6bf23875a8d60e3c0125af148bb944d4f71ef262
MD5 6f531139fb8a3ead12ededa9d846112c
SHA1 eca11464e43d38960cd17221260fcdfd951dcc78
SHA512 281142208824c5eee4472fecd011262840f570aa2ef43edb920d98dd59f28fb9022654be628aa5190669a6b434d6ee86b7a6aa144e39c4f652f9078d2dfa5a87
SSDEEP 192:sxZtbRGWVr/fYsUIMIdpdlHW6+WNGY36EqNIg5sJ:sxZRnd/fYsUWvHbGXfy
TLSH
T1E822B8526E38697B8CC7D20DBB15BF53E6FA507261911E58A6FCC62C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9fc279ed6bf305150c28dc955cbf5e1a4d4a5adad4554fbbd5be5e7a5d76097c
MD5 ebfafe98be8abfc4c01204282866eebd
SHA1 c4437be218d292ef512cfbcd43eb5837d7d90df7
SHA512 79adf99a32df9b092cb2cd614d42b9ea8daa840f40505f5c01aab6be8f49a24ae648bb4fce376c46c0ccc293c45e593341596115c49f05437848a7593e8cbbff
SSDEEP 768:VlKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/rrorQ:VlKlm7QWvUYe0u1ja8/L/E/YrQ
TLSH
T1B8C2FA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b656.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b656.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 77c488c6b766fbbdf66b3d9897940e81b8c53351e3f76f67b9c6989ad2e570f6
MD5 6af9ff9cfb1704bdc5fb237fdac9a101
SHA1 743c185e140d318ef916979cf8cdb90681b3c39b
SHA512 85f979f9f5d41fcc3113ca102d8a372968d0852a525105f1f7e09b201a1b708dbf13a39cdae7ec022eb8119f5efaded656c7124631f67c695340f4a4577d9ff0
SSDEEP 384:yiFiZcIIzsNV8TUNTUlIlF+dxbMfch//PeHOtgOIwZOyTLqoK:5FQ0owgBw/YOXsomJ
TLSH
T14EA26C339CB8987FADFB9A84F54A76038EB481A7D6C5EA94E6DC9A1D00D71DC030BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 952e301256557a28332725d1b13bcf2e6d5d3bc0c7772a49c5b01fb39e9e66ed
MD5 47f364841113814a01c8c646b903a411
SHA1 8fc885c3ddb803e097fd9d6f933c1c9b1a435abe
SHA512 fbbdaa8117db9223f8416a16a22370af14bbfa371f7127108b43f0d969da5e3d8eed86e963d9ab4b268cc348370ce28c4973344085bab166dd0ae988ef543fbc
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop5uQaDbBKP4v+Y1xf//ojdexBywvBCr:BONX6JUm0QmiUy+lso//3ywvBCI/VSU6
TLSH
T16F02E938BC687C7B9EF3AE45B48777235FA5106BA6952F84DAD81E1C01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 515c4a3d01bc65db910f1b45e91f04d05e3dc59bc1b772381ac39ab666b49ddb
MD5 ca5f875bf2f992bbc2fbd2162e6913d9
SHA1 cc719eb43364502a2aeffb3dbfe91772e61b54c3
SHA512 9ee1d93131f1e385005f7a1ce1e2792afbd2fe95d55f9d2ecaef6f77025b7ae246f7ae2a8ceb1a93b1a2ad0b45968a53f91099c1f162b6fb6c6ed3fe71d08c2e
SSDEEP 384:pZcIhsNLo+dxbMfch//Pe9OtgOIwZOyTLqoK:hhZw/IOXsomJ
TLSH
T17B828D32AC789C7A6DF7A545B08777030FB88567A3C9AF84D5ECAB1D00DA198031BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7667340c78a085f9fb3d480c034eeb6c8fd2901f4d6493dd81c31851096223e
MD5 d9fbf744d84ca28c10275dbb89991354
SHA1 b52ae6ed5ad70e03886c81558b8a105d92988773
SHA512 3cf1d60c11736a2fd6de3de69df1046ce153b609e5c9e0ab13730016a1cb9bf2472a3bfc00f4e4eaf7804854a1a94690cd6de4c6b9b01c35042618177a71ba67
SSDEEP 384:AZcIhsNLF+dxbMfch//Pe9OtgOIwZOyTLqoK:+hCw/IOXsomJ
TLSH
T129828D32AC789C7A6DF7E545B48777034FB88567A3C9AF84D5ECAB1D00DA198031BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ed53a440d61cf272ab7d66c413f1607a253357a3ad1f15d630b53b88ec1168d
MD5 99d76485f695276aba702b5b9a1feea7
SHA1 adebe927003e86850ebe3a0b306cbf6753b1f9c6
SHA512 b53c4f632fb5fc2297238f10c4da1238ae0e1d2150e00aad9b6f3ee5888dc49ea34b6a21d61bd8c12c3e5c19702e38fcb2b573f4d96a47024855d017fd4369eb
SSDEEP 192:BONm6JUIQmiUyvlMo//3ywenezqNx+cqemU6:BONm6+o6Mo//Pe5OU6
TLSH
T182120A35B8B8BC7B5EE3A994B48736135E644267EB896F80D6DC2E1C01DF19C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33fa277d-ee56-4bf8-a932-aa1eee6c59e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\33fa277d-ee56-4bf8-a932-aa1eee6c59e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 75f94f87bbdc1a617374fbc03cd8c626f903ae3f7186a7f855f9cc0b0846350c
MD5 3b54aaf9727b3dbeb875c7f809eb8e4e
SHA1 7deff6bf532f753237716f92ae71fcd1790b2b84
SHA512 d90b362dd70473911d1984ba30119ef4d21ad58ef36820bcd96033c46ecadc44874d8ca1f54a1703f69fff5ebc2a133a14d1d6929f8303617fee08d41094f2db
TLSH
T1B9411C58A6F91148B3B76E56ABF7686E487BB8772F0A946D10110E4F0A63B40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download