6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-dg1m0f.htm
Size 34KB
Sample260930-b37xpasx2j
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3680	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{46784394-7386-4E5B-B299-07931A0A3650}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2568	2616	msedge.exe	88
PID 2616 wrote to memory of 2160	2616	msedge.exe	90
PID 2616 wrote to memory of 3680	2616	msedge.exe	91
PID 2616 wrote to memory of 2160	2616	msedge.exe	90
PID 2616 wrote to memory of 2160	2616	msedge.exe	90
PID 2616 wrote to memory of 1604	2616	msedge.exe	92
PID 2616 wrote to memory of 1604	2616	msedge.exe	92
PID 2616 wrote to memory of 3784	2616	msedge.exe	93
PID 2616 wrote to memory of 3784	2616	msedge.exe	93
PID 2616 wrote to memory of 3784	2616	msedge.exe	93
PID 2616 wrote to memory of 5064	2616	msedge.exe	94
PID 2616 wrote to memory of 5064	2616	msedge.exe	94
PID 2616 wrote to memory of 5064	2616	msedge.exe	94
PID 2616 wrote to memory of 1784	2616	msedge.exe	95
PID 2616 wrote to memory of 216	2616	msedge.exe	96
PID 2616 wrote to memory of 1784	2616	msedge.exe	95
PID 2616 wrote to memory of 1784	2616	msedge.exe	95
PID 2616 wrote to memory of 216	2616	msedge.exe	96
PID 2616 wrote to memory of 216	2616	msedge.exe	96
PID 2616 wrote to memory of 1144	2616	msedge.exe	104
PID 2616 wrote to memory of 932	2616	msedge.exe	105
PID 2616 wrote to memory of 1144	2616	msedge.exe	104
PID 2616 wrote to memory of 932	2616	msedge.exe	105
PID 2616 wrote to memory of 4716	2616	msedge.exe	107
PID 2616 wrote to memory of 3988	2616	msedge.exe	117
PID 2616 wrote to memory of 1524	2616	msedge.exe	118
PID 2616 wrote to memory of 4616	2616	msedge.exe	119
PID 2616 wrote to memory of 4204	2616	msedge.exe	122
PID 2616 wrote to memory of 4204	2616	msedge.exe	122
PID 2616 wrote to memory of 3548	2616	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-dg1m0f.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff872abc188,0x7ff872abc194,0x7ff872abc1a0
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,358775370735476540,16292627299457236098,262144 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,1256410925374253845,3355047848564317025,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,10316293112454609763,13965478440963367471,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14111920531272061932,16531911775835585214,2097152 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7432962005577234138,8257946750200343149,2097152 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,7667430758627103937,14967341188658793118,2097152 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,3831478583392292347,13377151379475884536,2097152 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,13735861726969413880,15768906186902089699,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2668146855404453717,13478606805382660497,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15014782934396655219,15932180677334892396,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15014782934396655219,15932180677334892396,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,17975304142219276123,9000273175695108528,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,11307064422528482458,3557077301727492779,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9265317996519236428,11148604094692772399,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,9735847544354465793,17360147126672759353,524288 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5008,i,11979924904602584260,4240083039466481632,262144 --field-trial-handle=2216,i,9533302280044773538,15377891618661641833,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b423072c81aea823a5887cc2a1e7b67ff006a37c6a8d7d885eb46af8cd8c7dde
MD5 fa571fd1646ef97c3b6977227aee8eef
SHA1 b32b2aeae90e60be332de62b23a61f262e50cdbe
SHA512 0257866361dd79d2bc0088332b223aac055a97ef983d3b705f332e965dc2445faa7ae3b44a27e182ef45e9b92d6462742af52a428f544b456f56e69a00618307
TLSH
T119618F90BFD078A1FBA87FB9DFD7048336B3A7C01AA7ED50A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59011f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59011f.TMP
Size 3KB
SHA256 0198e2ad815eaa859818c742ee50dcbcacaed80f061151ed8f7f4fb00c8b46f5
MD5 39d607d6cb9142ec61b954b09312fd81
SHA1 758ef7cd802086be7060d9e59b9f087b232064de
SHA512 d60081768462c1893550e57ddc1a2c4dd12e2d3d25dc71c8c4af216daf0808a5aa04f108ac75c96f1ecfc8691a407ce2ca9907af5ed59cc91ce6adad02ee12dc
TLSH
T190618F90BFC078A1FBA87FB9DFE7048336B3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5988b81ef3f31521d9e8be7115315791aa97fbcb5a71d24be9ed74309a083e4a
MD5 e6a766447231aabd49eeb329e7b3ac72
SHA1 2261c2424687352d58ce6fb8eebd4a2a9177e5f7
SHA512 2c0f5447808ce5b98e1bcd0fb111775824115389f63d7831979f724df3df0cf1284790a3611dcd904df48935af7eecfe7252532f69c888932608d2442e26cc85
TLSH
T178117AF3C3D595AE8D0116F06A24AE2BCE6D0616821C7D19C9D4EF2BD3E3075E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 af783340b1a36f40ef0a90d69d7bfd534a2fc50d4678d1f40099e7ce0a388764
MD5 6f705b837c7c1326e406af21a039e948
SHA1 5f35f3361f5eb1f4c10074000003902bf656fc63
SHA512 d7ad0488fdc5b2de3fe32e501d794f887316e0b2782e6baa4b91f7685cc0710d8d986c9f166c190d5b62481840ec991386213aa7918709ef45e2054c4ba38f9c
SSDEEP 192:sxZL3RBWe/fLsKyeIdpdlHW6+WNGY36aMBIgrJ:sxZL3qe/fLsfPrHbGX39
TLSH
T1BC12A8516E78A57B8CC7E20DBA25BF13D6FA503251D41E58B6FC861C05E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e98d350a7e49ceaf96fb9b36aad445ab89b25147b46231a2af2e61d2308dab58
MD5 c56651272da353b8a6a6ce35095c09a8
SHA1 fc51cfa15fc9ca83e970da1cc0393df11f78cbf1
SHA512 e288314b87d943b6e6b9c2a405643d967694ed71a216ef107f2bc1f5fdaf4ac64650122e378944a9dfea1b1043332f9a4ca1ce81da767e5fae7222ead5b92e7f
SSDEEP 192:sxZL3RBWe/fLsDyeIdpHlHW6+WNGY36OMBIg5jJ:sxZL3qe/fLs2PFHbGXTn
TLSH
T1D222B852AE78697B8CC7E20DBA55BF53E6FA503251D01E48A6FC861C05E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 db7f525b8e38ef3e8641d49bd6daaffa8c729f817be677e23b4213a2495388d7
MD5 b100cc4616b50da5c29cdec262af4a24
SHA1 1f0fa1e92d635bc15456de0ad47effb9e2193ec6
SHA512 3dacb6f391bdf0af400ba78d44af5c5e72d199be70f237014a6a7ea85c9f0afdc325c4bd2b5a453705dcbc7aa3e217c61fedb3958feff619fd3377d546c07c99
SSDEEP 192:sxZL3RBWe/fLsDyeIdpdlHW6+WNGY36DMBIg5jJ:sxZL3qe/fLs2PrHbGXYn
TLSH
T19E22A851AE78A97B8CC7E20DBA55BF53E6FA503251D11E48A6FCC61C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7e9aa403529b6c1af1c455e1af1c08184af9b981d0a7f5a68e368b724ddf71e1
MD5 e3833fde59b6d9057f15b25fc983f764
SHA1 4087316d2199fd621e1645eb5c2d0e2350130476
SHA512 0256789390183079e8e8205419a1de743960facde269be87186d23a19cf8be9ff0ec15d0ca64354c0af1cb7dd2c36a313149e7a6497dde99dbdea73c310a2419
SSDEEP 192:sxZL3RBWe/fLsTyeIdpdlHW6+WNGY36aMBIg55J:sxZL3qe/fLsGPrHbGX3B
TLSH
T1A522C852AE78A97B8CCBE20DBA55BF13D6FA503251D01E48B6FC861C05E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1f108a5-1bb3-4652-a0a0-104f89cf8c41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1f108a5-1bb3-4652-a0a0-104f89cf8c41.tmp
Size 27KB
SHA256 77331bddc02841de65c5cdf91e1f1fc99a17c05752f6e304fa1d88dd49b30b3a
MD5 84c3bb13a8459f5ec28f845616d544d2
SHA1 b11b9bb2aea37d834507640d40e4ba8e1787904c
SHA512 cdf07b04cba9e07d25fe0f3ecd8b372f8a9b951402d6a70cca8d0baa329d94652ea8cab2b4ff7184999bf71ee0a966bb1481a03d143ab7f4374ac966e6096567
SSDEEP 768:F9Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/aromq:F9Klm7QWvUYe0u1ja8/L/E/Rmq
TLSH
T18DC2FA2B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599b5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599b5c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2cba8d11bcc024f6e4091b6eca75105d741cdcfaed31ea398d75bc3346bef0ee
MD5 43c5913233753fc8bdb594591b6edc82
SHA1 c586d2a4ec67b1495c9d65ce70040f5f496eab87
SHA512 5335729b28746a3465746bb3fa29568374b4381a4800869cca08d67cc8c7c39cf7100b0a1a4ea2590eefe6738894e97aeff4d6c4debdd157ef4152bf32d94aa2
SSDEEP 384:8ZcIhsNhwHgWbTuih//z8ExUXQvTtgOIwZOyi9o4:qhNkK/D8QvTXslj
TLSH
T107829D32AC789CBB69E7A144B48B32139FB4807BE7C45F94D5ED5B2C01EA1A80307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b7ddd6dcd81586c27f580b03bd3c710fcb136199d0aa0d4ab0d5ff8fc960c699
MD5 1394e011eabe2ac2cc67a27b246790a7
SHA1 890318f1c8479e422440a052fae0a84916b18182
SHA512 52cac366bb687b883fc78635efc13b73eb6dd22af1c271908ee3ff18f83a5d2717ec9b1182419bc526eb5e2c135a8b7d3fe7c96b81e96e260af8460767663f14
SSDEEP 384:9iFiZcINzsNz8TUNTUlIl5HgWbTuih//z8ExUXQ1TtgOIwZOyi9o4:0FQ1Gwg3kK/D8Q1TXslj
TLSH
T10BA27C339CB8DC7FADFB9644F54A32138EB0407BDAC5AB94E6DD5A2C01971980347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14287088cf3a180c639778858d0dc07a38d29443f61e6f4aa759c174f472c3a9
MD5 5ee033f6975190df25b10e094e280759
SHA1 3c8fcb9d2baf001310237d823550dc24a934b41f
SHA512 ee8601dee80797def8be69b6177eee54be0d75baa0888da24d6f27f8bfa9b753df5405686aea8ee1c72b6c4763f5308bebab533b6a791b0891c9cf80804f0334
SSDEEP 192:BONN6JUm0QmiUyGbso//jjzorB6ywxWjBCqaU6:BONN6+mE1so//z8ExHRU6
TLSH
T1D602C838BC687C7B9AF3AE45B48737139FA5107BA6951F40DAE81E2D01D715C1306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5fc48f9bba84782583dab8112a5b18ce9d28259f103f57415750a46641b87f84
MD5 bd57443e02e63cb94f0db7a2a5534c3b
SHA1 7589bcb78aa503cda6f9da33b735d092a2060062
SHA512 6cef7fa2a655c2a03b28745897a47bd15905fc69521e78c4d94b6f59ff3ed03ce533fb1b61c52c9ba9debd6169fc24da64e4c98fcfea0604649b122e6f758c80
SSDEEP 384:9ZcIhsNh5HgWbTuih//z8ExUXQvTtgOIwZOyi9o4:lh8kK/D8QvTXslj
TLSH
T18C828D32AC789CBB6DE7A144B58B32139FB4806BE7C45F94D5ED5B2C01EA1A90307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7e7a3f45eb341f1735cad7c440f65917114edfb66c2729663b553b9332e4ee1
MD5 728f17401ebde3b4ce6a2cdfc069ee8b
SHA1 7696b7ec8c16cebd85519595b9d93a3774c75749
SHA512 aca1f31b6ef84c2d5cfd867c0940b5a9c570a386a7cad626f3741b593c96f10e5ef3b811c9db663d5528ace8b487dcd2c7dcda189fe169cfb7d77bcb25cdcb49
SSDEEP 192:BONk6JU0QmiUyGb+o//jjzorB6ywxW5XQpNxRqeU6:BONk6+EF+o//z8ExUXQJTU6
TLSH
T116120A35B878BC6B6EE36595B08732239EA4413BEB856F90D6EC2F2C01DB15C5346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46a625f9-4be8-4c1a-b4df-9038fe320918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46a625f9-4be8-4c1a-b4df-9038fe320918.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da0659009ceb250caa511cace4e64ca770f19568d26c02107d18197fabb49bc4
MD5 37a9eea9bfe1b38a94450375fc1a66f1
SHA1 d2be5d654a85d26cdd5bcf98e5a153ec155f4a8f
SHA512 b695b567ced98017f57015c2327cb769221c50a1fc8c1acbaee09614bbe8e009aa2d52de2e63d970cbaa6bba7462643ab79f20559ef0fd64723e09e8d26a7beb
TLSH
T18C41E75CB6FA1148B3B76E4AABF2A96D487B78772E06D55E10110E4F0662F40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download