3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-tulwho.html
Size 171B
Sample260930-b9vwpss19j
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{D929E904-8771-418F-B92A-4C5B39F794E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
860	msedge.exe
860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 4352	5896	msedge.exe	89
PID 5896 wrote to memory of 3124	5896	msedge.exe	90
PID 5896 wrote to memory of 1940	5896	msedge.exe	91
PID 5896 wrote to memory of 1940	5896	msedge.exe	91
PID 5896 wrote to memory of 1940	5896	msedge.exe	91
PID 5896 wrote to memory of 6140	5896	msedge.exe	93
PID 5896 wrote to memory of 6140	5896	msedge.exe	93
PID 5896 wrote to memory of 5640	5896	msedge.exe	95
PID 5896 wrote to memory of 5712	5896	msedge.exe	94
PID 5896 wrote to memory of 5640	5896	msedge.exe	95
PID 5896 wrote to memory of 5640	5896	msedge.exe	95
PID 5896 wrote to memory of 5712	5896	msedge.exe	94
PID 5896 wrote to memory of 5712	5896	msedge.exe	94
PID 5896 wrote to memory of 5084	5896	msedge.exe	98
PID 5896 wrote to memory of 1048	5896	msedge.exe	99
PID 5896 wrote to memory of 5084	5896	msedge.exe	98
PID 5896 wrote to memory of 1048	5896	msedge.exe	99
PID 5896 wrote to memory of 216	5896	msedge.exe	101
PID 5896 wrote to memory of 220	5896	msedge.exe	119
PID 5896 wrote to memory of 32	5896	msedge.exe	120
PID 5896 wrote to memory of 5428	5896	msedge.exe	121
PID 5896 wrote to memory of 5096	5896	msedge.exe	124
PID 5896 wrote to memory of 5096	5896	msedge.exe	124
PID 5896 wrote to memory of 860	5896	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-tulwho.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff957a5c188,0x7ff957a5c194,0x7ff957a5c1a0
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12383388373565004372,6539955399731982464,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,10936806066039254855,17650792533144041517,262144 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,9222235927456390234,16777294294450469968,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,16389605178683010396,6239425721115372291,2097152 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11463097819593508167,8793813536443561015,2097152 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,2212459801458172846,17282816367967565532,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,599192649026184933,966585165778062949,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,10400987405975971391,16775338063629259371,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,10400987405975971391,16775338063629259371,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15266717792670074439,7564825592742535052,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,6679607248996631673,8585068186016922786,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7344229636176687107,13211655657923178931,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,7215107403630721507,9203790893137429716,524288 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2824,i,17456569545703466722,16804112539506874148,262144 --field-trial-handle=2300,i,6692869585632288208,17268524269331282831,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d5572219724cf3833e37f8d579456b67058a8e11ae55508b0b2209e0115ef32c
MD5 c5ae9d073623219cc3e6ab86868d667f
SHA1 8b3cf1d90d1b7594b199d20f4d1da00342ed9579
SHA512 9b1da27f13df171460e16359ce6229f1b4ed0fe3bcaaa0ad665e4d467d1ed6c2cce0f7fe95d39b81791c7219f8eaee486e7baa62b5703d61e53e6b4cd30ed9c9
TLSH
T133F028B5C921EC3B08FD1B3920950746F751232B2A819C5F3B3E811C8FB053B468696C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c4bebc80b2b082ff02e7d161328a526ae30b5021ec157cfbac12516850e376d6
MD5 cc69f2ea884b0358f3d79bd186c7d6c8
SHA1 0de0821ba20d3895cc0583b57b33ffdf879b5d8d
SHA512 2b3be201c247d50c28b9724bc3f4f5dd28447c59aeb61ed1952a5d475aa62a41421d892efeafa0bef58effb9f8dbb951d6512d346e4b918887dda150ce43629d
TLSH
T199319FF3C3E4866EC90156F0AA18BE2BCE6D0A55532C3D5AC8E4EF2B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5fc94a0d2a686abe7d044238af75be600c528fadca9f2c22b565df9b4d21fdc5
MD5 349e0ddd65a0d48838f3409bba18eee0
SHA1 78d146b791671a650231755701fb7822b92c7dd0
SHA512 2d578139ff9bc5a3b690482922204f22ffbd4636dcf37c8ac38a4e01d2b81abe0a910edf162989f0a46becad3ee508c145853abb1bb15f3291724eabb70ed3f0
SSDEEP 192:sxZsR7ky/fHsQzaQZLC8AzodpHFHW6+WNGYoWCSaqIgjteJ:sxZsOy/fHsQ2ONjlHbGvSFjtq
TLSH
T1CB42C6156D38A97B8CC7D619BA55BF53E3F9103290D10E48AAFC8A2C15EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 55c1e93c400200b0f89c3ea7446b0f4f13789e2ff22d0d276aa6b685f961231e
MD5 459710d65143642ac8aeed9a6a706f3c
SHA1 7d181f1533e370e9f2e264d75fe12df9a26e082d
SHA512 783b08c83ea5fef65b4e155e54c4a3402b25cb1e50909c1ffcc038a19274070432f8ff6ae8b16e90dfdedb66bfd0ba2646c5e6733403fd041e5d1db5844a4cc3
SSDEEP 192:sxZsR7ky/fHsjRQZLC8AzodpHFHW6+WNGYoaCSaqIg5ZteJ:sxZsOy/fHsjRONjlHbGfSFztq
TLSH
T18842D7156D38A97B8CCBD619BB55BF53E3F9103290D10E48AAFC8A2C15E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bb8d2043bb62474411fc7cb43db2da70848fcd63d4fb76e747ccaac8dd82662a
MD5 5584880c27d5be21fb9b58fc0620ff93
SHA1 467d90c0458c7db44dc26c83baf4b6f321f0c14a
SHA512 3920cf17f265a3bedc8b7e786d10a0ba418bfaec512e606277976a558177852cfa12cc5236bb74568645601e6fb80d83fbe812489018d7660f263f58d7360d4b
SSDEEP 192:sxZsR7ky/fHsjzaQZLC8AzodpHFHW6+WNGYoWCSaqIg5ZteJ:sxZsOy/fHsj2ONjlHbGvSFztq
TLSH
T12A42D7156D78A97B8CCBD619BB55BF53E3F9103290D10E48AAFC8A2C15E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8c44acb2fd4dcca929c1b36df528e7a7ab1f7259415058b36e553a9615f118e7
MD5 d174f5cb5baf1e195079edda7d7add6e
SHA1 f5722e315f1a8ed2a020d11329b433654af6ca4d
SHA512 4173b14cbe5a45badfaefbfa05481fbdc25b6b3584f403e5b84455bb34c2e0576a466a22070b5e6e02c22276918780a023392fde78d6f55afa492d4b4cca0ce6
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgQ:ST/2dXOJhJlpfnpp3tNXVrN3mFDx
TLSH
T127B2205571BB421039FE290891B58B2E128231B37159E62F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 436a8e65ed0a97be0f464891c265a4f87345a28e1968223e480955c064bd1b3e
MD5 1e2c8ba3e2990072a2327b225865eb54
SHA1 227cb4308a20877bbafa62fff3c71f74cb557d24
SHA512 04081a72b229b2480e20c20f97c753f562570da504b8a13655c6b79d44f76eebd92e0b2998ccebfc1d5e13e1bb58e2e05ff6d7b0a87ccc324f7b11c536f674f0
SSDEEP 384:nOiFiZcId3sNy8TUNTUlI4WaKMT9DiwzWfLBCUz5o+RYoFu4ieAtgOIwZOyqZgLl:lFQd3Twgq5JpEBCUy+RYoFDieAXsQN
TLSH
T1C7C23A32D8A8DABBFCEA4ED5A74A7603DEF44153D58CAAC4D9D81D1C00974DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 236e422399a5cd589599f3b280b1e43284eafe02b2056beefd6853617186150e
MD5 e22632b22723e05d574c17bf48c1f8f6
SHA1 cd977d0836e202a74f05f7d6d6dfd030d8ac4b3a
SHA512 a099abeca997fa5ec5bf26e0c49d26327ef99fd21f06380c8adf0337eeb9bb1c64f48deedc3fdc0014ae3d3e46e20ee945cd26f3e9b18948a369ea5d035525eb
SSDEEP 384:nEiFiZcId3sNy8TUNTUlI4RaKMLbDiwzWfLBCUz5o+RYoFu4ieAtgOIwZOyqZgLq:fFQd3TwgjVpEBCUy+RYoFDieAXsBN
TLSH
T1A0C23A32D8A8DABBECEA4ED5A74A7603DEF44153D58CAAD4D9D81D1C00974DE430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a8d5d1ce7b65bde5978206db668c2622bfff6576cdfd9e74250e25835fa07861
MD5 ddea13b27b3f9c9428c3ec63181be970
SHA1 a0e84c1e2e4a13f350e3312513caa2789498f30e
SHA512 6b35fb695a80806b84560dad9212103fc56d6f9557007b639984226c1bc6e7c48d155abf1efe1c5d244309d5cfb43f3b98fd1cec1fa4ffc5fbd8e03b9a12bb93
SSDEEP 384:nWiFiZcI63sNB8TUNTUlIm2aKMix4wzWfLBCUz5o+RY9F7sa+VY68gL/7IzVoA:9FQ63Awgc0HEBCUy+RY9F7hgGP
TLSH
T114C24A36EC98DAABECFA4FD5AB4A7603DEF41163959C9AC4DAD85D1C008359D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 eb3324877808e0ba8d5c72595540685b1b337a2e890bc5ca9aca31c3cfebebc9
MD5 861e2a54cd89d4f6414b984cc18eda83
SHA1 b8a983bdd22d13db166f2ac0920a82eeda63b159
SHA512 08a940abc6cd6330ea0ef4e2350ca0d7e1d2cf7685682d769f876069b75d9275e32b67ec71812d58c7fa426b26ab149c1177871208db52a40ce5b7de490f164c
SSDEEP 384:ngiFiZcIW/3sNy8TUNTUlI4RaKMLbDiwzWfLBCUz5o+RYoFuLkmeAtgOIwZOyqZ5:7FQI3TwgjVpEBCUy+RYoFYkmeAXsBN
TLSH
T1CDC23A36D8A8DAB7ECEA4E85B74A7603DEF45153D98CAAC4D9D81D1C00974DE430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 30c3bf2947e8b9b534fe164a1f472e1062682507608bb90720df82b622a486cd
MD5 d705dbf009421e337c6090ffb8f37d7d
SHA1 9742da278be26c6728ee2349905823af9b05549a
SHA512 a3413a0eb8cb5d0fbc3a16772af5c999017411031fb6ccc267bfbc1a941ab931eaadd77c4c4ccca0b7692add73ed51eabdcbab3582ffefd2f97709514c98b340
TLSH
T13D41276CB6E81158B3B6BF569FF6A86D487BBC372E06C46D10110E8E0626B41C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-184-0x0000021A211B0000-0x0000021A221B0000-memory.dmp

Download