5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-n3wym8.htm
Size 1KB
Sample260930-cwt8pavxct
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{11CA70A7-F9C7-4F03-AF73-738A044732E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2676	4776	msedge.exe	85
PID 4776 wrote to memory of 3476	4776	msedge.exe	87
PID 4776 wrote to memory of 4640	4776	msedge.exe	88
PID 4776 wrote to memory of 4640	4776	msedge.exe	88
PID 4776 wrote to memory of 4640	4776	msedge.exe	88
PID 4776 wrote to memory of 4688	4776	msedge.exe	89
PID 4776 wrote to memory of 4688	4776	msedge.exe	89
PID 4776 wrote to memory of 4224	4776	msedge.exe	90
PID 4776 wrote to memory of 4224	4776	msedge.exe	90
PID 4776 wrote to memory of 4224	4776	msedge.exe	90
PID 4776 wrote to memory of 2352	4776	msedge.exe	91
PID 4776 wrote to memory of 2352	4776	msedge.exe	91
PID 4776 wrote to memory of 2352	4776	msedge.exe	91
PID 4776 wrote to memory of 3300	4776	msedge.exe	92
PID 4776 wrote to memory of 3584	4776	msedge.exe	93
PID 4776 wrote to memory of 3300	4776	msedge.exe	92
PID 4776 wrote to memory of 3300	4776	msedge.exe	92
PID 4776 wrote to memory of 3584	4776	msedge.exe	93
PID 4776 wrote to memory of 3584	4776	msedge.exe	93
PID 4776 wrote to memory of 4528	4776	msedge.exe	97
PID 4776 wrote to memory of 3316	4776	msedge.exe	98
PID 4776 wrote to memory of 4528	4776	msedge.exe	97
PID 4776 wrote to memory of 3316	4776	msedge.exe	98
PID 4776 wrote to memory of 4488	4776	msedge.exe	101
PID 4776 wrote to memory of 3620	4776	msedge.exe	118
PID 4776 wrote to memory of 1200	4776	msedge.exe	119
PID 4776 wrote to memory of 4748	4776	msedge.exe	120
PID 4776 wrote to memory of 5072	4776	msedge.exe	123
PID 4776 wrote to memory of 5072	4776	msedge.exe	123
PID 4776 wrote to memory of 4592	4776	msedge.exe	125
PID 4776 wrote to memory of 4592	4776	msedge.exe	125
PID 4776 wrote to memory of 3344	4776	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-n3wym8.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff82394c188,0x7ff82394c194,0x7ff82394c1a0
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11289540054489657732,6814721379362744601,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,1130839726934153229,5154361336513646220,262144 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,17621593408739051516,17656685063662952463,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6362354171310822816,210696463001523736,2097152 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10569600463321598388,12334089926283849426,2097152 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5285501482703083391,14946119079428100621,2097152 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,7167227367927598603,5642266411695178751,2097152 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,14556965161173812976,17573794665299944373,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15612115803547101699,8727515825831295650,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18272624203763161594,16243161546912004830,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18272624203763161594,16243161546912004830,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,181014529572390700,17924262449148562505,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,4053751774656885122,1575513022878417615,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,9765681955910425908,15987846125117032638,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7842444087005095429,16213182637618238941,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,1611826042114706273,17198622377896532826,524288 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,16823251924181565521,12056890771199921920,262144 --field-trial-handle=2420,i,3385045953923251113,17928756914877059945,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

5dab29ab-c0ba-4a69-8064-143484560c2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dab29ab-c0ba-4a69-8064-143484560c2b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b97109d1a3f82679dd0634a76e17aa7d6afbd7a88b5f81001320d8a95a2b8b66
MD5 9468bfa8f7b64736e517997605a9058a
SHA1 df17885bc28d24ec1e57667d5dedf86207774d5e
SHA512 65ccb5bffbb7bf17e769f70770ee6731746d2617be3c1faaa2167eed7ab7a134f96083c133cfd4d3f2c1e2807e78134c8f3cfdcd6c6cd9ad002387fc45eaaeb5
TLSH
T1F151C5829FE303E5FFEA88F68FE529EB373E45C081835E72C198C6B8C9473548094088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59521e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59521e.TMP
Size 2KB
SHA256 a484de9262faeadf546f171454b5255aff86537ca1661d9517378a0e8dec8d49
MD5 20e1e9e030533a5346a08b619be723ca
SHA1 c0bab7bf2301d2bbd9257237581eafe1c10793df
SHA512 9806fbd0310f7ead411e62dea96ac139e49073a811a7aa68f309e3aa8fdec43260dc4b35a13f77b8da143cb810e5453b9ceb6f128c117934e875d0d4d1565d37
TLSH
T1AB5183829FE313A5FFDA88F68FE429EB373E85C091835E72D598C6B8C9467548095048
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0e9a0ec28a68392f676bd13b81620e867a52c8fbe7c5a07f5af3272a7cd41515
MD5 7176e21b8ba8dbf02da61d2206d953b6
SHA1 6a9cbfce33fa927040c4b541b1367af3f0e8906c
SHA512 a699e061c909461cf2015cf0a1a4ec6517a427aa94f88115cc5a5663d04c28a672be6bafc0b5c5b24bdc2f6fa4946d3964fe78f8d4779de57b96b662e6675204
TLSH
T124117DF3C7D585AE890516F06A28AE2BCE6D0505421C7C1989D4EF2B93E3475D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8be56c3529e008682ee9c91904eada18cc3c88061a8bad3ad517f7303f67c458
MD5 8c689705ec2ddce3791c2c23a7c98227
SHA1 1dc00a02461c6e1c39be7a890f7165d32c5f510c
SHA512 d381983da0ed2bce71c7b08b987b97e25b65a507f449120bee8b6f4befc41305526a55a6c136c54885b688700479da958bddaf475789948203284b738fd3c28e
SSDEEP 192:sxZqRGWw/fDsqSFIdpdKHW6+WNGY36alsIgrJ:sxZqvw/fDsqS28HbGXR9
TLSH
T11012B7126E38A97B8CC7D20DBA25BF53D6F9503261D01E58EAFC861C05E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 42b62209d377316339192f5d34d30e9eb96e2b26808d171dd02fc4ef72f32a56
MD5 0f030e56ef1ab150973122a86dda12a3
SHA1 2811b02675951919d37060032e5336a59c6b582a
SHA512 0d01f609954876c8edcb222a02c24531e9752f11e1855aa77e15afe3223ae3438cbbe886612a383bed075a82e7a46156e777479c271643982fb1a3602f6887d9
SSDEEP 192:sxZqRGWw/fDs6SFIdpHKHW6+WNGY368lsIg5SJ:sxZqvw/fDs6S2qHbGXTI
TLSH
T1C722B7566E38A97B8CC7E21DBA15BF53E6F9503251D01E58AAFC861C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3b467ca7ce8267cf57ccede1f631928bb52b22decbf49949b3bef35f32e6d9a6
MD5 776f37e681fc24918b931fb2c357ffd6
SHA1 60670a6f6c9b919f462d0976983685377412c2a5
SHA512 f3d8032f2adac3e006342aada7eb13d86f867756b9778c9e82df4e00de0de54c3510bf274216cb23f724532634e986309d5c11dfda961b6adf8b64380793ed56
SSDEEP 192:sxZqRGWw/fDs6SFIdpdKHW6+WNGY36jlsIg5SJ:sxZqvw/fDs6S28HbGX+I
TLSH
T12222A7566E38A97B8CC7E209BB15BF53E6FA503251D11E58A6FC861C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0897272df9d52ad9258a181afe82ab60560d5d069f7c8163884cbdd9fedf2bbf
MD5 3febc7da8a36dd8bc7a578c12494b2b6
SHA1 e3c6692ed643c9c26a9063995e6927922b788223
SHA512 d7e05cedf329d4fa5d62491614d5de7e3c958f27cebebffaacd1fb69cdd42c0020c4254c5582ba38c6ab4c9e91f42e7ed8f96d72ca9ccb4d6b8bbd5f3eaeaa85
SSDEEP 192:sxZqRGWw/fDsnSFIdpdKHW6+WNGY36alsIg5gJ:sxZqvw/fDsnS28HbGXR6
TLSH
T1D722A7566E38A97B4CC7D219BB15BF53D6F9503251D01E58A6FC861C05E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4d455ac57e68a67e5b83f675afee0211c7e1b1cdb2ffe5d8002c9b1937689a88
MD5 fddd082942cb52730c85d3a76f81ee51
SHA1 6c2ab8f7f4fcf4a8574ad966c64bd2d2b5743c89
SHA512 58766fe2f4b9978adff48dd3c64462a4b96ddb096eea5980c0a6160ce5ee3dde77bf4b267a63b6c63774cb5ae22c6196f013aa69f1b7d726cf66385dcac4e720
SSDEEP 768:XDKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Aro/NG:XDKlm7QWvUYe0u1ja8/L/E/L/0
TLSH
T1FCC20A3B640CCB7E4FC05A9DDC5A6F972EA802C7A6588D4047FA994C02C77EE51264CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 312f4e9ff7d5e2138f0ea8bbde6758ac4b9dce4ee514e93748a96a3643f617ef
MD5 19339bd5401ef4cefc48aa21237b2cf0
SHA1 ac7d50b6b8542a4c442d2ad4a8fd31731dd2d160
SHA512 f163ee32c1e4d86b7bdd4977bc2519abb712f64ad32b21eb7c35d49b87741553f08af9ac3b53fef0273a592fdf00d7ffe5482bc276236c5629535764f634bea7
SSDEEP 384:xZcIhsNmsIbV5l9h//at675rVZh6DKhHHOod:ZhBlj/trfYGHHOu
TLSH
T105828D366C78AC7A5DF6E141F4423B138FB880A3A7C95F84D5DDAB2D01DA1981317D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f71ce23c1988bd5b409724fe263056957253101d7623571cb386c0929b1f4692
MD5 b7d114a2fb3b5c0f28b5b706eb1fbc48
SHA1 652001997360bf3d8ef3d4a853eb94b571c503a5
SHA512 5aad529940ce7cac84319d9672ea5defe3523736824acc33ccf854266dfe757d88b82fcef2a0900986eb6e1a9dc221f5bb7082897f18cc74f7ca2db74cadc86c
SSDEEP 384:XiFiZcISzsNm8TUNTUlIlfIbV5l9h//at67VrVZh6DKhHHOod:SFQ6fwgYlj/JrfYGHHOu
TLSH
T1F4A27C375CA8E87BADF69A81F5463613CEB440A3D6C5AE90E2DDAF2D01DB0981307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4662641392bef61d25a1f506e5213abb10993626be34fbebec93cb51149f8018
MD5 77f6da35b4fb07c2029305c3625202ba
SHA1 1ead08d5cb46f6781b675d40eeec997b3b9ac8d3
SHA512 97bb7fed914023e4da4bfbfda9e8ba9217c162879b03341b11d608f3f5d4488f5afd6c3d4825b7726a2878cc1a549edbf9ff26dcfa3cb474b3a730ea945ebec0
SSDEEP 192:BONO6JUm0QmiUy1Kso//OywtvCxBCs2U6:BONO6+mE3so//at6WHU6
TLSH
T1B102B739BC68BCBB8EF2AE45B44777239FA4107B9A911F84DAD91E2D01D755C1302C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7411a485eda4f1376d5556a65bbe127c74e6bbdaff48d84ee92fe101ec1d3d56
MD5 cfbd2a44ea0ae2b3808690fe40c3fbbc
SHA1 9fea0ad0a619418b4e65a2799224cb0ac81fa59a
SHA512 942dd38347f48d4e2b46736dee197e45f24d67a923fce3482abb7b277b1d635005849e61d12ab2498568c950d43ca6cb9dd294025a25b0ded49b0054004245ab
SSDEEP 384:1ZcIhsNmfIbV5l9h//at675rVZh6DKhHHOod:NhYlj/trfYGHHOu
TLSH
T14A828D366C78AC7A5DF7E142F4423B139FB480A3A3C85F84D5DDAB2D01DA1981307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6e1cfe9b4fe42d2abac20bfa38804e2932039b210905e99c60ff985368274a8
MD5 48cb01c58428aac1a439d48ab9faf491
SHA1 4c679c256cb7c2e05fdde0d7a20feb37bcce8817
SHA512 1e9589a3ac781aa9cf3ef758ccfaaf333570eb7fb3bc7c58c1fc82631293fd386651b82f79eee3e47896aebcab1e4403936523025d386f9573c75dd8c7735af9
SSDEEP 192:BONf6JUNQmiUy2KVo//OywtvC7OezfiNxgq5U6:BONf6+LsVo//at672rU6
TLSH
T173120835B864BC7B5DE3A595F08336239E640177EA896F80D6DC2F2C02EB5AC5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 506c3bed89c0cf0de82843c1b751cc9153ff27949a7907d22fa3eaaf3e9f7cbe
MD5 9d18eb869821c899b78df811290d17d5
SHA1 e873db92ad835c0dc67e9fd802b5298e5f7693cd
SHA512 7643a73b5072e3938a349afa10d9e56cdfdffd12a42e9e0fa21b1b500d913d489380923d1bed273e0ba38c3f54cd87618d02d09921cb0a273c2a54cea52f389d
TLSH
T1E5413B5CB6E91148B3B77F5A9BF2A86D487AB9772F0AD4AE10110D4F0663A00CC61737
MD5 SHA1 SHA512 TLSH

Submit Download