af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-ulkpsn.html
Size 214KB
Sample260930-d1hwwstdkb
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{C0D94774-E6C6-4BEA-9445-E780658F71A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1460	4884	msedge.exe	85
PID 4884 wrote to memory of 4352	4884	msedge.exe	86
PID 4884 wrote to memory of 3292	4884	msedge.exe	87
PID 4884 wrote to memory of 3292	4884	msedge.exe	87
PID 4884 wrote to memory of 3292	4884	msedge.exe	87
PID 4884 wrote to memory of 5092	4884	msedge.exe	88
PID 4884 wrote to memory of 5092	4884	msedge.exe	88
PID 4884 wrote to memory of 2060	4884	msedge.exe	90
PID 4884 wrote to memory of 3668	4884	msedge.exe	91
PID 4884 wrote to memory of 2060	4884	msedge.exe	90
PID 4884 wrote to memory of 2060	4884	msedge.exe	90
PID 4884 wrote to memory of 3668	4884	msedge.exe	91
PID 4884 wrote to memory of 3668	4884	msedge.exe	91
PID 4884 wrote to memory of 4812	4884	msedge.exe	92
PID 4884 wrote to memory of 2352	4884	msedge.exe	93
PID 4884 wrote to memory of 4812	4884	msedge.exe	92
PID 4884 wrote to memory of 4812	4884	msedge.exe	92
PID 4884 wrote to memory of 2352	4884	msedge.exe	93
PID 4884 wrote to memory of 2352	4884	msedge.exe	93
PID 4884 wrote to memory of 1816	4884	msedge.exe	97
PID 4884 wrote to memory of 2056	4884	msedge.exe	98
PID 4884 wrote to memory of 1816	4884	msedge.exe	97
PID 4884 wrote to memory of 2056	4884	msedge.exe	98
PID 4884 wrote to memory of 3300	4884	msedge.exe	103
PID 4884 wrote to memory of 3380	4884	msedge.exe	115
PID 4884 wrote to memory of 4332	4884	msedge.exe	116
PID 4884 wrote to memory of 1056	4884	msedge.exe	117
PID 4884 wrote to memory of 4252	4884	msedge.exe	120
PID 4884 wrote to memory of 4252	4884	msedge.exe	120
PID 4884 wrote to memory of 3244	4884	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-ulkpsn.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe28f5c188,0x7ffe28f5c194,0x7ffe28f5c1a0
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,148640510286530285,5456411580717007181,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10363761423273726793,10811031975888605469,262144 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,13178280569422817549,15816925193479801284,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12496416202712772488,16333718503331710476,2097152 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13244113135702310506,16796921785410593044,2097152 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4204888109338690931,14535520934216779358,2097152 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,4729522273164494771,4976623235920577852,2097152 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14702851388485622733,6538668396276374764,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,4332100519672444619,9625547459483607591,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5730573641029922301,14633497493486576643,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5730573641029922301,14633497493486576643,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,8762024852259401419,9820471481737436232,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1342815731049979826,14486747466306639597,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,5515446445088538435,4402506261012909799,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,301820743745450957,15234490422243434929,524288 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,12765995062399346557,9064698369015979015,262144 --field-trial-handle=2324,i,2968585992344318467,15609947467000475984,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d0adb2c0f604745c0a6691000bc1c9169c5045b224e2c93d75007f637a59bfd4
MD5 c6b5cdb0eba25003b9a2a32f64762ca9
SHA1 bbc0849c80aaa719656a93c596cdb613c67f847d
SHA512 8fcaaf87c9946b4da2664b7c2568ad90d98c4532b1861380858873e5cbf801a4144ab710722c15dad2a92251502f947dbd71fe11d7eb59944d3ad42b7958b2ad
TLSH
T10C51A2C0A584C161CBA854F086D126A337377A7BE9C3DE830E58D9BEDB4A736D0020DE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3986706aa338a4d9878c04faa2c8e58991c2a4df2bde5f8f15845a84b651c2b9
MD5 c6c69ec81439f0947640f6eccf789754
SHA1 962bea8d5727c43f46e57cab3aff87628331ee2f
SHA512 ceba810291f99a2776c227e9ad5fb90b4d2d67df0d405e882b6e891b8eaddc5cc4cce97d49cc636de164c8f066bddfdd38067a1e0bca611bbaa567d84cf1bf9d
TLSH
T10F115BF3C3D585AE8D0156F06A24AE2BCE6D050642187C19D9D4EF2793E3465D10259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 424b0ccbd57aee3647984b04fd26e61d852b5900290d9a34c3e95fee73499ac3
MD5 5994f618e6bced6969db45e6d10de3fa
SHA1 7195f901bea7d77fc6ba527e5fe2296594d8c21f
SHA512 8c139d2c7142421cb0a391cae77a7c8110c51317e865855d7c09d247f0ddb1c735fe1080516769790b878ac5398b2b4fd2ce7776b74d7fddf2127f17d18a51a9
SSDEEP 192:sxZbR9zWOZ/fMsGiqIdpdsHW6+WNGY36aYVIgrJ:sxZbKOZ/fMsGijiHbGX19
TLSH
T1BF22C8116E38A97B8CCBE20DBA65BF53D6F9503251D51E48AAFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aea4fe58453b2ede03f0ab7e179c0af27cf9189d156bd91bcd7af84e9521e4f2
MD5 6b531a471e27ceb88efc847c72f5cbb1
SHA1 1087b76f4301f791be27adc6d6a646459193bec3
SHA512 e2420b4fcdc88c495327b8f28fbbae7ff11774d31115dbc6fbda05e949edc45e566e4e87df65b99f2538d0aa914182e81360efb279ea60a7fa62c9533e910d24
SSDEEP 192:sxZbR9zWOZ/fMsCiqIdpHsHW6+WNGY36DYVIg5lyJ:sxZbKOZ/fMsCijMHbGXsLO
TLSH
T1FE22B7116E68697B8CCBE20DBA65BF53E2F9503251D11E48AAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9cecb6d406ad2f45d2694a3ca87a79b5aabf25f736a31d2c2f0d9a4684f154b3
MD5 c283be42b78685b82f4f49410b4bb10e
SHA1 122154ab5dc3bfd52cfeaff0043385dc57c69582
SHA512 e39e0ce8e75a8160cfec72e7207e830f346f2f8af60bb09cb06d613cb76830f837bfdaf652433739cd350ff41bb48d3c707b9ee9b9b2ac13fc4bea5dcb256633
SSDEEP 192:sxZbR9zWOZ/fMsCiqIdpdsHW6+WNGY36vYVIg5lyJ:sxZbKOZ/fMsCijiHbGX4LO
TLSH
T1EF22C7116E28697B8CCBE20DBA65BF53E2F9503251D51E48AAFCC61C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7cdce6d3ed32684e6d2be92881ffea7bb70baaf521d15ccd4bfede6f2aecc287
MD5 04a55119a28d403aff8d3c741bae33d2
SHA1 d90cb5e40b96f76b7fe20b26e53bdd793fd17ffb
SHA512 846b1d586c30facdce8fd9de84272bf71dec5279d291c5e2d709ea419fe72079e994732aa5d8d261972c7470457a6fad1e51e2237476d8763cc383f42c1843db
SSDEEP 192:sxZbR9zWOZ/fMsyiqIdpdsHW6+WNGY36aYVIg5lAJ:sxZbKOZ/fMsyijiHbGX1Lk
TLSH
T18A22C8116E38697B8CCBE20DBA65BF53D6F9503251D51E48AAFC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f6e7c71c936b9b948e4718c15105224443dc87ed3c7f40d456a27c250370f47b
MD5 282f9b8ff78d94b3671e7571fef3c084
SHA1 55aa8671e1cd6abae77aa895d5c316666829f4ad
SHA512 d152b7d84efaa3fa6f03d8e4f621b481766b203ef2b540744b569af990545dcc9fd87a62eb5c45f3ae318552073039e4ddf9c74f53b3fb23436bb30bb9890a92
SSDEEP 768:7DKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/AroyZ:7DKlm7QWvUYe0u1ja8/L/E/LyZ
TLSH
T1E0C2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b9bb22746bc3878265d8e48ba385427f4d705045636c6de0fb48d639669c138
MD5 acc4be3c3dbfb4c6391ca69c741f1942
SHA1 ba9770c15ab2df42005ff4228dde8cd27998e68e
SHA512 b5ab1439ad12ecebd6ec6963529adc58816567cb81e0740183aaa1332621a528c11068157f88e0a525f18e581f850b4fd1b103b4cf6b61c427d7183934921a95
SSDEEP 48:K098xN/rvQbjWDISFQK9F1nQxVAYGH99yLGDGmGHGjGNGlG1G2bGlGoG9ISGjG2L:KE6kKbqCeDyKcEb4gKVSCf
TLSH
T1D7912C41717A120138BE789C81E4972E568232733019FA2B7FBD11B64E6AE058DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f7e7d96-317e-4121-9bd4-55164f1c42be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0f7e7d96-317e-4121-9bd4-55164f1c42be.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2707de61b462c729d0d9771de96c1a7767073a872153a7e0d2161fa748b345c4
MD5 b3bf79021e003451c41581332278420d
SHA1 16133d0c7281b1aa82074f5d44978198c32cc87f
SHA512 8c560a27659bfb1ca509395eb96b7bfa7bd877b85ec56c34fc08af74309550e39eff341bc7fbc6504c7397a7a8bd065d3b4ea06ac259423455945b9bcea31dc5
SSDEEP 384:kZcIhsNYf6b7K8h//ma7OBtgOIwZOysLHoC:ChPQ/uVBXsPrB
TLSH
T1C5828D326878ACBB5CEBA185F48732135FB48467E7C95F9499DD671D01DA0D8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ce8f0a452a709051c27db26fe1b2b29b7b767b6787177319f9380d107377494a
MD5 1327557e07a677606eba9c7bedf12d19
SHA1 396f9cffa27c83b229e634700ecacd608e8493fe
SHA512 e26775e466efd8b10f8eac4341bb0a051ff17a092dfd87501ec839a35a8c67367e2210f5f40401f80dff347cb6be3470d9ed6b493ba16b7ad2cbc872b8122328
SSDEEP 384:yiFiZcICzsNI8TUNTUlIl26b7K8h//ma72BtgOIwZOysLHoC:5FQKhwgAQ/urBXsPrB
TLSH
T150A27D335CA8D8BFADFB9A85F54632138FB440A7D6C5AB94E7DDAA1D00D60D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be916094a46f8638ad6d9ef1336b9aca6e92dd34c7119398c7147ba42dd93d46
MD5 b2e86019301f277295ea612543ebf4a7
SHA1 fb2c5c36425a1cd2ed93615eb531ebda079f6c36
SHA512 276ec5af954bce66146c50e39c185700fde688e209aab9cc013b32e6e5bb575e40b6f831e7d4be820cdf8298744f96b0a3a7da946f3627dfe0393c7cb5145d57
SSDEEP 192:BONB6JUQQmiUyLqso//ZsPC7nQezaNxxqsU6:BONB6+Qdso//ma7gBU6
TLSH
T149121935B878BC7B5DE3A995F48332139E704167EB896F84DADC2A1C02DF19C530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c746710eb5ed9b5f61dc683a466167b4240ac16b2df8072861bc4b14420f00ba
MD5 6f783ef68bab7103bf738cc96271e1fa
SHA1 205890754d1c22795b4ddc25a424d2a15860bc8c
SHA512 d0ef828566da65d39209cd0af0fa20681a6897917e1e6845a8cbbebf8298de4be556742c8f1f3fd43a4ca2559032c0ebb77fd49b9d8504e7b20ad1275f55c43c
SSDEEP 384:cZcIhsNY26b7K8h//ma7OBtgOIwZOysLHoC:KhGQ/uVBXsPrB
TLSH
T15A828D326878ACBB5CEBA185F08732139FB48467E7C95F9499DDAB1D01DA0D8130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 156915ffe47600926fb7bd014f23f40b2525cb31ab46caddf3a7c55a77e004c6
MD5 1e927b1e8b7c767c49caba79c6df4a65
SHA1 0b361ab593d91b3947b44f900307863216a303ab
SHA512 f47e57fbbd003301af0df3dba7880659ae1c4e1e8bbe748e5359bfb25df80e710d4285e28acdb552258efd2f23b834cae4593bc93b8e6217b6298a36fc6b7004
SSDEEP 96:KqONkhQsjpfbUmjH5ih/cIPURHl8h4otop5UaD6BKP4v+Y1xf//ojdexVeYrMpP8:BONJ6JUm0QmiUyVqso//ZsPC7dBCb+U6
TLSH
T10402E838BC68BCBB8EE3AE45F48777239FA4106BEA951F84DAD81E1C01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aa5eb50-a8c8-4aa0-ac43-f4cbb56e7fc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2aa5eb50-a8c8-4aa0-ac43-f4cbb56e7fc7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7c96a6e716df3c1f301fcaf4188325d03fa085f08f445a807a850232b0243185
MD5 fb0d61103eb465abd495eb34dc7c6535
SHA1 e42574e5bd6beb4c6594f78816d0e499dd691f23
SHA512 5c59fd85d6a55ba35d999267b2d093705bad4e2fb0388855894d56936c6a7fbc08e3ebf705ab75c5fcd712d1165947fb725aa22d0d6edb52e3e980373877a659
TLSH
T1F7411958BAEA1108B3B76F569BF2A96E487FB8772E06805D10110E4F4A63B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download