af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-z29qhh.html
Size 214KB
Sample260930-e3ywkaxcnb
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{8269002D-66EF-4405-BC2A-69707E659CB4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3912	2328	msedge.exe	86
PID 2328 wrote to memory of 4196	2328	msedge.exe	87
PID 2328 wrote to memory of 4368	2328	msedge.exe	88
PID 2328 wrote to memory of 4368	2328	msedge.exe	88
PID 2328 wrote to memory of 4368	2328	msedge.exe	88
PID 2328 wrote to memory of 4456	2328	msedge.exe	89
PID 2328 wrote to memory of 4456	2328	msedge.exe	89
PID 2328 wrote to memory of 1672	2328	msedge.exe	91
PID 2328 wrote to memory of 1672	2328	msedge.exe	91
PID 2328 wrote to memory of 4228	2328	msedge.exe	92
PID 2328 wrote to memory of 1672	2328	msedge.exe	91
PID 2328 wrote to memory of 4228	2328	msedge.exe	92
PID 2328 wrote to memory of 4228	2328	msedge.exe	92
PID 2328 wrote to memory of 4072	2328	msedge.exe	94
PID 2328 wrote to memory of 3852	2328	msedge.exe	93
PID 2328 wrote to memory of 4072	2328	msedge.exe	94
PID 2328 wrote to memory of 4072	2328	msedge.exe	94
PID 2328 wrote to memory of 3852	2328	msedge.exe	93
PID 2328 wrote to memory of 3852	2328	msedge.exe	93
PID 2328 wrote to memory of 3144	2328	msedge.exe	102
PID 2328 wrote to memory of 5048	2328	msedge.exe	103
PID 2328 wrote to memory of 3144	2328	msedge.exe	102
PID 2328 wrote to memory of 5048	2328	msedge.exe	103
PID 2328 wrote to memory of 4496	2328	msedge.exe	105
PID 2328 wrote to memory of 2760	2328	msedge.exe	112
PID 2328 wrote to memory of 2928	2328	msedge.exe	113
PID 2328 wrote to memory of 2568	2328	msedge.exe	114
PID 2328 wrote to memory of 3904	2328	msedge.exe	122
PID 2328 wrote to memory of 3904	2328	msedge.exe	122
PID 2328 wrote to memory of 1104	2328	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-z29qhh.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb8403c188,0x7ffb8403c194,0x7ffb8403c1a0
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14984194310289286525,1329875569430157376,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4261990924997404541,2361335938999717462,262144 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,3573498697178089582,1734099235727635264,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,18238544508896322147,8997882086803011805,2097152 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12039874149436075060,9085139287890161205,2097152 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,11641374420509970406,2515270234534529282,2097152 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,1296164945883896082,1548741569833397705,2097152 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6940570069470036280,2687767143654522762,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5029756483704913090,12124582919869711292,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6857824024245670036,17064749182399346763,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6857824024245670036,17064749182399346763,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,13299932475237871122,11293180701890022249,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,15951363288562581972,13509144180104682045,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,966786712719760400,1724968206038973905,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,17900955859216405285,10194727169057734451,524288 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,11917985695993949637,10423547219430765042,262144 --field-trial-handle=2264,i,12419257002319828131,3285357933254453553,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fde7005c2df7b48c5a02874cfdf30a5c2a96b70d6be88553462ee3f754ad34ae
MD5 7ac8d1160118c91a7bdc4e9d1d5cc95a
SHA1 1db287d341af61fb50cb6c92af80ddfd3fd77b42
SHA512 5654844ffd5d3b13d9f68d3b7ff525e92eaa8f927e9f8688c933ad1e946942af55301eabbdf00c6fc6cf74723e3c6950e80ec8c94a837afbc1c3e224ae1090db
TLSH
T1C251C78BD768C2AAFB68457441F6D3873330EAA1EDDB1F1A25ECC5BD9F0A7549208314
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5947fddfa56f0c62b081b7489aecb4529b3a3168f1b76808fb33ca5e6adb042c
MD5 4f22c56237d0c1296d39d1c81d250c4b
SHA1 5672ebbd0a05e9773bd9622bf2c68c9f560631a4
SHA512 f5f182c0eb255ff6637f608dfcb8507172bfacf228ca731acc9db49303221e6167b8d86994aa01383d953f1965e9e0aa027eef86709b3a169d4733f2a2deccc7
TLSH
T117117DB3C3D595AE8D1116F05A24AE2BCE2D0605421C7C1985D4FF27D3E3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fdd15b0fe1d848013df9c45a508553bbd80ddae073d66229289d1bf872a15715
MD5 e759e85ec6953d47dc46645d44a90418
SHA1 95f6aa26556877b7e7afd81f5a6c4e6eb7a34064
SHA512 f64cd5d905cd5901ff3969b598e56e5017e9aa5c4d41a319a3b2950fd8a215637c0a5a00760ba96e81ea517519b4f3ce89ee95641536259b7afc408fb7fad228
SSDEEP 192:sxZARHcWP/fns+evIdpdIHW6+WNGYapYY+nIgrJ:sxZAVHP/fns+ViHbGfo9
TLSH
T11E22B8126E28A97B8CC7E21DBA15BF63E6F9503251941E48F6FD961C04E76CE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8c4ba93b72c14f39d9ea5505ad33381c1db642903d0111d4ab12edc8d68dc411
MD5 d51ff9facdb4965f1d072ce753fd12ac
SHA1 6ea469e3c463579db1d29325b013c490c60fc31f
SHA512 361525b7668a26fad7fb1a3e46f42639bdaf8544fce56d9b205b2b66fde757d7f046f50542b155c48ebc8aa1c7e71512315ca2942ac9032f9d7b6fa2c542d6a6
SSDEEP 192:sxZARHcWP/fnsoevIdpHIHW6+WNGYapzY+nIg58J:sxZAVHP/fnsoVoHbG2oq
TLSH
T15922B7126E68A97B8CC7E21DBA15BF63E6F9503251911E48B6FCC61C05E77CE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0874ffd392697f9f42a5c37ae9dc46821a1deb14bbe00cc0268c9a5c53badb11
MD5 38ccac8b2792a0c2cd4ffcc376c456a2
SHA1 ffc1f582e9d9af82b3b34dc227832b5c066c433e
SHA512 e89be703fe50976411f1e501b2a48dd8abea1a3f6822bf73050138b53db02f6be8ae94362efe1269a1f8816df1eb72903541df56cfca2253a069176441a3a092
SSDEEP 192:sxZARHcWP/fnsoevIdpdIHW6+WNGYapMY+nIg58J:sxZAVHP/fnsoViHbGzoq
TLSH
T1F522B8116E68697B8CC7E21DBA15BF63E6F9503251911E48B6FCC61C05E77CE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aae15abf1a49f699ea1219b0c8691a7f8fc6f6ba94b422f5f8d05ac2cd6b8f90
MD5 c7fe4226a5ac044390ff6572533b9a13
SHA1 29dcab55772148173246bcfe2dc600af2a03fe66
SHA512 b6776a7a3701302e3298a6804171862ce38625fc5c0db993c794e89febb0a77b6b546a1c8c2384aa6831da63f73ff2355ce0365169a6bb10428ac787e1315447
SSDEEP 192:sxZARHcWP/fnsIevIdpdIHW6+WNGYapYY+nIg5WJ:sxZAVHP/fnsIViHbGfoQ
TLSH
T17B22B8116E78A97B8CC7E21DBA15BF63E6F9503251901E48B6FC951C04E77CE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b5406e9ef020049ed1cca16f5618adb83eb647b8501b2ec7327a45fc7de80ce7
MD5 39374934586b2691a235724670909713
SHA1 383c2edc2bfd77e355fa84ad078a85a1b19f3cc2
SHA512 5eb431b8a7638356a4a0cad9c7902677e4471473b43db4ba32fbab45c2bfc6f010d8be59e0c3ec333a92d9fe6df595a8014566525cb64cd7ad0509325e3a380b
SSDEEP 768:oUWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7bro4Mfe5mR3:oUWPcLKWvKeEeu1jaClLiF7o4MW5mR3
TLSH
T152C2EB3F644CCB7E4FC01A9DDC5A6FA76E9802C796588D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c10bc05a8230cd4e12f7a2c37763e1f8bca3b1e4f2ab2817af4e4c1c27c7942
MD5 19379848f435ae884281b80c1792aea1
SHA1 7189344733ec62bd27438613894944f5b9da774e
SHA512 b7ba7cd11f2532823838b5b0ea46a1b9b59516f2a6223107db11673203304c117cf460ca2520f4e956f48c5883a1affdab659ab3a5675da04c21e899a36c9534
SSDEEP 48:KsuInKTq03yNRIZKa8kLhsD/xPLfgD22IX3fKGOeNfSZPJ+zb0yQDylB7W:KsuwKTqO2RyKa8ZiEK7y6d
TLSH
T1DC91CE5532BA1245387E39098265862E124131B3305DFB3E7FFC54AA8B67E198DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d836.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 265bcc19fc3be00b87c9a8a21eaf8f81cbae8ed9837dff7f7ba655d44d157566
MD5 6f9ea054ece6290daf04ce6458b14435
SHA1 fbd0f393217aa204f378f22f0f1d3d152bcd98d6
SHA512 0eae66ff9dfeb296d0871276177d32c37ffe03706ee5d5d2132b4fb13a60b1c5ae0be61d7a33d107eb7f456b057e35b4ed565864e20163508f7e0fbc11e4a474
SSDEEP 384:nZcIhsNOUfeyv11S5zIGmeh+bQ8iYQtgOIwZOyhogo6:PhhyvOFVhQhihXsvgx
TLSH
T1AD829D329CB8AC776DE7A140F4863A135FB88127E7C9AB90D4DE5B1D01DB298130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6a527c12a7bc7b4787979e0e7728b5f29f0fe66848e0a2e87e3405f48a8afd33
MD5 0b145d34954b4dcabcb72021c4d0f060
SHA1 6742239b6f382a0a7453993d71e1378b29247ca1
SHA512 6a4715a7ea90ae8359ac594aa62e2c99070733f8915531a5c01daca5af7d33204af30d3f5c98ad8fb9443b4fddeaae83f1458ec39e8572506bc20f9daaeec542
SSDEEP 384:fiFiZcInzsNT8TUNTUlIl6eyv11S5zIGmeh+bQLtiYQtgOIwZOyhogo6:qFQzKwg3yvOFVhQGtihXsvgx
TLSH
T1B8A27C738CB89C7BAEF7AA40F54A36138EB44167D6C5EB90E6DD5A1D00DB1D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0938f91010c3dae1ae94a5fde2d0da3b3881b6bde0d521ead8482d3444aa231b
MD5 e19c22b4d2fa4fc28faf3259132be780
SHA1 64982cd658732d5632a38b37380ae47f1b8a2447
SHA512 6cf78d779da72008c52dc723678b918e7b53a9054d216af572fe5ebc6f3024be6ecff45888091c183bd98be4f3e6f6a47dafbc4d75700bf2ee517fc41acea9b3
SSDEEP 384:5ZcIhsNOU6eyv11S5zIGmeh+bQ8iYQtgOIwZOyhogo6:Rh4yvOFVhQhihXsvgx
TLSH
T1FE828D729CB8AC776DE7A140F5863A135FB88127A3C9AB90D4EE5B1D01DB298130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d86d272df8774fed636a6f1dc02cab06bb12499e1797c87e558df2270f0e46e
MD5 6435f7f77631ef8936e7177532086699
SHA1 3b048661afd584de75c917dcd73b12519c50ec47
SHA512 e53d87241f791cdc8e53b965ade27453ab1aa8ca41d498d2540e597d2aa015cf3dcb703e5fb32134f0a6b10ec86730f5f1265d9937042cf07149d71c47ce34db
SSDEEP 96:3qONkMQsjpfe/tyng7X5ih/cIPURHl8h4otop5oYDENBnP9ZvEI0IG2jb90ymtI8:aONg6IE7QmiUy5ETPuIGmeh+IC7sCAU6
TLSH
T1AF02F935AC78BCBB8EE3AE45F4877A239FA5112BA5952F84D9E81F1D00D724C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e58e622702e24d9da852aae5134c93aaa1d41396bfba306ed7ce387688a02a0b
MD5 20e894f6eccf446b86bdcea2ef18fdfa
SHA1 54cbe3147dfd357f8a03127739442ad7708bf56a
SHA512 38713f9b002d40da857b719984da144eaf3e4f2db941534499d3955968fc4b6b348bead9bdd1ee3a5562fe3956c24705c943e85fc89c91bead0027697f76551c
SSDEEP 192:aON06IEKQmiUyzET7uIGmeh+bQT27H4qyQU6:aON06DG17uIGmeh+bQgHYQU6
TLSH
T189122A36E8B8BC775ED3A840F48739235EA55227EB897F94D5DC1A1C01EF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd4ea15e-c47d-4a1f-a069-39680a5427f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd4ea15e-c47d-4a1f-a069-39680a5427f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd05926289e4917cb5acdaedd04a9688e4a9af42614d0dd685b9093307c8bf05
MD5 cbf065cc81a095ec6cbcec32e8db12ac
SHA1 30284a2ddd2f8f56e88049596fb4d85d6cfcf203
SHA512 811452e2ad0d9f1147d5eacd6cebfa97b2899d80ae8c5ab57b0820de5347e33a794c2926dafc236c9d0fe7c9e9a20645db073df098c08c56c68902d0200e7662
TLSH
T11C413D5DB6FE1158B3B36E5A9BF6695D487EB9372E06949D00010E4F0663A40CD71733
MD5 SHA1 SHA512 TLSH

Submit Download