c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-9whs6c.htm
Size 34KB
Sample260930-fl9geaydma
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{F2CEDB72-D4CC-4A36-AA99-C8029C3B8A83}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2292	4092	msedge.exe	87
PID 4092 wrote to memory of 940	4092	msedge.exe	88
PID 4092 wrote to memory of 432	4092	msedge.exe	89
PID 4092 wrote to memory of 432	4092	msedge.exe	89
PID 4092 wrote to memory of 432	4092	msedge.exe	89
PID 4092 wrote to memory of 4296	4092	msedge.exe	90
PID 4092 wrote to memory of 4296	4092	msedge.exe	90
PID 4092 wrote to memory of 1416	4092	msedge.exe	91
PID 4092 wrote to memory of 1416	4092	msedge.exe	91
PID 4092 wrote to memory of 1416	4092	msedge.exe	91
PID 4092 wrote to memory of 1028	4092	msedge.exe	92
PID 4092 wrote to memory of 1028	4092	msedge.exe	92
PID 4092 wrote to memory of 1028	4092	msedge.exe	92
PID 4092 wrote to memory of 2276	4092	msedge.exe	93
PID 4092 wrote to memory of 2276	4092	msedge.exe	93
PID 4092 wrote to memory of 2276	4092	msedge.exe	93
PID 4092 wrote to memory of 2744	4092	msedge.exe	94
PID 4092 wrote to memory of 2744	4092	msedge.exe	94
PID 4092 wrote to memory of 2744	4092	msedge.exe	94
PID 4092 wrote to memory of 2924	4092	msedge.exe	103
PID 4092 wrote to memory of 3788	4092	msedge.exe	104
PID 4092 wrote to memory of 2924	4092	msedge.exe	103
PID 4092 wrote to memory of 3788	4092	msedge.exe	104
PID 4092 wrote to memory of 2452	4092	msedge.exe	106
PID 4092 wrote to memory of 924	4092	msedge.exe	113
PID 4092 wrote to memory of 3136	4092	msedge.exe	114
PID 4092 wrote to memory of 5052	4092	msedge.exe	115
PID 4092 wrote to memory of 4616	4092	msedge.exe	124
PID 4092 wrote to memory of 4616	4092	msedge.exe	124
PID 4092 wrote to memory of 3308	4092	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-9whs6c.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff97559c188,0x7ff97559c194,0x7ff97559c1a0
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,13126233527327080226,18162885802017596581,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,1213061675359919248,15192646545568609865,262144 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,13331007768927475746,11191736496143381878,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,7080251256569026480,13837056677093337907,2097152 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11784132584721034079,15639171851635489539,2097152 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1849850028758260900,5904972926600805385,2097152 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1583787807058045554,4414438238152883294,2097152 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8093968441073892273,9308801786214443026,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,12295985663846835646,1491597486237146850,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,2186125863119476190,8386194082918363157,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,2186125863119476190,8386194082918363157,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,6596802239512492398,681236770982264654,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,3605126703377863305,7998119094319662759,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,497425190127885707,17366436190665473509,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,5640713333387150130,18368387231255909632,524288 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,15930842370104872760,13985955435943860047,262144 --field-trial-handle=2088,i,8299446308244778039,11665324146630317024,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 860a03d72f3edfe20acf9503687d56e348e7aed16e97bff2858cc4a5414ce500
MD5 fcee18ecaf9431f3f8209d6ecc8652c2
SHA1 05ee010958c1e25cf4f7a612e289b24876dc39be
SHA512 632659e9a1c667b5f711a1245217d4ac7be2533b962c085397106449425be902d938557a57608c9af04ec99f078eaba056dcbc63e235d234d6966c24c8236d69
TLSH
T149319DC2569B207FF7AAAD3589D132833A374E9056AB4F3304B9C0B76E8A7D09114143
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b0c7464eca0fb91d1c8556b18c07bf88c515922b7527e51eb6d550b9cf72484a
MD5 dbea2311d64e0b95bdca533526cee415
SHA1 4728f68b9871419f804fc87a8c88709c51ecaa34
SHA512 bc806c3765f7b1471685642cf9a8734fbadd5c37bfba0b4ba5552f52f8ed0eb4443b64f0342c91094bb5432da2375028d0b66daa7cc5d0be3684df3d7def075e
TLSH
T161117AF3C3D5C5AF890156F05A24AE2BCE2D0A06822C7D19C9D4EF6B93E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b039fea8ba4442175a303800d24e4a7f4577b9f3d92cf0616bfc49dd4d22a2d8
MD5 4546c3b0e536471599523a9613fb29cf
SHA1 57bba9091a6a17f220dfed54c8af26fe124544d3
SHA512 35f5260d3291a0df4c9b96c45d5c5e2641bc116ccd0a7438ce688b12389f900155d9137c4e54797ede3fe0ff44f52a965aac87ad82d38b98c2187c7b288d3d38
SSDEEP 192:sxZPRfW//fss1FbgmIdpdkHW6+WNGYYBa5QIgrJ:sxZPg//fssPbgHSHbGff9
TLSH
T1DC22C7116E78A97B8CC7E21DBB55BF63E6F9503261D05E48EAFC961C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1439f9af8118ae1d69685a04da9e86e47a25013abf79e1464e030b968a066bf9
MD5 bff2895d56f01b577b66bce06cc17802
SHA1 99500c24bf0112470d9fb1f1d6ed53ff21c5a111
SHA512 4f0d2790b6b0d5a132ab1eb2e2da60d45d4671995c100437cd7b2c5d2ed4087741c61f1061d3b318b41fdda9681d5ff35c98abd035fdea3fa232023991b8b0ed
SSDEEP 192:sxZPRfW//fssJFbkmIdpHkHW6+WNGYYB95QIg5YRJ:sxZPg//fsszbkHEHbGfcub
TLSH
T11E22C7116E78A97B8CC7E21DBB55BF63E6F9503251D01E48AAFCD61C04E66CE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 60db3b6b71ac62547c222e8ece40a5752fcac6d6a28dc1f43e08c182b27583a5
MD5 61c4ab231fc1cfa79ca846ae0ed3b807
SHA1 31abef840dff5f28e0bdfaf59390c3296889e167
SHA512 513bbd3f6a178997c502f3baab509ad3470910fda504b7bdf65a0d2842b3bea1d57823c529b8cee553ea53b0fdb4efe8ca8670972dda0c1c6d3ba1172ece10f5
SSDEEP 192:sxZPRfW//fssJFbkmIdpdkHW6+WNGYYB05QIg5YRJ:sxZPg//fsszbkHSHbGf5ub
TLSH
T16E22C7116E68A97B8CC7E219BB55BF23E6F9503251D01E48AAFCD61C04E66CE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 50745a6c3674a6216acad90386f25e3b6b551ef216fac2ce987a0831955ed514
MD5 5a056eb6011351dd0ea37748c1d8dded
SHA1 ff3e072293ad4b9857f0e53ee686fbbb6cce25ee
SHA512 1cc6e2aadae9f70c53401da400c55246847e97d291cfdb9ad74f2f46ec541fde8e50ea43ce85e5c122207f21e2974e3489b502facc16afcf563f285bcf2e3b32
SSDEEP 192:sxZPRfW//fssJFbgmIdpdkHW6+WNGYYBa5QIg5YDJ:sxZPg//fsszbgHSHbGffu1
TLSH
T15222D7116E78A97B8CC7E21DBB55BF63E6F9503261D05E48AAFC961C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cec69dc096419da5f46f51ad540182b94dfac7336e786f03566f4d2085979ea4
MD5 6058eb0880e57aad116a257cf284b2f4
SHA1 f62c7c0ee80298335b1d815e4a849beb0e0f3e26
SHA512 7aba955e6c9495d1e3eba26e196a9fd5ba68db6f5587c996610fcdb3866cad1c9eda02e110c09c5162b4ef400dc85d57058ddf75fa763fb88aa683fb42e14a16
SSDEEP 768:0xyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXbroppdHkM:0xyYR7jWv3NpBu1ja/CL8OXoP
TLSH
T115C2E93B644DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 020480a56f641e445cc7fa8a70e4bd8931b0999dcf0964d53014bd59655314a3
MD5 6300d0327dc45cb32e248a624f9f2d60
SHA1 e8cfa3b9fcb1361ed6a01ea96c8351eec0243812
SHA512 e3582fa40fd077636eab6ff517dd402b2cc53b63d7732991e2eda9184b54368d937ba9a26fc89f88dbc0f2adfa15c65a5bb6572ac2fe548e995e31d136dde876
SSDEEP 48:KgGh8g+kkdbofQIS4dK9c1edx2NY3IkmyLuJkomscVbgnoISAVK9k12VxOFYfgce:Kk52KyQi2lKKmQt1mKu0iuTSKQw4
TLSH
T157C1DF5130BB061038BE258C91B6875E024172F37055E67BBFBE04F58A6EE145EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ecec84b-da7e-4887-8083-fbe803507a00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1ecec84b-da7e-4887-8083-fbe803507a00.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f8e5b9eb58a9e1da5bd2ca5f1f2235a61976fca0b0b49938012768460d059ed8
MD5 c87f17327a4fa87113250d8a84875fcd
SHA1 76dd5b8f952dc7570f2cef9e1a4f7251dfb873f1
SHA512 0d72753e866851ae591c7dbd26706ef3aa385b28cd860ffe7bd35330e4e05b6978f8f6f1dea9ece25398fce79e969a83435328d7520b73fcfde8768855178f92
SSDEEP 384:WZcIhsNsbuSx5oiqjCOQX5+DtaOV/CnsJrf75btgOIwZOyiocop:EhtYrelkDQOEshf75bXsOcK
TLSH
T136828E329DB89C775DF7A195B58A32139FB85437E2C5AAC0D4ED7B1C01D96A8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 42633dc4ad3236aff71f3e6c135c8b725271aec240cb5fe9ebf260b91b7781b2
MD5 78240f2d8c53d7307ec6e582c285d177
SHA1 46532862d0ba4c9e402c8131bf82c454b817e275
SHA512 3ec28b388c6fcbb52750902f5791de702fa387717e7f2c7b61d4d7cc16d62c3d2585523d2e713ef0ee1ed34fe4248c857f01eb9b8cb7e51cefbc9d7245e16da6
SSDEEP 384:NiFiZcIJzsNk8TUNTUlIlCuSx5oiqjCOQX5+DtaOV/CnsJrZ75btgOIwZOyiocop:EFQpxwgsYrelkDQOEshZ75bXsOcK
TLSH
T160A27D335CE8CC7BADFB9A94F58A32139FB45077D585EA80E6DD6A1C009A5EC134BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75f185c39f71276392029c0ae37169adc68f4fc1ed14514327e4b6673e5c3fba
MD5 5b9d11d2840fe05efca7a40f52ea2f07
SHA1 1ece619ed2812d0836f4f33ac100c26d0d6ff193
SHA512 9d86ef272569a73280a4ca3ba6c62507d2644ebdf816cd4c3165f77159a333f64a5a386c639839a3a8e4b2d8d88c9d37a4b1c9d6fc448d0c4e91447a7589b5b8
SSDEEP 192:EONq6nnHGQmiUy97QYcX5hQDP1aOV/CGMc7IoU6:EONq6nCqQNX5+DtaOV/Cm7tU6
TLSH
T1DC02DB34ACA86C7B8EF3AD59B44737136FA5213BE5956BC4D6D81A1C10D7A5C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 894ac5f52bae3adeedfd9f55d59bc3ab9a5a2056db9db3e4be68f36d5108951e
MD5 9c9dbbdf32c92a5c57c8f73d45c89a3c
SHA1 f48118d9befc4ec53f4e85f258d2d2c1d543cb52
SHA512 15f147a9d41e19461642478048baa86aa8cde2edd6ef08d703657b8c7bcf2e4cf79fbdd69a8e185728f37d042aceeb49a5543011b74be9d5fd556b206f76c112
SSDEEP 384:uZcIhsNsCuSx5oiqjCOQX5+DtaOV/CnsJrf75btgOIwZOyiocop:MhyYrelkDQOEshf75bXsOcK
TLSH
T177828E325DB89C775DF7A195B58632139FB85437A2C4AAC0D5DD7B1C01D9AA8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e746814d90e3123588e4cbef4af29c243e380e52c9c3a5edb5caec02ab227d0c
MD5 5b03165f2829f7022888bd6430e54803
SHA1 ca4ef458b93a12c9700f21202022aef55d7d45a6
SHA512 ea7e67c72bf6134fb8950811a61630fe277512ea0087746cefe7a3ae1034acd1aa383985e6c9acc6738bec78bd9de8a1656c1e663bb87f7cdb318f01172abac2
SSDEEP 192:EONt6nnHQZQmiUyA7qYcX5hQDP1aOV/CntSJrsg37Cq5bU6:EONt6nKVqNX5+DtaOV/CnsJrn75bU6
TLSH
T186120C31B9A89C774EE3A595B08731139FA55127D6857BC0D5DD3E2C01DEAAC234AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a9277f1-3a6f-4636-a920-3341b88ef93b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a9277f1-3a6f-4636-a920-3341b88ef93b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 acbf47e9a5bff76ee4644d7962b137b5f62a511706193f38e75124aa4c5df07a
MD5 fcf044890b649efd7de0abd00622cf2e
SHA1 d336b1814a23d6ef28aef3cf0d8d111d824280d6
SHA512 5e4306256badcbc79ab222f615fda22942362e127089e4ef08a693dee62e10fc942ba51f31ae16b20c653a011c40eac274a0b26a9b14841bf6e67133609828c2
TLSH
T15941F858A6EA1158B3776F5A9BF6A96E447FB9732F07D45D10000E8F0762B40C9A1B33
MD5 SHA1 SHA512 TLSH

Submit Download