6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-1holq7.htm
Size 34KB
Sample260930-h2blestza1
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{25B7B920-4F21-4455-8D4B-633626902225}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4688	2776	msedge.exe	88
PID 2776 wrote to memory of 2436	2776	msedge.exe	90
PID 2776 wrote to memory of 400	2776	msedge.exe	91
PID 2776 wrote to memory of 2436	2776	msedge.exe	90
PID 2776 wrote to memory of 2436	2776	msedge.exe	90
PID 2776 wrote to memory of 3760	2776	msedge.exe	92
PID 2776 wrote to memory of 3760	2776	msedge.exe	92
PID 2776 wrote to memory of 4124	2776	msedge.exe	93
PID 2776 wrote to memory of 2696	2776	msedge.exe	94
PID 2776 wrote to memory of 4124	2776	msedge.exe	93
PID 2776 wrote to memory of 4124	2776	msedge.exe	93
PID 2776 wrote to memory of 2696	2776	msedge.exe	94
PID 2776 wrote to memory of 2696	2776	msedge.exe	94
PID 2776 wrote to memory of 3344	2776	msedge.exe	95
PID 2776 wrote to memory of 4016	2776	msedge.exe	96
PID 2776 wrote to memory of 3344	2776	msedge.exe	95
PID 2776 wrote to memory of 3344	2776	msedge.exe	95
PID 2776 wrote to memory of 4016	2776	msedge.exe	96
PID 2776 wrote to memory of 4016	2776	msedge.exe	96
PID 2776 wrote to memory of 4612	2776	msedge.exe	102
PID 2776 wrote to memory of 1940	2776	msedge.exe	103
PID 2776 wrote to memory of 4612	2776	msedge.exe	102
PID 2776 wrote to memory of 1940	2776	msedge.exe	103
PID 2776 wrote to memory of 4236	2776	msedge.exe	107
PID 2776 wrote to memory of 4600	2776	msedge.exe	117
PID 2776 wrote to memory of 560	2776	msedge.exe	118
PID 2776 wrote to memory of 4148	2776	msedge.exe	119
PID 2776 wrote to memory of 3080	2776	msedge.exe	122
PID 2776 wrote to memory of 3080	2776	msedge.exe	122
PID 2776 wrote to memory of 3752	2776	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-1holq7.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86622c188,0x7ff86622c194,0x7ff86622c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,8895957431122631058,6958429751321227354,262144 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15464877635036078041,5262690908235796634,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,7184256626468154663,16230170562039473440,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9382099226327671880,4698665956715351260,2097152 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8277630899754425598,11056295408432143836,2097152 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,12031526994020430686,10102308646576830686,2097152 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6665667687663629233,8486895003060056102,2097152 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16588550646072648853,6987522622366899525,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14485340449065959743,8850351995124306577,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4453007382547467715,13388272374465218541,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4453007382547467715,13388272374465218541,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,4475227111129956005,2037616733525123670,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5108615150783517764,16928750948764893574,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9783124543773020904,6605386893945381302,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,13620877240708311312,3348219475659827207,524288 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,581768530442098553,7835385032110006275,262144 --field-trial-handle=2120,i,9002951138751969751,10482145754491486583,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f43cea310c7364d05644c825165deada9799dc8964314cc13217460a039d1eda
MD5 0fc7397d681ffa27fce5e85613980c31
SHA1 623fb1cb70ce267958eb56bb4681802aaae18c4b
SHA512 66df1d5b56a0d75bd7a4d0b2ec4da547ee54350e7080e454c90240e38ebf42063741c690c8ba0719be99a34b1e5e3e83b653070da3aea49072a46c7d1004a07a
TLSH
T15D616D90BFC478A1FBA87FB9DFD7148336B7A7C01AA7ED40A180D8F95E0679050A0354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fd08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fd08.TMP
Size 3KB
SHA256 1b3010dbd74052e0a5abdd2d9309e6778730cd504b40c5800b1cd18a44febe9d
MD5 b1b5d6f9dd37d2116591a9900d33c1e7
SHA1 e155eee4c0603ad17f12dbfc6987dbc8486d6a9d
SHA512 01e356db7aff5b035f10b2552d84e635fea6c6ced5ac6a38c06d06a6eb144104ef71369e1e5bf4a4727643ed40ea6ec32a0e046264dd08a8cab97f9d1954c39f
TLSH
T1CE618F90BFC078A1FBA87FB9DFE704833AB3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dd97fb4f47c3259699f6b0cd73efbca9d2d8907c8030b0086221d9661af1524a
MD5 f4c610ad4b3801d5d2c15d6aff89aac0
SHA1 ce0fac67cf39b9ecd1061c95b0b599fa5266c02f
SHA512 e7d56df53bc95c8090187765896a27e331ad413330f8b1572506e7f2c33c56d6d15791a4da433325f1cc74e6781c04a17010f55878183f2efdb4c6e0a0398cca
TLSH
T132215CF3C3D585AE8D0566F05A24AE2BDF1D0A0982183C19D9D4EF6BD7E3071E11265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f46e7549244b9d2d6c4aeb7e00dc929e7642d31ecff4ba31bc0d76da43e43bd5
MD5 788444ba5820fbcf2a07705f57fad47e
SHA1 0b94e69fc8bb67b6dd7cd41d16ebb3aa59327d3a
SHA512 7f5beb8343e1dee63b7fd26e7c20faac07c898122bdd90325a3be8ba202841ac5d5b069ec524675663388903d887ffb99b5d1f63bccbf23e9794c2f8872d8341
SSDEEP 192:sxZ//RnWq/fysPUIdpHlHW6+WNGY36eSCIg5DJ:sxZ//8q/fysPNFHbGX+7
TLSH
T14E22C9566E28697B8CCBD20DFB15BF53E6F9503251901E8CA6FC861C05E76DE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d67d7284de76e27d44a95e9cf698ce1e7bfaa4b7a65b27c5d6d2923e6f17ce86
MD5 bdd4ab52e4d682b44eb7d6eb46deaecc
SHA1 773752e5a577239aadb38449f395b0d9237b68d7
SHA512 942487ad45c8d06c2de5c1690059b0a9b491bb495343f12db5d38d86de8fd2be83d56e7920e93f5a36faa48cc8419e2ba122cb8d93416bd8a107bc8d150e918f
SSDEEP 192:sxZ//RnWq/fysPUIdpdlHW6+WNGY36FSCIg5DJ:sxZ//8q/fysPNvHbGX37
TLSH
T1BD22C8566E28697B8CCBD20DFB157F13E6F9503251911E88A6FC861C05E76DE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fdedd1c206cdd4b1dbc0f4d4ce1b64a3636a0769d83bd97e08b744b88206e0a3
MD5 fe1a0aab6297caf092b342f913c6f4d3
SHA1 a6ae17a92a75fe162e314e57aa30bc52eb493f89
SHA512 807fdc695eb0aaf1b0ef3643b126ce061d62db6ac49c5f5d7c17baa72ba0cf152ef2705738658ab64abd59180c254e2ed5f1b15594c2bdb96de9d690a5b16d31
SSDEEP 192:sxZ//RnWq/fysPUIdpdlHW6+WNGY36aSCIgrJ:sxZ//8q/fysPNvHbGXC9
TLSH
T19212B7526E28A97B8CCBD20DFA25BF53D6FA503251D01E98EAFC851C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b4900fe6d675b9f67842bf29baa9196b1d597923e428c942f9117aef139ea8db
MD5 cc57ba27d7b8da0c778dd80e11dced36
SHA1 0df6ac249fde7184a35e9bdacf33bcb93053a82a
SHA512 566e119c34605dc7645c94cdf565a82438d35daa9984c75175832055b3834b068e48de64ea4ace3bf116f0d7c624f2e81bf570b466644266cb9af5df629513a3
SSDEEP 192:sxZ//RnWq/fysDUIdpdlHW6+WNGY36aSCIg5ZJ:sxZ//8q/fysDNvHbGXCV
TLSH
T1BE22B8566E38697B8CCBD20DFB15BF53D6FA503251901E88A6FC861C05EA6DE220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 44249899541bbc5db5597a6368cebfa858833f7edea94f0221fbd2dc119b9cff
MD5 4d45844ca20900854fd8d616c1599801
SHA1 7e7893f82821be692a5b3ddec0b103d025c7a86d
SHA512 245163c8052a442445b764cb4e409302e38f48e0c930089c17201ab999d06221a397ef41aac92fbb929c837f587beb32a2f8f1aab9b115028a83e3d03bdc7b63
SSDEEP 768:/3Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/8roiu:/3Klm7QWvUYe0u1ja8/L/E/niu
TLSH
T1FDC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599810.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599810.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c4540efad0e114e85a2b031179bdb78b76abf8ebfc3e70fd27d6b325d5fd9757
MD5 48009f6504a9190261ff80424804a28d
SHA1 d842add541780b8f0cc0d4fc31a36553e94b3162
SHA512 60c1bae44ef002c71c73c82370e7dd758c79044f9a1390bc6eb359b45fff961b0663aa2e4a00fc0b677c3538db90d452e75c2f4ba2a999a60b9ca0ca0d79c1b1
SSDEEP 384:NZcIhsNjqo57GEbGKwh//z8ExUXQnutgOIwZOyjLJoQ:VhiPM/D8QnuXs8t3
TLSH
T10B827D36A878AC7B2DF7A184F58A32034EB4807BE7D55B94D5EDAB1D01DA198130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 07ee2ecdf8e59ff911aa8ea50b5d3f34b1cb9e353cf8a4c03f817ca555f614a3
MD5 4979c2970c767f058c984ea216a8e549
SHA1 9f24325afdcd1ce9f89e3eba9316df006fb2575b
SHA512 c0300053495f0c569f24e40b40a77a281579cf4942666c701e2111721000fbf82cd577f83045e08be8a69003d946556f99c0e509d9ddae4cb019c3962ea0faf4
SSDEEP 384:7iFiZcIOzsN98TUNTUlIlXo57GEbGKwh//z8ExUXQ1utgOIwZOyjLJoQ:WFQO0wguPM/D8Q1uXs8t3
TLSH
T15AA26D379CA8DD7F6DFB9A84F54A32038EB44077D6D5AB94E6DC9B1C00DA198134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b09ea13201a785db7e643745ceaa07a4230d0f3262c213cd61c3b32853a04168
MD5 4296becbb4ecdf88ac3d86ce62f9ba3e
SHA1 80d29d348190c2fbfb242f01559484db9b61dbaa
SHA512 77b1c0967107ce86bb92798f00b1183f79b54702966b63b358962399f8f0e3069fbc80db6de656464a9621ba59241af1546e50af397e3c73924888c80bf26c87
SSDEEP 192:BONN6JUm0QmiUyEhso//jjzorB6ywxWjBCaaU6:BONN6+mEhso//z8ExHBU6
TLSH
T1E802D839B8687CBB9AF3AD45B48737139FA5106BA6951F44DAE81E1D01D725C2302C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8d52def6c353187cbf5a705557be639fbd55ca1d71cad56761bcc6e830ed0f23
MD5 54f7a3516d73c7145fe00716cc287af8
SHA1 210909af2ca2a8792d298b2c146d83c07e729b7b
SHA512 f2c9fd127a64046460ec31ba6da6ac6ee129401165d494940606f6f08110d94550049d59248e8bac7115fcea55358ee70afaf565cc28ccb5b9cb42953aababaf
SSDEEP 384:IZcIhsNjXo57GEbGKwh//z8ExUXQnutgOIwZOyjLJoQ:2hPPM/D8QnuXs8t3
TLSH
T1A7828D36A878AC7B2DF7A184F58632034EB4803BD7C55F94D5ECAB1D01DA198130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 861c1f330d0b09569975d5bd7ebff965da61bf2d41c1a88f999e4161615ec2c1
MD5 f260cf1760447ac6b7d119b5f95c0853
SHA1 17f187a7452cdf2cbd1e0532a5280c4a4798b8de
SHA512 ef94df5df5420c8068813dd15e20ed46270ab1e647472bfa2447d086182d8f0976b2a44b1ea8f49e35e301e43f3a8bf386d12b86e601aa9dd05735f0a638ac31
SSDEEP 192:BONe6JUuQmiUyGhwo//jjzorB6ywxW5XQbNxBqLcQU6:BONe6+qXwo//z8ExUXQ3uU6
TLSH
T16A12F936B878AC6B5EE2A584F08732139EA44167EB856F94D6EC2F1C01DF15C5346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a2d6cd16218a3b0373651560f1ff2b75d81d5055ccd9217d26e1013e40184e0b
MD5 77e30f91d3360d85db4d4a845cb04e6a
SHA1 ba2bdf93f4f3c0095d8c88fc16f91270c65eaba2
SHA512 d2e326cd5985600f9805ec0991cc79fa19f03cd9bc878798949adc094045bdc29ae18187f5f22f49cd9a4a3f5089f3d90a6ca9f238dc424093251bbbf313fa4a
TLSH
T1E641E758BAEE1148B3B77F5AABF6A86D487EB8372E0AD45E00510D4F0626B00DD71737
MD5 SHA1 SHA512 TLSH

Submit Download