ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-odcwo6.html
Size 116B
Sample260930-jf5stawsdv
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3780	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{FFD497D1-0C52-44FC-90D2-3DE3E6AF0A46}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1216	464	msedge.exe	85
PID 464 wrote to memory of 3780	464	msedge.exe	86
PID 464 wrote to memory of 984	464	msedge.exe	87
PID 464 wrote to memory of 984	464	msedge.exe	87
PID 464 wrote to memory of 984	464	msedge.exe	87
PID 464 wrote to memory of 2964	464	msedge.exe	88
PID 464 wrote to memory of 2964	464	msedge.exe	88
PID 464 wrote to memory of 1324	464	msedge.exe	89
PID 464 wrote to memory of 1488	464	msedge.exe	90
PID 464 wrote to memory of 1324	464	msedge.exe	89
PID 464 wrote to memory of 1324	464	msedge.exe	89
PID 464 wrote to memory of 1488	464	msedge.exe	90
PID 464 wrote to memory of 1488	464	msedge.exe	90
PID 464 wrote to memory of 952	464	msedge.exe	92
PID 464 wrote to memory of 952	464	msedge.exe	92
PID 464 wrote to memory of 952	464	msedge.exe	92
PID 464 wrote to memory of 1476	464	msedge.exe	93
PID 464 wrote to memory of 1476	464	msedge.exe	93
PID 464 wrote to memory of 1476	464	msedge.exe	93
PID 464 wrote to memory of 640	464	msedge.exe	97
PID 464 wrote to memory of 4240	464	msedge.exe	98
PID 464 wrote to memory of 640	464	msedge.exe	97
PID 464 wrote to memory of 4240	464	msedge.exe	98
PID 464 wrote to memory of 2812	464	msedge.exe	101
PID 464 wrote to memory of 448	464	msedge.exe	120
PID 464 wrote to memory of 4780	464	msedge.exe	121
PID 464 wrote to memory of 3760	464	msedge.exe	122
PID 464 wrote to memory of 3048	464	msedge.exe	125
PID 464 wrote to memory of 3048	464	msedge.exe	125
PID 464 wrote to memory of 4880	464	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-odcwo6.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff83016c188,0x7ff83016c194,0x7ff83016c1a0
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,15698869714754063460,7040282013109520377,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1761269937747129019,3452136586216258106,262144 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13803676027912528040,4193460309957558544,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3428784610230013261,6782467010241712807,2097152 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9417293899679000602,2167991702176967849,2097152 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12256782901269732921,9052520133804068710,2097152 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,14990195611467748245,17316414681293520327,2097152 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,18170790549267665684,4119944583997850550,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,385382549615043261,4216927805624100261,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12078540404698488825,18019484283077752294,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12078540404698488825,18019484283077752294,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,3915092243326439705,15292598549524113394,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,14135249613282856047,12427511305817670127,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,18036973007673026544,6707753783707528009,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,12162385881279313950,688570799195338155,524288 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,15288194599928658220,2115320922349848455,262144 --field-trial-handle=2240,i,17308426048712355575,4612117164614946402,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 14d9220f90b8f2b13f9db232657f9bcf3531d3f6489bf0de5437ba0e1e67eb49
MD5 da9ae4564e4d0db97d721fd9b7a795bc
SHA1 b88de1fc0836e8e7e57979dfe5405148c62e08d5
SHA512 577dfb878e204947b1157053ab3f2fc8c2876282c8341faa5a59b7a1c715727baeecc74889e4bf4f433c1cd27d49c7d8013ed0ab2717124ab08d8dffc5e1f9c3
TLSH
T1FF51A5829FE303E5FFDA88F68FE529EB373E45C091836E72D598D6B8C9477548095088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595440.TMP
Size 2KB
SHA256 14c8597c581be843c847d93209230622e0e131cc22024cbaa8b13ad070077cc6
MD5 dc4cd89eea6b12faa80a35763b22627e
SHA1 4e160117c6a288d4c73bcfeac6b3ed5818bf51d0
SHA512 08fb1c46090dd64f874f6aeb103e968559d0da383e5bfe598fa8cd77faa712ed6aef7d5761d4d9529c0e61a146fac2dc346499291366a8b91e880196f8991411
TLSH
T1395185829FE303A5FFD688F68FE529EB373E45C095835E72C598C6B8CD467548094048
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8aed164ecd17a738b9519a285f8dec69c7b6c8742e8252a626b0ef2fcd6cf5c8
MD5 4a55d232a7a1d34b3e7e1f0b82226642
SHA1 9135d86eb1f79191e95d704ca2e9cfc0fe0fd302
SHA512 e1d6a3c74f4a2a0466aa51114af5751eba3aabbd8c9925196152f1b35e0297e0cdcabd06ae212b04cbba180d2ae0b9148f4edc8200a2bf7c8abffc02d598f4a7
TLSH
T17F113DF3C7D5C5AE890116F06A24AE2BCE2D0915421C7D19C5D4EF2BD3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 64fab8e45a46ea016a11de0cf6a45bdad93890a2eb15bd615eb8d2d29438d607
MD5 6db05ec121223057c09e7c708d9eb909
SHA1 32cf8b110cf6d612132fc29e55f7f2be51968cb5
SHA512 a2f9bb687859743bbd259e4c3ae390253f121a57e618d136033fe76a426f2ee88c85c38cd424c37eef7df0f44a78fa0083b361ed24a3672c1f05748cbb230b98
SSDEEP 192:sxZCRzWn/fzsbiIdpdVHW6+WNGY36altqIgrJ:sxZCYn/fzsbLjHbGX19
TLSH
T13C12C8126E68A97B8CC7D20DBB25BF53D6F9503291D01E98EAFC861C05E66DD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1c629457bcd51899788d29260b59c1a595a1d6ddb547022011c01874826ed69c
MD5 7da8e15af002bd74aa24caf1754e5ac1
SHA1 b1c42a9fa01f14101480fdf00a47c5a63db5af29
SHA512 19fcfa76e69b90b58ab64034051ca2b6992e7bbc3cdeb5fbf332835f6117e7f1f82f3086c328a75a2e22fc08f8224fcea792e83126ba566f2dd754c78cc8d5db
SSDEEP 192:sxZCRzWn/fzsnkiIdpHVHW6+WNGY36tltqIg52J:sxZCYn/fzsnkL1HbGXkE
TLSH
T14422D8566E68A97B8CC7D20DBB25BF53D7F9503251901E88AAFCCA1C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 71bbf8b12f12da7d83bddc9f1473d577d00e7a990f4d402cbfc13df79687e393
MD5 17831c30be49cbf64299e1e7d79bd726
SHA1 59d26272812111c95e49c12cd7c22fffdb94b0c9
SHA512 d0ebbadca92bb4789af3eac3451196712438ab8bce7118d45702605e62d1cefdaa830dbeca1b6fc4fb4ebfa95d398af321b2f9622eb9cc06d1b5fa5d76e12c58
SSDEEP 192:sxZCRzWn/fzsnciIdpdVHW6+WNGY36altqIg5UJ:sxZCYn/fzsncLjHbGX1G
TLSH
T17522C8166E68A97B8CCBD20DBB25BF53D7F9503291D01E98AAFC861C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b488618255c8ad78f9f4ad335e6aed6b4776c553b98873ff867c18203092acf8
MD5 12f69c0704b09cfab254679558bbab85
SHA1 256d845074ddeace4d28c5e8a20ba38bd50e67d2
SHA512 72c1da2df733e2da10150011b497a1112abfe445b87604feb204d124adc58e06bb77b57016afa36f4e4ad5f37664a654bb76584829bef8f75fbdc66c5996c88e
SSDEEP 192:sxZCRzWn/fzsnkiIdpdVHW6+WNGY36nltqIg52J:sxZCYn/fzsnkLjHbGXKE
TLSH
T1D422C8166E68A97B8CCBD20DBB25BF13D7F9503251911E98A6FC8A1C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 24094009830839583c4f86b4310c0f86a60e8f9ab3f48cba2ead081915ffef9b
MD5 0daa5f115aafc36be1f37b1ac4f1c061
SHA1 e35a029a85b98b26a231a7e3080851e9cee00477
SHA512 023f48e71e506e0eed35d3778359d02bbb29f0545a8ccd3d0150a0c915b91319d3d9b8e633af42f5fe21e261f839c0f918adefa9b599eb3293d4c6d28e5dbfcc
SSDEEP 768:TPKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/YroD3:TPKlm7QWvUYe0u1ja8/L/E/jD3
TLSH
T188C20A3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8ff156e-da28-4bbe-83e1-ebe98ae600ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8ff156e-da28-4bbe-83e1-ebe98ae600ac.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59eebb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59eebb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e8e1b3b1c78b12b4aeeb946cf4603a9267d3c5a43b76391ef81dd4e19458ebd7
MD5 e5f28758f840ded613600546fcaf0808
SHA1 873c362172ddd0f3b0dace36edb489a893a77093
SHA512 5fab0a298234cba6a239c645caf8aa24f265b46bb364309d9bc0e14b608f8d6c08b120b74d81be4492eff75f7fd54538ba523e61700bd989a4b7ad5730a5daf0
SSDEEP 384:JZcIhsNmUY/bhaWBh//at67FotgOIwZOyCo3op:BhR/v/poXsC3u
TLSH
T122828E35A8B89CBB5DE7A185F08776138F744477E7C49F94D6EDAB1C02DA0A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 cd55637ad9d58936096e1c5d36033f9ca7053769e102091919afc0be58009fd0
MD5 869c72cc9afba32b3d9900e7ac2034ce
SHA1 14f080f2315b0c14938ee6a85f817489aa4698c4
SHA512 0b067fa6dd5270484a5174a72ad8382ea65255314461f48e3e9cd6f99c0c93c06e9ee005b8f18de0379acad3f426263c25853e919c26e717dcac49a0d2bed5ec
SSDEEP 384:x8iFiZcIgzsNm8TUNTUlIlpY/bhaWBh//at67HotgOIwZOyCo3op:ZFQ8LwgO/v/roXsC3u
TLSH
T17FA25B3698A8DCBFADFB9A84F54636138FB440B7D6D5DA94E7DD9A1C01DA0D8030BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ae3fd57c5d539ff9f5f5a9cae7a5a99775633a8421b970885c6cbd30b75a6b4
MD5 5ec67a8da9c0d372774d73583b0d7b12
SHA1 61062b3bd5156f6ed6ee4c0580198600fb0aa9ae
SHA512 e315d0c71912c20d1cc851390bc3f4425b93a9f69c21264e7e16f2769df41ce2bbc1b1b805fea5e37c6be4c2416fbc0cdb427f7d8dec12d437012cecc94ae982
SSDEEP 192:BONO6JUm0QmiUyubso//OywtvCxBC62U6:BONO6+mE1so//at6WVU6
TLSH
T1E002D839BC687C7B8EF2AE45B48777239FA4107B9A911F84D6D91F1C01D715C1302C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2c307e0fce24340cd2a6b0be73985d68c1697b79bc90267ad6883943abf017f
MD5 e06feb1e910b092e3b928477036b8381
SHA1 bf57cee6ec66c58a7d44bcff1a6ad1ea282cdad7
SHA512 693e8d040acdf18ca9464f9c96f3dea8556d7bc89538269262ef3d92516e544618915684dfdc4c21a870d207a1a07ec5e3685eed235e37848dba354a0ad1fb0c
SSDEEP 192:BONH6JUsiQmiUy4bzo//OywtvC7OezfpNxSqYU6:BONH6+sebzo//at67joU6
TLSH
T147120935B868BC7B5DE2A595F08336239F644167EB856F84D6DC2B2C02EF19C530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8324355ec172466ae3c3f11bcbf3070f6411e0a83e84e0f68041d5d3be5db599
MD5 320c23dc2afb2508616b9655511ff420
SHA1 8ad506eec533bb71e14d0489338945ffe75acde1
SHA512 439f759e93f4bfb9056b30daa3c2a0af21d6968e47decdd9326d453b44065cf4543466c5b5508aee1c1cb773c3fb7d6756b824bfd4134e4488fc973fc7078d36
SSDEEP 384:XZcIhsNmpY/bhaWBh//at67FotgOIwZOyCo3op:fh6/v/poXsC3u
TLSH
T10F828E35A8B89CBB5DE7A185F08736138F744477E7C49F94D6EDAB1C02DA0A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

896d3ee0-9166-46e3-b26c-49d7030dc918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\896d3ee0-9166-46e3-b26c-49d7030dc918.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 872e8b958102b145a9024549e159ac14286a2ef93fe974a62f3e3fb9a5f8826b
MD5 9a7c0bac8ad9c1aee5ec0225ad106e91
SHA1 460c461025c49541a6eb34d273df4abb369220be
SHA512 638dad188c83bc65766662ebbfb2b42e74f6f366c52d66542862ba7e372d6e8884b7667a0394e636e6a8d4e10523de0c7f524a06b4d1526f25363f73079f3f96
TLSH
T1F941B858A6FD1158B3B7AF5AABF658AD447B7C372E0A945E10010D4F0962B01C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download