c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-wxpxvy.htm
Size 34KB
Sample260930-jj7ftaaa93
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{2B8A1A61-ED3F-4FE5-87AA-2B08AFB95B32}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2196	4100	msedge.exe	86
PID 4100 wrote to memory of 1888	4100	msedge.exe	87
PID 4100 wrote to memory of 1132	4100	msedge.exe	88
PID 4100 wrote to memory of 1132	4100	msedge.exe	88
PID 4100 wrote to memory of 1132	4100	msedge.exe	88
PID 4100 wrote to memory of 5048	4100	msedge.exe	89
PID 4100 wrote to memory of 5048	4100	msedge.exe	89
PID 4100 wrote to memory of 1112	4100	msedge.exe	90
PID 4100 wrote to memory of 1112	4100	msedge.exe	90
PID 4100 wrote to memory of 3580	4100	msedge.exe	91
PID 4100 wrote to memory of 1112	4100	msedge.exe	90
PID 4100 wrote to memory of 3580	4100	msedge.exe	91
PID 4100 wrote to memory of 3580	4100	msedge.exe	91
PID 4100 wrote to memory of 3468	4100	msedge.exe	93
PID 4100 wrote to memory of 3468	4100	msedge.exe	93
PID 4100 wrote to memory of 3468	4100	msedge.exe	93
PID 4100 wrote to memory of 692	4100	msedge.exe	94
PID 4100 wrote to memory of 692	4100	msedge.exe	94
PID 4100 wrote to memory of 692	4100	msedge.exe	94
PID 4100 wrote to memory of 2772	4100	msedge.exe	98
PID 4100 wrote to memory of 4108	4100	msedge.exe	99
PID 4100 wrote to memory of 2772	4100	msedge.exe	98
PID 4100 wrote to memory of 4108	4100	msedge.exe	99
PID 4100 wrote to memory of 3124	4100	msedge.exe	101
PID 4100 wrote to memory of 1076	4100	msedge.exe	114
PID 4100 wrote to memory of 3924	4100	msedge.exe	115
PID 4100 wrote to memory of 4564	4100	msedge.exe	116
PID 4100 wrote to memory of 4380	4100	msedge.exe	117
PID 4100 wrote to memory of 4380	4100	msedge.exe	117
PID 4100 wrote to memory of 692	4100	msedge.exe	126
PID 4100 wrote to memory of 692	4100	msedge.exe	126
PID 4100 wrote to memory of 4564	4100	msedge.exe	129
PID 4100 wrote to memory of 4564	4100	msedge.exe	129
PID 4100 wrote to memory of 4268	4100	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-wxpxvy.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffab7c2c188,0x7ffab7c2c194,0x7ffab7c2c1a0
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,8311808637521676091,15390473662105839137,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8546852211533734774,253128717429347821,262144 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2805775395748067480,6954580485601233559,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2856609263323722723,11021974016246198132,2097152 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5154418223515252354,14519478483391050902,2097152 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14534769650929557104,5166517157768208040,2097152 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,5128681689391050424,17464644513313254432,2097152 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,5134504332552076165,5373584381079932535,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,17192478872348979982,7334645447211049236,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9068357667330190259,3253213872580833583,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9068357667330190259,3253213872580833583,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,3118423198895767493,2063682945936421351,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,12841577118439490858,9422016886223357657,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4994662566390420631,1655948039709468583,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,1420509632973192733,17774480494753805568,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,18392630361499339196,11221631277045041679,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5173689751901288811,3451765628161400851,524288 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,6136538317194075039,13128405345897672930,262144 --field-trial-handle=2272,i,3420899794067274810,3300396085964083028,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 128623dfe844fb8b18e6b3d37b86c30c2145c428491783790b2799e3e33a315f
MD5 d4357bb0a89dcbb355f51fd70fd610f4
SHA1 23bac406a0f68649b547a9e6fa4b6c32dffc77e4
SHA512 7adade0c168d5c9749e488897b5fa83676414bccff5e1aa0e29c254e96e095afed7236717121419e83be68df0d293f3478eaad5024cc24643b53ff432451efa9
TLSH
T123E026A84BCAC3AFE240645743ECA74C93C03B2A97CC7F4A1B0CA4897881450E6C3ED0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 14ae6634e7a4b929fd034fa9cead09765c77f9e7e5a9ca03cc2af2fb2a5e1a7c
MD5 a96c69f4c68d7de6681666e7ca3153c1
SHA1 1060c9c4e30066563e6147ab536fb200e2cf6ba8
SHA512 dfa46bd5d81aeef9c259b805ced9dff0e93b8040365bc2dfbc53e9691f5c521390cbdcaddfc940e7c1dce8dcb060dde04a7dd5badf77625d7738bf7ee569f9f6
TLSH
T1DD615EB1344F8D57EFA855BC99F5108B3A3C7DF041832E4E89B4F8EA43BA3569040847
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c147.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c147.TMP
Size 3KB
SHA256 308856e864012dc54dc2d6ef327bdb370553fcb9775d9c750b64f387781377b4
MD5 561cd2ef79dad9b4e86dfd2defea03bb
SHA1 3148c5c460788631a39c388c7a6a98a6e17da274
SHA512 1011cd30ca4b78251c1f9df3e9471666badf2f0d2cccc28d16e1c28cdf87fd8224e8faae0c95ea397322b590fa65dc420a64bfa54cb5eb40711d42fb0ef9d31b
TLSH
T1B8614DB1344F8D67EFA855BC99F4108B3A3C7DF041832E4F89B4F8EA47AA3569040847
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 afab7f8e8312a7543533a9379815c629604cd2e97366b53a9283236f1766484b
MD5 9c85151045448f4e77ac9a8332f2e49f
SHA1 a750f3bda15b8c4ebba6368c5e4002c7f9be1444
SHA512 fcc9f2b915770f7700687ddf707b6cee091dd06689944e87f2e772fcac4091372c6a3332fb237c78a276b7907b46e49904447770ff2032dd6bbed2c0369cbea6
TLSH
T19011BDB3C7D595AE890117F06A24EE2BCE2D0506421C7D1A89E4EF6793E3479E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b5639e46-97ff-4b21-a065-fde4a16c9880.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5639e46-97ff-4b21-a065-fde4a16c9880.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 324e8485ae974e359ab4461726e896d17bf2c2b59cbed901882bedc44b0efd4e
MD5 8d5e8954577489f9816ccd6748e90630
SHA1 ab85e7cbe416f21b2906791419a81b544e0151fb
SHA512 d3c9df54f5e04955357284bd66853c41a05ec0a1dadefba1dad68ae554e3ee7b03ec2a3632aeaae27adbc29c451b4934a88250ca8d3a5485366973295a0d140d
SSDEEP 192:sxZ5R+WG/fAsZFIdpd4HW6+WNGYRPRBXIgrJ:sxZ53G/fAsZ2mHbGmv9
TLSH
T11C12C9556E78A87B8CC7E20DFA25BF53D6F9503291941E88EAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c446d6c9fbd3bc1b1d90d73e09f584426950baff2904e5ed2df2b6ce94e08638
MD5 ff73b30739da3a6847eda596be4eaec0
SHA1 8326539bc4d9d2be2ddf213ed326c72308f1cc08
SHA512 949e6c6748984b55eb6b7e9943c98d1fbb1c7a235e0d4858a7f54d99539d92f6345e742df64b4fbd69d55394e9e2d24771ae3180f25e97043061215833488ea8
SSDEEP 192:sxZ5R+WG/fAsZFIdpH4HW6+WNGYRPaBXIg50J:sxZ53G/fAsZ2YHbGmum
TLSH
T1EF22C9566E7C697B8CCBE20DFA15BF53D6F9503291941E88AAFC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 12c89e1b1cdfd6553a0de222b0aafc9b2a6a8b8705ab604eab4c9ede797f6e1e
MD5 4cd0db454c6ae9d7b2dddf0b9a8883ee
SHA1 334f7917f4ffcb140a8942f13b90361629b8b383
SHA512 401b7b80807088abed236bf1473ab63a6d6fcb118d2d4620f2ac87c13c144f2ecde463420c9178b1882a0be1d3e592c0da99f2da082c213a0075f47e80598388
SSDEEP 192:sxZ5R+WG/fAsZFIdpd4HW6+WNGYRPBBXIg50J:sxZ53G/fAsZ2mHbGm/m
TLSH
T1B522D9556E68A97B8CCBE20DFA15BF53E6F9503251941E88AAFCC61C05E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2c7aec1024fa387f2d632405f2e38989757a3d2c3521e526026c71a58f5207e4
MD5 ea9ed0800e3e962d8fb8c7e476f03616
SHA1 2326e01e7e53278342a5af9c1ae59c18d3218617
SHA512 5df68fa35fef2779a2c395b08eee48d4060326145a795f2ee4c59107a248364d711dcd1a36432c9521a3cd685ed3c92ec7e4dcc179430c6dc74a48c0fe3b6792
SSDEEP 192:sxZ5R+WG/fAsBFIdpd4HW6+WNGYRPRBXIg5eJ:sxZ53G/fAsB2mHbGmvs
TLSH
T1B422C8566E78A97B8CCBD30DFA15BF53D6F9503291941E88AAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 46bf65b2a21cf498ab27b11c1e474eaf149064ff6d6c3f311f5c435b06d79dba
MD5 a4be9de08b8604d39bb821f7e109c944
SHA1 0e661e9baa2ab1914b642127fa4ab29dc6010f75
SHA512 cd2ad9a55ea2fb711386963bd87ee287df757d7f12f8c615f02a814b222a20a7794b2106d58f63f4d17145d0672ebc5cde90725ec8dfddd6bc43cb73bf6897b9
SSDEEP 768:5NK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3wroV+db:5NK9uzYWvcQWsu1ja0HL7Q3bV+db
TLSH
T192C2F93F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA944C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cb3fd0d-4adc-480c-9364-412239f4bb08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2cb3fd0d-4adc-480c-9364-412239f4bb08.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fee1fdc47ff3dc842590c70e0f8ed06432ed3671ee868227c6962fef1e647855
MD5 2acfb4c3e4bfb32398743ca262618f35
SHA1 1ca691a705db63448fdea66d44c890a30de512e1
SHA512 eb02121738c6f2d080be358d6681a9d640e4b8ac6c46e0182c15a31e2ab64e2e39574a994dea9df74c9e81f74049c8db60e9530ab1032f75f6bdfddf37f8e707
SSDEEP 384:fZcIhsNtlw5P5Vg1DsOjTVINOrnjlSGVZh6DKhHtbloR:3h75cDnnWO7jldfYGHtbly
TLSH
T151827E36ACBC6C765CF7A245F94B36039FB881A3D6896FC0D0DD6B1C01DA6982307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 79fa3917df95cab4e28502833e93edc4d943faa2d65cb9a6a03a1b5716179322
MD5 6349dfd6d7253d7d937ac8f2c7143556
SHA1 a125a30ca7bac25cf9ef9ae7141c7a6022f87cc9
SHA512 7a0eb69a549ec77bd9b9dd290677f5ac40b67ecf547742ec9eef29bb5e6f2970e4501c3a3d020b5c2034d565f84d61f69f3a9918d8c6cd9ac8a42e89ea15b276
SSDEEP 384:XiFiZcIWzsN38TUNTUlIlow5P5Vg1DsOjTVINOrnjpSGVZh6DKhHtbloR:SFQmqwgt5cDnnWO7jpdfYGHtbly
TLSH
T1AAA26D339CAC9D7BADF79B85F94A36038FB441A3C585AA80E1DD5F1C019B1D82307D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 518c6b52790b9c2827363c8d31c9f8a5afce17b087a8089b3d94206eed9db8af
MD5 b0bcbf14156b34a20229ef0b61fa40f0
SHA1 5bcdfb326277e4bf78fad594401a6dcadb2ef330
SHA512 84f1460a822bf9763102ab7ffbc2b0e5e2d413fab84c8c4167763570f33dafc1d7aceff5bd4c569b19c707311d3fb4c648e70ffe9f3d2d99573f3631641b4b24
SSDEEP 192:SONu6ygpQmiUyVatOCTVg3NOqm5zPduU6:SONu6lHZtOCTVINO9wU6
TLSH
T12C02C634AC683CB78DB2AE45F58B27139FA8116BDA562F84D9E81A1C01D775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2e42ef9ad17b6dd36bcf7c457ddde23591e79fa1fb12707567347c24594d9790
MD5 95e6c23cfe1233bd2fd579d7170838d8
SHA1 9e32f6527e79781d6b3ba2895fc18ca367082577
SHA512 82d37c3b9c0c989f472af8d5dde0b1b84f2751f4289928613ff672adb8b6e3c5f9201cb4e3eceb27e113243cb74060ea91ac1ca233135531f3cc23cc251a82c7
SSDEEP 384:RZcIhsNtow5P5Vg1DsOjTVINOrnjlSGVZh6DKhHtbloR:5hQ5cDnnWO7jldfYGHtbly
TLSH
T1F0828E36ACBC6C765CF7A285F94B36039FB88163D6896FC0D0DD6B1D01DA6982307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45a98b1e4f43cc03a5857681937ffcd0dda879acef4faca0783b68a3ec8a0c21
MD5 5ae746d34918e823a49baf084b17dc58
SHA1 631cafa61919bd977468ec9dae6fd2b9eed9edda
SHA512 7e1aa44e7fdbfc68f999d80bb9306b618a207068394f3e85e6e39c75b28b308d4f440d51551b544bd3264d70410a7704e4b34b42b4ec15496ef7881cf7473f9a
SSDEEP 192:SONI6yXQmiUyvEa8OCTVg3NOqmjnjOebN3UNqaCGU6:SONI6S2p8OCTVINOrnjgSGU6
TLSH
T190120935A8B86C775DA2A585F48732139EA44267DA4A7F84D4DC1F1C01EB69C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0c3c075-1ffa-4daf-a410-8e5cd498d3ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c0c3c075-1ffa-4daf-a410-8e5cd498d3ba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6eed2252aa8512d66a01c603262429de18405dd3c2c1f524d898528728fad425
MD5 552e7b75126df7ec1e489f82b877e7cd
SHA1 d4ba3df71f8e69e1129a4806bdd29d8e9cda7036
SHA512 5552597b3032a4b14e911ed8b8be4288f48f0ea683ddb692c0f4263ce564298da3c1e705427444ed16f0b913372c1b7c7da5782cbdfd72b2737e2b5bddface76
TLSH
T138411A98B6F91148B3B76F569BF6686E847F7C732E46906D00110E4F0A26B40C972B3B
MD5 SHA1 SHA512 TLSH

Submit Download