6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-ei4a00.htm
Size 34KB
Sample260930-ky21babc73
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{FA36645A-8D6E-49D1-8B7F-C348B098BF5D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4400	3132	msedge.exe	85
PID 3132 wrote to memory of 2860	3132	msedge.exe	87
PID 3132 wrote to memory of 4888	3132	msedge.exe	88
PID 3132 wrote to memory of 4888	3132	msedge.exe	88
PID 3132 wrote to memory of 4888	3132	msedge.exe	88
PID 3132 wrote to memory of 4780	3132	msedge.exe	89
PID 3132 wrote to memory of 4780	3132	msedge.exe	89
PID 3132 wrote to memory of 1080	3132	msedge.exe	90
PID 3132 wrote to memory of 1080	3132	msedge.exe	90
PID 3132 wrote to memory of 1080	3132	msedge.exe	90
PID 3132 wrote to memory of 3940	3132	msedge.exe	91
PID 3132 wrote to memory of 3940	3132	msedge.exe	91
PID 3132 wrote to memory of 3940	3132	msedge.exe	91
PID 3132 wrote to memory of 3744	3132	msedge.exe	92
PID 3132 wrote to memory of 3744	3132	msedge.exe	92
PID 3132 wrote to memory of 3744	3132	msedge.exe	92
PID 3132 wrote to memory of 2716	3132	msedge.exe	93
PID 3132 wrote to memory of 2716	3132	msedge.exe	93
PID 3132 wrote to memory of 2716	3132	msedge.exe	93
PID 3132 wrote to memory of 4816	3132	msedge.exe	101
PID 3132 wrote to memory of 4364	3132	msedge.exe	102
PID 3132 wrote to memory of 4816	3132	msedge.exe	101
PID 3132 wrote to memory of 4364	3132	msedge.exe	102
PID 3132 wrote to memory of 3004	3132	msedge.exe	105
PID 3132 wrote to memory of 1352	3132	msedge.exe	114
PID 3132 wrote to memory of 312	3132	msedge.exe	115
PID 3132 wrote to memory of 1468	3132	msedge.exe	116
PID 3132 wrote to memory of 1132	3132	msedge.exe	126
PID 3132 wrote to memory of 1132	3132	msedge.exe	126
PID 3132 wrote to memory of 4704	3132	msedge.exe	127
PID 3132 wrote to memory of 4704	3132	msedge.exe	127
PID 3132 wrote to memory of 3872	3132	msedge.exe	130
PID 3132 wrote to memory of 3872	3132	msedge.exe	130
PID 3132 wrote to memory of 2604	3132	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-ei4a00.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffd1540c188,0x7ffd1540c194,0x7ffd1540c1a0
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,5074499920261147354,6360135327363938449,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,2714713577586972874,15830452534809599251,262144 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,11290212559340473529,2932203315229941988,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11254960825269345517,3598041965882232007,2097152 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8840946340123792716,13117701620736708925,2097152 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,2597250966147754291,4105901031870386688,2097152 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,8845358128440944114,3086993699024710062,2097152 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13235142959336447340,10325107155883295238,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3346045467072846398,2335355215354266042,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7843885597386570721,18015440104147935767,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7843885597386570721,18015440104147935767,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,2938008181880757139,9716637868547761075,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14826344848127855654,11111353710228167757,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,14906594409074645429,16915374908919625548,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,10201239704902821079,11191178737277566751,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16339959898090393416,10515368045119641604,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6388813699975079145,8648375944829117707,524288 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,9027770894090754936,7169242715626196095,262144 --field-trial-handle=2332,i,10955331295905884913,13356828869729219163,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 83e90ef62a99e5f60d64eddbfd5b0d0004c143c2a6bfe8ddb512fedce9522017
MD5 8c05e9804e8fa3c16c83f3d45e9d0bbb
SHA1 013d50fe270024db3d85da69f4142aa0b94dbc90
SHA512 8e9800b4f8d1a971af65fa056197207bcd653c0e11674a2f9e9c9e350ec0e4ba123e9467f77bc5b7118aba496546264e0df01c5a6aeadae5dc8178eabd9dcaac
TLSH
T176E0208485C5C37DD104A44B4394674CDE803F0F92CD7E0D2B0488897406D40F2B59D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b3401fa8438dcbbbba41d28e5f8c0b338b545d5eb9440f3e2e3fee1361b370a
MD5 79b54180e7f3ff0f20c185d4661a0c89
SHA1 b071720113bb968ef623a819b0156eda22617b4b
SHA512 93e712b505f26d89eb66b2939199262cee7de8ea2a7a138e04c1318a2bcd004ce9100ac4837b2e95b5d4bffe8b95e41b1c07d0424550178de2891a924b3e1660
TLSH
T1C361C78215440EA9FFA8D97889FE17873635A58124872EC2406DECFA580EFD5E37037C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bcc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bcc3.TMP
Size 3KB
SHA256 e75706b3575e675352b83bdc71213328272fc898625b549a56279d18c9d151e8
MD5 90e978ae9cc487134bba2e23ef0b71b3
SHA1 c6f3860fd57f4042fcde55aeb00eee55996d36c5
SHA512 b34d53db426a8664c908fae7977832c4da7487f727dee7d3a34367e67d6ca4fe9493d6398a0d743f7b570dd7b4af9c52347ac4c4aef3ae494e60181e78429775
TLSH
T1F161C68215440E69FFA8D97889FE23873635A58524872EC2509DECFA580EFD5E33037C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c08b866fb49a14a6c93222eded19b281046f1dc5cbc7126841afd75f1ecd1097
MD5 868e203402c5778157eecf67fafd1e61
SHA1 1972f3957d5402967592cf265089a374933bd6f5
SHA512 64cc0bcbab138771014e2d36d1e4f05b15bcd3c9b16bde078d604d7d389c793c409edd5aac5badb81b1881f5a80c2d570b11bc85b5d790d454b0451e9a306de2
TLSH
T194117AB3C3E585AE890116F0AA24EE2BCE2D0616421C7C19CAD4EF2B93E3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 612f70eb45484fc173168b5ccf0900eabcc92c6d3ef02abcaf7bd2c3d98c32be
MD5 a8b8ae689d679d304ed5fc97158a2d5e
SHA1 cb6c69891838144a3fadff31be029392251b8c35
SHA512 f1353dccd3392282bc881eb1523e2b41da796b4a8f09890aa54869366442b95e84565a60fcb7705a29f55c60663134c350da8dfdd05e028727725183c471cee1
SSDEEP 192:sxZkCRJWLM/fr5sGlTIdpdiHW6+WNGYRPRLTIgrJ:sxZBWI/flsGWEHbGmB9
TLSH
T1AC12B7166F38A57B8CC7E20DBA69BF53D6F9503291951E48EAFC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0fd1db31ff88fc8b1d493a8db7c4cbf6245c8b44bb9c1b45ac27054c34402e07
MD5 d0d0194dad0c8e6eec7091c3d9d7de11
SHA1 f6ddce4254c6a302b9259bff910e041a94e314fd
SHA512 ba030b2fe5ccd8a65d6db96be14d28cf0a15ff26c3e395d4771d3b2e7de2f0ff7e45357fd8edd1f9cf26b11516cb165c4d764dfbe58480228f47bdb9cc3b9272
SSDEEP 192:sxZkCRJWLM/fr5s9lTIdpdiHW6+WNGYRPyLTIg57J:sxZBWI/fls9WEHbGmk/
TLSH
T1C122C7126E28A97B8CC7E20DBB55BF53D6F9503291951E48AAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 16198a5faa37cd0f9b13780c1329f46dbcc14bd68f3ab34d4d36e4a018b6c512
MD5 1eabec1b289789552924ed96dbe006b5
SHA1 41d1993a7b032986adef3668dc3a40611002920c
SHA512 536a8eb73607269b9b73511df693f293d2e806be9e16a9009b223af80ef9445d817ebbaa577eef235cb2602fdf668ce5cf05b0d159906277f51e6ddcf7df50f6
SSDEEP 192:sxZkCRJWLM/fr5s9lTIdpHiHW6+WNGYRPmLTIg57J:sxZBWI/fls9WCHbGmQ/
TLSH
T1FB22D8166E38A97B8CC7E20DBB55BF53D6F9503291901E48AAFCC61C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b05421faa81727e4dd491a54027bfbb5a70bd74b4040e0a90c8015655e3ecaba
MD5 776d8633afb2b6b9d9ae247c7e73ef7f
SHA1 b1f9eef7b0efccc908a09f9e0194ea093713b1be
SHA512 ac0cacd8bd11ed398d184134dcd2dc346520e16509c21d3893ad1d79b8a943b1bbf296a7fe8702db1f210848cb406d1bb319cb780d5671cc79ef5676ddbcf15c
SSDEEP 192:sxZkCRJWLM/fr5swlTIdpdiHW6+WNGYRPRLTIg5BJ:sxZBWI/flswWEHbGmBp
TLSH
T14D22B7166F38A57B8CC7D20DBA55BF53D6F9503291951E48AAFC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0bb23c48680958e700005ef4cac9ab2df02c3e249d280d6e0bdbd1a38c8d8844
MD5 7d74fb975d0a96c1e6ebf7dfd91aa2bc
SHA1 a7a0ebc1270f7344774b31ad0c31f79b6dcaec0e
SHA512 e1034eb0f6a0dd4903b4bb8bf5625c09caac534f5f5a996ed31b24dd181809e2446a42325cfe1d15c9b65bd1add7ce898fd334b9416dcf598045de6c1c0fe88f
SSDEEP 768:Q2K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3ero0+pQ:Q2K9uzYWvcQWsu1ja0HL7Q310+pQ
TLSH
T109C2FA3F640CCB7E5FC01A9DDC5A6F973E9802D7A6684D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59570f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59570f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 488920fa5e8051cf70dc3c1065a24bc85f97cee541279b174a670f7808bb120b
MD5 3b8efb9f37cf16abc4b772f92745f8ee
SHA1 cb9b711bdabac8240a283fdfefd156baa94f7673
SHA512 562bd12ec709d8dd3ae47e1d7cff5e3710f822b62fc29756763f68323315bb2da6bd0d71f7e920fa0a6dbbf4c759c19d04bd51c37fc849fe12107ae3a260a1d8
SSDEEP 384:3aZcIhsNfAw5qeWOjTVSpOsG5bjkDQVZh6DKhHzoj:3YhStnAOrjkDQfYGHzo
TLSH
T141828D726C785DB65CF7A546F48736079FF88053D6892B84D0ED6F0D01EB6A8230BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0b6fdcdf6ac881e1f3a2639dd0362c2a7ce9b944ee518dca357146fb06884630
MD5 8a16efccb9a74230ab61f89108fef8a9
SHA1 9493c6f1f4add271773d667d0500471cfac75d26
SHA512 049e3d5530885a80ce7759b7b7c87ac9961d8acce3c377715348f36a4524e23a689f639999a21a4a8e1a90cabccc4e95a059cf040aee60d773634a13ccb7b95d
SSDEEP 384:lpiFiZcI8zsNB8TUNTUlIlHw5qeWOjTVSpOsG5bjkxQVZh6DKhHzoj:lAFQA8wgWtnAOrjkxQfYGHzo
TLSH
T15BA27D735C689DBBADF6AB45F94A32078FF440A3C585AA90E2DC6F0D019B5EC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f0d3211dd21d1af74f5426dd1184cdd24ec387d5ce08bce5518aa7683bc2d07
MD5 4b29841b7db2ef8c0347c9bc3cbbe3d3
SHA1 836d1ab81828c664a61e472295fb8168e16306ed
SHA512 3da7ebb756bea4cd4d6c2484eeec2cc039fe7d409c9b76be5d25d81ad62bcaab3c79c87f4d9d328bcbe6e0ef727fc97062b18f80236542f0047413819c87d6be
SSDEEP 192:SOND6ygpQmiUydytOCTVgFpOsR0XzPIBSU6:SOND6lHptOCTVSpOsGzTU6
TLSH
T1BD02C735B8682CBB8DF36E45F48B37179FE4116BE9952B84DAE81E1C01D766C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4a888faffe03004cc1de8cc22590a1b546a091c3550afc31a4509a1d631a98a6
MD5 7e0845dab45332173cc253645ad45e4a
SHA1 6969f55449b5c8a74855ea8db29c27137b27cf87
SHA512 ad97429db4057396b907b177d5d03cf55bdc245ecec1b7c6a0700115a354f1697cb73b661b80e54c9e8079e0ae100b38a9944411f841a9dd8d1293ae7f0b93a3
SSDEEP 384:taZcIhsNfHw5qeWOjTVSpOsG5bjkDQVZh6DKhHzoj:tYhPtnAOrjkDQfYGHzo
TLSH
T105828D726C785DB65CF7A545F44636079FF88053D6892F84D0EC6F0D01DB6A82307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4a13cc7af8b8d08d6dbc5fe74096d3cf5a15ae4e53ffba9ec4db259c8da7b7a
MD5 6625f711672f0199e50cff08d3b1ab73
SHA1 924f87a42d2c5b6cbcce279ef6d3b7d315c2f3f7
SHA512 c8938139b4f07ef4de926987f24444a40ba27d2e0c4bc6d969ff03f198589b6888c317861c166ce6884d668d900122d64a640c94b994fbb4fe9afa7d09f2e2d8
SSDEEP 192:SONy6yxQmiUyCyCOCTVgFpOsR05bjHEW3UGq8U6:SONy68oCOCTVSpOsG5bjkfQU6
TLSH
T1D812083578786CB75DE2A545F48732139FA84167DA457F80D5EC2F1C02EB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7574dd62-40b6-4a6f-9615-1f322ab88256.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7574dd62-40b6-4a6f-9615-1f322ab88256.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d53f74ed7d68a51d4b6bc7b42ca6eac43f5c9f9a3cce74a496d67a6949ea165
MD5 8313302f6086426e01c0c3ff0b421126
SHA1 edad94bd18942a4666fcc8f4a7450bd83e1e948d
SHA512 cb044e39fb74782a4cc96f0740eecfd030c97df68df15ac93901aa3c0ce07f012c78c00afe69aee52f48865cec11699f3eda6af26cd2625d4313ac25dfb45feb
TLSH
T10E412958B6EA1048B3B76E1A9BFA682D487EB9732F06946D10110E4F4623E00CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download