ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-706kbt.html
Size 116B
Sample260930-l2hlhscc45
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8224EFA1-7B29-444D-BF42-DB9576CA907C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
928	msedge.exe
928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 4424	1084	msedge.exe	86
PID 1084 wrote to memory of 5020	1084	msedge.exe	87
PID 1084 wrote to memory of 4464	1084	msedge.exe	88
PID 1084 wrote to memory of 4464	1084	msedge.exe	88
PID 1084 wrote to memory of 4464	1084	msedge.exe	88
PID 1084 wrote to memory of 3568	1084	msedge.exe	89
PID 1084 wrote to memory of 3568	1084	msedge.exe	89
PID 1084 wrote to memory of 2088	1084	msedge.exe	90
PID 1084 wrote to memory of 2088	1084	msedge.exe	90
PID 1084 wrote to memory of 2088	1084	msedge.exe	90
PID 1084 wrote to memory of 5032	1084	msedge.exe	91
PID 1084 wrote to memory of 5032	1084	msedge.exe	91
PID 1084 wrote to memory of 5032	1084	msedge.exe	91
PID 1084 wrote to memory of 3140	1084	msedge.exe	92
PID 1084 wrote to memory of 4828	1084	msedge.exe	93
PID 1084 wrote to memory of 3140	1084	msedge.exe	92
PID 1084 wrote to memory of 3140	1084	msedge.exe	92
PID 1084 wrote to memory of 4828	1084	msedge.exe	93
PID 1084 wrote to memory of 4828	1084	msedge.exe	93
PID 1084 wrote to memory of 3032	1084	msedge.exe	99
PID 1084 wrote to memory of 5024	1084	msedge.exe	100
PID 1084 wrote to memory of 3032	1084	msedge.exe	99
PID 1084 wrote to memory of 5024	1084	msedge.exe	100
PID 1084 wrote to memory of 3760	1084	msedge.exe	102
PID 1084 wrote to memory of 5072	1084	msedge.exe	117
PID 1084 wrote to memory of 1048	1084	msedge.exe	118
PID 1084 wrote to memory of 372	1084	msedge.exe	119
PID 1084 wrote to memory of 4916	1084	msedge.exe	122
PID 1084 wrote to memory of 4916	1084	msedge.exe	122
PID 1084 wrote to memory of 928	1084	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-706kbt.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa157fc188,0x7ffa157fc194,0x7ffa157fc1a0
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,2221191900349806749,13296849655757329157,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,15598500219859346248,14720544344011049773,262144 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,13924259154356073415,14102316834134269781,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7441700192584341486,10987451383158343133,2097152 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16866792933730377786,16852522547438110770,2097152 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13200859091762285845,834867383680431048,2097152 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,12020942376890873792,16156779855936217188,2097152 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,16057507992094272303,16667980535841654742,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3179850819453695917,7407830093149801563,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6760938373006752884,14207154082896310305,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6760938373006752884,14207154082896310305,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,5545852416329016808,3890657262375391766,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,15790085063202447292,11323420315566926231,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11517639547477514966,16452505691617409684,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2776171595954915942,15093192095614539677,524288 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,8854553122120418286,14683164482842616359,262144 --field-trial-handle=2340,i,7234520194543705592,12128035188620388654,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 79cf986df417225882050e1b2bea1527090d0f9529d550c3c91804a6553f9c8c
MD5 89c3fa3ff660afe8620cc0d7414be041
SHA1 6f71d4c77037bd14582b9654c9d520db22816fcf
SHA512 4de2561186a83b65c6a0dbb5340a41c068a87126314499b2c7a0103049432394545431ff22d3a5710d9f80b4762fbbb0df98e2d758789db00cdf3799afa3b6ec
TLSH
T1916183A959E45A51FBA04C70AAFD32433B3B97F14BC34F821954E978D619F3130D6E82
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 656f56c5150b226e0862a01ef3e06ae2d766d645d9efbe103e1c9d0e51ce278f
MD5 0532f2666a472a9ec880b92db7f9dc5a
SHA1 83aea0f24b593cf7b5fb84520d3dbfeb669dae5c
SHA512 9afd2fc6e6ad703b93906eb44947fc5f6f186f8fe777a7e84408caa0919f8b2fc61fed1b511a32bd35cc97f21c40801da9c10884bfca77f3468dddf318a5f4ef
TLSH
T12F117DF3C3D585AE890116F06A24AE2BDE2D0506421C7C19C5D4EF2793F3075D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ec819ffbccfeb1f4f2d2a366af6ebe275c803270e8038c93d6c57eeb1ed49695
MD5 76927c3597f8493f92ddcc12849a2af0
SHA1 92c2f22cb664bc4942262e254aa03ff7c3fb848d
SHA512 51a4bd5ac8d833575aa64a0dbecd6296f627b14e595c795efb78e5ac7fae85c4aa4445eb725ce192d3ec0df2d483a83b4566ec077b3c64cc30103c7f7044eeea
SSDEEP 192:sxZMpRMWK/f2sA1IdpdxHW6+WNGY3RiXIgrJ:sxZMpZK/f2sAGHHbGX9
TLSH
T19622C7126E38A97B8CC7D21DBA257F53E6F9503261D41E58AAFC861C05E6ACE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dda172d9e6dff2757a1751ca14ce962694739178201c9cec031830d58a71d9be
MD5 cb62b58f7398b73b4cd5b554940301fe
SHA1 9d57e03ac75b0637c0f728de589bd0002b141317
SHA512 6c3ffe0dae5f81a23bb0c2a30b0a636d6b82c24fda432c258f643b531280729d09473edc33db7e3c67b4d80f218ddacf746c11fc0c4b5828408cfb234eff47e1
SSDEEP 192:sxZMpRMWK/f2sl1IdpHxHW6+WNGY3wiXIg5wJ:sxZMpZK/f2slGRHbGYS
TLSH
T19E22D8166E38A97B8CC7D21DFA157F53E6F9503251901E48AAFCC61C05E7ACE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6c5e0bd7a1a98ac3de416d60c84575e75ad6a4034ee6bd6e27ebad04b3e5ffa2
MD5 ff9dbc1db9ddd9c853809d04406bb3ad
SHA1 20ba2f3c9d79e61941bce29c8085a02d1f784741
SHA512 a73590f409caf0507ceefe728b0ecd4649fabd74f8f992c56fea75d0800f7727752e3e253b21069006e62414bb35e2bca2f3df11b2ad8f3d465126d093e9c36d
SSDEEP 192:sxZMpRMWK/f2sl1IdpdxHW6+WNGY35iXIg5wJ:sxZMpZK/f2slGHHbGZS
TLSH
T11822C8126E78A97B8CCBD20DBB157F53E6F9503251941E58A6FCC61C05E7ACE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e9fb98275510ddd5b641a9409c0be01c02192869d40800efc1466defdac412f5
MD5 1a60ae0a0242b82ada7330a4c09425a5
SHA1 67a3c0498d90f300aa3c097f6b94a6ed3b1df6be
SHA512 61825a4f161fb5531606fc4a235c15c07f5b433750c540a01be9f67592810909fcc411997d8060e2757c7272825fb0433d128e7da8c5c3c5fe1660fdbe3abc43
SSDEEP 192:sxZMpRMWK/f2sG1IdpdxHW6+WNGY3RiXIg5aJ:sxZMpZK/f2sGGHHbGXo
TLSH
T1AE22C8126E38A97B8CCBD21DFB257F53E6F9503251D41E58AAFC861C05E66CE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 66cdea28150f657d98400357e91f9a9a61b54925f3f99a0087ae1ae9a169975f
MD5 a4f2c06d58ed65380c3f1631cbfd694f
SHA1 402bee72fa77e96be24d9e6505d4b7d444c0f297
SHA512 9281407a90c249a3ad445dc1ea5c74abcbb49e94a4967e9c1e482c195203c6c73c6990d7c971e403450978e366dbd5bfe9f37d2a0e080d50a12790b3b40bd1ca
SSDEEP 768:s830AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ723rolZMW:s830AbSWvS2l9u1jaLmLZ12kt
TLSH
T1A8C2DA3B640CCB7E4FC01A9DDC6AAF9A6F9C02C796648D4047FA984C02D77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a142c6646f0d033c628a3d76867ea0ce612f2de7c847e0b384a3f18103043d6
MD5 08067d0fa1f6af4cfac5a4f1ce0826cb
SHA1 ab95a848fb02e938c55f3dd9677afa607329be6b
SHA512 37afb0e864fc073bf5066e778ce4bdd5da8668282333b6f31b37d8afa07053768cd3f65b994032d099df044ce63e819b6087d5cbe50201ba5b0d5209f2774acc
SSDEEP 24:K24ngUOItKkhg1eSBudyXhGxeAsIVKahU1+S7YzNfMjyiX5/jTcTP+iIbXTKa8hm:KA5ItKSgIPylrIVKMU4QCIfKHKozyZz
TLSH
T13791CA12727A0241387E691D81A6D76F168239737018EE2B7BFC50A66E67F084DFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34ee24bb-45fb-474d-9607-96c7e5e12f42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\34ee24bb-45fb-474d-9607-96c7e5e12f42.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8ba5c6bee9a42f9a32b897289fdf82c23f84b6c499e6257097358640066395a2
MD5 23cb1f1310b13fb37a171487d67723ca
SHA1 e20403380ed9c3038c9e991c09f73dab896b035c
SHA512 b7da78ed3a879c0f14d0490f52a4043c096a3fff6af3524903966dd2dea129008b0fbac1fa1e11356a08a58f96f7debdcef9c53e1e5beee0b6f323e2a6b28276
SSDEEP 384:aZcIhsNcK9puvB29iX5FF+UcidtgOIwZOyw/oM:YhO8iaZBrdXszr
TLSH
T1B7828C369CB89D7B6CE6A100F54B36035FB84067E6C8AF94C4ED6B2D02EA5D5130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6f3cdec75e9b756fbcf4c5f1df6da2b8760775a6a138cf7caeb0e61f745f9e88
MD5 76c1a6c93df5ce703691100a0add5433
SHA1 ccf29d196ffed99c432259ac784eba60c7119428
SHA512 f237f8d6e0a789c9e3e2a88f5d607f8412a77559ed40a9ead63e34f3541f2f629282a3e5ab4495e12f46be9d670848dbf3eedf7c0fb21946c9039d2f01f1fc11
SSDEEP 384:4iFiZcIozsNU8TUNTUlIlj9puvB29iX5FF+UcVdtgOIwZOyw/oM:DFQUpwgz8iaZBydXszr
TLSH
T1ACA25C338CA8CD7BADFA9A40F54B32038FB44177D6D5EB94D6ED6A1D019A1D8130BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4dba74627a4b154a789947e451fb943e429d018909bf79eda203939a41872ac
MD5 83eaa2b3cf9981d6969d0a94ed47e5d4
SHA1 5fa5fb4ade46bcd26844979398728f4073919880
SHA512 1c0d0dd31376e2c18b20b6ed880eed5741a7d5b67ed93697c3f6ae00a1372fecf4600244956cb9eb9a372ae82fbc6bb34a9776eaf1b84181d9ae4b0aa08c77af
SSDEEP 192:LONm6AmwprQmiUyEg6siX5FSY+U9JipaU6:LONm6ipdw6siX5FF+UqYU6
TLSH
T11D020B35AC786C7B8EF2AE15F54B3B235F99112BEA941F84C9E81B1C01D768C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7016e2d435920660cb6e15bcacbdbff52b101e82d55595d0a20c253fde9b8a04
MD5 20aaacab3a6630faf9a27f747affc9b7
SHA1 a417122258da1cde3bb1154256d6ac2b59345bd6
SHA512 82e9e071bb744102c9944588c9cdaa24cefa0b3c4af0793a4a3002d59493b1735c4026384db5486bba71a436c5f3a9472a5cb83b930dfbb8c5237e50fa727211
SSDEEP 384:sZcIhsNcj9puvB29iX5FF+UcidtgOIwZOyw/oM:6hp8iaZBrdXszr
TLSH
T1D7828C369CB89D7B5CE6A100F54736035FB84067E6C8AF94C4ED6B2D02EA5D5130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f1128cda0bdad21c7c391b29f6a31aff58a26d0444bc1704f91d110ad590268c
MD5 70acbd1a45d3b23589f123eb998a0ace
SHA1 b366b77a797aff7165f5a7d4ec05b22ac6161ef2
SHA512 e09a6f565b854c786fe07436bb1b2137d08eaa24a33e8bf48f6817ffbf104eb53c3a3d446d84ed1fd7a7d3971612704bde45c1b11ac6a528150dc081929274d6
SSDEEP 192:LONN6Amwp7QmiUyTgisiX5FSY+UcXeSlR6qlU6:LONN6iptlisiX5FF+UcNdU6
TLSH
T1A0122A36ACB8AC7B4DE2A550F44735135FA54227EB886F94D5EC2B2C06EF598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb9389ce-2a09-481e-a87e-64dd4743eb14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fb9389ce-2a09-481e-a87e-64dd4743eb14.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e11f6c3474b7f98b80631642b87360d3ac0cf294910bcf92faf2371f928df27e
MD5 48567e976c1332c3bb1c977c9260c48c
SHA1 490d6626ad510db76a5e3264fe45e7946671f5bc
SHA512 b7285a8c3d40efd0893cff0908f94c40e9941a94921161d4d991fb1a6607c137d3ce645f7a2218803eba38850ef06c01e32e3710e0f7870b7450b9a090b7499c
TLSH
T16241285CA6E91148B3B76F5AABF2A46D487B79772F07D15E00410D4F4633A40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3760-169-0x000001E250530000-0x000001E250679000-memory.dmp

Download

memory/3760-168-0x000001E250530000-0x000001E250679000-memory.dmp

Download