af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-e031mo.html
Size 214KB
Sample260930-leddaats3l
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{77C69636-294A-4AA3-B9A0-435BC40B11A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4152	4396	msedge.exe	84
PID 4396 wrote to memory of 4300	4396	msedge.exe	86
PID 4396 wrote to memory of 2248	4396	msedge.exe	87
PID 4396 wrote to memory of 2248	4396	msedge.exe	87
PID 4396 wrote to memory of 2248	4396	msedge.exe	87
PID 4396 wrote to memory of 536	4396	msedge.exe	88
PID 4396 wrote to memory of 536	4396	msedge.exe	88
PID 4396 wrote to memory of 2228	4396	msedge.exe	89
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 2228	4396	msedge.exe	89
PID 4396 wrote to memory of 2228	4396	msedge.exe	89
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 3452	4396	msedge.exe	91
PID 4396 wrote to memory of 3452	4396	msedge.exe	91
PID 4396 wrote to memory of 3452	4396	msedge.exe	91
PID 4396 wrote to memory of 4244	4396	msedge.exe	92
PID 4396 wrote to memory of 4244	4396	msedge.exe	92
PID 4396 wrote to memory of 4244	4396	msedge.exe	92
PID 4396 wrote to memory of 2044	4396	msedge.exe	96
PID 4396 wrote to memory of 2044	4396	msedge.exe	96
PID 4396 wrote to memory of 2708	4396	msedge.exe	97
PID 4396 wrote to memory of 2708	4396	msedge.exe	97
PID 4396 wrote to memory of 1040	4396	msedge.exe	103
PID 4396 wrote to memory of 4548	4396	msedge.exe	111
PID 4396 wrote to memory of 1472	4396	msedge.exe	112
PID 4396 wrote to memory of 2648	4396	msedge.exe	113
PID 4396 wrote to memory of 2124	4396	msedge.exe	121
PID 4396 wrote to memory of 2124	4396	msedge.exe	121
PID 4396 wrote to memory of 640	4396	msedge.exe	122
PID 4396 wrote to memory of 640	4396	msedge.exe	122
PID 4396 wrote to memory of 3912	4396	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-e031mo.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbcb1dc188,0x7ffbcb1dc194,0x7ffbcb1dc1a0
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,8450814220695005615,10212356945568254006,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,803733794615488532,13340414778435848873,262144 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,1724447861744086751,4542620875075394883,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,18077832508222548775,6842202253800285404,2097152 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,16906096930203182402,1641189990868249453,2097152 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4384973985165092639,14019298792533427803,2097152 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6376803798512546573,2257676662477442297,2097152 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8456493732729575380,2403379419424760045,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16680624921887443186,8290558387151675401,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18081913576421442899,11846447437996690639,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18081913576421442899,11846447437996690639,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,2353335176341304719,350030619531054891,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,7426930657997529729,10882452842486198614,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,18059170426921357714,2717644326282643859,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,15618700299900052596,8896757152200873582,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,8803929518377345027,6426195281684853213,524288 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,3098492150041303958,6806809644557034166,262144 --field-trial-handle=2272,i,7770577973467002478,17863718088011769976,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc80169bc781bca61a031e60d2ba24a11304660bcb39d58e941fec9cefc1040e
MD5 7f1592a6a9c2c531e79a01c0dcce16cc
SHA1 8ec13fef14304fb7bde1072206f5c9bcf693864d
SHA512 87c0cd9cb0a20f4b5496af50f4a79dbabc8da5ca97871aebdfb202d0c1d061bdea87be4c406ff3bc884439e289edde2709ea1f89dcdebdb9f7016e5240e7f378
TLSH
T1EB6156AFFF5AD66EF7944070E9EB2B9B393C1DA338C3DD0325ACE67A64463584112064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a74.TMP
Size 3KB
SHA256 9ba4112a6b344e44f22aeae7bd2e7691a77c9213c1b3ef545ca5f539b89ea0d2
MD5 03a67ff464e7e73e925c4cb1ce352300
SHA1 1d1025ecd46f19506f98c435fbab22fa619c6eb5
SHA512 747b5699198c0d2fb50e3942b2f94305647e2ac6608b4fbfa2599dbf7f5f75e15c027f5f2d1025f4b7e8fda8a3e0ec2651a3bcd85cb9ec9fdc79126f41d78379
TLSH
T1AF6153AEFF5AD66EF7944070E9EB2B9B393C1DA338C3DD0325ACE67A64463584112064
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35988b94-df43-49ca-8704-503c27692be2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35988b94-df43-49ca-8704-503c27692be2.tmp
Size 949B
SHA256 67a60181efd19e117276387e8974284046a2f50d4de0e5a50ff7d02bec55d71d
MD5 3bf32bbe7af021e9b1f2b9a3e5cac116
SHA1 fc202890d50f5de2860552ab3f6db1487ee3b430
SHA512 457186c7d2b1ef87954a37ba6e93d46ca9d737428586971768d4ee53e727838a2799684fe05597eb89f835ea2a3c9322a7e5c01c642134fbb263c8d98517c26a
TLSH
T1AC117DB3C3D585AEC91156F0AA24AE2BCE1D0505432C7D19D5E4EF6B93E3079D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 64eaab1557ba6eb7866576843696df53f2a891b51598bddd636c5594370703c4
MD5 901c6c555f7e366f887ed6c4dc11c19c
SHA1 1648f5f98290ff25ae4bc330ef4501e5b6691db8
SHA512 b6da5805e7a7b52199aa8589624ff09963b393ddc07be25ee6f63d7594b86407abb95a499f4092bd7f7e993d59a437a04a1c4ddbb57b6ece0e89e6fb4a456e1a
SSDEEP 192:sxZ9iRzW7/fosJxIdpdEHW6+WNGYrbwDIgrJ:sxZck7/fosJ6GHbGV9
TLSH
T14812B7126E28A97B8CC7E20DBB55BF53E6F9503251D41E58EAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2dd144f3adfdb4319cb64ac63ed7ba436caf0988030ee73215f20d4697cb541a
MD5 b7eeff5df0ce77c3a720ad97c98d815d
SHA1 f2eee56077209dbd5f3c1a56693a2894f5305692
SHA512 702ad0a141854bea75c34f93aa90262b430e1a0c9e7c1db03db70ab419eb3d14b6e1d02c563659b2704449b3cb0ec32af0d41faf6eaf834b9ce02f8154519975
SSDEEP 192:sxZ9iRzW7/fosexIdpdEHW6+WNGYrRwDIg5UJ:sxZck7/fose6GHbGV6
TLSH
T1C622D7126E78A97B8CC7E20DFB55BF53E6F9503251941E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 07f00ffea9fcaea57a19f0027b1d594f215c85ed791aeba92820c6abcd39aaa1
MD5 4e90dd8b1d9b9291387bca7ecfbb09c9
SHA1 7ac4d5ede166b37dcc25b661057f7c68ce08fc94
SHA512 29f8e724b32882e92afeabcdd6a1b649df62fecfb6970391e79e39a450a682017d5e608a96b98e975f950ff9b535dde0814b7a85120583197a1c3640964f45a1
SSDEEP 192:sxZ9iRzW7/fos1xIdpdEHW6+WNGYrbwDIg5+J:sxZck7/fos16GHbGVg
TLSH
T1FF22B6126E28A97B8CC7D20DBB59BF53E6F9503291941E58AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2585e171c77a7acb9534bb1556a1480d484a56058fbb21b6b3e9dc6a85b2947e
MD5 a486652345ed57676ddd94a48a263b1c
SHA1 cdd69c56073debd1ba61c415bbfe729c128f5304
SHA512 0809f82146a5ed4c926f0098248bd354c5e4d4d8cfe7c4adf37ad4d302a93fbda34bba42d1ae1b087cfc32a3341515013810cde4849f01db889a0a6195ede54f
SSDEEP 192:sxZ9iRzW7/fosexIdpHEHW6+WNGYrvwDIg5UJ:sxZck7/fose6kHbGz6
TLSH
T1F522E8526E78A97B8CC7E20DFB55BF53E6F9503251901E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 828bda9c033863b2a946d2faf5fab8a3268f140345e479ead383e374ebedc216
MD5 7000157dd8ca7d4c34e666a7ad104a22
SHA1 33a995f00601716afdb4d40a22989e17536cacc4
SHA512 fa7e1b5b4852773b9a8b67c9e025f40b36f878af8ad8e6df73b1ca9f30c923ccc83c36746fefd927a0c1f9cea740a07b34730524ff3809adbbe37dbc8812ae4a
SSDEEP 768:Tky4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb8roRvm:Tky4J/DWvbtBhu1jajiLm0bnlm
TLSH
T18EC20A3B684CCA7E4FC00A9DED5E6FD73E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a4e1629-6cef-406f-aa53-3bb45696b701.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2a4e1629-6cef-406f-aa53-3bb45696b701.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4f4dc5c4a9ad08249a03615e49be2b4edf95ed224ae6f659569fd540e1069bee
MD5 c4fba8abff4be801f95ead9af5decc7c
SHA1 b11245c562cbdccd41f621979bc785b9fdf69b2a
SHA512 4bbbc8e19c105f1351e1fcee719cbadbf13dd071c246f4a96db2a6b2df9365192eaf87efc11365c481bb9a903f6916910367a9a0e327cc2d2cea889b77f03a34
SSDEEP 384:+ZcIhsNCVhlZM5UHX58EN8vAU0Xf+2kytgOIwZOy7LGon:8hz+6aTcflkyXsgyU
TLSH
T1E0829D32A8BCACBB5CF6A145F08A32035FF98167D7C9AF90C5ED5B1D01AA598131BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0acbf5720591bedf0c61503cce44037a89a0ed14c6617d86a426579e66889ca
MD5 eef7b439478bdc89f22235807204e56f
SHA1 9553944f6c98d64115038e78247da447e3cbf996
SHA512 d39e338ef344e39734574722c64cf56ef2fb96e443b8d21e6d22f034ba4fa823408e4cb38ceaf27e72e9559e39d3e9a49a11591c1076d522c445e316402bed69
SSDEEP 192:1ONV6wlDgQmiUymWW4X58gZxjzorvA7wbDlqYU6:1ONV6kg0W4X58EN8vAU9bU6
TLSH
T18102F935F978BC6B8EF2AE09F48A26139FE5112BE6552F80CAEC0B1C00D765C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 dcc71486509fa64c599dae07e8622574930b41a0a959161931cd25fadd1a22bb
MD5 bb088cfc1b319bb33aac1d79dc3b82c1
SHA1 59db2f498a350296b3a6fca3564047f5ffa37af5
SHA512 5c8d9db3603d2cd88755189e65273e1856e465714a8ea315c31602b8d66166c860d6afdb4ab4ee04acefe94e6ed756468d049b8403254c26b1e52100e3e0f3cc
SSDEEP 384:fGiFiZcIqzsNa8TUNTUlIl0hlZM5UHX58EN8vAU0Xf+2DytgOIwZOy7LGon:ftFQijwgi+6aTcflDyXsgyU
TLSH
T106A27D3398A8DD7FADFA9A45F54A32038FF54167C6C5EB90D7EC5A1D00AA198030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 029dbaf4ca25203742ad4690be53197fc88543b6bd3cb2881ebf42850ca8b232
MD5 665fdbfbc8d2fd9640157463398842a6
SHA1 ade520f56d8bcca62c10ef8f25f171047117d939
SHA512 a5153716a94398df2b70022126dcc78cbbf5a3799e980a8734ce9ec0613bfc42a58ad2243173355aef5f7ad857edc6a1fc0daad766707a1fa9b42c5ba8a5127e
SSDEEP 384:XRZcIhsNC0hlZM5UHX58EN8vAU0Xf+2kytgOIwZOy7LGon:X5hm+6aTcflkyXsgyU
TLSH
T1FC828D32A8B8ACBB5CF6A145B08A32035FF98127D7C9AF90C6FD5B1D01AA558131BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fb5fc17f8e459152eb2e1a0be19b8066e3454620fb56d953f1f5915dfaa80eea
MD5 255e2b02bf6ab7de75c8f114a7f4f46a
SHA1 94a59c521daabe1de65861d179484502e8a7457b
SHA512 4c6f7f982a55a850f26ecf49cd74e40c9cfdf6402430a56650ba8a447b95a5eeafd3d9c6e3ae59c4db2f13915b2f8ca4cd57451275a4aa6f673acff7ccf8a50e
SSDEEP 192:1ONb6wlDRQmiUy9W04X58gZxjzorvA7w0XN7R+2EveTqtU6:1ONb6kvV04X58EN8vAU0Xf+2vyU6
TLSH
T10A121935F4A8AC2B4DE2A545B08B35139FE65227DB897F90C6EC1B2C01EF66C534AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

444ba705-f7bd-4b01-ba20-99ee42bb97f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\444ba705-f7bd-4b01-ba20-99ee42bb97f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a95700c1e92aab4c97627ddf7d9f378cf77bc31324d416cd166b561630f74540
MD5 22048e7007cfd855cb4e1825754c5888
SHA1 33fc0e069b2cfbb5dc9b8f5eb42646a65c7ee167
SHA512 04cdce00a0e24bfe8ac6469241bf88359a2fb5ba3738203853bf640f82a875fd06e54d77a04e768ebc3a293d7b95ebcfe7e66376b0fd9132389c5f83c056237b
TLSH
T115416059A6EA1148B3B76F1A9BF669AD487B78372F0AD46D10110E4F0A23B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download