6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-h0uant.htm
Size 34KB
Sample260930-ljfdfatvb1
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{E01F6469-C814-40E0-BC56-A94502A5C342}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 5036	4068	msedge.exe	89
PID 4068 wrote to memory of 4424	4068	msedge.exe	90
PID 4068 wrote to memory of 1348	4068	msedge.exe	92
PID 4068 wrote to memory of 1348	4068	msedge.exe	92
PID 4068 wrote to memory of 1212	4068	msedge.exe	91
PID 4068 wrote to memory of 1212	4068	msedge.exe	91
PID 4068 wrote to memory of 1212	4068	msedge.exe	91
PID 4068 wrote to memory of 3196	4068	msedge.exe	94
PID 4068 wrote to memory of 3196	4068	msedge.exe	94
PID 4068 wrote to memory of 3196	4068	msedge.exe	94
PID 4068 wrote to memory of 2280	4068	msedge.exe	95
PID 4068 wrote to memory of 2280	4068	msedge.exe	95
PID 4068 wrote to memory of 2280	4068	msedge.exe	95
PID 4068 wrote to memory of 2892	4068	msedge.exe	96
PID 4068 wrote to memory of 4580	4068	msedge.exe	97
PID 4068 wrote to memory of 2892	4068	msedge.exe	96
PID 4068 wrote to memory of 2892	4068	msedge.exe	96
PID 4068 wrote to memory of 4580	4068	msedge.exe	97
PID 4068 wrote to memory of 4580	4068	msedge.exe	97
PID 4068 wrote to memory of 624	4068	msedge.exe	100
PID 4068 wrote to memory of 1076	4068	msedge.exe	101
PID 4068 wrote to memory of 624	4068	msedge.exe	100
PID 4068 wrote to memory of 1076	4068	msedge.exe	101
PID 4068 wrote to memory of 2212	4068	msedge.exe	105
PID 4068 wrote to memory of 2528	4068	msedge.exe	112
PID 4068 wrote to memory of 3428	4068	msedge.exe	113
PID 4068 wrote to memory of 1668	4068	msedge.exe	114
PID 4068 wrote to memory of 3880	4068	msedge.exe	124
PID 4068 wrote to memory of 3880	4068	msedge.exe	124
PID 4068 wrote to memory of 1268	4068	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-h0uant.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffe9b9ec188,0x7ffe9b9ec194,0x7ffe9b9ec1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,3777182855740950288,2923134779917605809,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3951217610391234916,14870253672243711014,262144 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,6110995324323938208,9649590472417722163,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3009220845660107120,2450440474563095274,2097152 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9156273623137055784,11683529377960122532,2097152 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,12016823168151934128,7858149696546666171,2097152 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,8059623628352240304,7206441083567968711,2097152 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6330628913267957071,10423727277356120931,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,18196749702525793729,8461835179658491897,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4833052554902370573,5762668825685585924,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4833052554902370573,5762668825685585924,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,12960261668981165534,4190822248286473537,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,3932185759471833050,1218826091097242385,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7628368597267493420,14882634026023928893,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3084,i,8471366555466369564,15469043250811584400,524288 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5800,i,9964706373392396701,11959196140216176437,262144 --field-trial-handle=2256,i,7738849198287975185,13542405587653535483,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0d8cffaf8db3e8a9b38add81975c175548a67697b96016fc3c2657a7dd8db83e
MD5 b22047c4e6d756a3b34067b5a8a8e83d
SHA1 36bfc59cc8920d4cbc7f84940e10e68416b0037e
SHA512 a55cb728fc70632969b5cee3d4985e814efa9f5e6521b334542f539f518c921e0173dadfe199f1a2575ac2eaef4fb8a1316d320649c300d6bc625ec76237df80
TLSH
T1CA516EBA454A48D0FF5810F0DEE889873EB8A97D55C3CE0A37B0DCBAB9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592948.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592948.TMP
Size 2KB
SHA256 5b631f9999d2080180c458cae4f870e132bdf0eddca6df41d44899be5cca5518
MD5 256621dcaf1dffad36bb9e435cfb79d4
SHA1 f6cc4e135dcf64610013247cc3e4dbf39afbb741
SHA512 1ab427f178a220c6670f1bb49d2c9c1a32135497fae9227d9e3e9ebac28a7992d547c14b91bdc9f1a53c0d82d5b8343ac5c70c8974be094dcf18475407e1d180
TLSH
T1F0514FBE454A48D0FF5850F0DEE885873DB8A97D55C3DE0A37B4DCBAA9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 aa85d13d7fcc30d6d6c849392ccfb5437f5554da7334b5294b0d33b6568ae681
MD5 3b1b4169aa80ba3651127430496e577d
SHA1 64bb3b0cc7a9f6ce1be55103107f9819650799b5
SHA512 7e685aa9a8b7b2e44e23228f1b015927a0644f0abef117788c642434379ae98e07a72c8fed820e317366296b0fbd2a59fedec05c4772d24e044b44eb64f3c483
TLSH
T1FF117DB3C3E995AE890156F0AA24AE2BDE2D0506421C7C1999D4FF2B93F3075E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8f4e5ee55c79444ad9b4eb1cbe103f4eaa0a33233d9cd9e2a75fbf8505719551
MD5 55ea11a86356427b142a6bf42778e8f0
SHA1 505dde42d0fb95a0817772c762607da8ceea0587
SHA512 c646c0d1c4ea12d6b1a30cfa41b999ad180ac151e92c539077abf485fab6ddeab3bc003bd9f0ba3c617bed8775771b45e77fd0798370e8bae742e0c1474a237b
SSDEEP 192:sxZ2RqWeb/fHsfvFIdpdgHW6+WNGYrbInLIgrJ:sxZ2beb/fHsX2CHbGV9
TLSH
T1A212A8126E28A57B8CC7E21DBB59BF53D6F9503291941E58EAFC861C04F7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4f631021f3adb47222957d579c0716d740a6a33f1fee649128cc016c55b789bc
MD5 288ec4700de06ef326cb7fe30e40d749
SHA1 d95f4fe1c1023ee0ec9bcd67ee4ab01345560d05
SHA512 0d4e86ddbff69d0aa484107970d404ce39c68fab429330fafe78d9066737968ca013a0ef9e3f6dffdf1e0377a8d17d508a48853fab0917a23885fc3daa6be956
SSDEEP 192:sxZ2RqWeb/fHs7fFIdpHgHW6+WNGYreInLIg5lJ:sxZ2beb/fHsT2AHbGod
TLSH
T10A22C8526E28A97B8CC7E21DBB59BF53D6F9503291941E4CAAFC861C05F7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 de906005a771dfb7a36ef01154b44ccad4fb56f2745b94b89ab75a9f3776a80b
MD5 fb14cc04cba2e71c75850f634551d6dc
SHA1 339788f8267ee24bfe5bd5230455a71e5daea567
SHA512 d790de8bf06e349a763c2853f4dc7adef125ad361011de150e2a013082f975ef3b5033d721d4861db068f47a2f47a871780ae645f136e0bab0e9c024d2dccdad
SSDEEP 192:sxZ2RqWeb/fHs7vFIdpdgHW6+WNGYrbInLIg5XJ:sxZ2beb/fHsr2CHbGVb
TLSH
T1E322B7126E38A97B8CC7D21DBB59BF53D6F9503291941E48AAFC861C04F7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 af74df55a52b87d362f5b238b32a717dae4b00ca5d35cf53816288d38ee154e3
MD5 f91c7a7bba53dae0e58442ae4eef92af
SHA1 543e480e95794309f7e29e72f7e96cc262ae0a66
SHA512 29ceb5273e42dcb531ea2c83bd9dbbe0cf32ffad2bc7815d6e80e7863a45961c594c885e6b758fb3b545a09f9dc53496bf10a0ca621371cbdc45bc008c9d33ca
SSDEEP 192:sxZ2RqWeb/fHs7fFIdpdgHW6+WNGYrUInLIg5lJ:sxZ2beb/fHsT2CHbGWd
TLSH
T14C22C9126E28A97B8CC7E21DBB59BF53D6F9503291941E4CA6FC861C05F7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 51b053db4da5b9a05f1c74cb28fc70cd96869911dbd7ef95992c6e80b7b67226
MD5 e9bf99e043ab857470051ad3a923f95e
SHA1 b0a3f89dc7ebadc8ef91ce9bda8ff51ff6cddc56
SHA512 94972b0ed0768e8ce976d561c878ff53fa6cb5e967a546b7a22c741d3c1d794f334645666d93e698b54cd6eae618bcc10d6edc0553191ec70d7b4bd2709aac28
SSDEEP 768:o1y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbHroRDW:o1y4J/DWvbtBhu1jajiLm0bURW
TLSH
T1D0C2FA3F684CCA7E4FC00A9DED5E6F973E9802C796948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45325de8-b23c-461f-844b-04f1699d9194.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\45325de8-b23c-461f-844b-04f1699d9194.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2568c4dba7d7dbc58f6149842c0fe3b0624b5db5d40b68c92bde7553ae5143bc
MD5 3356a81bf1a7dd084cca101a14215a91
SHA1 ee5fd2d4adea1d643fc9bc03f54aaa02eff73867
SHA512 31d19c8d14e7a9a6b6742166b60e239502db6b9d83c5dbec917f82e4c0c9703630b0b1a75c27c88d02df2a7a3b065b09d3c12acf8371ba82dbebf2fe652c3655
SSDEEP 384:UZcIhsNNbQZRi7HX58EDOJbAWWa+YtgOIwZOyKLnoK:ShJ6Da4Od2YXshz9
TLSH
T149827D32A8B89D775DFBE145F54622038FB49067E284AF98C5EC6B1D00E96AC031BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b11e7c385db695a0cc03adf4eb511f0794cb9bac02fc16bd72295cd9a687b4e4
MD5 bd80f92907a8a70fd3fa3319681a2f97
SHA1 62170814a871d173439ef30f97ad90cfcca3b8f4
SHA512 8995f12fa6b33558b74426a2f5d8f0481bf007568b35cd5aa32d3d76f9bd675412a9aa76804e11a4f5d4926118bd2b6139d74104b2ac2a018282dda2cdec46cc
SSDEEP 192:1ON46wlDgQmiUyxDW4X58gZDOKaFbAIDlDQUU6:1ON46kgqW4X58EDOJbAsDU6
TLSH
T1E402E935B9787C7B8EF2AE09F58B26139FA5106BE6512F84C6E81B2D00D765C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 02bf198232cab7114949e54827ebd03818c56ff7c16fc406e7fa53165bd5dd9e
MD5 ff1d9ea7742b60d0d50400b350a8c216
SHA1 bc59a615f843310b6030db6f0cc1831576706681
SHA512 ccd3fce7c6ca16fa187686f43ba3e1215412275408f3a9166e69664a1992065098094a31b476e5e1be6ce0a2e2bb10355ab8240ffb9f449b89a367f57026918f
SSDEEP 384:eiFiZcI5zsNX8TUNTUlIlKQZRi7HX58EDOJbAWWalYtgOIwZOyKLnoK:1FQ5iwgv6Da4Od9YXshz9
TLSH
T155A28D3398A8CD7BADFB9A85F54A3203CFF59067D585EA95D2EC6B1D00A61DC030BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 26d37dd16b4ab28e8b7a69be2051f5ee9e14afcf813952bfe959f419cf9383fa
MD5 69242778955c2ea126e5733df30ad463
SHA1 c4be83891d3dfee6eb99828d795014a7c212f208
SHA512 254eebc27d65cc76f6df89c53b7e2721898a568e00ea95f40be9aa54774830dafabf47b067715569b16786f263770c58eb677e5d359c4371d5a179be76d6fbf8
SSDEEP 384:iZcIhsNNKQZRi7HX58EDOJbAWWa+YtgOIwZOyKLnoK:Qh+6Da4Od2YXshz9
TLSH
T1FB827C32A8B89D775DFBE145F54622039FB49067E284AF98C5EC6B1D00EA6AC030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d500ee37347c4b1d9bf8748bb85d1850e32c683c8ee3c2e50459b40b88a95d37
MD5 4a7e6a79195d701ab0f431a6045393fa
SHA1 9f7b33f9c3d0b9ae2706903f1327ed8d3074f6e8
SHA512 d1dd209cb8db4b17b6cdca1022b4a46e1bf4b0b467a58ca000e08f4add5751eda02cbb49d69778da49c76d685bbfe893c1325c2cb862c7b7edee57778f0f1edd
SSDEEP 192:1ONo6wlDKQmiUySDZ4X58gZDOKaFbAWWayveQqS7U6:1ONo6kGjZ4X58EDOJbAWWaVYU6
TLSH
T1D5122831B4B8AC375EE2A585F58732139FA55167E6857F94C6EC2B2C01EB6AC130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65e308a4-3102-4e27-a3b8-45121eb5efb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65e308a4-3102-4e27-a3b8-45121eb5efb0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db184f2bf96406d75afbc7dc1d1581733a21af2f7f5adb71aa08364750f38251
MD5 89729c06f0082e9eda3cb7f3523fe10f
SHA1 6ff07a6298aa5ff62e57050b6ec6a5989b9337fa
SHA512 c6f663feb65c32f437cd02af094b642e488569d230459b1b34a74e7a43bc5101a473f0a16bf05f7b64ebe1d439124327da15a2724105b39cb8af41f09a9124d1
TLSH
T14241F94CA6E91148B7B7BF166BF6586E887F7C772F06C45E00110E4F0B66A44C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download