5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-c5xz78.htm
Size 194B
Sample260930-nc7kfssgkh
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{F50D188F-9A44-46F1-913B-CF455B76F66F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2176	4732	msedge.exe	86
PID 4732 wrote to memory of 1824	4732	msedge.exe	87
PID 4732 wrote to memory of 3740	4732	msedge.exe	88
PID 4732 wrote to memory of 1824	4732	msedge.exe	87
PID 4732 wrote to memory of 1824	4732	msedge.exe	87
PID 4732 wrote to memory of 4080	4732	msedge.exe	90
PID 4732 wrote to memory of 4080	4732	msedge.exe	90
PID 4732 wrote to memory of 1880	4732	msedge.exe	91
PID 4732 wrote to memory of 1880	4732	msedge.exe	91
PID 4732 wrote to memory of 2920	4732	msedge.exe	92
PID 4732 wrote to memory of 1880	4732	msedge.exe	91
PID 4732 wrote to memory of 2920	4732	msedge.exe	92
PID 4732 wrote to memory of 2920	4732	msedge.exe	92
PID 4732 wrote to memory of 3032	4732	msedge.exe	93
PID 4732 wrote to memory of 3032	4732	msedge.exe	93
PID 4732 wrote to memory of 3032	4732	msedge.exe	93
PID 4732 wrote to memory of 3284	4732	msedge.exe	94
PID 4732 wrote to memory of 3284	4732	msedge.exe	94
PID 4732 wrote to memory of 3284	4732	msedge.exe	94
PID 4732 wrote to memory of 1324	4732	msedge.exe	100
PID 4732 wrote to memory of 4844	4732	msedge.exe	101
PID 4732 wrote to memory of 1324	4732	msedge.exe	100
PID 4732 wrote to memory of 4844	4732	msedge.exe	101
PID 4732 wrote to memory of 4572	4732	msedge.exe	103
PID 4732 wrote to memory of 3332	4732	msedge.exe	112
PID 4732 wrote to memory of 4284	4732	msedge.exe	113
PID 4732 wrote to memory of 3516	4732	msedge.exe	114
PID 4732 wrote to memory of 4012	4732	msedge.exe	123
PID 4732 wrote to memory of 4012	4732	msedge.exe	123
PID 4732 wrote to memory of 4552	4732	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-c5xz78.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbb40bc188,0x7ffbb40bc194,0x7ffbb40bc1a0
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,8720094605853105859,14688402370665344830,262144 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,973589128170633430,13815514294283803274,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,3779303596218247628,1797096105702822824,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16228734315042691792,11381499961762218686,2097152 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17210598766635810942,7181755194269566425,2097152 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7085696668090226415,13342760750822130915,2097152 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,12251295661668753922,8995717518690059120,2097152 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17717077669394333472,366984721353895394,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11684825400338588023,1272446150514214216,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9885165314153846508,10211455875689217563,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9885165314153846508,10211455875689217563,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,15069503652123649926,14053218676566280844,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,972145715610104919,1076669126788564995,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,15780138106053967128,17913063248645824666,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,12206716204099142475,8402702903339570461,524288 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,5825505790666863520,13137722558614533361,262144 --field-trial-handle=2772,i,6554006897820902650,12687537572254271532,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 113f379840a66bc04e61d63064bbc2c1b97fc676334ca8cb5d9a96845ab300f6
MD5 2606894ea99d3de95cf3bfd0ccf04a48
SHA1 b67fe4027c44e47136c7d3513d8120391b551621
SHA512 444648419a4ca4c9b7a3420c58076fe09be5d644fc3c1701581b105c8f1cef27c78ebcfdb7bd3a451400d5730ba40dc03353db3058424720a5b0d40d2fad1cc7
TLSH
T157615F85E7D14020FB991E729DDDD28B3731328F5A8B5DD23158E8B4C8C27512D62CCC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6a9004c3c451eaab482da08627da70b3144b90896873388408157352c3599a81
MD5 c791a8197ece83d06474e91b8481b941
SHA1 123f556bd3cb33bc7503433fd156f5dd7a33b7e4
SHA512 968cb0c17be40e1b4b9c3cd4f60fb61676d0b470c06a7ce82a6a683e8f8675fe72823de123c3aa407c2a659a00b66d7fca569b3ffee614e5e5a1a331c1cfc586
TLSH
T14E117DF7C3D585AE890116F09A24EE1BCE1D0506421C7C19C5D4EF6B93E7475E00559F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 91989c65b8979c9fa43f742a055ffffa60d6b0be703a3e7272f144a9e0802b0d
MD5 4bb0464f85a89f528a2a4f6287faeeba
SHA1 fead37669df7e0a48978e2f5d29928599f9c17aa
SHA512 8ba7bd4362474e0d227b1d964164cc80266e0af28c2882cd44aad578c8d93c29af7629c66a6dc3192d25af6d6ce2d2716eb4f9d5cec4525e18239d0f6395f221
SSDEEP 192:sxZkRbWT/fMsJewIdpdEHW6+WNGYgUX5IgrJ:sxZkMT/fMsoRiHbGY9
TLSH
T11022B8526E28A97B8CD7D20DBB15BF53D5FA503291D51E48AAFCC62C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 53698d551570a117168b077fc3b77cb6b969bb966226fe5bc1a6e193c8c80920
MD5 fb1b52e2e3133ac23cbd159a3f4112bd
SHA1 e76037bd018c0e019a513769a0b1d892b22f20d2
SHA512 f5da1e0e34ff9c78bcba7739be77a121d6e3c27f9f50b383c8ab2fad327568d9e654f9fbeafdbc311616a9c4e65e22c5dc2ceed585445cf5f25fb42e49ab659a
SSDEEP 192:sxZkRbWT/fMsNewIdpHEHW6+WNGYgEX5Ig5qJ:sxZkMT/fMsERkHbG4k
TLSH
T1E022C8526D28A9BB8CD7D20DBB15BF53E6FA503291D11E48A6FCC62C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1edae09802fa861e714a0b22d9bc073742e207d1d74afc5d86ea92bb60e4ef2e
MD5 069efa754831b2f61239705e7d182f77
SHA1 f7b5a6d8dd7deef050bd9848bb14b9f40d1c0aa7
SHA512 11f94467053601443e1584f83b05b05752ed709651021641df31f08a0a8d95c90ccd6b452fcbe5b05fbb99482669719db6dc458d602db6ab479a369b9387d466
SSDEEP 192:sxZkRbWT/fMsNewIdpdEHW6+WNGYgWX5Ig5qJ:sxZkMT/fMsERiHbGak
TLSH
T1A022B8526D28A9BB8CD7D20DBB15BF53E5FA503291D51E48A6FCC62C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c6d5cab56b0e4f6a2251240a659b09996798977bdae4d922f651a6f4998c8324
MD5 4ebfcbf418372c52849ffbe387057f94
SHA1 7e5bcd68b922da7c5a8ad9b199f89c988bebf426
SHA512 ddb190e20e0a48d0cc204877b62f1ce2c77369d7fc95266449943d3c98da916fcd7097257113d102ff11e9060b33a4805b91ae5a96d794a0c8614cc7052a9bb4
SSDEEP 192:sxZkRbWT/fMsEewIdpdEHW6+WNGYgUX5Ig5IJ:sxZkMT/fMs5RiHbGYm
TLSH
T11322B8526E28A9BB8CDBD30DBB15BF53D5FA503291D51E48AAFCC62C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 555b629bb7715af1e93ee7b3475a8123379121969077057de1138644a419f76f
MD5 cd14ff099e9e6485382455b9d151a0de
SHA1 aee7dc1e53827f8c147dce01e7092ec8644237bc
SHA512 b2091024628f085f0f40ba3f57a67d6031400c989d77c0ed99c41782606edf7eebf4de0cbcf1c91a1b12f8e9fd3715097b87e291c7f56fe92b9111bc00255ecc
SSDEEP 768:qnichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzZrow4c:qnichfPWvPZplu1jan+LKgzSlc
TLSH
T153C2FA7B640CCB7E4FC01E9DDD1A6F967E9802C7A6588D4047FA984C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f656e00c3f7e5ce98bafbb048c21ab1161cb606986d0d98038df826d61bc141
MD5 6dc1db47dfc5adc596d1e10dc36ae388
SHA1 d435f354b0d560127c44b34bacd89647636689a8
SHA512 382808651dc83b103af849427a2bdf7f4840cf7c7f6b6f0ae93e1ee9ca00fdc051dba8d1e5d821aa4b2104503197766f2f12d913d72adc6932ba379a1a2ee335
SSDEEP 48:K0Ezy+suCLbyB6ISWLK9y1ALxEbYJqC4yLaFoUaYoZbED0ISMZK9w1qZxCJY7cMB:KQDOK8oGWdGKewRD2K0IeU
TLSH
T17C91EC4231BA0240397D698C96B8C66E064131F67059EE7B7EBC50F19E6FE090EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a8e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a8e8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 62e6b8e8ced9623ccf3bba492cd8cc4f9be13d3f00f36dc82e2ef0ea9520975f
MD5 70e52c4e8200e6c29fcbd422a074a7b8
SHA1 0e9cc5b14e49b3a6d057541086bd400fc18659ec
SHA512 d736d057365f0a889e7c2ddd7d63690564fe528ae13b7e65c3319e6a111ef9589ad9bbb8cb7b219628b46e7550512a2a7ac947afc4767bedbce78b66f5f41e37
SSDEEP 384:lZcIhsN34LPz51AHBGYX5EofsQZaCvEtgOIwZOyanotN:dhLQhGYuofs4hvEXsRcN
TLSH
T118828D7698BC9CBB6CFB5551F58B36034FB8812BE7C56B9494ED2B1D00DA198130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7d52f5a926d3061c2129a924ce14c0fff4a7046c057fadc8644716c5995577f4
MD5 212a9f40ebe37a416addcca2aae24812
SHA1 78bc6ee63932ee73eca69f13cffe9edaacafd928
SHA512 edcde21ede6c2232326fedf91ca1ecac30039333543ae183f6fa6a04f318d2e03c4d708ad7b671e85b13089ffc66a0ee20acf28851203c67ec96ecc8c3370df7
SSDEEP 384:riFiZcIRzsNJ8TUNTUlIlBLPz51AHBGYX5EofsQZaCREtgOIwZOyanotN:GFQhYwgTQhGYuofs4hREXsRcN
TLSH
T185A27D7798B8DCBBACFB5B45F94A32038FB4812BD6C5AB94D2DD5A1D00DA1D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3a0527481f4d967d597074e651d955989d9462bc520776b7d8e350e2cb9e06e0
MD5 a0b41b6a020ce8ccb18cd4829bb91bf6
SHA1 7c075b5dab4c76b20a8af29f146f9a11f481f18c
SHA512 c038010e4e5c25bc72250db4be0c00fd4bdc206e6f432d0153d05498321f681198c7d71d80b3d8fbed90181aeb4daaa14a57b1d5224c5cdf346e0aec610c1266
SSDEEP 384:KZcIhsN3BLPz51AHBGYX5EofsQZaCvEtgOIwZOyanotN:ohoQhGYuofs4hvEXsRcN
TLSH
T194829E7698BC9CB75CFB5551F58B36034FB8812BE7C56B9494ED1B1D00DA198130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1eaed3d017b7ede483f9cd9ac1e6c3a3ff52aba98a284d32013720debfb0022b
MD5 bbb4eb61f371df6f773b508f175fb81a
SHA1 9a3a17c71f0cf65a3bb2d2fb537f4b799736002d
SHA512 8707c12db463b7f277c945d57d88760aa1ce89f2afbd61f2eb0c0e45358ea085af8225f378f09276898ab8f3c50cc84c73751b2934032208d8a099071cf3864d
SSDEEP 192:LJONi6DphzqQmiUyV91wGYX59ezhCfsQZaCykIIOq5uU6:lONi61ge1wGYX5EofsQZaCDEU6
TLSH
T113122A35A8B8AC6B5DE36951B48B35034FE8422BEB897F94D5DC1A1C00DF29C630B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba9e20ddeeee7a658fe834bb0d82c87976f52dd23c84f4d58e17393e0977027a
MD5 1af9f5830b32b640795cc5eec9724224
SHA1 7c14403370f0f75c19a03a1c25d6504b48cf8a31
SHA512 138d91877cbbb2dcedcabdb30ea51cbeac37bd5c1b075ccbde6d79ce7e03d8dfbc5c1658a9820e3ae9b5e2290cb236168dc906e70f756fc83c15193b8286df62
SSDEEP 192:LJONv6DphmqQmiUyc9q8wGYX59ezhCfsQzkk7HvU6:lONv619dRwGYX5EofsQrPU6
TLSH
T17002FA39E8787CBB9DE36E45B58B26135FE8112FAA902F84D6D81A1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 544f24bbfa0219f9b30d880b48c8fb8e19bd1d4b77372c8d3e9cd1cfd283f42c
MD5 1d43ef403d6eeb0c246526541c2cfa62
SHA1 207fb27498aada755d4312f9692003f0cbded688
SHA512 bc38f1dcd50926821f4a34c2dc4fcee6771403cd6f70de58748bc2b67ba553815c89b0b51d471a03737d9f1dca62f1808e413539710117014184048244a57661
TLSH
T17A411A4CB6E91148B3B77E566BF7686D887BBC372F06D59D10110E4E0627A80C861B37
MD5 SHA1 SHA512 TLSH

Submit Download