bcd9b14cd2299ebb830ade106e5713ab2c04b7c4d1429dc5d838e62c4d3b51ed

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-it
resource tags

arch:x64arch:x86image:win10v2004-20260911-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.html
Size 4KB
Sample260930-nfad5ashnf
SHA256 bcd9b14cd2299ebb830ade106e5713ab2c04b7c4d1429dc5d838e62c4d3b51ed
MD5 e1c790d9f908c7ed6980452c06c62811
SHA1 62f859917533a29000bf94bf8d856c21d43474d8
SHA512 4484d2d1363b655e2c1cfe6cdb41b34bf6a4eea39ac616e6439d49f4af09b219cc58855d579567e11b764ef6eeb8bbba51e33f213438a7d98504d71bb6b22829
SSDEEP 96:WFexp0CkJfAA2OaYTVAPVsD4JEAf2sD4JrQAIM1K7KEvSA0+9OFeb1:WFqp0CMxSKU/UwWFEwwOFG
TLSH
T1479152F352812C3B1993B7B59033FB5DE1D74181CB835696E8FF029B5385D82C45398A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{30BC2105-A45D-4206-BAB8-233C65F0478B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4296	1012	msedge.exe	87
PID 1012 wrote to memory of 764	1012	msedge.exe	89
PID 1012 wrote to memory of 3824	1012	msedge.exe	91
PID 1012 wrote to memory of 3824	1012	msedge.exe	91
PID 1012 wrote to memory of 4672	1012	msedge.exe	90
PID 1012 wrote to memory of 4672	1012	msedge.exe	90
PID 1012 wrote to memory of 4672	1012	msedge.exe	90
PID 1012 wrote to memory of 3452	1012	msedge.exe	93
PID 1012 wrote to memory of 948	1012	msedge.exe	94
PID 1012 wrote to memory of 3452	1012	msedge.exe	93
PID 1012 wrote to memory of 3452	1012	msedge.exe	93
PID 1012 wrote to memory of 948	1012	msedge.exe	94
PID 1012 wrote to memory of 948	1012	msedge.exe	94
PID 1012 wrote to memory of 2992	1012	msedge.exe	95
PID 1012 wrote to memory of 2992	1012	msedge.exe	95
PID 1012 wrote to memory of 2992	1012	msedge.exe	95
PID 1012 wrote to memory of 3164	1012	msedge.exe	96
PID 1012 wrote to memory of 3164	1012	msedge.exe	96
PID 1012 wrote to memory of 3164	1012	msedge.exe	96
PID 1012 wrote to memory of 1236	1012	msedge.exe	100
PID 1012 wrote to memory of 1236	1012	msedge.exe	100
PID 1012 wrote to memory of 1100	1012	msedge.exe	101
PID 1012 wrote to memory of 1100	1012	msedge.exe	101
PID 1012 wrote to memory of 1980	1012	msedge.exe	104
PID 1012 wrote to memory of 1408	1012	msedge.exe	117
PID 1012 wrote to memory of 3592	1012	msedge.exe	118
PID 1012 wrote to memory of 2160	1012	msedge.exe	119
PID 1012 wrote to memory of 1340	1012	msedge.exe	122
PID 1012 wrote to memory of 1340	1012	msedge.exe	122
PID 1012 wrote to memory of 4376	1012	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff59e8c188,0x7fff59e8c194,0x7fff59e8c1a0
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,6748180055856836794,8986846855917368177,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,2248588332209428061,5714324492862486522,262144 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,9251927198319883178,17683588286852226421,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5482264855089379628,1380961285871064272,2097152 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17962636020848507445,9360114502805923061,2097152 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,1241618192177704781,11384458089975520657,2097152 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,6734494181835945561,10628160565336899112,2097152 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4169092032093983090,8809502651516747481,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,232999286373905120,8330985727463760858,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14394093710718716737,15340733007803908925,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14394093710718716737,15340733007803908925,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,17180931669656336380,11205388070577930151,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,8467525064704877719,15813859133476676883,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,9627602273224527219,4812917715699188754,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,14369573389520898982,10941154907048719831,524288 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,5211778676128141682,16424499296130690896,262144 --field-trial-handle=2192,i,16423891211957634353,12975540410865940182,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0282b432bc43338ec0d3782cf4794e56888ecf0ffa81ae4c09ef89576d39c066
MD5 a408634b2f3f19e827356dd6e493accd
SHA1 df4ee137043c6b891c88206c01af1184c5402dcc
SHA512 2f6110fdab11e2a6e2d71c9d6fbc6c98d35d590cd39b634109b99854404e5ce4e8bb1af6c6b929e51930e7bc09d797736c9e723068af9325ad05c7f698df0aa3
TLSH
T144615FA1F8810C62FF6968388AC924B7363CDDB095C76F9C83A0D479AF967907300C5B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a25.TMP
Size 3KB
SHA256 3073f8d372e35b75761abd2364dcbe19d597ccb40785715cecce03ce28c8fecd
MD5 24b3e1e38ef87c0b12a0713bc5d2cc28
SHA1 239f33eae7dda9840004ef0e929e2989d4f94909
SHA512 47a688ea3e4abdcd0352780a03beaf12af2b8e25a7dc23da8537812d79c78a764b39fc6ad9e0798406d328c9a20436f6c7de171e203acee3c5c087c4e6d6b722
TLSH
T1F86160A1F8810C62FF6968348AC924B7363CDDB095C76F8D83A4D475AF967907300C4B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 263e5b03cd5aa10fba0ab5da8d9cd453340955834e5fe47e549000a222c3d75b
MD5 2627b7a25be8d18a8a8eb0560e4c8f2e
SHA1 314e447d4380759942c1194a5c412fe0eb243bad
SHA512 aa736b37f7ade8340abc11fcd5bf35c1e85473189898fa593fb33b51d9ddca75750f726e3b235c2355912bd4264f18c4d5b1c73fee4613ba54c6491b9f152ef4
TLSH
T1A4319DB6C3D8477E891552F49A256E1ACE1D054B422C3C5A8DF4FF1F63E24B0E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6eb865b438b7fb64e4c9442827f4755e245b4eb82dbc1954e75691d85e573a7b
MD5 7a0973f113741908998217ea1be0f266
SHA1 eb1b2fc8c759c515dddc0f9343480dbbcb2c161e
SHA512 48f4c0bca870f308336b118d3d99ad2f27591c6a89d2ab96a11eda8dc770929bacdca3f49d885ac4d8f01a897f95a87ba2fd6809615b704e2fcc83b3039ccc25
SSDEEP 192:sxZ5LWf/fJsGQIupdUHW6+WNGY3RchzIgrJ:sxZ5qf/fJsG4OHbGN9
TLSH
T1C012B7516E38A97B8CCBD21DBB19BF53E6F9503291D51E48AAFCC61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9f1afc50530f3956448012657f1d9747aaa3dfbc4e820323bd536b188e0f5192
MD5 e98d0d3fe02ee9bcb9862b4d7668f6e3
SHA1 472db675f248a4f7279b7327bfd219b16ed5937d
SHA512 2c9d791f2189fee88718e9c91cd77c9302f1c51946fc1361d381885ba8895f41a4aaab23414d24451d08b12523f59d91dcbb218c8803b53f0c85a95a430e9c1f
SSDEEP 192:sxZ5LWf/fJsIQIupHUHW6+WNGY3eNchzIg5PJ:sxZ5qf/fJsI40HbGBMH
TLSH
T1F522C8526E38A97B8CC7D21DBB15BF53E6F9503291911E48AAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9b1b651d1e8f0d64bdb4a65a7bae4cbd1258182ea915d24a1af595c118d0f042
MD5 daa86c901b539803d0bce494ca5ce484
SHA1 a936ba6077ff4101988cdd58858291a00fa28eb8
SHA512 71172adb7c959e168ee1687fa8b4eed2c56e4c11d30d6302ffc51c04f05420a865be3cd80e6fae684b93127b25810db6d3832493822bd6662e5b428eca49c7f6
SSDEEP 192:sxZ5LWf/fJsIQIupdUHW6+WNGY3LWchzIg5PJ:sxZ5qf/fJsI4OHbGQTH
TLSH
T17B22A6516E28A97B8CCBE21DBB15BF53E6F9503291951E48AAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 933a31ee7a1679ced760464035c3a57263153b344fb6c9156305db95ab2839ee
MD5 0e1c8c66819ebc9ad5aa7d75ce2b96d0
SHA1 dd3ccf58ba839f6c1ac52132f8f5709fe774ff92
SHA512 e2139a57ede4e592600ec152d9d4d4e703a490a5f0da5ce5b632f85a93f231424a969fb00c5702d0fe8b9fca76ee9773b92642a4db0e1793c3b199d62ba56b38
SSDEEP 192:sxZ5LWf/fJsmQIupdUHW6+WNGY3RchzIg5lJ:sxZ5qf/fJsm4OHbGNh
TLSH
T1D912C7516E38A97B8CCBD21DBB19BF53E6F9503191D51E48AAFC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 499f8d2b1931deb0fae012411f01d70f54720591046bfd2376e496b2ff8ef027
MD5 02a09116b3e817acbac45cabfb45a6db
SHA1 6929f66245a0cb9092557488fcfc61bf44e4e6c8
SHA512 2046e3faf858d6aafcda0596d9ae895eb68c61321a3e1f94afab436f12e1f64baae079f93bac0809fb3ebdcd572bd79e951f3a43b0893ca73b6e19a9e12e117c
SSDEEP 768:ks30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ723rolZMp:ks30AbSWvS2l9u1jaLmLZ12kG
TLSH
T1BDC2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

816c1e6e-47e9-49b1-b835-0fecdd9c98a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\816c1e6e-47e9-49b1-b835-0fecdd9c98a1.tmp
Size 22KB
SHA256 f429961ace041200b0a6f4a3fb8e693fbc03721c6ac63bcc34c17d3e99ae0e7a
MD5 50e5faaa44d5d76aff26a151a18c4cc3
SHA1 0c539a4106cf75f34c81db5d295df51f35566354
SHA512 9ed9e069af12cb64ad0e1dac13912dfa8ca78741416e1c71d48cf8726b6cdd17a91a63ba9a642fa0bca5e1b77bed00e60465d75df1f4ab83dabe673c54bbb3a0
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ul:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAk
TLSH
T17EA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7155bcc35f2a2dc86ee1c672467b68dea92240bff38d7c8429060f91ea9f49cb
MD5 e2d1761ab16d81caf46ff3a93224f0be
SHA1 dda4d0ca413023866e26919ea69047763a9eea86
SHA512 8168bdd24e2f9fda271d36b245e7fd8c9d38289d3f00088a295ec428b369c361f2bdf94a4be739a103f2327ecfeb8209fbfad27550022f452a0126e13ef1e0b1
SSDEEP 384:BZcIhsNPUeEpuxlFr9iX5FEM2YCSBtgOIwZOyd7po8:JhWEKXJaQ5SBXsCX
TLSH
T192827C7298B85C7B59E7E245F58B36035EB88017EBC96F84C9EC672C01DA198030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 94976639972dcfdcfeb5f7f6ff29aa963fe07970b2ea8129b19a6dd5ea9ec758
MD5 46e21069c65e7e3ee21ef3c6e128175c
SHA1 3061008f41b9ffd8fbabbf7007009cdc0a1945e9
SHA512 28cc2de2ca0e39b5e4b9155cb3d05094045b543ab972552cb85f68843cf9484434eac48f5d05121fc4e309048107bbae7b4393b1b0a4ac90de39c94e8caf7afe
SSDEEP 384:msTFiZcIKzsNx8TUNTUlIlReEpuxlFr9iX5FEM2Y1SBtgOIwZOyd7po8:tFQCMwg6EKXJaQkSBXsCX
TLSH
T117A27C739CA88D7FADF79B44FA4A32039FB44067DAC5AE94D6D85A2C01D71D8030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ebbbe5ce8bc456d7c2b0912f1f428d16506285bf7641e6f452b27e5da09eb88
MD5 4c85b06ade633f6161face49e24946a2
SHA1 e1a7c4a7cb29201bd1e5b171923b7943f140412b
SHA512 0fb63599b9a1d121b5632345222d548e755e22045415c9f68f4a6727b60a4f72ccd393aefe8ced33a7526eed573154fd80cc65d5db8f91fc3ecc0d959629729e
SSDEEP 96:gqONkPQsjpfuMVwptaL5ih/cIPURHl8h4otop53iCDvBIPuva6zx8X5FxTV+qs7+:LONP6AmwprQmiUyZZ6siX5FKJiS+RU6
TLSH
T18002FB35FC682C7B8AF2AE55B54737236FA5112BFA902F84C9E81B1D01D725C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0fa12a9c2b02828b20942000a66280e5fe4eff0ad3b1f36676dc3b2da3202153
MD5 42921e8ed2bfc55151f604a4a996bd0a
SHA1 93fd62dacd0dadcdecc767a34e6bda83ecd74a7f
SHA512 e8a14b282d16dae800507f5f26836f1529aa81e53cd73f7813d81000b9548726ab034e493350515ecc6faa7a495d2e79b859b3adfc4affa49861a0ef615aa4e2
SSDEEP 192:LON66Amwp3uQmiUybZdrsiX5FEM2PwYxlRSuqFU6:LON66ipaspsiX5FEM2Y0SBU6
TLSH
T12F120B35B8686C3F4EE2A994F48736135EA54217EBC97FD4C9EC171C01DF29C530A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1a70aefc790aae7647816375f02c9903ad9c5abc9f416d02555c5f622ef7361
MD5 0ec3a235d5a74fa9a7038ec2811a2336
SHA1 3f5e8ab5c0cdf78f7a23432697c091a1e8383f40
SHA512 0b45da913b7b7450c79201bdb9e2561d2d40d4f9575c8c0e4c21ec3d5c3af6c445fd11ad677926fa095de600814e65bc83a527baba7f63796e98397aaf10dc13
SSDEEP 384:YZcIhsNPReEpuxlFr9iX5FEM2YCSBtgOIwZOyd7po8:mhrEKXJaQ5SBXsCX
TLSH
T132827C72A8B85C7B59E7E245F58736135EB88017E7C96F84C9EC672D01DA198030BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ab7bb88-1318-4c8f-9bed-a780fcb87101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ab7bb88-1318-4c8f-9bed-a780fcb87101.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33ad30387ce7d8f1d61c02fc2e619e83082791562d796f9cd1285ab4c3511900
MD5 7464aa243e693cb568b4502b3f71e0ff
SHA1 182ca14ec4bb7144cf2e880c71627cc7538c5481
SHA512 4dd57c034bb35392533bbde73ee9b21bf4c61287aead147b2253162d998f84c811af62f9e6c754c1863a704d344f7d0d96f06b351dedbd4511289280a6e3756b
TLSH
T18041F84DA6F91148B3B76F5AABF6A56E487BB9372E06D49D10550D4E0A33B00CC62B33
MD5 SHA1 SHA512 TLSH

Submit Download