af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-h8nkmq.html
Size 214KB
Sample260930-qxp71ssdle
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{EF4C293E-9BE4-4AF5-8C44-53258A6DB638}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4512	1908	msedge.exe	89
PID 1908 wrote to memory of 4748	1908	msedge.exe	90
PID 1908 wrote to memory of 212	1908	msedge.exe	91
PID 1908 wrote to memory of 212	1908	msedge.exe	91
PID 1908 wrote to memory of 212	1908	msedge.exe	91
PID 1908 wrote to memory of 4016	1908	msedge.exe	92
PID 1908 wrote to memory of 4016	1908	msedge.exe	92
PID 1908 wrote to memory of 3472	1908	msedge.exe	93
PID 1908 wrote to memory of 3472	1908	msedge.exe	93
PID 1908 wrote to memory of 3472	1908	msedge.exe	93
PID 1908 wrote to memory of 1160	1908	msedge.exe	94
PID 1908 wrote to memory of 1160	1908	msedge.exe	94
PID 1908 wrote to memory of 1160	1908	msedge.exe	94
PID 1908 wrote to memory of 3644	1908	msedge.exe	96
PID 1908 wrote to memory of 4264	1908	msedge.exe	97
PID 1908 wrote to memory of 3644	1908	msedge.exe	96
PID 1908 wrote to memory of 3644	1908	msedge.exe	96
PID 1908 wrote to memory of 4264	1908	msedge.exe	97
PID 1908 wrote to memory of 4264	1908	msedge.exe	97
PID 1908 wrote to memory of 392	1908	msedge.exe	103
PID 1908 wrote to memory of 3548	1908	msedge.exe	104
PID 1908 wrote to memory of 392	1908	msedge.exe	103
PID 1908 wrote to memory of 3548	1908	msedge.exe	104
PID 1908 wrote to memory of 2300	1908	msedge.exe	106
PID 1908 wrote to memory of 468	1908	msedge.exe	113
PID 1908 wrote to memory of 4888	1908	msedge.exe	114
PID 1908 wrote to memory of 456	1908	msedge.exe	115
PID 1908 wrote to memory of 1836	1908	msedge.exe	124
PID 1908 wrote to memory of 1836	1908	msedge.exe	124
PID 1908 wrote to memory of 3124	1908	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-h8nkmq.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe9b72c188,0x7ffe9b72c194,0x7ffe9b72c1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,6834544824980045976,14595512773541499911,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11028102996095651542,1808207087750388813,262144 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,5976194189175457463,9393472629579452254,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11826233049432774536,1673706862228536496,2097152 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,8456132148190908207,13001573240090729425,2097152 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,12561085704278688912,17280343782689456373,2097152 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,13259942712836754982,11711834264309460933,2097152 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,5874153696919916507,4485981981514994606,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14606890157882885036,10831822946635483150,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,2769184577924610100,10840904825547526723,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,2769184577924610100,10840904825547526723,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12685177102320821234,9302500460956484526,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9480677286649023753,8268977661408094052,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,12858549499505778662,17403014806246860873,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,6866574499895440787,7439516189191522025,524288 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,16639124181161065238,15409202813688267912,262144 --field-trial-handle=2212,i,16370341176918727797,6420819019809322188,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9a71bacf88e0171b48a33126512bfc81d6fd07ea9728c74016fd9862f878314d
MD5 bff01cb54374f7ee875ae45a780ed22d
SHA1 c0d87f8c164d86c7dfd0877597a8f27a7e03a28c
SHA512 380ca77e51c1f7c4f6b9959930b278ebe0b03a9676162a95dd8814316566e0c208be71a49f32e09e25e0a926151b7907429d42fa412ff9b6b4305cdd0599c380
TLSH
T1D1516EBA454A48D0FF1850F0DEE989873EB8A97D55C3CE0A37B0DCBAA9027797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592c94.TMP
Size 2KB
SHA256 da57ec2bbb20ff746262f670f59225a6861a651b5fe54ddb1433a20b1ad79f4b
MD5 a9ddf9575b0cab7f6cfebd2de25aad2f
SHA1 90414a914b92a84330ec834d4eedd9134a661578
SHA512 f25a138adac68c89bbdb2b77c72fa89919f2919ed43588f3fc93180472bd0c102b69ac710778e997e7a1e544150a81e914059ccd1b551dacdc79aad1234de420
TLSH
T1F6516FBA454A48D0FF1850F0EEE8858B3DB8A97D55C3CE0A37B4DCB6A8427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c8639aec55ac15188a4891f78e87c213f3b21aacea669ef7085a5f2b2c6ffbf4
MD5 ad36d35d10f31515eed998eda94f80cc
SHA1 f122e88654da9919203a8a42f7002ee1c0d590fb
SHA512 c87a9c5cfc0c4b62e8d737b2811ea5235528a9a9697ca320556230225c9899388649ddb434e1eff12bd9c9d5977c7205993f26e34b4ffbb67de80e61baba5c40
TLSH
T1C2117DF3C3D585AE890517F09A24EE2BDE1D0505821C7C19C9D4EF2793E3476E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ed9deecd4ad76464b95898b348ecc0f9f03c862e726c439f0c63177098855bf2
MD5 f6c71430b4a0d3eba1e7c9ff44408e4e
SHA1 dc99761d8543e344b28f70cb2219a6af328218f6
SHA512 632a81dc4bae50fdba48f20a43717fa6a0bf8bc652c118703514c3836ff0ea06815d1d74c3e3ecc9af759ec063c0ac81efdc32598dd5818b7d0f1277f39c9381
SSDEEP 192:sxZHR4Wz/fAsJ5GZIdpdQHW6+WNGYrbAlzIgrJ:sxZHpz/fAsJ5GymHbGVt9
TLSH
T19612B6526E68A97B8CC7E20DBB25BF13D6F9503251D51E58AAFCC61C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cbeed88926e93484fb770397fdae69c3302130410d9360348b65e0d6df14e428
MD5 79beae26ab835dd118190ec34f519919
SHA1 56d5f2ac2cea5b6ff114ba10e41b9e8cd9de4984
SHA512 2241cf632110cf7191e24fc8a3c74ebcc8265395dc28215ba34988cd33f69955d195a6b5a33898c5f17a790077c48067c2772c9fdc67e2dfe961d9b8cb4fb8ee
SSDEEP 192:sxZHR4Wz/fAsk3GZIdpHQHW6+WNGYrQAlzIg51J:sxZHpz/fAsk3GywHbGytR
TLSH
T14722B8526E68A97B8CC7E20DBB15BF53E6F9503251D51E58AAFCC61C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2e4fb6ad531647e96eabd7291def291871a88a0566ba1f679e0ac91480d0ae84
MD5 37d9941aeebfe8de23fb4cedfdce6ba6
SHA1 5d264cb1161021a43e7d2bd4092044126aaf7fc2
SHA512 e3233a52e88999e82b3cbdffa059d4262718844f4584867cd4da0a7be7c3cd987daf4fdd8ec39a982a5b2bfe406501c522b15e73c28f29dddb647b72ebde7830
SSDEEP 192:sxZHR4Wz/fAsk3GZIdpdQHW6+WNGYrpAlzIg51J:sxZHpz/fAsk3GymHbG3tR
TLSH
T1D322C7526E68A97B8CC7E20DBB15BF53E6F9503251D51E58AAFCC61C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9d87fedb58a20e74cc9ff00de1e52a0835e81b99ebd5ee0a64e9b063e69316c9
MD5 ccd45588708de95c51368c7354e9f66b
SHA1 85c30e68bf572b8d8b92d4fce7765540392ced3b
SHA512 fe10f98250373f0afea921e83d51e940574ee0e76a64e3ba3a3e0ff37f92df1fff35e37543c6286ae29827a08c55b1011d9f90bad983e554f2b118fb6ed8221e
SSDEEP 192:sxZHR4Wz/fAsk5GZIdpdQHW6+WNGYrbAlzIg5nJ:sxZHpz/fAsk5GymHbGVtP
TLSH
T1AF22B6526E68A97B8CC7E20DBB15BF13D6F9503251D51E58AAFCC61C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 98b43e14781c7d236f23e9ca84380a0bfb3643a20ea83b3546283349ad469718
MD5 b57398a0c4d46cdfd03b29bde1eb0b75
SHA1 bee823a424ca0b34e8d575fb0da888f28f4b5d46
SHA512 09f4dfe7be0c5421d001d5dbe704a5b0a67c08a3fadbfd6e03f20c1d0571569f38f73eb93b5d4076fede5233757a73ebc3581ce8abda96bf6583934b839c1b7d
SSDEEP 768:bky4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb8roRdh:bky4J/DWvbtBhu1jajiLm0bnDh
TLSH
T112C2FA3B684CCA7E4FC00B9DED5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc6afed5-eaba-49f3-85c3-ea10791f0bf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bc6afed5-eaba-49f3-85c3-ea10791f0bf4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 64cba7cc503468d3c46fc1f96575c9f98f35113cd6ab63be6cd871691aa663b2
MD5 399a6ee4d6db707970fdf0caf215e027
SHA1 4be6b5f96c84ca4879653c8eeb894b15e856518f
SHA512 68238644d0ac4ee0f8de660e222c29f0e13a49c9e93bcb048e3ae2cb372f9a6a6effaf7ac01d50fd0994eabad00b56b94e4d9ba362b43139e77d67488071d5be
SSDEEP 384:6ZcIhsNs0ydLZmATHX58EDOJbAWWagztgOIwZOyMLsoz:4hvLl7a4Od4zXs/AU
TLSH
T1B7829E72A8B89C775DFBA185F54622034FB89067E2C5AF94C5ECAB1D00DA6A9130FD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8557f0119d110d4c7bcedcffc81ed525f484443cc2eb0bbed42470122d1db961
MD5 fddb3a5439d311233cd228c42f0e8500
SHA1 418eb18c1659752191578460253586ee2f65ff05
SHA512 69139d346abfe0f8879ca0a78f37806d1d57c9456aa081a730cdd465868bfd2740bd2fd1a7a74ff349484f6d4a070a88a02ba036d50d7b93a541ddb2b9c2ae97
SSDEEP 192:1ON46wlDgQmiUyiJW4X58gZDOKaFbAIDluQUU6:1ON46kgrW4X58EDOJbAsMU6
TLSH
T17102E835B9787C7B8EF3AE09F58B26139FE4102BE6552F84C6E81A2D00D765C2307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 15e18e91c7c7bd77981a3cf09806c74414a551d90afc17c1977e389e37c94c05
MD5 ef77f369e9950a1d6383a3f64e038901
SHA1 d78c7cd6913a715bef8d30bd7ec45ecdd48d4e81
SHA512 5774c1cca84017f36773539804a07e0315d28ae756cf41e49e1846507daa50b0cee67ec695c8b9bd6eff4a5c48a2755de5a79d1db5c74e3e9653a81b9020a750
SSDEEP 384:6ZcIhsNs0bdLZmATHX58EDOJbAWWagztgOIwZOyMLsoz:4hQLl7a4Od4zXs/AU
TLSH
T1F8829E72A8B89C771DFBA145F54622035FB89067E285AF94C5ECAB1D00DA6A9030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 429e14bb6518cb12cedda9d499873242ef4dac2ef108d9a4cc7797bc5149e2fa
MD5 4700b3f6dba9b981bb014ff19b7aa626
SHA1 9dec409f9d68e37d8c9895d0b84501d3ffb1abae
SHA512 2fb9f7bb162ac0629600c11a5a0f4f352121be5139369c8333c93764e0102ab6df411e6e925dc3cb34f65ae9236e2ea6591558a09baa4a2c3d83e90744afcb85
SSDEEP 384:diFiZcI0zsNs88TUNTUlIlbdLZmATHX58EDOJbAWWa1ztgOIwZOyMLsoz:UFQIwwgfLl7a4OdNzXs/AU
TLSH
T1F4A27C7398E8DD7B6DFA9A85F54A22038FF44067D686EB94E6DC9F1D009A1DC030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0456d1fcd4c684cc5aa1afcf685ffbb692a34d21d65dc584537f5f49b729335c
MD5 fba99fb2fb86331a46cb2d884a12698c
SHA1 91af5a89ef304290c52732b5b7880e171631bf0d
SHA512 381a799af17b2bd5ed2af860276b3255c72aa6df1c40102253f6f229ee847d7beb2a56276ac055d84e4e78f71a0f084e47b931b0d2c2c0cc7ae1a5d4bd1595a1
SSDEEP 192:1ON4B6wlDUjQmiUyL6J5n4X58gZDOKaFbAWWa9vexqmU6:1ON4B6k0pB4X58EDOJbAWWaczU6
TLSH
T1EA121835B5B8AC375EE2A545F48736039FA55117E6897F90C6DC2B1C01EF66C130AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31139e34-7259-4008-8e6e-b42a576721b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\31139e34-7259-4008-8e6e-b42a576721b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ae4dcfd4ec723eadc6281adf2e1ab479b030dcc96749292793bd3a48d2ad3a1
MD5 dbbe96ba1527de539d0b78db49aa48b7
SHA1 176947514a08575de34f7be068de279034931d5d
SHA512 d69d4c6ad2bbc83f5c5d021363213fe560ddc7dea055344d59cf3a14c4d3a4652e874f93179558c7b095a347b9d00db1a2b990259a0e7355777e18855e8b1ade
TLSH
T1E9413B5CA6E91148B3B76E466FF6642D447FBC732F4AD49E10110E4F0662B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download