6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-awg6hf.htm
Size 34KB
Sample260930-rc5mmsteqd
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{FF647634-E832-4697-8A1A-6E5B4F778BEA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1764	652	msedge.exe	87
PID 652 wrote to memory of 4384	652	msedge.exe	88
PID 652 wrote to memory of 4744	652	msedge.exe	89
PID 652 wrote to memory of 4744	652	msedge.exe	89
PID 652 wrote to memory of 4744	652	msedge.exe	89
PID 652 wrote to memory of 624	652	msedge.exe	90
PID 652 wrote to memory of 624	652	msedge.exe	90
PID 652 wrote to memory of 444	652	msedge.exe	91
PID 652 wrote to memory of 1740	652	msedge.exe	92
PID 652 wrote to memory of 444	652	msedge.exe	91
PID 652 wrote to memory of 444	652	msedge.exe	91
PID 652 wrote to memory of 1740	652	msedge.exe	92
PID 652 wrote to memory of 1740	652	msedge.exe	92
PID 652 wrote to memory of 3376	652	msedge.exe	94
PID 652 wrote to memory of 3376	652	msedge.exe	94
PID 652 wrote to memory of 3376	652	msedge.exe	94
PID 652 wrote to memory of 4028	652	msedge.exe	95
PID 652 wrote to memory of 4028	652	msedge.exe	95
PID 652 wrote to memory of 4028	652	msedge.exe	95
PID 652 wrote to memory of 3852	652	msedge.exe	103
PID 652 wrote to memory of 3468	652	msedge.exe	104
PID 652 wrote to memory of 3852	652	msedge.exe	103
PID 652 wrote to memory of 3468	652	msedge.exe	104
PID 652 wrote to memory of 2244	652	msedge.exe	107
PID 652 wrote to memory of 2432	652	msedge.exe	116
PID 652 wrote to memory of 3052	652	msedge.exe	117
PID 652 wrote to memory of 4080	652	msedge.exe	118
PID 652 wrote to memory of 676	652	msedge.exe	121
PID 652 wrote to memory of 676	652	msedge.exe	121
PID 652 wrote to memory of 3768	652	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-awg6hf.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe9671c188,0x7ffe9671c194,0x7ffe9671c1a0
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,16885788277645787553,3818109101926786998,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9647615305073399406,14312347255271644851,262144 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4524867148708572895,15151512883799628729,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9915802498118561153,14859081306179008658,2097152 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3825098822325290902,6304985080335062174,2097152 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7231850392726772785,5186577877502810438,2097152 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12830660089688530874,18111872687565233907,2097152 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,3603599373737672741,14141786951779394838,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4873517181423125665,11281387565366818235,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5384690341910655888,15954881350879408254,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5384690341910655888,15954881350879408254,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,18263198904951229720,17140043001492444267,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,9448892263807321526,10705193969303402781,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,6870703215701402020,14414354480651668080,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4866125724307583577,12283680314706527169,524288 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,100392026685758701,14810891684270116349,262144 --field-trial-handle=2436,i,3300319233684606443,1944375003506187695,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e7d67f05de765ef630c4ef1026c39b3af51c77f77c7450a2d2435403c8f24d0
MD5 02d5a62f57cdcc6da76d956919460c0a
SHA1 4900f40a330d52ed75e1f1ec399fefa29a402acf
SHA512 3aa4781787f6e9e39995002c40eba00b2b2b21941d6396203661ab5668aab387cce7638ed4b21fd0e076d3106eab5e9d5d409567e94a1c2d76a263c423c1dfc9
TLSH
T17F6109E4D58182EDF7F8437C97D13B877A38B4D8B1836D2200A2FC3B540E359AA82074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590749.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590749.TMP
Size 3KB
SHA256 f3359ea3b60b5cb3ba24cd7d2a6bc8ba3a2e96983cca080c63093a45e5abbd23
MD5 ab5a3ed7a1954b51c9e28f69cef8aa38
SHA1 b6b08bfb1500cee3527d278a19f6ca9e7d8bae30
SHA512 d1d0658ef2e0cd44b6c7b4230c7b1e6826f9a55111b8a7668b56d40d9105336d380c64be157dfc19b6eaa7d725032160137e8b45000184b1d5571d5f8fbb31ca
TLSH
T19F61F8E4C58182EDF7F8437C97D13B877A38B4D8B1836D2300A6EC3B540E359AA86074
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8a30f03221ef8dee3054003c62e09c640b6203f0f75f113d16653d23e1437cb4
MD5 fbff341f0b248d51ca850201d0b1d5bb
SHA1 96b4f4b469bf06b1ac1c71316a4aec082a92215f
SHA512 095eaa4b94e4a7ed06cad4d8ab0c702e74f843a6d63296443e7456300fa052aaffe469ede2324482ded9597b286c813c29c12a57acc18dec3d5b6ccec377f105
TLSH
T102117AF3C3D585AE8D0516F05A28EE6BCE2D0646821C7C1989D4EF2BD3F3475E00299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dadd5fa748eddccfc286d4f0acf1045f3a3daf86484a7628f2ffed27280e06fd
MD5 8cf93369d9a2529024cbe0fe59285538
SHA1 7a965797059e300a0984908fea4790f123cfd118
SHA512 f08aeda8a364d5ab8de8aed54f6004ae53952e2e53b5a1c4ff38e138632041416017ad45644ce3433b0229b5fb30aab6853c4f39528b729620c7213e1b828813
SSDEEP 192:sxZrlRKW//fssGSkHIdpH4HW6+WNGYgd3+Ig5cJ:sxZrlv//fsssIYHbGW+
TLSH
T17D22B8126E28697B8CC7D20EBF15BF53E6F9503251911E88A6FC862C05E7ADD2247C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 79d352447f70e57061dff83c5294f228b60e57d652d3e11eb895741ce2ca39d0
MD5 1b238369911d7f27599650d0a2d719a1
SHA1 0e0c9802406ae9e1555a91c837f185565dc8f1b3
SHA512 032a68594a3e7fd955a254eb9e0ad9419409cd99322d255ec7a32880b8a8ca6d5732ad8c83b1a27a40c12957b0d5c30f45274e5f2424ad03bde1ba1c6e115343
SSDEEP 192:sxZrlRKW//fssGEkHIdpd4HW6+WNGYgU3+IgrJ:sxZrlv//fssOIuHbGR9
TLSH
T19712A8116E28A57B8CC7D21EBB15BF53E5F9503251911E98EAFC862C05E6ADD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 675bc542e50d6299be005c96139663e8f2fda0cfc2ed24902f29db599a014d45
MD5 8bbd94c561e1bfcef0fe4ad256cf53b7
SHA1 ceadecc81583fa08f35edf8ef203cb7609cfd465
SHA512 c6bbf0b0c5ecbdd12b83bdbc816d15a50f628305b7f0eae99a710c552b3dbdf337292a71d687b5b846d6908a680f399a71d95180e2362b43e9a38d341c48f89d
SSDEEP 192:sxZrlRKW//fssGSkHIdpd4HW6+WNGYgd3+Ig5cJ:sxZrlv//fsssIuHbGa+
TLSH
T1FB22A7116E28697B8CCBD20EBB55BF53E6F9503251911E88A6FC862C05E7ADD2247C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c9e154255c4be807ec5034d45b7f9a04ee646562e89c9991deaf689c627b5f78
MD5 2a9fadef71cf8c5a44fb583780c70c13
SHA1 a9f0a3d4a45e1245fd9373e9de9d80ab40ebea51
SHA512 9791dbf983ff4fd56990cac6bbdc8a2c9bf24abfc400c39f35a24a1a4f2b5361a76c5284ca0fcb73fd9b63dddc49905bdf86a104c4169188afe3c6343a0fbb73
SSDEEP 192:sxZrlRKW//fssGEkHIdpd4HW6+WNGYgU3+Ig52J:sxZrlv//fssOIuHbGRU
TLSH
T17822B8116E38A97B8CC7D21EBB55BF53E5F9503251911E88A6FC862C05E6ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a933330878787826bed224a2ac469687ee128b9395b99a42e9af65c856108599
MD5 5ad14c83194f18cf793aa3ad909f9c77
SHA1 fcc53590f0f0ce5bcc0beb158191a23fd0d25250
SHA512 5f22f7e9a02e5e35e8260e21648f323c085625055679babded1426461ac1c0b7d538e6b9545d2a30c021d9ec0fe057f0a992a733a617318fb3e7a45dd1fdfaaa
SSDEEP 768:e/ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzxrow3O:e/ichfPWvPZplu1jan+LKgzKyO
TLSH
T142C2FA3B644CCB7E4FC01E9DDD5A6F9A7E9802C7A6688D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ad62474-31a3-4f6a-a37a-0fc4e039c9d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6ad62474-31a3-4f6a-a37a-0fc4e039c9d0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4213c550198065d761ed78a66c262ee0403213a8e97cce8d27287489fd71f0fb
MD5 3cf3dc40880cea9fde191f08bebb5a98
SHA1 4df4183a9032307558dc7df12d0fa9c2192d2ba4
SHA512 4c11ffe00d16cc41d74de2d9657b5703673ac4d12fbed77e9f066092e9688092ff1df075b325f7dd6e536ed7f37f7b78c71b72c426a4be2d2addda8b77046ff6
SSDEEP 384:0ZcIhsNAJ455WYeBGYX5Ejl83sIXHe6tgOIwZOyBLYoG:yhYboGYujToHe6XsGsd
TLSH
T1FA828F329CB8ACBB1DE7A145F44A36039FB89027E7C4AF54D5ED572D01D9294134BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 411d40c0e9eb14a01368f41f5f249de7d199327822e8c62aee05bfe33b3c976c
MD5 ab5fca258ed5c5de33730baa814e6c78
SHA1 6cd343d7a9c0fc9369a2b1632a661bded6b793e2
SHA512 1ca6a3326ceb55569c7928cc080d1c76725a9a267493c29cfe7115b33962557eb6b2521e101542e0fecb22c68fe8789fed929cd16371ea085f4302c9fa856b91
SSDEEP 384:WiFiZcIlzsNA8TUNTUlIlw455WYeBGYX5Ejl83sIXHQ6tgOIwZOyBLYoG:9FQdNwg7boGYujToHQ6XsGsd
TLSH
T1DDA27D339CB8DC7F6DEA9A85F54A32039FB44027D684EB90E7DD5B2D019A1D8134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51de9a365727269d72dbb6607be8952da32c5b03062b351b84a48815348aafb6
MD5 23685eec258b00a9252ff39f830e8ff2
SHA1 513540f401515a81b0779110cd9b0a19fab92970
SHA512 ab5653b54690a0b92ac934fe89b2753cc910085f0ad56f76dd50918bf7bb7245c13467822ff2375a61ee2fd8a1144e36370cfeab9ec4032b72d5e13caca6682b
SSDEEP 192:LJONI6DphmqQmiUyd8q8wGYX59ezKCpjzor33Ikk7d9U6:lONI619RRwGYX5Ejl83GTU6
TLSH
T18502D935F8787CBB4DE36E49B44B27139FE5212BAA946F44D6E81B2D01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 be76ce8b67c344c9006911b03ac018b8d1a092503290ee3d44ee93a9c4402f4e
MD5 64193845e9a6f9c73985cffc2375b209
SHA1 6b6e44fa4bbcff377cb40fd97fbdecede339b8de
SHA512 2b452830cb6125e458dc9a7dfeed69f091be47d9ac1cd8b5071919a0539db365497e09066b0d9874908c2b223d26c26d597b60587ba53f1a96b8fef71690142a
SSDEEP 384:cZcIhsNAw455WYeBGYX5Ejl83sIXHe6tgOIwZOyBLYoG:KhpboGYujToHe6XsGsd
TLSH
T10A829F329CB8AC7B1CE7A185F54A36039FB89027E7C4AF50D5ED572D01DA294134BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a85bbe6afa53ad7d5d859010888dc16ff89d2791cc1059988586cbc789e98a9
MD5 325779d548e0bee76e0fd3c99e3494ad
SHA1 672e711354612acb1376cc51deeb925fb846cd59
SHA512 cfdfab1d598731249f04eae156492114a9cbfc02a82c95ec87b9efcb3e7507dea5d21f99f80f96f2bc5cf92dbe443f60c5854c4e0383f3ef6a198b73bace3f14
SSDEEP 192:LJONp6DphCqQmiUy98awGYX59ezKCpjzor33cIXEE6kIIXq52KU6:lONp615JawGYX5Ejl83sIXHL6U6
TLSH
T1EE12FA32B8B8BC6B1DD26595B04B36139FB4512BEB846F50D6EC1B2C02DF698134AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa9ea21b-3821-4c44-9e95-278b6be23d80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa9ea21b-3821-4c44-9e95-278b6be23d80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 82b900dd6fdcf0f27a119cbd23e916946864a3b251471dd38037681935a219af
MD5 b2c0d3ae6caa6ccbc05e80b156fce805
SHA1 7d48df3f67fd5db8407b9353468ac2fd08a786bd
SHA512 f9d7fe653f86deae4107c769e29443ce556d78ee793072ca4245683aa84bfa7ad6b31ad597c41e724f08794c0334c65a2cea42b208e169b093efefc37f0a79d8
TLSH
T17D415D5CBAEA1008B3B36E569FF2686D487B78372F0AD19E10110E4F0A73A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download