101c7888032c58ac8f30cea190201e3cc4534aed4e0f40b69c23b28f605399c2

Analysis

max time kernel
148s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gpbc/faq.html
Size 29KB
Sample260930-w7tabayeng
SHA256 101c7888032c58ac8f30cea190201e3cc4534aed4e0f40b69c23b28f605399c2
MD5 9daa2c52b65b8bbd34a6c778bda7719f
SHA1 da987f580a4f8e9556a9a0a097c74f46901f0b88
SHA512 d5b2df615a25f1359f41015ad5e279e5e4a9b15739680eab96eb9909a90af7a2e41c321bea9f6afb8abbc67b0d16264ea7850b10b07e73ece37554f8e6846aa6
SSDEEP 192:hCdnh7TgIKbkMExuaYrUe/JSq+3hwCBcXGhndMPwydfldCfU+j:8dnh7TgIQkMEABGGCLewUGfU+j
TLSH
T1FCD21E2028F8113B0192A1956E686F2E6F92D317DA1F1E1472BC1FD95FD3F8ACD23159
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{A8E3B11D-DA27-400F-931D-0626050995AE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4744	2680	msedge.exe	87
PID 2680 wrote to memory of 4204	2680	msedge.exe	88
PID 2680 wrote to memory of 1248	2680	msedge.exe	89
PID 2680 wrote to memory of 1248	2680	msedge.exe	89
PID 2680 wrote to memory of 1248	2680	msedge.exe	89
PID 2680 wrote to memory of 2588	2680	msedge.exe	91
PID 2680 wrote to memory of 2588	2680	msedge.exe	91
PID 2680 wrote to memory of 116	2680	msedge.exe	93
PID 2680 wrote to memory of 116	2680	msedge.exe	93
PID 2680 wrote to memory of 116	2680	msedge.exe	93
PID 2680 wrote to memory of 3148	2680	msedge.exe	92
PID 2680 wrote to memory of 3148	2680	msedge.exe	92
PID 2680 wrote to memory of 3148	2680	msedge.exe	92
PID 2680 wrote to memory of 2088	2680	msedge.exe	94
PID 2680 wrote to memory of 2088	2680	msedge.exe	94
PID 2680 wrote to memory of 2088	2680	msedge.exe	94
PID 2680 wrote to memory of 1600	2680	msedge.exe	95
PID 2680 wrote to memory of 1600	2680	msedge.exe	95
PID 2680 wrote to memory of 1600	2680	msedge.exe	95
PID 2680 wrote to memory of 4440	2680	msedge.exe	98
PID 2680 wrote to memory of 4812	2680	msedge.exe	99
PID 2680 wrote to memory of 4440	2680	msedge.exe	98
PID 2680 wrote to memory of 4812	2680	msedge.exe	99
PID 2680 wrote to memory of 3340	2680	msedge.exe	103
PID 2680 wrote to memory of 1960	2680	msedge.exe	114
PID 2680 wrote to memory of 1068	2680	msedge.exe	115
PID 2680 wrote to memory of 1364	2680	msedge.exe	116
PID 2680 wrote to memory of 5008	2680	msedge.exe	126
PID 2680 wrote to memory of 5008	2680	msedge.exe	126
PID 2680 wrote to memory of 3772	2680	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gpbc\faq.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff9736c188,0x7fff9736c194,0x7fff9736c1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,812540279928441499,8965950621423223430,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,556849062845689475,6513051215083578564,262144 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,8362165640530818760,4042709968712684126,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,5890585437250262634,15446933532101031271,2097152 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16296186359359475647,14789098938906570934,2097152 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1047091508332846657,3560828819365967845,2097152 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,11016086493660755975,941811125803974282,2097152 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,8989764222956293503,16214495739381142603,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,4489489064796547146,15696410750809813177,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11703672371600470655,17821734211116681490,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11703672371600470655,17821734211116681490,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6535080101650314185,10190082983301220023,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,4247252363230448042,17154928492647615990,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,10190013395137370970,1202190386107747527,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17444936869030306128,8073697326552060147,524288 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,7307083110979942639,15251208608761451018,262144 --field-trial-handle=2240,i,15571204941417375943,11446795980495925103,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77900053d24e3c097baae3eb0a6422295d9b6971a45d6001d38a7c00f4304832
MD5 b160715773eb337c5435ca14b55a55b6
SHA1 b5dc19a108342542447b8c350cf4730761801a56
SHA512 afd4134946cbd4d1cd3fe4f69db63244970ff50ecdc1dc7f2a17eea283742519806965aa030e1848539647ae9161b7cd399621cdab295bb106af458c30bd3f08
TLSH
T1B261A3CAE1E34C85F7A806B047C70DCB3333DC8355672E5A9468DDF878CA3966109310
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a459.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a459.TMP
Size 3KB
SHA256 c6733cdc237d4502ee6a6bc0423be4c2ec5dfdd618ec2b03ec61c4ca648002c2
MD5 a9dffda6c0c231c90ac89000793d568b
SHA1 e3d7aa1d8788370e3c76507c567a5bfad6432f8b
SHA512 f67bb8fc3c2a28f1cfbe89d80a7f6c85ec78f3b37e8c5795b366a3f77c668e49a537c47c320331737f784e608a6854ff50a1eade058cf44504fcb4bdd2ab99df
TLSH
T1FE61A2CAE6E34C85F7A806B047D70DCB3333CC8354672E5A9468DDF878CA3966109310
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8344dc79e646b65acea3b287c669cba76f8cf80ed1adaa47e6f40ee63368756c
MD5 56ad375ac977251a15615400f661c515
SHA1 915a7d32aa86282027849f6d74af71f48513459b
SHA512 fda569bc7a0ee53ff214e032b7174010228b5a9e420fdc97bc0ac13fc818a8eeb30f3a6cd1950ba1565bef370732dca48dba9e3f990446ccf3febacb1a0e1ccc
TLSH
T178316DB7C3D586AE890157F05A24AE2BCE2D051642283C5AC9E4EF5B93E2475D20259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5381d0342b4d6158f216125759840b53eab58b693aeae9aa60617c900e8d989b
MD5 d9e174bd364f7bd09d8f3b390629c71c
SHA1 a7f816f5dee13d1a52cd6c2b3124b367664ba681
SHA512 41a089f52aa0ec9eecf676de17b81ba1d012813e62e2fcc99d621eff7fa4584915739088001882e3d2a464ff4dad830bc80abcff08bd86445d78fdb6460165b0
SSDEEP 192:sxZURHWN/fysXbIdpdOHW6+WNGYRPReRIgrJ:sxZUgN/fysXE8HbGm89
TLSH
T1A212A7126E78A57B8CC7D20DBA65BF53D6F9503291D41E48EAFC861C05E6ACE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 38fda61a68939526c37942eef6a3a46f81c2b17b26f47be5e20df03654963cdd
MD5 93f5712991d6b1ab48ef9ecddf27ffff
SHA1 ebca23e58749ab17c3d0e4cd17ce56d85c5ce210
SHA512 0fb4eab018a4962e04f4dfa7752fa45e967aa2da6938b7c5ffe2bf49698df7b1bf43a2998cd463f90ee173265a9d7eadcee10bcee12e8127da4e905209af5d2a
SSDEEP 192:sxZURHWN/fysUbIdpdOHW6+WNGYRPoeRIg5QJ:sxZUgN/fysUE8HbGm/C
TLSH
T14422A6116E78A97B9CC7E20DBB55BF53E6F9503291D11E48A6FC861C05E6ACE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ebfb37e8ae5e97cfe54d86923d70013ca1f681179e75116bdb3b62a82498850c
MD5 5019242532b921b79ac7e31c0706f636
SHA1 1612c73043b044688948d9cc9dd7b7e442ea1c95
SHA512 ccc5170a4ee8d9765f2c9aa2170ab8b9aad1cf1e02122f3ac70f9ba94495239c6cb5a82d6dae9975662ebf1c6ed030b0a09834193acd6b18e511b18c896ac33e
SSDEEP 192:sxZURHWN/fysRbIdpdOHW6+WNGYRPReRIg56J:sxZUgN/fysRE8HbGm8Y
TLSH
T19D22B7126E78A57B8CC7D20DBB65BF53D6F9503291D01E48AAFC861C05E6ACE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 deade62badf3fd89f4fe8150f6da05b5721b8e1122df75d1374f829a7e44f48c
MD5 04f16c55ca9f955635daf9d7c3f2f87d
SHA1 b7a530021acd4d7b756400e0a0a49a2fd539a94d
SHA512 629bcfa3e2549deb3db71b39c542f6bc0e2d0771a81460febe9ad1e5ef561bf15907dc9a376524e859a901e574e75fbea33833b9825f384f28aaca8429090b73
SSDEEP 192:sxZURHWN/fysUbIdpHOHW6+WNGYRPleRIg5QJ:sxZUgN/fysUEuHbGmwC
TLSH
T1C222B7126E78A97B8CC7E20DBA55BF53D6F9503291D01E48A6FC861C05E6ACE230784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4758cccdd8afee84d628eea12f3a3dd1d49a4f701edde08a3be49d3d9b38c7be
MD5 c825b31c89e37914f69280cdb8a250ab
SHA1 a17cd2651a626d75e7cf3557e54457c4951e14bd
SHA512 20b047f91145fbc86f1908726da3c411829bdef086b69090e8f9ccf4de82ac0a6a556e2355bef452b50a82bc6037a8a73634fc5b473cad9addb18333c55ad2b2
SSDEEP 768:DbK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3IroN+VT:DbK9uzYWvcQWsu1ja0HL7Q3zN+VT
TLSH
T1FDC2093F640CCB7E5FC01A9DDC5A6F973E9802D7A6988D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0750196978f7b9fec8e262c1ad67062f4cacdf6225636c11ab906d0fffcec43
MD5 a9e835160ff058c9e8599df573b5e1c6
SHA1 3e484d863f07586e6f4d8e4df61410ed9951aefb
SHA512 e0b71fb2148972394f38a05d8549d0aa80cd3d94b8146fb2a8e3c9bf98ff59841dfd9aece900bcc8eff9217a6a47f26fb3ccc2eae2f9351ec840b7ec5b21cd1c
SSDEEP 48:K0mImRAthrvzMb/KXIS5MK9Z1zMxxcYKbRRyJeInKrqIDytrIpKsgI:K0mJGQKjiO6ekKrquOrWKsgI
TLSH
T1FE912E24307B56523D7D295886A9D72E528231B23168EA3B7FBC50B15F2BE444CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8758a10b-2831-483d-9112-359d9842dd2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8758a10b-2831-483d-9112-359d9842dd2b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 10a42a3f63c839ab797173a56f73b11fcbc358b07e3781a372016fd0a87372c6
MD5 df562fa091d577d0866ed568ac3d0905
SHA1 7f5d6cc5c7ee6767a8aefea60861cca8e7985b2f
SHA512 c50c936500a6487ef2269fae1c162995fb08980b215a56676670bdc319fdf4eb2e03a74520d05bd06a3a62f87beff670287b52332262c4eaaa80e8c98b612127
SSDEEP 384:2ZcIhsNK+wYPMY20uOjTVHglhBrEtgOIwZOygzoB:khCYwnOFrEXsVG
TLSH
T1B9828F315CB85CB66DFBE105F5CA31034FB890A7D6C56B8094ED5B1C01DB5A91307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b377f29a2aea449efb7212d25157938b324ab5681dad1080adb74c79c36fbb7a
MD5 58ae4b8c612639ee90f11d8c33a9c2e4
SHA1 c8f7bc06b5b3c0acd7df5716797e616703d34d16
SHA512 4f076030b561bad843da764ba75106e54872a30436f5a325fd9c37b51175c656a56958171841e4f6f1a8e20d69eedc2637be540e3272ff56733bb9d488533bec
SSDEEP 384:+iFiZcIr7zsNS8TUNTUlIl/wYPMY20uOjTVHglhBXEtgOIwZOygzoB:VFQrvbwgZYwnOFXEXsVG
TLSH
T1C0A27E335CA88CBBADFB9645F9CA32038FB440A7D5C5BA90E2DD5A1C019B5E8130BD65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c841bb0675cc2f6b5c4a873fb734dd3f2a9a474faa1e7de821d9267961d3ceb
MD5 76ede9b99c674d6b77000818ae50d7f7
SHA1 f150a8440b4e05cb82678ee68ed4f20d8b23fef4
SHA512 858183da27b8b09e33186b176248e6fde2684341e0a00cfe7f611a28a375c18debb3ca9cff09ff3f28fb8a282c31c8f695ee1a4fbaa669882fa4bc44f5b31b2d
SSDEEP 192:SONk6ygpQmiUy0vtOCTVgcSMosSPzPaoU6:SONk6lHJtOCTVHglb7U6
TLSH
T1D202E835BC787CBB8EF3AE06F8C622179FA4117BDA552B44D5E85A1C01D766C2303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7a3bc59e7eae6376678cd4bec0913a80f413b495d1dc67c4a61396087fad27ce
MD5 56dddaf9e428592bf107c39de1f33f9c
SHA1 270d6daeedfdb9cdacc1d377a9c27f1c086a9cf7
SHA512 2292156fecccf234270683f63dc40fccaa366af55d6046c0e7a502580dcd4eec15b529a76c51f267a5fe778d37c04f2e10fccc1d0dbde61cce4bacd3cd69cd37
SSDEEP 384:sZcIhsNK/wYPMY20uOjTVHglhBrEtgOIwZOygzoB:6hlYwnOFrEXsVG
TLSH
T1E3828F315CB85CB66DEBE105F5C631035FB890ABD6C96B8094ED5B1C01DB5A91307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93290e717b00a9ecce030e11745156fd62f009bc9ab3dfd7f1051f129203990e
MD5 23aaf6b4d0a3e2a626e5249828fa3c2e
SHA1 75abee22045246285758a40e58266d509ae0b369
SHA512 6adcec8107ddf2d54ae8d7f2afcb26c900aa07732fc152c80bee585544bd77a9611245c917c7325d7c711c8b84affec4db2e714977cae454cbb834a115ae6ea6
SSDEEP 192:SONz6yZQmiUyjvfOCTVgcSMosSh2BEwi3UeqoU6:SONz6EkfOCTVHglhBcEU6
TLSH
T1F612F935BC686CBB5EE3A541F4C631035FA892A7EA497B40D5EC1E1C01EB66C630792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f39a21e-39d8-487c-841a-08939223edad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0f39a21e-39d8-487c-841a-08939223edad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8b72a01873edfaaf4491e2eb688f21b531ea3700deeebd154b02706c89513cc7
MD5 74a619806287559f32b42098d95dae1f
SHA1 eb4e5afb4c9f13bf1d8d8fc59b76c2d92a86bd24
SHA512 f71bb095a7a485c9031b63433fd9771dace789a0eb550d193da6eb9c31a224e0a0118ff68467efb1cff9bf853f597e390f86f4cda369996211fab53d90d17fef
TLSH
T1FF412C5CBAF90144B3B76E1A9FF6A46E487A79772E06D49E10110E4E0B73A01DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download