6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-u2376m.htm
Size 34KB
Sample261001-n8evbasajd
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3676	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{AFC264D7-DF2F-43E3-82C2-8C87107E2CB2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 872	3544	msedge.exe	86
PID 3544 wrote to memory of 3676	3544	msedge.exe	88
PID 3544 wrote to memory of 2704	3544	msedge.exe	89
PID 3544 wrote to memory of 2704	3544	msedge.exe	89
PID 3544 wrote to memory of 2704	3544	msedge.exe	89
PID 3544 wrote to memory of 1936	3544	msedge.exe	90
PID 3544 wrote to memory of 1936	3544	msedge.exe	90
PID 3544 wrote to memory of 1184	3544	msedge.exe	91
PID 3544 wrote to memory of 1184	3544	msedge.exe	91
PID 3544 wrote to memory of 1184	3544	msedge.exe	91
PID 3544 wrote to memory of 3204	3544	msedge.exe	92
PID 3544 wrote to memory of 3204	3544	msedge.exe	92
PID 3544 wrote to memory of 3204	3544	msedge.exe	92
PID 3544 wrote to memory of 1856	3544	msedge.exe	93
PID 3544 wrote to memory of 4968	3544	msedge.exe	94
PID 3544 wrote to memory of 1856	3544	msedge.exe	93
PID 3544 wrote to memory of 1856	3544	msedge.exe	93
PID 3544 wrote to memory of 4968	3544	msedge.exe	94
PID 3544 wrote to memory of 4968	3544	msedge.exe	94
PID 3544 wrote to memory of 1432	3544	msedge.exe	101
PID 3544 wrote to memory of 400	3544	msedge.exe	102
PID 3544 wrote to memory of 1432	3544	msedge.exe	101
PID 3544 wrote to memory of 400	3544	msedge.exe	102
PID 3544 wrote to memory of 2600	3544	msedge.exe	104
PID 3544 wrote to memory of 4724	3544	msedge.exe	117
PID 3544 wrote to memory of 3816	3544	msedge.exe	118
PID 3544 wrote to memory of 1668	3544	msedge.exe	119
PID 3544 wrote to memory of 2444	3544	msedge.exe	122
PID 3544 wrote to memory of 2444	3544	msedge.exe	122
PID 3544 wrote to memory of 4612	3544	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-u2376m.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffaacdec188,0x7ffaacdec194,0x7ffaacdec1a0
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,10531869053312580488,3760821715566252596,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1063412319521639042,1982083076897416823,262144 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,5028679446363866775,6934472746271264813,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13023276342322525459,9916311306975119859,2097152 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,8552910406028657399,9324629596067110414,2097152 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,14522991921054191500,9819192975570681937,2097152 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17448423421734285146,6521462183804443423,2097152 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2959661824183415039,5954551081664775972,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5743957335763075619,17330302168808457319,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2766094132574889179,8858467289218026073,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2766094132574889179,8858467289218026073,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,2377911232059345850,16953760883171993001,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,14644480033035865123,3300060894211856996,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,1368535481344567756,7338034680289658180,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14820842593940936710,3675697275699811819,524288 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,4676582675370969440,8640558161615533684,262144 --field-trial-handle=2348,i,17794238558361302598,11998286885096768565,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1a13817694bf733c386c7b7fbd25453b10ffd71ffaf6a7a1f8511259d528df41
MD5 92c9ef219902c1f5660e681bd280438d
SHA1 5e30f492ad5d84374fa42d86ebc75bcab5d9a1ae
SHA512 d74d3d0554683abcd1bab93ac522c7e644c3ca3f5049fed6ae50b880ed24978cd87a5d52f33c0b28eae85f7901e6fac0eea4fc319158a7bc0098e021f2a3f086
TLSH
T18B615F8F46D9C867FBF896B296F5938236F8A6825B431DC130E4D879D82EB53F109200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594d2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594d2c.TMP
Size 3KB
SHA256 266117962f5c03bc0443500e31cddf1b940233a921da3b68ddd5b10ae58adee1
MD5 60d6c11428ca58d8cae40b42f85fa8ec
SHA1 1e231a2db50294dd35978b68b8d8f7b02b691488
SHA512 f92fea89512c5874f38d1a5f4d29c44887c8f9b83ccade57d8bd841e7fc75fc63bab14e7df6bcfafc8352ad467388705ab2446ec982ca58dff63c79eb9508390
TLSH
T1AC613E8F56D8C867FBF895B296F5938336F8A6825B431DC130E8D879D82EB53F149200
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 de6c2ed7dc165ddd490153219991266e9edefa64e3a0d8587145dc300e5581d2
MD5 6f7d3ef5acee2ef9c535d42b2fa2260c
SHA1 11aae6f6aa23a132253a020352ed0db871f1f58e
SHA512 a4a68f8dee914c3907a587d9d4d5fd1b89ab2ed312ce463135da08c916ef040ae6c424166e610428a1661ea200fe7d676171f28f1de83fb28b3055c5a209cd93
TLSH
T15B11BDF3C3D595AE890516F06A24AE2BDE1D0606821C3C1A89D4EF6BC3F3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b857f593ff8e98014741d6107182e4592014c986820e08d1ae2f0895b92c64ed
MD5 8083570f3555aabf442c470aa4f0c349
SHA1 af24b8ed51479089a325b1d3b7a7362d2cfec50a
SHA512 a69ae8b608b3c1b14cf22a6c8631fc6009656f839c4b5c046226a63c6493d37377b34e89bf6249ef495859e1471f918cfb537b0e57911407de03dc0c96267ddb
SSDEEP 192:sxZSRXWw/ftskoWIdpdzHW6+WNGY3R4e+WIgrJ:sxZSQw/ftskoXpHbGel9
TLSH
T19C12B6126E28A97B8CC7D21DBB25BF53E6F9503291941E58BAFCC61C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 063d90660188e771cb0dc91ea82ed3dbca28674c6fefac31e24fe51930ccc869
MD5 953a35765185b0f95a03e4cfa7734afe
SHA1 f5ee368d45e373993f9bdeff1832fce78d6ffca6
SHA512 f530682e26593af42b36806a6562039bced263e0ecc09bbf470f562faad7e87d619b5afca2d31adac8cc61246a08cbd8ffb18e30929c7acd55b38b568b95a9f6
SSDEEP 192:sxZSRXWw/ftsLJWIdpHzHW6+WNGY3E4e+WIg5kJ:sxZSQw/ftsLJXTHbGFla
TLSH
T1AC22C8526E28A97B8CC7D21DFB15BF53E6F9507291941E48A6FCC61C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2f552e01f8b6674bd7455aed9847901b4139d3fca38f015ff9cfaab0db2aa097
MD5 a77b5906ff1831ff11c34b0700d1d553
SHA1 9d5e50be886e146d7796ba15cb7ae5a3c64d9037
SHA512 79082c5eeff0c259ce1a86caa47c09a303dcf14ca680b62ca445679f0cccbd1ef069ea802599fc2c33f3d240aae4ded6543dc9f0536a02f216b76b9757315a6f
SSDEEP 192:sxZSRXWw/ftsLJWIdpdzHW6+WNGY3u4e+WIg5kJ:sxZSQw/ftsLJXpHbGXla
TLSH
T1B122B7526E28A97B8CC7E21DFB25BF53E6F9507291941E48A6FCCA1C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 353cda7ca2521f05792e398af2fe0923a7c2e180dfe00529a87a39bd7e430018
MD5 d4bfadc73550da964d2630913afa4511
SHA1 201228dc345eebf6ac2f1a928f44f60b42b7cfb0
SHA512 64a8e41f0bfd3c6e7d308e5eff5b344ec4fbe4fe96519106f34809a9ed5ea55244c030c08a13d75f217e6c667adfd0ad3a9b01420499e9e28e281f8b68f7b354
SSDEEP 192:sxZSRXWw/ftsLoWIdpdzHW6+WNGY3R4e+WIg5OJ:sxZSQw/ftsLoXpHbGelA
TLSH
T1E122B6126E28A97B8CC7D21DFB25BF53E6F9507291941E48A6FCC62C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 af1833134efe64fd47a83c9512fdcbca6d0b486b77d4e32dc9488e8377b22883
MD5 790fd229f7d6a84450aec6ba861a1fcf
SHA1 b3b70fca03c6d494be49e08c2b90b0d21a0d8eb6
SHA512 99916e8681fb6b6f6aa45960fc6f91fe255f961829fa32a930aef3cd865099605ce5878855a0940eabd34e58e49b7398fc96a7ce5fa46bbe7b8cbb1981c720ff
SSDEEP 768:8w30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72zrolZMG:8w30AbSWvS2l9u1jaLmLZ12AZ
TLSH
T189C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA511B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e8a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e8a1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b42d06edfaf6682b22d4d94517c60c2492f7757fb73b63b62ee5089f9cb4fefa
MD5 56e38d7acde4af253837929033e4133b
SHA1 cd9a8a0072a90f7a1f1f05670a98373b0f5a7b9c
SHA512 16a160381fccc0a9eddc438c742b8b5816f479e8fb9f2e26c38673016c916c57f420a47108766184d32d3c2e2075ea5baba46a2c2a6143ff729397e96bd83c19
SSDEEP 384:PiFiZcIGzsN18TUNTUlIlHa5/9pujK99iX5F71sFq7JeVZh6DKhHWhoo:aFQ20wg4F7ja8OefYGHWh3
TLSH
T111A27C7398A8997B6DF7EA44F50632039FB450A3CAD5AE94E6DD9B2D00D71D80307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3681fa277d679a4a7bbed84b417d1ee9a47c2b88b879daa2fa7d97a6c205f5ab
MD5 4e995fa9885b82fd1ab1f470ecb15bb8
SHA1 1b1650ea1711e074e731333185c0476c198b784e
SHA512 ce8b6f8249dfd296fc02059a5da150da3cd38569ec29d06b81b5a924c7274e8e2793fc4c006c0309a7da0739ae1986b7e945b90151f10d4a802a676d35d49368
SSDEEP 192:LON/6AmwprQmiUyzk6siX5F7wksF+JihpU6:LON/6ipdv6siX5F71sFrLU6
TLSH
T1F502F935BD686C7B8DF3AE45F14B37239FA5116BEA942F84C9E81B2C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7c89a21fc4c546da59ba17147a66d17909d4858c5927133a5a94be731b56b16a
MD5 7d7a1090bc8ac4031cbe4da60a922a38
SHA1 fdfb93c5eaa7128c129fa46607c88744705a0a8e
SHA512 8c53a03f72617a102e30b1b6bf95d82dc286a4b063bd046d302645656d27c3ba3055f7b479db269782e53bf3446d9f40d96e6b9c1639f258c11b5928b7685443
SSDEEP 384:QZcIhsN0U2a5/9pujK99iX5F71sFq7keVZh6DKhHWhoo:uhkF7ja8ZefYGHWh3
TLSH
T192829C73A878AC7A1DE3E544F44736039FB490A3D7C86F84D9EDAB2D01EA594170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8e33fc916fb815557f01d211d10ccfba137828d38ebd7a83b1f139784077cb94
MD5 51849b9e17a174cd8297057af38043ce
SHA1 1e43b7a81da6831833357584f3cd0d34aa27f9e6
SHA512 f75188d72488883b210d7230fd8d94501e9da5481c53414be198c3f2ef8b6acc42a524b51e73edf9ca62407460e3535b3ff81dd4276aa855c617674d3ce98fde
SSDEEP 384:mZcIhsN0UHa5/9pujK99iX5F71sFq7keVZh6DKhHWhoo:0h/F7ja8ZefYGHWh3
TLSH
T1FD829C73A878AC7A1DE3E544F40736039FB490A3D7C86F84D9EDAB2D01EA594170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 606c264a10e0282f545e1e66638f780cc7e50363b99d4e9a445040660a0ade0b
MD5 823c6ff887a208377855f1d02eaa9d6e
SHA1 46632aba48c5456336e84fb4ef9690dbd5630343
SHA512 e9943217eb230c354e232470eb4eff0a3a574fcd06fae1d91c0f77d5ea44eb4fa8f2a48e2362fc7b082882bf152336c05faa430c69c130753805da6e973ac903
SSDEEP 192:LONe6AmwpPQmiUydkfsiX5F7wksFqwKPeIlRCqeU6:LONe6ipRbfsiX5F71sFq7DeU6
TLSH
T1AA123B32B878AC7B4DD3A554F04735139EA55177EB886F84D9EC2B2C02DB59C530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa4495fc856cdb8ccf53c44c51d8e5e774cd4908589b3cd2bc17b6eab0de6ad3
MD5 6cfae2dc34d4e8caf63d310b638c9da2
SHA1 fb7ed242fef63a772c8c8a01725fe00b373c3383
SHA512 334c3edc5f1a715ca6a24baa8dbd797eb70ab369c8ed658ef5c782ff17f389ab80936cd358073ec645f78eeabbac20b4f6ddfb5c3f109b641aae2556d5e781d8
TLSH
T1C141095CA6FE1148B3B76E569BF2A82D843BB8772E07D4AD10110D4F0727A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download