af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-sxmtal.html
Size 214KB
Sample261001-p259csvfjb
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{056C8FBF-E0D4-4977-A027-698C9F1F0D25}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3752	3668	msedge.exe	85
PID 3668 wrote to memory of 5104	3668	msedge.exe	87
PID 3668 wrote to memory of 3040	3668	msedge.exe	88
PID 3668 wrote to memory of 1080	3668	msedge.exe	89
PID 3668 wrote to memory of 3040	3668	msedge.exe	88
PID 3668 wrote to memory of 3040	3668	msedge.exe	88
PID 3668 wrote to memory of 1080	3668	msedge.exe	89
PID 3668 wrote to memory of 1876	3668	msedge.exe	90
PID 3668 wrote to memory of 1876	3668	msedge.exe	90
PID 3668 wrote to memory of 1876	3668	msedge.exe	90
PID 3668 wrote to memory of 3216	3668	msedge.exe	91
PID 3668 wrote to memory of 3216	3668	msedge.exe	91
PID 3668 wrote to memory of 3216	3668	msedge.exe	91
PID 3668 wrote to memory of 4476	3668	msedge.exe	92
PID 3668 wrote to memory of 4476	3668	msedge.exe	92
PID 3668 wrote to memory of 4476	3668	msedge.exe	92
PID 3668 wrote to memory of 1384	3668	msedge.exe	93
PID 3668 wrote to memory of 1384	3668	msedge.exe	93
PID 3668 wrote to memory of 1384	3668	msedge.exe	93
PID 3668 wrote to memory of 5008	3668	msedge.exe	102
PID 3668 wrote to memory of 1176	3668	msedge.exe	103
PID 3668 wrote to memory of 5008	3668	msedge.exe	102
PID 3668 wrote to memory of 1176	3668	msedge.exe	103
PID 3668 wrote to memory of 1528	3668	msedge.exe	106
PID 3668 wrote to memory of 2312	3668	msedge.exe	115
PID 3668 wrote to memory of 3472	3668	msedge.exe	116
PID 3668 wrote to memory of 1856	3668	msedge.exe	117
PID 3668 wrote to memory of 4224	3668	msedge.exe	123
PID 3668 wrote to memory of 4224	3668	msedge.exe	123
PID 3668 wrote to memory of 620	3668	msedge.exe	125
PID 3668 wrote to memory of 620	3668	msedge.exe	125
PID 3668 wrote to memory of 2896	3668	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-sxmtal.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c4,0x7ffc8544c188,0x7ffc8544c194,0x7ffc8544c1a0
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13737067157685140638,1540874456109530069,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6953057890289432960,17798514768611652854,262144 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,2881362642204518740,16615383542137886042,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15069064984256339783,15163583286354839106,2097152 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2022879365474286195,16430607264537207986,2097152 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16669622408473035774,11852737071513306570,2097152 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14499296353076295415,10180366259112386016,2097152 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2831922377694184961,16487777920123530688,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10312905813791464588,1020506627623099433,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,10130892324703331752,1112369221484699544,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,10130892324703331752,1112369221484699544,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,4775283302849679206,9291299710732818236,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,3980003089216787983,5299508874197598409,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6465526593252675092,18308357404580667115,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,15214961044616697583,15369058867412299567,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,4327079288488582504,6328870636732900193,524288 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,9106621736186106075,1705636726517823085,262144 --field-trial-handle=2416,i,10095580554060143309,5219838282841511135,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e4728e64df2a6763ee4b3e4dfcdd67b2ec1abe254b5e17f72f034464355d109
MD5 3f02b41beeabc8beff080da285fd392a
SHA1 39b2cad7aade091ac9aa9b45361922e8f7304423
SHA512 1ece9c8e83a6dfd0799c8f288ccf1709d3402f4d3f21fe3ba7acb9ad7d9d0dc673df0556976dcbbde6ba72b4eaff18bade2dd4d0ae81b32b4e0c50efdcfa5222
TLSH
T1FD613B81D3F070A1EB9870B061D91E9736F885B2A3835E6612ADD5F4AB573C0334D1D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f94f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f94f.TMP
Size 3KB
SHA256 429a9887151ade26c3c190b52bf820eb9931a6579c4ea26322ce1c0155b148ed
MD5 3b337e1ce35deaa734d60e7234c338e0
SHA1 369a7faf1a9158d8ee7d5cc490ca916e7486651b
SHA512 09179060e51c0118401908896ddad339ce966b9ef27f12c1096f4311f73d99c9d3af417c8159b0a4645b26f9e68a7ec77b9c1223f0ba4d7f92d93c6c46102882
TLSH
T122613B81E3F070A0EB9870B065E91E9736F885B2A3835E66119DD6F4AB473C0334D1D3
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 942d9b839739195e32a910c0d24b561b0a52bfb1882daccd9a91fc5ebab63d7a
MD5 c56611b5053f5abc058892d1294296ec
SHA1 a07dac148eec29dccf0816537d7dff41cb6f7f24
SHA512 cf142fbc4df1045b5f328b72b96d4976175f7df5ea11ede5651de46c9b51fad55e8ac177883608828aa340cdd73f941aa9ad894cbfc263bd53dd3ecbe0299ec4
TLSH
T106117DF3C3D5D5AE890516F05A24EE1BCE1D0605421C7D5989D4EF6793E3475E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a9e51b2d62d56be566c89d771f1319e2b1200e00e6532f0b968440ea40070519
MD5 5fa1e0828d8e5d260d889f9404bce982
SHA1 4d94a76006a3a5c30e00fd9a291f4d6a16936281
SHA512 ff991d4c3144e7f3c761db884a8d99144ceda6885c01062b5b10c0dbeb85c3b16c29b0345f1eec573adfce19b65596e2d2aea54170e58c8ba7d9c9dfa3af1b72
SSDEEP 192:sxZvRnW5/fNsIrLIdpdsHW6+WNGY3RUuIgrJ:sxZvU5/fNsIrUmHbGq9
TLSH
T16312A6126E28A57B8CC7D21DBB25BF53E6F9503291D41E58AAFCC61C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8416dadde7c6bbc355118c0e5aefe6e6089f473887e77c4c2a1562baed526cc7
MD5 669e9dbeb5fb827709850d9c26757c12
SHA1 b189300bce3c0e6b50d7d4259a45de885a7897f8
SHA512 107cbda8ac878ffdee0f02f1304187930f843847b41add4f57f8d49dcb9d2333f917f59f12c5fd9f7ad25da1d178be3d15b3193d33bf8287023ed129f33066de
SSDEEP 192:sxZvRnW5/fNsNrLIdpHsHW6+WNGY3zUuIg5vJ:sxZvU5/fNsNrUMHbGsP
TLSH
T14622A6526E28697B8CC7E21DBB25BF53E6F9503291D01E58A7FCC61C05E7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7e16456431d065e882631e1078c6ea565848096193831d43a68e731020979a33
MD5 1187fd22aea2ade1e69152acaa1fdc32
SHA1 aa8b771b7364bc90dac97935f26cfeb4dec4dd4d
SHA512 d6f6896b32ef5d9624c6636d8cdf8de8f99519aa512f972eec5ead74ecf5a1bb3f1bd51df7d7ee6ad09bcb123614b5934632a47cadd600d715054c586e23e4d9
SSDEEP 192:sxZvRnW5/fNsNrLIdpdsHW6+WNGY3LUuIg5vJ:sxZvU5/fNsNrUmHbGOP
TLSH
T1D92296116E28A97B8CC7E21DBB257F53E6F9503291D11E58A7FCC61C05E7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d3381918a7c2ad919ed6c8947dbd34a66522fcecae6f30f291b622815aab6010
MD5 da216d4a71c3e0f607546b0d9dbaddf9
SHA1 070574a3675a480511cb01d94a6181cd96d4185e
SHA512 801d34289908a021b520cd5caa13a031f4658ceef6a399d0dc18543edc80b1a39ddbc14222b262c5c0b19cba3888d02f193fc99e3baf1ae4b8591a8a72852eb4
SSDEEP 192:sxZvRnW5/fNsWrLIdpdsHW6+WNGY3RUuIg5FJ:sxZvU5/fNsWrUmHbGq5
TLSH
T1C522A6126E28A57B8CC7D21DBB25BF53E6F9503291D41E58ABFC861C05E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ad2b0a982ff89366bd9332a3cf4256fa0e4a56d88f0cb5b837f4e3c1115d79cf
MD5 76bd21cec883a5275c08dd040f37b5af
SHA1 cca0f257202ee90b71224e9fc14d4729afed5a1b
SHA512 1734a32b61936d3f00deed3b12d98143df2ecb6829b793fdf77d93220361db7592360d9e5e11a389154ff3d7e5c8bf5bd245b422da83ea57adc97d9253880866
SSDEEP 768:aG30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72drolZM2:aG30AbSWvS2l9u1jaLmLZ12W9
TLSH
T150C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9802C796548D4447FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599570.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599570.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9d0d2c6a94e49a834aa4819fff55b861be0422de6e16c252ed851f737ad5b7a8
MD5 4bd1403160fdaa05f9995d3dfe575e33
SHA1 46550b4e9d1bf5fc70c40a9a32ee79df77b7d425
SHA512 9b390fa168ba7b7999b1db7f2accabf1bf839dee83190cac37b1be249dadf6b6f5cfe09d091e5c3a7fdc20dd2e3b9e5de267e1b4caf97f69c5e67ef75a725e32
SSDEEP 384:RZcIhsNvFsEpuHYh49iX5Fs+s9soi+2x6VZh6DKhHb/row:5h7E8Q8aQUlx6fYGHf3
TLSH
T1C8827B32AC7C5C7658F6E641F4473A039EB89167A7CC6E84C5EC6B2D02DB998130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 18bcbbba683102251f652211820cce6b3099941bd85f9f1d6f766fa839dadefc
MD5 caa7da3482997cce8ae02f76eb49b266
SHA1 60f23b591b42dafabb2d805358a3e0e4e95bfd3f
SHA512 8c6da799568079b32868469511199044613bc0b122b58307e9839f59a4c169361e97c9f49d312fd07a87e13107fe636f7bc0da627b351083e6aaa9dcb1ed867c
SSDEEP 384:2biFiZcInOzsNR8TUNTUlIl6sEpuHYh49iX5Fs+s9soi+206VZh6DKhHb/row:22FQnO8wgnE8Q8aQUl06fYGHf3
TLSH
T10EA27E339C6C897B9DF6AB41F54A36039EB890A7C6C9AE94D6DC5B1D01DB4D81307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f154c3fbecb05c551dff07e5f1bf151ee27ee2d6390f88339bbfbe560ba5c86b
MD5 9859491a592bbade3037ee551914e975
SHA1 0ae1d141e6bddaa3a858420b0fff66d47e34b1b3
SHA512 683b7bd10879617781a0420c2e2c22dd1dcaf042f85bdfb308946031bb95be7e224275068488c58594080bc74bc35992c3172d18b38ff2f6d703555c341ed2fd
SSDEEP 192:LONs6AmwprQmiUyq+6siX5FrY+s5JiV/5U6:LONs6ipd46siX5Fs+s+DU6
TLSH
T15502FA35AC786C7B8EF3AE15B54B76239FA9117BDA941F84CAE81B2C01D764C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d625a0a7f902704d99b5fe83adcb43bddd1551402a02fdd10fdfbad1cd8ce662
MD5 a948351af001060fc5629534b8a2e739
SHA1 84fbe19e157279ad0d17126d0741d4527485054c
SHA512 1dce7939d3bc89435691bea52fdb90dd3cf08e7ee1675703a2d1438dfd6781d4a380b8f1686c7a35ae123fdece0cfab9e9c476d3403d0fe3a5de75aaacac5577
SSDEEP 384:2ZcIhsNv6sEpuHYh49iX5Fs+s9soi+2x6VZh6DKhHb/row:kheE8Q8aQUlx6fYGHf3
TLSH
T1FC827C32AC7C5C7658E6E641F4463A039EB8906797CC5E84D5EC6B2D02DB998130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a365b12d6c266d049bb07a796ce24b5d4506aa4ba2913a27d5d1069ee77e801d
MD5 54d9421568160005205993663d394893
SHA1 225a7f4a26ba3ea553aec6808f1438c837afaeb3
SHA512 8ed11fc0f65e127c55c6775839ddb1f61b507823b38cc21b9f2adf9cb2ece0eaec6bf4d62472abf345058d9165f88572a3f8318afd3d7a880975ef76af6e3881
SSDEEP 192:LONy6AmwpLQmiUyX+IsiX5FrY+s9ssFi+2JlRVbq/U6:LONy6ip9LIsiX5Fs+s9soi+2B6U6
TLSH
T1CD122B32A8685C7B4DE2AA51F08735139FA95267DB886F95C5EC1B2C02EF59C530E823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0e8825fcaec6fa340d0e5540ae4c311b7fd3b34b3584b61fe906ea9c9416c9b
MD5 ee5c092d245a6ce2e620d604b69761d3
SHA1 16571cfe7cd469782f3653f36bc9f08a84081093
SHA512 9d617970209c6d65a8c7fae9b84c09015499df723687342938e2204ecd3b01d5cad80e685cd91d22894e2a6696a67faf29077f003716f2d736d0ed0f520d62ed
TLSH
T149410B5CB6F91148B377AF5A6FF6A86D483E79772E07C56D40110E4F0626A40C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download