5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-k7op5x.htm
Size 1KB
Sample261001-st5veaxzhy
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{281C2AEB-F7BB-40C1-8C27-C34D551D2A9E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4592	3048	msedge.exe	87
PID 3048 wrote to memory of 5112	3048	msedge.exe	88
PID 3048 wrote to memory of 536	3048	msedge.exe	89
PID 3048 wrote to memory of 5112	3048	msedge.exe	88
PID 3048 wrote to memory of 5112	3048	msedge.exe	88
PID 3048 wrote to memory of 4576	3048	msedge.exe	90
PID 3048 wrote to memory of 4576	3048	msedge.exe	90
PID 3048 wrote to memory of 1364	3048	msedge.exe	91
PID 3048 wrote to memory of 2020	3048	msedge.exe	92
PID 3048 wrote to memory of 1364	3048	msedge.exe	91
PID 3048 wrote to memory of 1364	3048	msedge.exe	91
PID 3048 wrote to memory of 2020	3048	msedge.exe	92
PID 3048 wrote to memory of 2020	3048	msedge.exe	92
PID 3048 wrote to memory of 4812	3048	msedge.exe	94
PID 3048 wrote to memory of 4152	3048	msedge.exe	95
PID 3048 wrote to memory of 4812	3048	msedge.exe	94
PID 3048 wrote to memory of 4812	3048	msedge.exe	94
PID 3048 wrote to memory of 4152	3048	msedge.exe	95
PID 3048 wrote to memory of 4152	3048	msedge.exe	95
PID 3048 wrote to memory of 1648	3048	msedge.exe	101
PID 3048 wrote to memory of 1428	3048	msedge.exe	102
PID 3048 wrote to memory of 1648	3048	msedge.exe	101
PID 3048 wrote to memory of 1428	3048	msedge.exe	102
PID 3048 wrote to memory of 4164	3048	msedge.exe	104
PID 3048 wrote to memory of 3040	3048	msedge.exe	113
PID 3048 wrote to memory of 4916	3048	msedge.exe	114
PID 3048 wrote to memory of 1472	3048	msedge.exe	115
PID 3048 wrote to memory of 5116	3048	msedge.exe	123
PID 3048 wrote to memory of 5116	3048	msedge.exe	123
PID 3048 wrote to memory of 3028	3048	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-k7op5x.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x214,0x23c,0x240,0x238,0x2dc,0x7ff93291c188,0x7ff93291c194,0x7ff93291c1a0
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,9799816370852832929,11313842471671732342,262144 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,5656195749151609335,3458930079777099882,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,14206562461628959505,2726084526991479362,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2353733791947170533,12949128629940613365,2097152 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16221694503533955036,8396014201878018974,2097152 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,4465197057727730198,4316990098843562606,2097152 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1667177768683649952,16938331457242336340,2097152 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,2608532363712408015,3647978692330950755,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,8516252855987607619,7058111550705881786,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,17847988237410682947,12332261308429903619,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,17847988237410682947,12332261308429903619,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,4674988421887926420,10936512082570513185,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,5304996191475046389,11304441730549214215,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,14841027085072608179,12442106932439964284,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9509521903888196864,967092733369642404,524288 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,10152211169510523256,10790484243209412380,262144 --field-trial-handle=2216,i,8405537363533477452,8861155656644150099,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f5a49242ad1de251b33a545de9994e04e5168c7b16183281a66729287c8d89f
MD5 1134c24e0f8a967aeccf4d8ecaa1f166
SHA1 c1bf0694d17dc607c44a29543adca09ee75c87fa
SHA512 bbf5b69c7e020474ee920a7217c76baa6607d30afa15abce300315cf0126d826f6a11775d7c480a47a567b2ada469738e0cce6e45da03d33c9bc593bf4830c1f
TLSH
T11C617479AA70E2B9FFA84479D5DA14CF39325D95B447BEC30EB4E87ACCB630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c53f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c53f.TMP
Size 3KB
SHA256 0670b89d58273770adfe6bec62e23b1b94a96b6860c701f61c58b97ac0bbf894
MD5 06b7f2e9dda7e6c38dea286bc278fa54
SHA1 1360d6c93e121a68437add2b740de7e649c0c3cc
SHA512 2a704650cdc049582dafa4f758ac236a73a136f38d78658ba72cb3810d5f159cb760e54f081997d410b81f94b88ec2a4ec945f94d71d7d32325a08276f1bb9e1
TLSH
T10C6184B9AA60E2B8FFA84479C4DA14CF39325D95B447BEC30EB4E87ACC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 13f73748334d9c2b0faa01579a4fc3aa4dff6293017c62d19b6a90c1852976fb
MD5 c3e96381158ba2253d86491d2dc21661
SHA1 4a3cff018486b98196b96b1ccbbf4a1033cdb788
SHA512 d2a10850c04b8f6cff48d0cdbbcc4902de27f9fc7f379141a64b0c639c80fcbe2781ecd178abfb90bd9b820b16faf2efdf4d813efd87e21138d657f38b4c4add
TLSH
T1AA11BDF3C7D585AE890116F06A24EE2BCE2D0605421C3C1989D4EF2B93F3075D00199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0d84c26bd6fd70e2888acca8133833476918e4d3eb2f4b6f8da9a6f751288d2b
MD5 691e02c336aa41dfdad642f627ed2ae4
SHA1 35d65fca509ed8120e542536907ce968d52751cd
SHA512 174a40b4d68913a12919c12b066bcdd09616a1132f5a090e18c1c94880e2dfe31b5c4456824e2aebc95e2a1ca4ecc62a5310064bac7129912ea4139dade39185
SSDEEP 192:sxZARyW0/fBsv1cIdpdXHW6+WNGYgUjeIgrJ:sxZA30/fBsv1FJHbGl9
TLSH
T1941298516E28A57B8CC7D20DBB55BF53E6F9603261911E48AAFCC61C04E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 52ab33ae1a4e4e334379ae264090ebc8d74321affd6d5e800b6d3566abf7fa80
MD5 0f6dc26cca840a45ca901b060284a3d7
SHA1 57e72047e719c37e708436b3ffb0fefbd46e2a0a
SHA512 75cc5111c6106ceaca074b5af808fd7d424ca81ab304837b5c13178e470c2b59c9939017ef077be9e90bd3f14e0cc468b4b476128dd4c0e2baeb820f4d71d555
SSDEEP 192:sxZARyW0/fBsF1cIdpdXHW6+WNGYgLjeIg56J:sxZA30/fBsF1FJHbGoI
TLSH
T1A422A9516E28A97B8CCBD20DBB55BF53E6F9603251911E48AAFCC61C05E7BCD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7ebff73b598bd67b9dc84120842127d9a6ef53b87720f36092a2ffba4379bb2e
MD5 92a3ae7f919759665535b0060efb114f
SHA1 c8b3043af8020180792bede63a898a80d22c3ef6
SHA512 b463bc1cedb927d8d3813a230dc449fb10a7882051e2fc6ce3fcd615712bc90d5e7d23593d400a0ba854e19503484ca877d2c38c0ad5da7a08a8a543564e33ec
SSDEEP 192:sxZARyW0/fBsR1cIdpdXHW6+WNGYgUjeIg5YJ:sxZA30/fBsR1FJHbGl6
TLSH
T1C122A8516E28A97B8CCAD20DBB55BF53E6F9603161911E48AAFCC61C04E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e1b78718676a11c18416fdc02d92a3f178f8e078e14be4e92198d0edc0845d92
MD5 634fc64e75e5493b170b1fe029188bf5
SHA1 45fb528aa84818d8bfc2032d81b5f8ca37c6538a
SHA512 60e307d9217f3bddc84cee126d55af26b1af45991f8e40c32e081ab6e3605d5d3742e9eb9c458b44ea7a50c0b2cc7c37efe21bb24722238c1df930b6fabd6cc3
SSDEEP 192:sxZARyW0/fBsF1cIdpHXHW6+WNGYgEjeIg56J:sxZA30/fBsF1F3HbGRI
TLSH
T15922B9526E28A97B8CCBD20DBB55BF53E6F9603251911E48AAFCC61C05E7BCD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 22e291800f89f07fc75364f370168413293bd99da730e874d9deb7c5901543a2
MD5 a7bedc04aa26b1ff644f54a5cccd66f0
SHA1 7e03339fd6a4c22ab161465026c3405e112cb7ba
SHA512 843902fd2cd28e7b4592d03d3823fa66c59cc409a7ce45f7052dc351ed0b890e30f42be62cbf11e75c65bd59f905520926f31b9c8796549f2a623fc87d03a1d3
SSDEEP 768:wRichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzzroNjuM:wRichfPWvPZplu1jan+LKgzAsM
TLSH
T14EC2E93B640CCA7E4FC01A9DDD1A6F967E9802C7AA688D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59619e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59619e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 272f2be3e8b5ccbd324c4a51149701f9cfc1b3cb6cd6badae8c0b00b9ab29e57
MD5 a56f057a4e28dd6506f4a1f20ccede96
SHA1 26eebd6cec96a375ff3d6d95f4543d053c62dd68
SHA512 9635484c089784a69f756910c3ba5ad50685c2570b51987a7f68a1d626ae58f59002b3c48f64b7acd29d8ffd772eb39fbe753b9b69a72c44488dbcb83503a5fb
SSDEEP 384:xZcIhsN8zkS5/qt4BGYX5E0S+YpDtXVZh6DKhH/G/oT:ZhRwtiGYu0SVpxXfYGH/G/o
TLSH
T1BA829E729C789C765CE7A282F94B3A034EF8A11797C96F80C5EC5B1D00DF694131B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2a04b30f9c4f2e1b00847f37bdbd5cd8c56cb988e1609485241c52673ca11add
MD5 79794bdffeea15517d67d0109798a108
SHA1 6d04bc10ff060d3b4a071bf721c8a9efc66fc4b7
SHA512 29a47d5e5374ab14cd346e8571eab974fe0b12d5db608bfb8438247f508018c55a483b223ff7d6503fa9b4de1705e8653a807ef11c92167c60df3ad70bb73d36
SSDEEP 384:+iFiZcI/zsN08TUNTUlIlmkS5/qt4BGYX5E0S+YpD1XVZh6DKhH/G/oT:VFQ71wgewtiGYu0SVpRXfYGH/G/o
TLSH
T1A5A27D738CA8D87B9DFA9B81F94A36038EF45167C685AF90D2DC5A1D00DB2D81307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d66fa1ca0f1f0e9f034d4fc29f44c21a57c7b9339c2b6679f68c3548eedec6c
MD5 b4286715f43c3c36223bedb6c8cd6574
SHA1 f785146e32e22ccb97fc89742b098fbf8ef06457
SHA512 d34f62121969ac4719a40c79979684e1280eb5d53f706990c9d47907cf18c816518a7b83f198db50902eca93aca7ef326c63be0c43d49bd6c491211ddfea9561
SSDEEP 192:LJONc6DphmqQmiUyi5q8wGYX59ezVCNY+Yjkk7vr/U6:lONc619PRwGYX5E0S+YbjU6
TLSH
T1B902EA35E878AC7B8DE36E45B48B27235FD4212BAA946F84D6E81E1C10D769C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 766686b4ec73fd6b4d847c323fbfef0e0bab279712b4a2880f78a5479da6d28c
MD5 309b19027c407f3c00a5201883ad77b6
SHA1 1d4aa5e99d9b8c87af4b9d71ad02ed7b53efc6cf
SHA512 3e7b80ccdb9971c1ce59ea347803f671e4bfe13e03387ba1205b5bc95fdf001bdef4a0567b8b178c05ab23d1a7b02c4573ade9f4946d5368fa9fbae6a3f25728
SSDEEP 384:rZcIhsN8mkS5/qt4BGYX5E0S+YpDtXVZh6DKhH/G/oT:zhcwtiGYu0SVpxXfYGH/G/o
TLSH
T1A7829E729C789C769CE7A682F9473A035EF8A01797C92F80C5EC5B1D00DF698131B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 03a2d5ff96343ff3907b6866e7262b79a4f955787f3cc858d1200d9fda2560be
MD5 5199b5354ad8856aaaba57ac7bb824e6
SHA1 b995f76d3ff019ccf1a1b48427c7eaa4f07ef44a
SHA512 2761854cf2cdf01682de87a1508b69aadc735fa38002b7aa2bf72960e90b064a489d436d71a4701b433cd61b00ce8771412f443e79aee1bce6a864c05ecd5ed6
SSDEEP 192:LJON16DphYqQmiUye5SwGYX59ezVCNY+YpDyeFkIIqq5D1U6:lON161L1SwGYX5E0S+YpDUXU6
TLSH
T16A120A36E878EC7B4DD36951B4873A135EA4522BEB857F94D5DC1A1C01DF29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9d6e2ff-0a05-427a-ac58-404c7c50570f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9d6e2ff-0a05-427a-ac58-404c7c50570f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 97d0fa9d6b01423e9e7f78b1ffe690c30134ed1ef652aa0dfb89e527fdc1b3aa
MD5 26a70006811b2b35b181c6c5879cfe43
SHA1 1826464d4ac5bf10a997505a2b57b10946c3517c
SHA512 8e7ee0a45c91f50ded2c69cab7ebe36f31c2f3df702705368e5f77801696d1b1ce227fdc54bb94d60117fe52304fe9dbca2a9a563175dc381b2043bf6a0f3938
TLSH
T15841285DB6ED1148B3B76F16ABF6B86E487B79772E06D09D10110D4F0A66E00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download