5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-obfq2s.htm
Size 1KB
Sample261001-sysewaythy
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{8BB740A7-BF1D-4DE7-8A3C-BE67708ECB06}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 5072	4888	msedge.exe	85
PID 4888 wrote to memory of 1996	4888	msedge.exe	87
PID 4888 wrote to memory of 3980	4888	msedge.exe	88
PID 4888 wrote to memory of 2476	4888	msedge.exe	89
PID 4888 wrote to memory of 3980	4888	msedge.exe	88
PID 4888 wrote to memory of 3980	4888	msedge.exe	88
PID 4888 wrote to memory of 2476	4888	msedge.exe	89
PID 4888 wrote to memory of 3484	4888	msedge.exe	90
PID 4888 wrote to memory of 2780	4888	msedge.exe	91
PID 4888 wrote to memory of 3484	4888	msedge.exe	90
PID 4888 wrote to memory of 3484	4888	msedge.exe	90
PID 4888 wrote to memory of 2780	4888	msedge.exe	91
PID 4888 wrote to memory of 2780	4888	msedge.exe	91
PID 4888 wrote to memory of 4572	4888	msedge.exe	92
PID 4888 wrote to memory of 4572	4888	msedge.exe	92
PID 4888 wrote to memory of 4572	4888	msedge.exe	92
PID 4888 wrote to memory of 4492	4888	msedge.exe	93
PID 4888 wrote to memory of 4492	4888	msedge.exe	93
PID 4888 wrote to memory of 4492	4888	msedge.exe	93
PID 4888 wrote to memory of 1072	4888	msedge.exe	100
PID 4888 wrote to memory of 1984	4888	msedge.exe	101
PID 4888 wrote to memory of 1072	4888	msedge.exe	100
PID 4888 wrote to memory of 1984	4888	msedge.exe	101
PID 4888 wrote to memory of 2176	4888	msedge.exe	105
PID 4888 wrote to memory of 1484	4888	msedge.exe	115
PID 4888 wrote to memory of 4584	4888	msedge.exe	116
PID 4888 wrote to memory of 2428	4888	msedge.exe	117
PID 4888 wrote to memory of 2908	4888	msedge.exe	127
PID 4888 wrote to memory of 2908	4888	msedge.exe	127
PID 4888 wrote to memory of 4272	4888	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-obfq2s.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffbbf2cc188,0x7ffbbf2cc194,0x7ffbbf2cc1a0
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,16400646963498698070,14318647221525423315,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,14228161261875852958,9665975102001961792,262144 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,7266394179058079487,14014469174824342552,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3136039780279395030,16935530916031261606,2097152 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2513677393069713517,2110177756622111577,2097152 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,3614767976658518615,15351501283566819269,2097152 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,3862073877365628144,3594201506046731820,2097152 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,9057565976386578745,13726637552001212959,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16617188845111572608,11497420029980484603,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7402980512047433994,6337821103774446091,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7402980512047433994,6337821103774446091,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,794073108581636079,11186551781230974606,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,14916147474014301333,9779825687585420757,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,18261248769680623214,11752004622812612803,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,7666489155338673344,18161780758752575316,524288 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,10212300504885999838,6872769356810737517,262144 --field-trial-handle=2340,i,6532309128050952604,5188908510871294942,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d380da28f94be5832524dd8920b3658738732d84dd297de42188229c19bd9152
MD5 d9ade2609161adfc7543f2aa37f804aa
SHA1 42d2b7d13a97b9deb6215053323c5a7765711f00
SHA512 c3886e393b3e592bc8862d074071d9ce7ed1d3945311195b889d6c7ba2255add76a6da6edb0793f4cebeba9575e664432720b478557411d9f669cab5da13de0b
TLSH
T19251F9C4CCB14354FB991F79D2D801CF36B867A1668BDF3E1A9DE4B9580AF19500C348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e961.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e961.TMP
Size 3KB
SHA256 917b026383853724af9c7d5b8f964bbbd668dc6c5a911df41f7399d455b0b601
MD5 f6379ca3c697ea3fabd3eaec411d7209
SHA1 4b28021deb74a7963abea56c7057c4994c5f3bf2
SHA512 9eda111efb2e9ea23e691836707438125c1c195d74aa76a5d18ac9bbab9fcbaa609f024c0ec11708cf6696dbb0f95e5187220a2d9619471389f8b96eb5876881
TLSH
T1B251E6C4CCB14354FB990F79D2D801CF36B867A1668BDF3E1A9DE8B9680AF19500C348
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 36ba7c78cbb7ea640a4b68869ebcc089d4128810adf2c2964d75c39a3523a01d
MD5 eae9511b4e54b7d6a5c7881a4a2b76d4
SHA1 82f70365da147f609510076ad18e2eb48788574a
SHA512 9440a606db5f6f571f3f0483c43d2dd2ca0552caa3ac557af62c186f631018971426d420b7e6d66ce0b46a87b5ee0c11f6ac9465d5498920e5f563d31c92b196
TLSH
T1AB0190F7C3D495AE8A0556F06A14AE17CE2C0506831C7C19C5D4AF2B93F3475D10189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 98b7751cd3e0504ce162dcf5d543585253ca92af22ab4ba3b867134b32a516ef
MD5 3ec451b22f13d1f29608f26aaa12b5c1
SHA1 aff58b13004e6d9e37cda67f0aa7ceb2ee6cb9ef
SHA512 2c91ed560e1c8741654db9bb015c730ce760f04ddeb52f168ce9489c9c330b769765d82bb09e95552c951ef3691bf0edc77efd205b935e3d66013f51393f3d1d
SSDEEP 192:sxZcR9Wq/fYsFSrIdpdsHW6+WNGYRPRz2IgrJ:sxZciq/fYsM0SHbGmM9
TLSH
T1F912A6526E28A97B8CCBD24DBA25BF53D6F9503291D51E48EAFC861C04E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b2eae7f953298abcee60bcec746d7fc43a663eba0a6dab21a58de4ff7cced24
MD5 2be0f89c75a716a0a0a5dd48597e8370
SHA1 16697e6b4f299a3bf039625713b8e049035fdf6e
SHA512 f5813adb11fd9424f798ec29c726a8e02fe9fa30d1871bd55e06ceca1203e57080a166f47f6995e73fa0adfc7a5e1d1af019008639fe37ddf48ac5f728efd2a5
SSDEEP 192:sxZcR9Wq/fYsQ6rIdpHsHW6+WNGYRP+z2Ig5LJ:sxZciq/fYsP0MHbGmZ7
TLSH
T1AE22B7526E28697B8CCBD24DBA15BF53E7F9503291D11E48ABFC861C05E77CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f52c1c6a70f6dd42b9a2b67ed121056ba810c00fd472544415994fbf65c3500b
MD5 313b55e2bbd4562ee8d86625dcdb6548
SHA1 1d551e0150c650310e64e0e357f32f2a033e281a
SHA512 f9d5036fffbc0e98d0e584aa7909e704a448d8d60176a892f39a5b24149cfc93145a66a4ab4884738727ebf93c81f6a69060db5d3420b6f5caea9dfdaec5afba
SSDEEP 192:sxZcR9Wq/fYsQ6rIdpdsHW6+WNGYRPcz2Ig5LJ:sxZciq/fYsP0SHbGmv7
TLSH
T1C722A7526E28697B8CCBE24DBA15BF53E6F9503291D51E48ABFC861C05E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 083d24ee08514f19a41223e9de44c6738b92b8b7d3f33e53fff98ca9bba50e3e
MD5 becf13ec676f7424a4b0a2439e9d9fdb
SHA1 25429a909650c8322fff56764a9c91c42d793f47
SHA512 84a415b6d33b1060151b1d30ca3836afa2439fc5fc6b0c71c81957563fa9080d074f516437584a0f9c673b262f2be11cea38850aa7586fe1b0e39dbc59680742
SSDEEP 192:sxZcR9Wq/fYsQSrIdpdsHW6+WNGYRPRz2Ig5RJ:sxZciq/fYsT0SHbGmMV
TLSH
T15C22B7526E38A97B8CCBD24DBA15BF53D6F9503291D51E48AAFC861C04E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0178b6f2fff739ba9ec51aef0589cc14dfd0285f343a4808452754c157500116
MD5 aea441ceac654353f04f0d76e4e1e2b6
SHA1 d11410a68d394d467085286d4145aa42ef5ae404
SHA512 2194f6c44e72ed1b592838ec4ffbb54d3bd1baac2a590c1d7cb67feb4a104b788ce5cfb2745fe324094ffdeff2a03321946a410d38db93fd5ca987194371f9e5
SSDEEP 768:waK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Xrot+xC:waK9uzYWvcQWsu1ja0HL7Q3Et+xC
TLSH
T114C20A3F640CCB7E4FC01A9DDC5A6F973E9802D7A6988D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598505.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598505.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83f6927587941967e8793086487a56daa756f9310d5bbf897ac176d861588953
MD5 ef0b06acd15aff4b06000e8a6da2ff8d
SHA1 fd07b61eee45a542795eb963b25b6a8a6cca372c
SHA512 c2613a2168b723a110af3a2a32f0b8fa89e4c9ea01fcc14174d249afeb6b2eec6d19769aac3885a3a10c16ca37e80cf5fd3eadb7436169860390bd1785eac3a2
SSDEEP 384:zZcIhsN3GwOG0FeQyOjTVu6diGrnRwJr18tgOIwZOyOEfoy:rh7vbRnbNih18Xs8fh
TLSH
T1B7828D369C781CBB98F7E141F58B32034FB49167EAD66B9495ED9B0C01D66EC130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 efe549898b8ad74833edda6609c1bed0b1ec388ecc9f5b1acf41f56035b7980d
MD5 05b7d05946dc34c4495e043bc6d543c0
SHA1 6d10f5e7ca06d2ffa80f803fc5cf49d1617f44f3
SHA512 05d15f7074e1212f5259d7ea7d84ba04b8b9cac80f7512034db3c07e05f3204277db96644e01a137064b27ce8dfc269a475948a569ee08c20d92323dfd17df52
SSDEEP 384:3iFiZcIQzsNJ8TUNTUlIlVwOG0FeQyOjTVu6diGrnRwJrF8tgOIwZOyOEfoy:yFQMUwgXvbRnbNihF8Xs8fh
TLSH
T15DA26D339C688DBB9DF79645F58A31038FB491A7D9D6AB94E2DD9B0C00971EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 19bf6ebcad992de2994a834e88abf025027fb42678cb56f352aa7a5ebf4475e4
MD5 4d870b4914866857c99e3d7bf3613810
SHA1 598e97286d5f662f03fa09b01d0418d8c63e3104
SHA512 b7ce2d8530ffde3a97a2e60eadd64981abc1b869306142ade1d78ba6984484f69728991493be3d792dc6fc15dcca647281a814b2a79d417257f7285759e9d7da
SSDEEP 192:SONa6ygpQmiUyZrtOCTVg9l+FdV0R0rNzPP0U6:SONa6lHEtOCTVu6diGrBMU6
TLSH
T1F202D835AC783CBB8DF3AE46F48B36139FD4116BD9952B94DAE81F1C00D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b7d5db5d847a9032fc0aa06cbfeaa8a513f95e3a99a2b7a63b951b7377b6091
MD5 963d7dd1b1200ee926f999efacc69778
SHA1 48271766e411ebfd056bbb2220763a13b59e4013
SHA512 492edf29d79b3e3d53212eb9596a4da4d7ba06ef719f54f944726ad99d7ee1a8b876e064b74a9fb6ccdcc343b03a5d6169cdc11898245a226375f2e25a5f6343
SSDEEP 384:JZcIhsN3VwOG0FeQyOjTVu6diGrnRwJr18tgOIwZOyOEfoy:BhyvbRnbNih18Xs8fh
TLSH
T1FE828E369C781CBB58F7E141F58B32034FB49167DADA6B9495ED9B0C01D66EC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0841434164d5ed519eed4f95071ddaa73ffe602a0bb3349f597f4aede05fadc5
MD5 cebc84d4adb0e253cb2ae3d73062702f
SHA1 ed0ffc5138e176a21d29b21eccb4789869904fcc
SHA512 8ed6ec87ce2701f17a8882ebf3f2738113f1caf144871e16e9fc3ec7c2a23ba56c6e5b14ea12d871f0080d8d421c54a9a53c29cb9190f70928291a5d46b56b77
SSDEEP 192:SONq6yNQmiUy7ruOCTVg9l+FdV0R0rnhxFJSJrh3UJrqRU6:SONq6kouOCTVu6diGrnRwJrS8U6
TLSH
T110121B35A8686C7B4DA3B541F48735139FE48267DE863F94D5DC1F1C01DB6AC134AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42e4e1e1-b33d-4132-b91e-3b91808d0731.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42e4e1e1-b33d-4132-b91e-3b91808d0731.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4e36a01535a72b2217c8ed7ce4186e8f82d5e37292322f6c07ebe021e4b27cfd
MD5 22c9bb632f3579cb6c4b0e0ab97de787
SHA1 365acb4b4414299bfee4a9e05616b7aff8e46866
SHA512 3f4548f86b746e710b77526d700607c706af7699e1483649508a90b976f89dead738066d5ed63da53fdcc47041f36d30e480969a2c9d62d3b24294bd6eb3b7b3
TLSH
T1EE413748A6FA1148B3B37E569BF7A86E887EBC772E06D45D10110E4F0A22E00CD72733
MD5 SHA1 SHA512 TLSH

Submit Download