hxxps://links[.]notification[.]intuit[.]com/ss/c/u001[.]300yz6laXDM6RtJ2CEfy98PI5azC9820v8Ac1xMQM7HhtfZ5rRtQAN_SYa97aGDTR3cFBGtKkzC0MZ13msIVnw/4u2/qbC-2JR_TUyhmfUhioH7XA/h1/h001[.]wlZQgrcTgB2pkO0fc42CgUR6lqN4dF5VisGnEFiBTw8

Analysis

user interaction
yes
max time kernel
298s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.notification.intuit.com/ss/c/u001.300yz6laXDM6RtJ2CEfy98PI5azC9820v8Ac1xMQM7HhtfZ5rRtQAN_SYa97aGDTR3cFBGtKkzC0MZ13msIVnw/4u2/qbC-2JR_TUyhmfUhioH7XA/h1/h001.wlZQgrcTgB2pkO0fc42CgUR6lqN4dF5VisGnEFiBTw8
Sample260924-relmjsty2n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347323971295508"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{21732512-45C5-4746-93DC-6B17927E6B7C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 5648	4664	msedge.exe	84
PID 4664 wrote to memory of 4440	4664	msedge.exe	85
PID 4664 wrote to memory of 2000	4664	msedge.exe	86
PID 4664 wrote to memory of 2000	4664	msedge.exe	86
PID 4664 wrote to memory of 2000	4664	msedge.exe	86
PID 4664 wrote to memory of 2212	4664	msedge.exe	87
PID 4664 wrote to memory of 2212	4664	msedge.exe	87
PID 4664 wrote to memory of 4816	4664	msedge.exe	89
PID 4664 wrote to memory of 4816	4664	msedge.exe	89
PID 4664 wrote to memory of 4816	4664	msedge.exe	89
PID 4664 wrote to memory of 1804	4664	msedge.exe	90
PID 4664 wrote to memory of 1804	4664	msedge.exe	90
PID 4664 wrote to memory of 1804	4664	msedge.exe	90
PID 4664 wrote to memory of 5628	4664	msedge.exe	101
PID 4664 wrote to memory of 5692	4664	msedge.exe	100
PID 4664 wrote to memory of 5628	4664	msedge.exe	101
PID 4664 wrote to memory of 5692	4664	msedge.exe	100
PID 4664 wrote to memory of 3372	4664	msedge.exe	103
PID 4664 wrote to memory of 4956	4664	msedge.exe	114
PID 4664 wrote to memory of 712	4664	msedge.exe	115
PID 4664 wrote to memory of 3784	4664	msedge.exe	116
PID 4664 wrote to memory of 2460	4664	msedge.exe	119
PID 4664 wrote to memory of 2460	4664	msedge.exe	119
PID 4664 wrote to memory of 2956	4664	msedge.exe	120
PID 4664 wrote to memory of 2956	4664	msedge.exe	120
PID 4664 wrote to memory of 4068	4664	msedge.exe	123
PID 4664 wrote to memory of 4068	4664	msedge.exe	123
PID 4664 wrote to memory of 5780	4664	msedge.exe	125
PID 4664 wrote to memory of 5628	4664	msedge.exe	129
PID 4664 wrote to memory of 5628	4664	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.notification.intuit.com/ss/c/u001.300yz6laXDM6RtJ2CEfy98PI5azC9820v8Ac1xMQM7HhtfZ5rRtQAN_SYa97aGDTR3cFBGtKkzC0MZ13msIVnw/4u2/qbC-2JR_TUyhmfUhioH7XA/h1/h001.wlZQgrcTgB2pkO0fc42CgUR6lqN4dF5VisGnEFiBTw8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8ae91c188,0x7ff8ae91c194,0x7ff8ae91c1a0
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3593861658449714999,14169694364135241431,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2895698755058905608,17048020304824959546,262144 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,17030808372873697730,4294295384987025963,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,15513610256892068819,9101089897424156489,2097152 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17745571612449144030,9136248171072645366,2097152 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,11476558771562283891,11348725141644529873,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,10320888182140652196,7682021741453794710,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,1257421327788006286,1968809320616963016,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,1257421327788006286,1968809320616963016,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=124,i,16760644902901857102,10449476603344717164,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,325617851330878687,16041825073331863723,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3019168710847757321,6590190969995518197,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,1394980487822843013,7132218146762595977,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4536353779477405470,15514801483187414916,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13682269483754755941,13865028308285275742,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5568,i,1728747214902440127,17811832290693950167,262144 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14271273228999018852,15154002820613744391,524288 --field-trial-handle=2160,i,9791444686946115341,14066925947720885018,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 78b55448b0866722600e2f9e218331ff59dd461d883d8c5e2e3f19897e62f9d0
MD5 0de87b74e8ae093a6f3f310ce87f055f
SHA1 59fc32339c3d4ae153a6d7dd35dc5da2fe17fa9e
SHA512 585f00f4a7dbc03f1ccbdb9991ffafafc9d46f31bbcfc720a84b690e92af9e9410742e275ec41caa28780d6e2e3bb8b25543d8c2cc6eaff4d2d687669dece051
TLSH
T13DE0268D05C9D27FB300A497916C578C82E03B4FD2CCAA4A1704C8887047851A2C26D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 93e50d1a572a3b06728874e7c340d904d7b9cfb39ae3310414b8c368b49c4fe9
MD5 b05a81ed50e8fa8d4b0fb84404b068c3
SHA1 0de6e942d1344640ed8e226002f37e5b64e0097c
SHA512 61fcad2c21ff663fcc898f7052ac47107208136c2f3706acfea4c92bf2672d764f7c39a47a0d54fc625ce0b2b896887b86b89820ef93b325ea8e770c89c9b262
TLSH
T1CAE0268B04C8C23FA3007487516C570DD2E0371F93CC7A0A1708C9887405850A6C7EE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 30cfeabaae77bcae64dbaf460c6b904d437ab2e0f99bee8d6cdef74285c7ae24
MD5 ff9dbdd0dc8af89145edd05ca9d17e11
SHA1 540d8728469c22f633821269ed53a2d9fb1ce073
SHA512 97509be44a6eb7fcafcb0b0730b7b19ef23b964f32d592320b5286d6a63c0d3b1abca1168861ba067cdc522e94e6c12246b9efd4b75c827a29d18c450d6d26a5
TLSH
T1A5E0869905C9C67FA30475D7416D6B4CCAA1371F96CCAB8A1704C98475C3D44A2D66D2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fa4140214f45d2f1cedb55ab8c647ad6b7d273e1190d71c7d0405e3a970abe41
MD5 5613bb917de09efdc913ca4a160a1d71
SHA1 5c0ec3719d90afcceb1a2fb9013f9816974ad1da
SHA512 266c018b36422a886999d16e5ceb1be062b875f2ee953f6767c925394af6ca238da27f4161881a823e23bea0e1dbda2f5a8b4fc4831173cfce075b9434272cb8
TLSH
T1A2F0F4BAC921AC3B18FD0B2D64A54B47F750237B2A41984B3B3D910C8FB153B4695D6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fd458cccd893197d34a8c833d0a5fbf7b3f96141ccb29620222756007cc9c064
MD5 b02685c828b240c1b08e852df6be2032
SHA1 99361eb318a84e33081adce0938ca604926ac0ff
SHA512 54d0f76eb0481c6e31b8d69af387285c837e134c01224746eb6fa1e36c7f3fc2d7368abb4db02dbfd04934ee66955176ec4a8b9f2fd2b79f787c7cfce91ddf31
TLSH
T1EB419DF7C3E8866EC90156F0AA14AE2BCE2D0514832C3D9AC9E4AF1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae1e2da5611dc8a0bb5ad961599a24fda05d047c3e4638ae97fb70d3d1b93491
MD5 6410c8955eb332cc85c22ec6b0c9baa8
SHA1 3f8b2bf52f38c2779ad1a45cd7e47294d35e0e59
SHA512 db8acc9401e3cc1cf442c9a1a89eae6256698eb68b3bd6deb45bdb4b9386b4532a31a769fc1f9b83cd0e86dff55920b40dfc532df577e56f9ebb8bd2472abaa2
SSDEEP 192:sxZZRLk//fbs/aQZLS89zodpP0HW6+WNi1K/Yo52SOWIgjt6J:sxZZu//fbsSONWsHbv/6S9jt2
TLSH
T14042B756AD28A93B8CC7D219FA157F53E3F9103395911E48AAFC8B1C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 052e973de3b9ef416f916ff55cc49ebda85a9b440a2e10d833040113d0659497
MD5 6fa63c4a4bf2d44e709c3b74d05abca8
SHA1 77ff14d462f92dc0ef0a64d897251c85b72c559a
SHA512 b9335ab1ccb77614a1bf808137293d0130d8a2404bb1b6bab67345eba382a1845d82d53307123951e87fdbb7ff6d11a5be5ad8b8679a8de7fe0fbfe2f5bfecf1
SSDEEP 192:sxZZRLk//fbsrQZLS89zodpP0HW6+WNi1K/YoY2SOWIg5kt6J:sxZZu//fbsrONWsHbv/7S9Gt2
TLSH
T1D742C7556E28A93B8CC7D219FB55BF93E2F9103390911E48AAFC8B1C15E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1d281c9b309e97de65cd625bd7aedd4b99e4d9f80f28c6e91f3e702b26fc7b65
MD5 c91e1d21cacf33e9882a9ab10cd3738b
SHA1 f09d953132a5a3bfce73b2183bb7ffd41e67b686
SHA512 26f293722fd70546eda0c8abb4d8ce71353c8b05ff95898457219c3f75b0d938212173e9e14d6defe4723916866098b68de88089130dcc68fceccfe7a8a7f035
SSDEEP 192:sxZZRLk//fbsfaQZLS89zodpP0HW6+WNi1K/Yo52SOWIg5kt6J:sxZZu//fbsyONWsHbv/6S9Gt2
TLSH
T14342B756AD28A93B8CC7D219FA55BF93E2F9103390911E48AAFC8B1C15E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 efe8a17e1a944766bf9edf7e061b8e7ad6701879054113fb840e71d9545c4d82
MD5 b4daf7a2c759b63053d40d608e685aa2
SHA1 6213116f95c55677840297062adba446db79b1a8
SHA512 f09d59396f9e155f198eee45452f4dd470718358b9254b489b0e6a2b3b42cf5462d1c49f7d281e37cebe3ec96b58eefaa81f9be11cc87aed166bac5b6b201f28
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgQ:ST/2dXOJhJlpfnpp3tNXVrN3AvD1
TLSH
T124B2341571BB421039FE291C91B5972E068272733219E62B7FBD40B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 75e69693235d0d64d5f6f7135a7710ec38329d7e72e76872275a50fa8618df23
MD5 0ec43605f46fcaf430e124a98a2c66b9
SHA1 8fb187353fdbec6f02351f2fbad0f263f2dbed61
SHA512 87e92a71280b8008703ff8bdb52510743c2efe4c7ac8ab389a3e0b1e010995b8c4303fc864b2581214d3e4b2f41cf334307beeb3506ef9e1489538cca0c85d26
SSDEEP 384:nCaiFiZcI7lR3sN08TUNTUlI4qaKMgwUw2fiBCfkhEyjym830/upa7dLKkzQmgLj:WFQr3Bwg4jjBCfkhDumA0Sa7dLKkzQl3
TLSH
T1C3E2A2F698D78977E8AE4B87673D2D0299FCC163B5885A84B7D81D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c6d0f0979aae8eafe8acd0d62c393e753a57b0d0e17191bb09c79713eb4e9461
MD5 33b31a23412f139a81977cac6c2ce0b4
SHA1 af39cf6e25b1c728802ec6bec8776bed87dc8144
SHA512 83342d06959f1b747f098b29a6cd4ccf59460ee42569930b123a229c499aa351c942d9a13a57eaab1157e62f7d7ff64a7a476994ee86179d138800a2de94ae68
SSDEEP 384:nCUiFiZcIPR3sN08TUNTUlI4qaKMgDUw2fiBCfkhEyjQi830/upa7dLKkzQmgL/L:YFQp3Bwg4UjBCfkhDEiA0Sa7dLKkzQl3
TLSH
T1BFC23A72ECA4DEBBACEB4BD5A70A7A43EEF44163858C9AC4D5D91E0D00D71AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d93e2cf1958bb623347d977220add59788b8394e81352b1d660f287486881705
MD5 bafd1fa05431cfb5ddfeaddf10bc9899
SHA1 6c0074b3218e54822623f55bd3df9ee3a2c9d2b3
SHA512 6f3532bfff77feaedd25d327894ab4875a49e96691ff82d8b892b5eef11eac811b34114fd00c6b8bcdb4a7f7c2e50ac25f8a3c4f1b9123ff8d0b5f5c20c4fcfa
SSDEEP 384:nKiFiZcI63sNB8TUNTUlIm2aKMi54w2fiBCfkhEyPFlsa+VYwSgL/7IzLon:BFQ63UwgcinBCfkhDPFlhgAc
TLSH
T1C3C24B36EC94DDABE8FB4FDAAB4A7A13DEF00163959C5AC4D6D91D1D00871AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4f0346ee562899afe89a025c1606a6dc336c0b691beb4f723ee1d86b7c4fb420
MD5 25a0039d02167d7ee63fb599759c762f
SHA1 709768b14180d80a0be2ce4ae942e196ed44bf35
SHA512 8cb0d32933738871ffb2fe01b79cddf18e20f35c28df991dd4d4842f7565bc22f92bc246811089bbc13609bcd92b53ad3cd4a21db77dcfb2dfb927de690b97fd
SSDEEP 384:nsiFiZcIPR3sN08TUNTUlI4qaKMeDUw2fiBCfkhEyjQi830/upa7dLKkzQmgL/7P:XFQp3Bwg4OjBCfkhDEiA0Sa7dLKkzQl3
TLSH
T165C23A72ECA4DEBBACEB4BD5A70A7A43EEF44163858C9AC4D5D91E1D00D71AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 596efa3739604bd0fc89c1814ff3dd735a9f0e2f407bb01050ef2ccfd48d4745
MD5 7625c6f1840838366a649d81e4b3df60
SHA1 be41c92c1d7bf8f426928f291103f4f50a6bc5c9
SHA512 d29a7e416c4681b77ab9f838919fecefcc5bc15b11a8d0d062bccdc7f04862f4bc75f3c3db91dad5a0f6b5a67ba4ae50f873483e175e3ff12c6e3de6c95266fc
TLSH
T146412A89A6E91148B3777F169BF7A86D487FB8772E4BD45E10010E4F0627A40CD61B73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3372-195-0x000002928C1D0000-0x000002928D1D0000-memory.dmp

Download