6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-1092870-aefzrm.htm
Size 34KB
Sample260929-2md8jsgh76
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{E592AAF4-7680-442F-8439-AEA6516F4301}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4780	884	msedge.exe	86
PID 884 wrote to memory of 2128	884	msedge.exe	88
PID 884 wrote to memory of 3440	884	msedge.exe	87
PID 884 wrote to memory of 2128	884	msedge.exe	88
PID 884 wrote to memory of 2128	884	msedge.exe	88
PID 884 wrote to memory of 2692	884	msedge.exe	89
PID 884 wrote to memory of 2692	884	msedge.exe	89
PID 884 wrote to memory of 2004	884	msedge.exe	90
PID 884 wrote to memory of 2816	884	msedge.exe	91
PID 884 wrote to memory of 2004	884	msedge.exe	90
PID 884 wrote to memory of 2004	884	msedge.exe	90
PID 884 wrote to memory of 2816	884	msedge.exe	91
PID 884 wrote to memory of 2816	884	msedge.exe	91
PID 884 wrote to memory of 1144	884	msedge.exe	93
PID 884 wrote to memory of 5012	884	msedge.exe	94
PID 884 wrote to memory of 1144	884	msedge.exe	93
PID 884 wrote to memory of 1144	884	msedge.exe	93
PID 884 wrote to memory of 5012	884	msedge.exe	94
PID 884 wrote to memory of 5012	884	msedge.exe	94
PID 884 wrote to memory of 4236	884	msedge.exe	100
PID 884 wrote to memory of 3380	884	msedge.exe	101
PID 884 wrote to memory of 4236	884	msedge.exe	100
PID 884 wrote to memory of 3380	884	msedge.exe	101
PID 884 wrote to memory of 3280	884	msedge.exe	105
PID 884 wrote to memory of 3460	884	msedge.exe	112
PID 884 wrote to memory of 3808	884	msedge.exe	113
PID 884 wrote to memory of 1548	884	msedge.exe	114
PID 884 wrote to memory of 1172	884	msedge.exe	123
PID 884 wrote to memory of 1172	884	msedge.exe	123
PID 884 wrote to memory of 2984	884	msedge.exe	126
PID 884 wrote to memory of 2984	884	msedge.exe	126
PID 884 wrote to memory of 228	884	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-1092870-aefzrm.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa3011c188,0x7ffa3011c194,0x7ffa3011c1a0
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17589579517717022277,9374882311391728876,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3723876665190791174,400197043696419452,262144 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,15620799578059135006,8816496249744968540,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12855785383317225831,9905567849687803676,2097152 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,526488981980784611,5570715614345906006,2097152 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,5359241615646006998,15247016051759185232,2097152 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,645117810866110260,7909388669012808755,2097152 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8059848316976697969,9387518346559417777,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,16830138802106442220,15568170787444255380,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13723029494023347108,3999370083414198221,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13723029494023347108,3999370083414198221,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,756223289315615304,7031389060117142298,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,9900098324370020361,10813943393883171036,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16465603254054044025,16570547572735614883,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,17945897333163061484,11869918398804467700,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,16099989900031438437,9442730039203554692,524288 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,4535096059628416588,14474669223590269208,262144 --field-trial-handle=2292,i,14918301224310134400,1085967878739536334,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 05166ff7634e28ac9570b1bc2270c48712d907205035f01d1f86fb427168dfd1
MD5 f028e13eeda3f3add2429ab8ba7f26e7
SHA1 10474bd4f3a1d40e3fff1da6e141c5a74b2a9ff5
SHA512 a79bcb5199a5360e4ac4b8af369eec6590f593e38ec0ea613f427c5d3e2e93c4ef39b7608a52275e2e35c0d646e7a43c0a25c7f02cbb94784de10fba6eb75e2f
TLSH
T14951524197608491FFE8B1BB51DE12FF3E746580D5831E721B98DCBE9F6A31740010E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2538ddea8c0730773f35e247c4390eed5921f76c7018edcd8b565fe88b6b2fa2
MD5 9df0ce3737e12e4ba8754c37923b70d1
SHA1 f30222d3151dfe45aabea29ec7887e9ca8a5913b
SHA512 630b7e17b424a161f8f256f6a9cd975da5ecbbc1b2107867cfe7c3dc84458d2711684e93275b7d81e60a84d923aa1581ad4ce75eeff8bd6b86757fbe473f2452
TLSH
T1F3117DB3C7D586AE891116F05A24EE2BCE1D0506431C7C19C9D4EF27D3E3475E00199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 894d2f278de360ad4cc046f41e1d78fc9c60eb8aea226c204e7d1377dc03e8e8
MD5 d35c25602ceb0bdbf459c2264b0ce0ff
SHA1 feb49c07e3af1a59d6bcac1a2c47ddaaa3ae5afb
SHA512 fd99e7bf48eb8a5a11d03c8ad5a79c214a81c22200b491aa96dcdcaa1e9f49d1fc862f9c4ddcd3b5ee9c75ec688a6070b9084658704e5852a15bfcf2508041cd
SSDEEP 192:sxZTRHPWr/fYst3IdpdlHW6+WNGYrb6IIgrJ:sxZT1er/fYstY7HbGe9
TLSH
T15B22B851AE34A97B8CC7D219FA15BF53E6F9503251D41E48BAFC861C08E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2fe1f2cc1684eabbfa33c62d0df30c86cb3a0892184e635d54f30be8a8c00d98
MD5 09f3643a7d8c576ef5c73664c4857f47
SHA1 64b104465316baca22910c9e3f0263fe06493068
SHA512 455e17997ae2cf3db1813dc297b30ddd785dd2713c84c9cf747529af05e8e8283c8964e3d5ab4f79f75b6744b73f24f1a04ff869444223f960d88626d2ece56f
SSDEEP 192:sxZTRHPWr/fYsd3IdpHlHW6+WNGYr86IIg5mJ:sxZT1er/fYsdYFHbGH8
TLSH
T14322C852AE38A97B8CC7D21DFA15BF53E6F9503250D41E48AAFC861C09E7ADD220744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a6f6a32d6019b42c7e2786042b6d55bf3c1bcbb867605a71f0e0bb20b447f684
MD5 0a8bf8796e484fa86ac5307115544ab7
SHA1 7b3ab70bcb4dc81203a5fa9ceef87dce1e282c91
SHA512 d8bf80ae06927940c7cdf468932acfa609d462d621f76952910d6dcd7d21611628e2030e73ce5a14d4e0546e93b4b67bc269755ac4c6187d8ae42d538a37c541
SSDEEP 192:sxZTRHPWr/fYsd3IdpdlHW6+WNGYrp6IIg5mJ:sxZT1er/fYsdY7HbGa8
TLSH
T15022C851AE28A97B8CCBD219FB15BF53E6F9503250D51E48A6FC861C09E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 138a1d862e5cf82cb34bf6e461de1fe74751a5f0a61a759e07d40b9e7628d591
MD5 4dbaafb4f06c532b61fbfb99a1d328a4
SHA1 607618e7c78ee3ab9004f17a9d65a510bf338855
SHA512 70bd3cf8f4294e72ecba38876ab27e2ef1b7745d142baa74739765ced307cfcc2119e39fb5b04ca2977f886eaad9db5b96a516c44ac7b3b395094b2d27229b79
SSDEEP 192:sxZTRHPWr/fYss3IdpdlHW6+WNGYrb6IIg5EJ:sxZT1er/fYssY7HbGeO
TLSH
T12B22B851AE34A97B8CCBD219FB15BF53E6F9503251D41E48AAFC861C08E7ADD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c09fa0b98b68481c59a372751b1fb4e8befd8c3374700a67d672dc553d6175a2
MD5 5a26df40eb8516deb1d3877b9bc9a28c
SHA1 fb63186d6236f4819ddf753d0fbd266b21443551
SHA512 82cd7e5f7994314a26f17720820baec550476187ff90ccedc3a78826762cbf3dc15183e6727e7702e0db348d5daa7650738fbc382e12bb2b7400759deda32b30
SSDEEP 768:yTy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbproRJe:yTy4J/DWvbtBhu1jajiLm0bCje
TLSH
T13FC20B3B644CCA7E4FC00A9DED5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 89dc59fdf6d907f2bedfbe91e572ea078e736e4e3ab15989d128aee8c9090b54
MD5 12eeb8929a4bd8c2d4da81f441696b61
SHA1 209d2b71d77a6d0cec8ee3ef8bf67db9868687da
SHA512 24a1e2d69444f3b6fad7d6c8e89fe9dab708f2ebe87829e9e140f4491674f8d29e88097d59a76ae5e52bdc634e7d5e0903561676916d4c331f054bd789bd62b6
SSDEEP 48:KIDI1Ks04jyLJ4FZDHb0bni/ISx0K9x1b0xZkYij5pyLOpEIGM81bAHIISg1K9ED:KIDCKs0+aaYKTCK2pOKKQi
TLSH
T10B91014670FB061038BD698C8175876E124232B37518EA2F7FBC41A5AE2FE045EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59796c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59796c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 368ac008f2323ee44e627b9fefa7389301e4231cc2d159a1bf180c42a822366f
MD5 ed87924a68850cc421e01e57c072b94e
SHA1 cdf695bd70d2cbd32f81071ea55a8ae9d147cb22
SHA512 4be7571c70bc658401d2089d9f49449bd0fc4c41f56f43109a35983a762fa6bdaadacb9f94784e2f4604ab0fcdd426d39defd91c7c7dda62524d367419c2a9b2
SSDEEP 384:xZcIhsNMnmcZuF5HX58EjORABjxLLtgOIwZOyNRo/:ZhOcaNaIOWjxLLXsKc
TLSH
T123827D329878AD771CFBA145F58B72039FBC8027E2C4AFC0C5EC6B2D059A5AD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9f92f82cda8d7626ee52a9096908c622fd2a22ba7cf5cbd7a156fa9799c37d06
MD5 22c487ba8aa4aa597fad54a101ebdb6d
SHA1 fa22eae9ba2013c03bfe84c820c9c99f4ea3ba62
SHA512 f47a6fb8f4fee7293a9e62b47d9cbceb1ec856d6bc2f878355d1bed9f5e7009a1f9b325ea1b3360ef435d7fc1a756fab855e57d2f8d49ae81c491dfc2feb6f1f
SSDEEP 384:rZcIhsNM6mcZuF5HX58EjORABjxLLtgOIwZOyNRo/:zhncaNaIOWjxLLXsKc
TLSH
T1DC827D7298789D771CFBA145F58A7203AFBC8027E2C4AFD0C5EC6B2D059A5AD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5348045d3ac1dc3780ba79b253d13048ddff42d2942905d3071c945c01ac37a0
MD5 55fdc01517d23bb99b5582a237190ed8
SHA1 34a58a933786716072a5ec7716075522df0b93a3
SHA512 5394709c2fbc8529fd2e68726b4b997bf572668da4650463a84dbe9e5676fc845bdd53d6625dd0be8671c4c1ec491f92b8d8a23036250025adf1f7e101122028
SSDEEP 384:OiFiZcI4zsNE8TUNTUlIl6mcZuF5HX58EjORABj2LLtgOIwZOyNRo/:lFQEBwgpcaNaIOWj2LLXsKc
TLSH
T1CCA26B3388A8DD7B6DFB9684F64A32039FB88067D6D5FB90D2DC5A1D01A61AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72807b3f6027b9ab881dcc9bbe6116338194fdf9cac99490430a3358fda036f6
MD5 fa31e80c41a9abbeedbfb11eaf39f73c
SHA1 2aeea5c6bc26193ea8a0542ca8154020dfd57abb
SHA512 ede18962bd16a104764e922497280edde063a2ba26c09aeef97704bb576810fe1653eb7d6373b0491aa67946c06082785c0c1618af6fcf5c9108e0c73527f4cb
SSDEEP 192:1ONV6wlDmQmiUyTD74X58gZjOKSABj5veL5q2U6:1ONV6kCs74X58EjORABj4LLU6
TLSH
T1F5121A35F968AC3B0DE2A154F48B35039FA95127E7857FD0C5DC2A2C01EF6AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18ff11f62e70d0de55c4d08e4b6b9245ba69bf83317035fddb8f3111ebb01155
MD5 c603bd1123ca6e545b9b13bb11168358
SHA1 eb378802cbf3a1b6691032d244f86bc652acf09c
SHA512 4e6c2bf5650c400ed96727a28bdeede5c140e22196d86afee9d6ae554d5955f04a56dddca3fbf3986fd07fc50fc8bd60d53f934f41d01535bd6144312b26fd26
SSDEEP 192:1ONl6wlDgQmiUyPDW4X58gZjOKSAwDlLzNU6:1ONl6kgMW4X58EjORAkLJU6
TLSH
T16502E934F9687C7B8EF3AE49F58B26139FE5102BE5552F84CAEC1A2D00D765C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ee2c6a7-5d8b-4571-8316-efcd260d2374.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6ee2c6a7-5d8b-4571-8316-efcd260d2374.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f46060460e2858cfca98e1afbcc242a4a814454cc636b2b16bac0f174e6a0f45
MD5 3738dc8ba53d7eeed37963b965347c7f
SHA1 20e6a8f9e92da902a26ce997ba5ea5d9757ce56d
SHA512 26e97d6e3833aeb7d3fce29501a14d831b8b29be62cd7cf390dd95b1d07e0e64fc759be66a87a74f773e2fcacad4f586d36c74ad505a144ecc775317e2b9d641
TLSH
T10541E95CA6EA1148B3B77E5A9BF6A87E447EB8372E07945D10110D4E0A23A04CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download