ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-1092870-n1bj4x.html
Size 116B
Sample260929-3pr3vsvt3k
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{2CA8F16D-BCBF-4334-B714-6D8D88EE43CF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1720	1636	msedge.exe	87
PID 1636 wrote to memory of 996	1636	msedge.exe	88
PID 1636 wrote to memory of 4296	1636	msedge.exe	89
PID 1636 wrote to memory of 3760	1636	msedge.exe	90
PID 1636 wrote to memory of 4296	1636	msedge.exe	89
PID 1636 wrote to memory of 4296	1636	msedge.exe	89
PID 1636 wrote to memory of 3760	1636	msedge.exe	90
PID 1636 wrote to memory of 2540	1636	msedge.exe	91
PID 1636 wrote to memory of 3236	1636	msedge.exe	92
PID 1636 wrote to memory of 2540	1636	msedge.exe	91
PID 1636 wrote to memory of 2540	1636	msedge.exe	91
PID 1636 wrote to memory of 3236	1636	msedge.exe	92
PID 1636 wrote to memory of 3236	1636	msedge.exe	92
PID 1636 wrote to memory of 4404	1636	msedge.exe	94
PID 1636 wrote to memory of 3892	1636	msedge.exe	95
PID 1636 wrote to memory of 4404	1636	msedge.exe	94
PID 1636 wrote to memory of 4404	1636	msedge.exe	94
PID 1636 wrote to memory of 3892	1636	msedge.exe	95
PID 1636 wrote to memory of 3892	1636	msedge.exe	95
PID 1636 wrote to memory of 4680	1636	msedge.exe	99
PID 1636 wrote to memory of 4680	1636	msedge.exe	99
PID 1636 wrote to memory of 1132	1636	msedge.exe	100
PID 1636 wrote to memory of 1132	1636	msedge.exe	100
PID 1636 wrote to memory of 4500	1636	msedge.exe	102
PID 1636 wrote to memory of 4572	1636	msedge.exe	116
PID 1636 wrote to memory of 676	1636	msedge.exe	117
PID 1636 wrote to memory of 2228	1636	msedge.exe	118
PID 1636 wrote to memory of 2052	1636	msedge.exe	121
PID 1636 wrote to memory of 2052	1636	msedge.exe	121
PID 1636 wrote to memory of 3248	1636	msedge.exe	126
PID 1636 wrote to memory of 3248	1636	msedge.exe	126
PID 1636 wrote to memory of 1068	1636	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-1092870-n1bj4x.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff97824c188,0x7ff97824c194,0x7ff97824c1a0
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,18314407160196298336,18121473271787976992,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:3
  2⤵
  - System Time Discovery
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,489529874334806394,14758129363771175445,262144 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,3505870698602975249,15871155264479484107,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6038555281087564638,13301233328256218689,2097152 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13005406333303880417,16174772984394330815,2097152 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,6395486717773059491,9822470731090642392,2097152 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,905328704899337881,11835427876606959043,2097152 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3691831545846544637,3787599265088284265,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1727968079745305652,3094345673720979277,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10361435055530309472,2810691282905730043,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10361435055530309472,2810691282905730043,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7906971500064050892,16210840135168600288,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,758391876934182325,15518425619332936156,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,13943902379300138130,4074675108570790976,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14416644676028823063,13479999021291724638,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11976602587105962442,2180168385194428369,524288 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,6546189634169711435,440366791930113442,262144 --field-trial-handle=2984,i,2916276076632609768,14415852639945115724,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eff32c27791aac4c9ec35d848bbde6d2955defa0959d581b5faed98aeb8fa3af
MD5 bfd3e64f0a8979f46e37c0c5c7efcdc0
SHA1 4933d680ac664d09d3783e2534b2fb70c86d7a7c
SHA512 a3318a9c0739b0fe9214e1338ece28886846ee0792f32b1e7d1d232ba1ff0ef47aa361a8d9289a7a72bee39479abb127ae143c698ffc834f62a1ee89ee43414f
TLSH
T1ED6161B465D081B2F7698D70E2DD26873B736B8357839D5132BCF87B04BA705584B7A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c6e5.TMP
Size 3KB
SHA256 d239b6a25423ee9bcae7432733af1f8ef879d7419f2f790e9b5f0ab7f155e5fb
MD5 54181e6694a1ba0e06a2da516dad2f7d
SHA1 97f2e824164579fa677cf22d5090ad0a478e0133
SHA512 aa7b5765e2178e2d708025bfa1209703827ab3674ca51082b7d7849666e7fa878232b703ca4a22ef396c6b86f51389c9f5c431d7ba680afe8d895efba3f55e4f
TLSH
T1AF6161B465D081B2F7698D70E2DD26873B736B8357835D5132BCF87B08BA705584B7A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 84cf5f052215ebe3c708b13ad5ceafd495dd0b11e6ed061ebc53c1151a41bdd2
MD5 3da6157552ae72483d4e40cdfd84a9dc
SHA1 75da412f1a5b241cae1e81ae2044774b3238b51b
SHA512 f5894980fc80fd44ca778d0462485b659eb66ce59b28f41bf75a103d10d03e03ce5e39489d0f7cb8514ba35eb1d9e719ef22e523a43f6b44e76bfe217987fb3d
TLSH
T119113DB3C7D585AE891516F06A24AE1BDE2D0605421C7C1AC5D4EF2793E3475E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d05d051f5cab19177c69903df81125febf2f66423454bbfb64c61927ee3daa58
MD5 67fb6fc4ee79cb08f6fb0a85f82bc452
SHA1 b7448f58e9d36f5188811bfa468e1e40a4469ff3
SHA512 c43da20a1489966ebf012e8d98f3c74333e0db3b6af8b47174d01116dbac2e24c15805c137a187e2c9bbf2537d432334364874218980d2fc3ed368956f355eed
SSDEEP 192:sxZyRRWt/ffsBy9IdpdJHW6+WNGYapYWgIgrJ:sxZyut/ffsB/THbGA9
TLSH
T15912B812AE38A57B8CC7D20DBA257F13E6F9543295D41E58EAFC861C08E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ccfc2ba6de4fe2d5555aac5917b494dae5e51eccf3e3de4a198488b10ef84a18
MD5 a3627f8cf4c7d178c8c39c3ee17a0b74
SHA1 b8772d69de06014dd50532c2e7e515dc432e348e
SHA512 c17274b02400658aef1235bfdf64094846fcd662969792c4da5b5bb238388426c246f0dca776f7a22fa265be30546bd1943e35b49f5731227070e066d65bdcfb
SSDEEP 192:sxZyRRWt/ffsMyQy9IdpHJHW6+WNGYapIWgIg5kJ:sxZyut/ffsY/pHbG8G
TLSH
T13322B852AE28697B8CC7E20DBB557F13E6F9543295901E48EAFCC61C09E7ACD120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e9626408cd2165922248a9e1dd1056e39e1f4e30c568a04f2b984da7c3b8490
MD5 468ae6a9cd7708ea074651df6d8f4376
SHA1 11beda9c87c6f146d1877f82a1afc00ab5d11145
SHA512 6c0d6244d01fc03bc17506eb6b44d46b2064b9bb64a5343545f5f42bfe1ccfc32822e9ac0780afcb17a7526406edd9f2627170f96726a4834e056a7fac273e6a
SSDEEP 192:sxZyRRWt/ffsMyQy9IdpdJHW6+WNGYaprWgIg5kJ:sxZyut/ffsY/THbGVG
TLSH
T19922B811AE28697B8CC7E20DBB557F13E6F9543295D11E48EAFCC61C09E7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 51c40c26ad1e41cec9110ca689aaef6f327835c0cb2797c2dd15e1d6a3610756
MD5 0b415b96657e3ebffa73565909662cd1
SHA1 794dcfc34985724970cea8d54d65d30ef7591167
SHA512 74559d86e48f4c7becfcbb4313a8e0d8155a4a4bd82c8f5e16b4cff5d1e435d7cabe67fdd3d0397897e0797c510b633493c96c19afb627bbc6d171cab25989e4
SSDEEP 192:sxZyRRWt/ffsM9y9IdpdJHW6+WNGYapYWgIg5OJ:sxZyut/ffsQ/THbGAM
TLSH
T10B22B712AE38A57B8CC7D20DBA55BF13E6F9543291D41E48EAFC861C09E7ACD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0c61479dd9dffc1b52b0b9d5429b7a3969aac9f85fe26efee5bcbcd973d2e6f1
MD5 319c71f20e328e12c7acaa28e43323d0
SHA1 2385852d7efe4cf70141248063b6e6fcee85b5f3
SHA512 bcf2ddb05c1174956f6497db04b0188be43956b1c48ff0a10ed936100afd90e53ec496b7cfd4ee06bdb7924e29a55c803b2b1efbc5e3f8dce1c142f2dc2f0269
SSDEEP 768:ymWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy79ro4bfefmRc:ymWPcLKWvKeEeu1jaClLiF724bWfmRc
TLSH
T17FC2EB3B640CCB7E5FC01E9DDC5A6FA76E9802C79A648D4047FE944C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c3a49ec-2b69-4691-9f5e-9eb8a11607a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5c3a49ec-2b69-4691-9f5e-9eb8a11607a5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef819feec39f872fe1ecc32431c01ec152f01f75717db9b4cfe12eaf7537413f
MD5 b74eef61e0fb0a1a6307209f194c81a5
SHA1 d7d87a79e42c2997adcd85fc57af664379e49700
SHA512 896141f3873e1a28778a64884d5f3c6026070a9eae14013b8c07325fb96d44ba5cb610b3e860a805240d315a0301629618c37622b118523925f9b14002cf9971
SSDEEP 384:4ZcIhsNnXM1w7uzIGmxR89MXmirVZh6DKhH2oE:GhZu4muEmirfYGH2L
TLSH
T13B828D33DC78AC7B5DE3B949F4462A139EB88123D2C86F84E5ECAF1D01DA6581317927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b785a063d3010d5e2b576c4adaa9d21b646e2a4f2045c703cf0b919918a163cc
MD5 8bb9aa9fff2dd0929ceca1b2c4fcc031
SHA1 90a8addbcb5097b3a4f7ed532fe7f2dd33a54698
SHA512 55e3771ad0c6ea52f4a92104729c373604fbabbf465d72b3f7e2481c95a6d5892e2628bc49bf51c9ecc6c7ee15106ad7cc789347586c739fe9f263dede179d36
SSDEEP 384:ViFiZcINzsN58TUNTUlIl2M1w7uzIGmxR89MXJ/irVZh6DKhH2oE:cFQ1Uwg1u4muEJ/irfYGH2L
TLSH
T12BA26C33CCA8DD7FADB7AA49F9463613DEB44063C6C5AA90E2D89F1D00DB1981307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38af041b7db90f2b1c804304dac4e517b83dd575607049d7d1ce685f72bd22ae
MD5 cf83f0cccbaf6f215af336dc929aed92
SHA1 98ac316fd4fa75bbe7484814f749a0a7bab23be1
SHA512 07729c1da4a7e271a9c875036397acab6055e7cf7aa48c07d79fa65b5278465699f766efb9b05481bf095a1e1588d894a1888fc85e360e33140f7a7659c5dd98
SSDEEP 192:aONC6IEWQmiUysBTKuIGmx9jzorHRPMX/eURr27HUq5U6:aONC6Dy1KuIGmxR89MXqHrU6
TLSH
T132120932D9B8BC6F5EA3A944B4873523AEA54127D6886F50D6DC1B1C01DF25C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 556ca2ac258843c455f3c9d4d01df1cf56aae0041d3570f6f18bc32e5704fd95
MD5 8c8eaf975a28cfbbf6b3ae364b0c20d5
SHA1 a7385c198ecb290738f350d07f35aa23fd2f7142
SHA512 ea6d49d1c50e6ab47c99180daf1f5a891e61da839484bf6005ac5d782b1b9d40ce822947da0cc612a66accb125c2ab9b3fec88ee073ef4a3e301dc6c09e500c0
SSDEEP 384:sZcIhsNn2M1w7uzIGmxR89MXmirVZh6DKhH2oE:6hEu4muEmirfYGH2L
TLSH
T196827C33DC78AC7B5DE3F949F4462A139EB88027D2C86F44E5ECAB1D01DA6581317927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 daa7b5a668517af1a6595c1d0c47aad5f800bf1deb3b40dfb0e0479ea51ea16a
MD5 2b7c0ecf341bb18554438792e2029fc5
SHA1 3f953c370b8c08b1068b5efc68be4c1daf9950ee
SHA512 cf67bcf05fb9908c358804d97368d96bf41e038674bcb84e932e208206789efb54b5dc6b19afd36cdb2bf7bd8100a812dc51b7732990e766b6e7e8944a1437c9
SSDEEP 192:aON26IE7QmiUysBTPuIGmx9jzorHRkC7smMU6:aON26DtbPuIGmxR8HsfU6
TLSH
T16502EA35EC78BC7B9EF3AE09B4472A239EA4113BD6952F54DAE81B1D00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6cc0f903aee51c5d5c801a256fe64b42f13ff82e362030d89271deedcbfd785e
MD5 e47249d2ad83e91c16a7dfac294145a3
SHA1 8075fccc77151515320c2cffa61e38e9996d7c2a
SHA512 e655079304ed0307f6664ba85b569af25719ce922680da1a07e206fd9e5069c64a965060d34f2471c8e3e2432b97c13749d43bc115d6619bcf630c64b50fd5f6
TLSH
T16641F659B6E91148B3B7AF5A9BF7686D487F7C373E06E45E00110D4F0A66A04D872B33
MD5 SHA1 SHA512 TLSH

Submit Download