5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-995609-v6loi5.htm
Size 1KB
Sample260929-trwpdsba53
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1948	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{FE940FFE-F61F-433F-BBE9-F49E29D783FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 5104	2692	msedge.exe	90
PID 2692 wrote to memory of 1948	2692	msedge.exe	91
PID 2692 wrote to memory of 3852	2692	msedge.exe	92
PID 2692 wrote to memory of 3852	2692	msedge.exe	92
PID 2692 wrote to memory of 3852	2692	msedge.exe	92
PID 2692 wrote to memory of 2852	2692	msedge.exe	93
PID 2692 wrote to memory of 2852	2692	msedge.exe	93
PID 2692 wrote to memory of 32	2692	msedge.exe	95
PID 2692 wrote to memory of 5036	2692	msedge.exe	96
PID 2692 wrote to memory of 32	2692	msedge.exe	95
PID 2692 wrote to memory of 32	2692	msedge.exe	95
PID 2692 wrote to memory of 5036	2692	msedge.exe	96
PID 2692 wrote to memory of 5036	2692	msedge.exe	96
PID 2692 wrote to memory of 1728	2692	msedge.exe	97
PID 2692 wrote to memory of 1728	2692	msedge.exe	97
PID 2692 wrote to memory of 3940	2692	msedge.exe	98
PID 2692 wrote to memory of 1728	2692	msedge.exe	97
PID 2692 wrote to memory of 3940	2692	msedge.exe	98
PID 2692 wrote to memory of 3940	2692	msedge.exe	98
PID 2692 wrote to memory of 1548	2692	msedge.exe	104
PID 2692 wrote to memory of 4804	2692	msedge.exe	105
PID 2692 wrote to memory of 1548	2692	msedge.exe	104
PID 2692 wrote to memory of 4804	2692	msedge.exe	105
PID 2692 wrote to memory of 4304	2692	msedge.exe	107
PID 2692 wrote to memory of 4440	2692	msedge.exe	117
PID 2692 wrote to memory of 208	2692	msedge.exe	118
PID 2692 wrote to memory of 4972	2692	msedge.exe	119
PID 2692 wrote to memory of 4596	2692	msedge.exe	122
PID 2692 wrote to memory of 4596	2692	msedge.exe	122
PID 2692 wrote to memory of 2076	2692	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-995609-v6loi5.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85f35c188,0x7ff85f35c194,0x7ff85f35c1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,6972083440066917437,14717282194505906280,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,17491391292381855309,18284762731462925013,262144 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,16830506430783663796,361133941583526175,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17535794579822217071,3510795134772280562,2097152 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7565249927253166646,17895230043646801961,2097152 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1692,i,10856101126741692897,10335093256348524967,2097152 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14952557730959377086,11780182398458564095,2097152 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7675316548936892687,3644794778214526943,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14066523772021814394,10902419459652769749,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6902442019475073642,15328813772796947629,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6902442019475073642,15328813772796947629,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,2580467620466190698,8227155801241545991,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,15191187450357496365,3989725567650585588,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8074201374062314645,5446096222952419934,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,4912556585315397021,6158994295146260094,524288 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,12394535889731096444,3870967474733026021,262144 --field-trial-handle=2272,i,11746401944533660998,6549257932313004050,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 705124f1b4ccce88dc8645b6eef3a33e1d2d194dcba2be9fd9a67106bed18054
MD5 c7131ceba6d311158d56470d472174ee
SHA1 59cc2d98a9ec64a78113abfe4ce82be1be86a642
SHA512 3d64b59c0c468644c66448b4499a14eb737c21d59ed0a77bcab61e4478d1c833e879cc610dd3b29372c521995c13ed09dd0ec5edfc7beb588aaa290e53fed3e5
TLSH
T16C516145C59280B2FBDA697092D1138F353C79A393AB2D6535CCF77B0B8BB055234806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ed49.TMP
Size 2KB
SHA256 dcd4c1c675d636a231f978fabc926bcb7a69c4f1ddac3bec1436ec72c264091d
MD5 1d6d86b2f0614b7e52b587a29ed28f7e
SHA1 0f0be8d6f3ca260691634c9a8e78af3960aaa8df
SHA512 159c569d09df5fc08ca77bb363b3399fc209cc4ff236e6f568c0bafde21ce0aaf22ccc57dad7b97483797b4c877d94262b75603a40d0b36e4d0b1475712d99d0
TLSH
T190516045C59280B2FBDA697092E1138F353CB9A393AB2D6634CCF77B0B8BB055234806
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4e2da47a9fdc58d4ee14bafc47e75c7c1911892c9975e970d83a113bb6b4708f
MD5 bac23830089cb5b98412a6ec5e1d19ae
SHA1 5b93ced3de6c5015b008b35bab7033ba1eadceaf
SHA512 cc0ac776c5e2a6015d2974cd5fb03dfc1181d28a74a13f15fcf5df9ad109c9fa1ab2fbe632e971887a3bc1c7c5a499c80321af010cb9ff3f2867b69653909f41
TLSH
T1B7117AF3C3D586AE891156F05A24EE2BCE2D0606422C7C1989D4EF2B93E3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9fb8f6e2b18d156c6370499df6b9fd1d3568387e2e5ea7edf0d63b7245d6c091
MD5 ad998c70cb97d90281188c106a70b162
SHA1 03c48eb70ab70458e3389228db2b499bf7d1a632
SHA512 4179c1b8422fc20867f6975faeb3789b6a1d5b6b814c30a5086baaf1c02947f57033a4dc9b2dd13018e22f8fd25b3da0e4327b4862a5add6341793e07f6832fd
SSDEEP 192:sxZ4vRdW4/fVsRHIdpdHHW6+WNGY36aWXIgrJ:sxZwC4/fVsRIpHbGX19
TLSH
T17D22B711AE28A57B8CC7D20DBA25BF13D6FA503261D51E58EAFC851C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5a519da7fd1e87ff7add9bf17dc209e6a3960c20f145c2098fd6a9272dc63df
MD5 6fd0348eaa5c6582d6de28f5e957961f
SHA1 9b444d5edfb034791ccde46fdcdd23c491b04ef0
SHA512 2e024086cb7cba7c6f578b40e1da980721fafb37b884bdbc6ee10e74dd2a963b8f08dad1811f3c11bab7876cdeb8c721249dee2c0de965f3c79454872a8c86ed
SSDEEP 192:sxZ4vRdW4/fVsk4HIdpHHHW6+WNGY36AWXIg5SJ:sxZwC4/fVsk4InHbGXbw
TLSH
T1B522B951AE28A97B8CC7D20DBA15BF53D6F9503251D11E58AAFCCA1C05E7BCD121740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1bb37936fcb55b4cea580800d1ec61684789a4c16344f1c83660c40075127ec4
MD5 dc416a616d9c67bcb806797c9f581b04
SHA1 07ca53ea00ea3d1d678b229f73068d8bb69f42ea
SHA512 9a7252c88161ccb785dc561eefea40f4437ecf506e96c57bb30a673fc996520b1cd9537e6615438974b3590b12cfa2135c498738520c4976d8979f8826e396e3
SSDEEP 192:sxZ4vRdW4/fVsk4HIdpdHHW6+WNGY36QWXIg5SJ:sxZwC4/fVsk4IpHbGXrw
TLSH
T1E222A811AE28A97B8CC7D20DBB25BF53E6FA503251D51E58AAFCCA1C05E7ACD121740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 da6a6b18ec2fce75a0bd560d4e40ea358bf7fa1a47db3f8fc3b56086618031c8
MD5 0030ffd9e83cc862707f6dc0264e071e
SHA1 76dd829abf9977d5d688a708275ef41c202a1e65
SHA512 1891ad91c4f8835f258f20eb4300a2bc423a0ae6d91f3286084b2117ab6c1368054fdfc26cbe8ef80994a5eff7804272fa67e1ae4c63ebc934aab3ac19413a4a
SSDEEP 192:sxZ4vRdW4/fVslHIdpdHHW6+WNGY36aWXIg5gJ:sxZwC4/fVslIpHbGX1y
TLSH
T13222A711AE24A57B8CCBD20DBA25BF53D6FA5032A1D51E58AAFC861C05E7ACD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5d4a1a345de9d718e51dfeae339e8570c37a95ed7236f4209757ff84d366edd5
MD5 ea3fee71c19719082c0952dce2adf6c2
SHA1 ae9fa9686f39de130396a3e41805a5df0a8d8b95
SHA512 231811d5bf0389d13cde02f805319ccfc0c650b677c4c217b9dc17bb9d7cf939db1e8b57d099b0967181a4bb808d428507f7cb6997da20005dab2d5485fd7d1a
SSDEEP 768:qQKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/LrolG:qQKlm7QWvUYe0u1ja8/L/E/4lG
TLSH
T18BC2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2be57d401f3df2961cb023c821a3eb575605f82f64980e9ec0c989e64536db9b
MD5 afb3d984c9e13830768be38e19eb56f5
SHA1 1051f21c74690430c8e35136f879e82c26b5c998
SHA512 4ad9cbb47d1aa58a24a98a34ad5d006dc8d135142fd54471332002d271f83192d5f925e5dc9da23d7762ffc9094435c9dc2159f8ffc704ef381a9d07c56dfbb1
SSDEEP 48:K0Mb6G02aDbqpyIS+DK9a14Dx8TYRi6AyLFk51Hznob7+7ISNoK9t1foxt4Yuf1Y:KILSKEkOKK4KP6ce0KDqeul+KOAG
TLSH
T127C1FF1176BB024139BE29988276871B524135733418F72BBFBC50A1CE6FE181DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae1c83d5-d51e-402c-95d4-9fb21aef5f52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae1c83d5-d51e-402c-95d4-9fb21aef5f52.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598776.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598776.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 189be51d041ac85a2e7f709b6504fac28f9627ca130c9e194d8aef1f73229d02
MD5 6d81dfcebedb686d5e431ddf3b885c31
SHA1 a3336382653e92b0e11ee14fb88606c696f58555
SHA512 e608b547e9e6ccf54fe62ec27ce7def689e3522f153e61c8b96b720688a8f795b3184053dfba4bea1e9420dcfe702fba506995a117e0f6a0ed1db7cd72494a69
SSDEEP 384:XZcIhsNIsGbFWxh//S+Zw+tgOIwZOytFoD:fhCf/K7+XsOw
TLSH
T12C828C32ACB8AC7A2DEB9141B48737035EB48463D7C59B94C6EE6B1D05EB1AC130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 aae7dcb666e343d23bca5b0a412b2db116f6c9979632f74939d34d413b634321
MD5 24ee661fd0ba8b1cdfc7b0e6c7216543
SHA1 2c7612ce5b49c553822b3fb77d6da996b7e1a2fd
SHA512 922bfae40192a61d2d2e471a90a821d19fd2d9f82b4e83205d082a3d1936711166651e935ab98c8916e3243262e89e986d458fdd902949aa2131fb5f9ce7ac5f
SSDEEP 384:G1iFiZcIBzsN48TUNTUlIldGbFWxh//S+ZM+tgOIwZOytFoD:G8FQxRwgTf/Kh+XsOw
TLSH
T1C2A26C339CA8D97BADFB9A41F54A33038EB440A7C6C5EA94D6EE5A1D00DB1DC130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ea1a807e1390f71dd2e2d0411e41a7388c05e0e1cbb0ea8627fae5d33f3e4d9
MD5 71f9a5448ca871c77e2c2e93b49376a4
SHA1 3caf018048f47a1a3ce066e17d10e7dcd0eeecc1
SHA512 60fd219e5b277013079bde67f197294c71715d28af157a8db9604e3f28690ab3e5257f68c28e82a82f0bca6eb0b9e323968e20cca3fc8635b0f08245cf012a5d
SSDEEP 384:eAZcIhsNIdGbFWxh//S+Zw+tgOIwZOytFoD:e+hVf/K7+XsOw
TLSH
T17C828C32ACB8AC7A2DEB9141B48737035EB48067D7C59B90C6EEAB1D04DB1AC130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c66b4244a526628c67ce2cae24ad2ca12e66f0d79ec27b680252159289999bba
MD5 bb19fc82dfc010bb1ea11411e097c937
SHA1 0316375ba5bb2de2d43d1b3a06f79b0e632745d5
SHA512 cd8a2ca7d0cc78056b70242d274e3cd413971df9cf2003500060b8756ff2f40bc0089a18d4f8cae19ce1113d96b0248ae220433e28a8076b2d6d97989a7436ca
SSDEEP 96:KqONkiQsjpfbUmjH5ih/cIPURHl8h4otop5QaDJBKP4v+Y1xf//ojdqxERtIgBCT:BONm6JUm0QmiUyJPso//S+gBCs6Q2U6
TLSH
T15802D739BC787C7B8EF39E45B0477B239FA4106BA6916F94DAD81E1C01D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e80fa05d913b2069bed6955c583a4786e11535f4a1aac173414135f993d246aa
MD5 e371fc51ed39248a42a27e4a2f1909f3
SHA1 03e4a1da8d852ec6483c424b123a6c640f2af87c
SHA512 72a8190f2a2c3147d8f00ac999e230f92c8e7e2e93ce3f83207b7a72dd34929729a5e9a77991a927000c14007d10e1cbf35fa8bac2b0ee4db5d85a2723e57712
SSDEEP 96:KqONkZQsjpfbUiH5ih/cIPURHl8h4otop5QmDJBzP4v+Y1xf//ojdqxERtIsx6Lx:BON56JUhQmiUyRPDo//S+ZgNxsRqiU6
TLSH
T1B1120935BC78BC7B5EA39981B08736135EA04267DB856F94D6ED2E1C05DF2AC2307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cf4556dc7013cda5767e0cc1637e0413981f7db3a69609905c1c3a019e46dd3b
MD5 a1d331b2225989da1d23f0f58866710c
SHA1 753024d004cf1c96f7ca64f50c034feb59e33556
SHA512 ab1ef39e45122c83b4fd9e80d7e67fbca480e319af37fc2184325f9f0fe1df95e5d8aadaa4aad1fc1fc6a01f0783a5e194158f235c49b99d25110f2781b4591f
TLSH
T11E414E5CA6E91108B3777E56ABF6A86E487FB9772F07D45D10110E4F0A22B40C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download