3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-1000678-44i35g.html
Size 171B
Sample260929-wspnkstyht
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2500	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{433ED2F7-764B-4A4A-BED3-64744CAE5035}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1908	1696	msedge.exe	86
PID 1696 wrote to memory of 2500	1696	msedge.exe	88
PID 1696 wrote to memory of 2356	1696	msedge.exe	89
PID 1696 wrote to memory of 2356	1696	msedge.exe	89
PID 1696 wrote to memory of 2356	1696	msedge.exe	89
PID 1696 wrote to memory of 736	1696	msedge.exe	90
PID 1696 wrote to memory of 736	1696	msedge.exe	90
PID 1696 wrote to memory of 2204	1696	msedge.exe	91
PID 1696 wrote to memory of 3956	1696	msedge.exe	92
PID 1696 wrote to memory of 2204	1696	msedge.exe	91
PID 1696 wrote to memory of 2204	1696	msedge.exe	91
PID 1696 wrote to memory of 3956	1696	msedge.exe	92
PID 1696 wrote to memory of 3956	1696	msedge.exe	92
PID 1696 wrote to memory of 3900	1696	msedge.exe	94
PID 1696 wrote to memory of 3900	1696	msedge.exe	94
PID 1696 wrote to memory of 3900	1696	msedge.exe	94
PID 1696 wrote to memory of 4312	1696	msedge.exe	95
PID 1696 wrote to memory of 4312	1696	msedge.exe	95
PID 1696 wrote to memory of 4312	1696	msedge.exe	95
PID 1696 wrote to memory of 4468	1696	msedge.exe	101
PID 1696 wrote to memory of 468	1696	msedge.exe	102
PID 1696 wrote to memory of 4468	1696	msedge.exe	101
PID 1696 wrote to memory of 468	1696	msedge.exe	102
PID 1696 wrote to memory of 4836	1696	msedge.exe	104
PID 1696 wrote to memory of 3812	1696	msedge.exe	111
PID 1696 wrote to memory of 3496	1696	msedge.exe	112
PID 1696 wrote to memory of 4584	1696	msedge.exe	113
PID 1696 wrote to memory of 1488	1696	msedge.exe	120
PID 1696 wrote to memory of 1488	1696	msedge.exe	120
PID 1696 wrote to memory of 2296	1696	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-1000678-44i35g.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbe92cc188,0x7ffbe92cc194,0x7ffbe92cc1a0
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12905703981248595652,8031499541580156768,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,8238325096329259775,4567443991264567533,262144 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,475125969556818136,11017666197459569885,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13608146337454219662,4616448990980331339,2097152 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3803859393625607558,14105491237367441134,2097152 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,8469307035404799253,17267709451820429945,2097152 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,6608602637392140994,8308963578685174843,2097152 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12725161004097686678,12326420818389293214,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8261167103865673386,14572007463881973515,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6160228925424452330,10795796886260705882,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6160228925424452330,10795796886260705882,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,4191911786304851242,12641157489646193927,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,3760072899107619865,9311136620080394872,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,5775861391882731687,1376055156400314932,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,18400493761418252093,8134947410323946762,524288 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5708,i,11493327856780485591,14329400741578162097,262144 --field-trial-handle=2244,i,3666092232282547443,9573414867074764290,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5b6600dc-e9f1-4e9d-9f0d-0299541424c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b6600dc-e9f1-4e9d-9f0d-0299541424c3.tmp
Size 8KB
SHA256 b4a6494ab256651cccb91762162b73d3507a17120a6d45786cc2f031ea8887c8
MD5 29aabf8ad6a1918e04e9e883480f4f09
SHA1 1b941c1a6b6a2b15c4ed28206cdcac1753c2ccd9
SHA512 0bdbb7acfb5978fece5f5a9c6868c450b8a69f015361e2c133e3086d005e61325a4ca95e6796cd38923c1bcc9ba14ea7a691e80025e6a9e1e8dd4bb9204f9d82
SSDEEP 192:aONI6IE7QmiUyxCTPuIGmF0LVC7sdFbU6:aONI6Dt3PuIGmFAWsdJU6
TLSH
T1E202F939EC787C7B9EF3AD48B4872B236EA5112BE5942F84D9E81A1D00D721C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0e2c0d09d82c154f0ba93a1de3723e3f599721ec228d6c0d4229cbbdf7f1a19d
MD5 4f6f85643989196c151052bbc7c75bb8
SHA1 622ec5e0ba7ca347a57859b94fcbd1eda57e6676
SHA512 64a3b9c5029381765923d23959737778574afe72b12c059e6c401f64ccf16ede1c2e5781c4b5ea98fd938c4fb477a7ec44a0d11c15bbb3e027519596650b9256
TLSH
T1C051328056A25370FF64F87E99E5136F3B38D481D7CB6E5A08A6DCBC7BCA39E9106044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dee2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dee2.TMP
Size 2KB
SHA256 7dca6737d4b5439f3f3c0811685144944827bdd001b728c07a79bfa750c82fc0
MD5 60faf49a4b94b2ff571dd492464d0efe
SHA1 48f262d8ce4ef35add8fb8f09dd82d31a64de72f
SHA512 a940545e9ee15acccdf7fea4da9a50a76bc5036e8bb3c3ebd47f152bef5ed0a68ae581827cb16f4401128ef53dad2b50956dfa5df7d35e0b95fc6265e8b520fd
TLSH
T17151438056925370FF64F87D99E5136F3B38D481D7CB6E5A08A5DCBC7BCA39E9106044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5783f0a6-887e-4dcf-a5ff-623ce022406a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5783f0a6-887e-4dcf-a5ff-623ce022406a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 982657add5b00e39b369c93e6d8681bab8c2e0f521eb233a9c477dc2ce625232
MD5 cf0efae9352dad43ebfd8eb3c3648b15
SHA1 3fdcc5a5f3c96c2a2793d4403a80a5dff6c2b443
SHA512 6b0023f68afcefa003f140d07fa9c47d6ddcc314380a48edca4641081503740a89420ebafadebd3e1db32e5eb2603760a67c32bf172dde829d9c234c7acf37ac
TLSH
T1E4117DF3C3D585AE890156F05A28EE2BCE1D0506421C7D5999D4EF2793E3475D00299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 68c7be883688ecb5f5a34db8452697afad46821b5a9be036316995ef37d01b7c
MD5 8e2aefc429ec443bd086f223e3390a29
SHA1 3cac25a8ac8af9622a5adf900ce47980ed18bbd6
SHA512 549521ed60c5c1b7661aecd73ad9c0dd2355d6be649fbb9b684714d2ac6a8ea20f9305fd690ecd5b28af2b621f9fd8f27c6d8df7e405bc73a1cdeb01fb7c5135
SSDEEP 192:sxZIRpWh/fvsV349IdpdBHW6+WNGYapYH+uIgrJ:sxZIOh/fvsV3JHHbGU19
TLSH
T1F922A712AE38A97B8CC7D20DBA65BF53D6F95032A1D41E48EAFCC51C05E6ADD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a5dc74d827e850056a03900b62cc310048f404d9390832403715b4807d38a147
MD5 51424bbca2c7c91dd8287cf2f3d9f566
SHA1 0735d7826437c84a0ff3c61cbe4f4181a3f31481
SHA512 e56ac23232363008f95a19c8ea1bdac51d326916cf11098c1a382ee1de3c7a65fbb3d617f46217ac4d6ef135cc1aa88352035abb3475f9a1af40f210624a6861
SSDEEP 192:sxZIRpWh/fvs7B349IdpHBHW6+WNGYapMH+uIg5FJ:sxZIOh/fvst3JhHbGE19
TLSH
T19D22B712AE38A97B8CC7D20DBA55BF53E6F95032A1941E48A7FCC61C05E6ACD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cb18fbc944477829ab0ed3244d40df7af7b18c3d51e267de4e2b90d342fbd4e1
MD5 e7c69109be5f8f94dc69c8ef4a9d74de
SHA1 7186826ce5482dbc23551ef192a9202d39b45746
SHA512 d7b4dddf8a5b3321c4a8012ad17c953f42bb1658c8a5e4a9e3009b546b4b1983c42d509be090a2e066cc10141ce709118e3e891ee083d52882b68a8acebc01e1
SSDEEP 192:sxZIRpWh/fvs7B349IdpdBHW6+WNGYap1H+uIg5FJ:sxZIOh/fvst3JHHbGv19
TLSH
T14722A812AE28A97B8CC7D20DBB55BF53E6F95032A1951E48A7FCC61C05E7ACD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cf5d649d616af88fcad83d608d18e58913bbd690844a87185a81f6d3124bfa38
MD5 22e1dc7da1afd090157e551d796e63b0
SHA1 d6ae4ba4b27d210affd15baaba57b59189333c19
SHA512 1f9017f406016a2de5c8af7b7923240a498fbb3dae89e0f6a59445a6b175363b541018c361c9299d5b9f6d5fbe40b93dcd157c9b22c2830b4ea0ef3b17dd068c
SSDEEP 192:sxZIRpWh/fvs72349IdpdBHW6+WNGYapYH+uIg53J:sxZIOh/fvsa3JHHbGU17
TLSH
T10F22B712AF38A97B8CC7D20DBB65BF53D6F95032A1D41E4CAAFC861C05E66CD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 69eced07d18dcb3f190dd15b8f2b968e9567f950e4746c6ec35af830a1277353
MD5 6aeef1ca8e12d57b82a679e4a413ece0
SHA1 73be241d86fd77efd70fe260b234d87892ef66bf
SHA512 7bdb4c60dae718f2ee9bf45c4c499b56303fa639462f825e3d88f399f5716e66082764551da83f71d990da5304eedc312a0994b8872bb28c03af3e9aea85a662
SSDEEP 768:SyWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7pro4/feSmRk:SyWPcLKWvKeEeu1jaClLiF7C4/WSmRk
TLSH
T169C2EA3B640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6175a57ba5c0e798751f0ee8d18b85284287c3fff87f24c5c867d23fdbdc367d
MD5 e9518438bb8ea3f7ae9a09fd904ebe38
SHA1 fd92c929b100a53616c853a531b827f3ab2bdf9d
SHA512 6350bb826743cab04890ea286a8970851a0645eaa732ced560608fb67db71fa70d4309ac5319658c98c8bd9fe83fbbc7082224a15acbe13c424275a0270f77b5
SSDEEP 48:KMIIbKZa0fyFPIlKoEYLk/YU+aWkmahPIhMkKAB42k800PB+05yj5+9pb3jkz3QO:KMIAKZa+2PSKoEjt+K+AqK6G
TLSH
T135A1DD0132BA024238BE690981B5CB2E525135B3755AF62E3FFD44A64E6AF190DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597a95.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 db5a0a4131c49d108e024b9ed0c56ebc5ec54253c088615cb9e9260532fe4694
MD5 7601df054357909de45cdf0a4a30b3e2
SHA1 4f6f18d6be278b1f5d7915bfc4fcce35db6029e2
SHA512 82913b106ef2b81052076c3c1575e361a3adac9d5a586c504b427fb7da092e6d5a95ff2a5d0584a5ae6a81adb6226b459700bae8dbf9b9660d63ac17d4b5190b
SSDEEP 384:DiFiZcIxzsNP8TUNTUlIl+Q1rtHzIGmFAk9wXIEidTLtgOIwZOy2RoH:uFQB+wgZ7TCTAIEid3Xs7c
TLSH
T1C3A27D33DCA8D87BAEF7AA44F98A36139FB54067D5C4AB90E6DC5A0D00EB19C030BD55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c8b2f96215e5f6fe042b9d4d25f10ac7dc70781a1f3ada5a2705a4923413d451
MD5 9fc1bf933be886c6b24643e5a00386b6
SHA1 1165c1b0e4e2a3c0508f3a8a03ed716ae61eb88d
SHA512 07092689260bcc59045609a8e7296d7f9ed58f7357c5965fcef704a168d137cb5ef8501b73e96582548820ec206b00cb3b643fa11ef03d06b5e847f3d7e35435
SSDEEP 384:rZcIhsNqU+Q1rtHzIGmFAk9wXiidTLtgOIwZOy2RoH:zhq7TCTAiid3Xs7c
TLSH
T1C0828D32DC78AC7A9DE7E544F9873A139FB49027E6C86B84D5EC5B1D00EA298030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0cfc4940ebc79967dd73601037943e7a7b184e50dd435d6a0a57731831a6c08d
MD5 ff28a5ede83efebded7fe08758755fc9
SHA1 8474dd507e0b5e2d86d9cddda9a2455d3bd2b514
SHA512 d0a82aabbbfa11d41ba7a0ba37637e574a014d93688eaba863e8640edcb246ddc5e7d14f978cab64073f294ec2dfb1a76a7103720a6e481c4f2e719bdae4e1d6
SSDEEP 384:WZcIhsNqUHQ1rtHzIGmFAk9wXiidTLtgOIwZOy2RoH:EhD7TCTAiid3Xs7c
TLSH
T184827C32DC78AC7A9DE7E544F9873A139FB59027E6C86B84D5EC5B1D00EA298030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e5767d565017d1d5e12a53a2e542618d5f06b308127960059a64d0e6a6c0fd0
MD5 03dacb4e301958cc07e33585f9353eb8
SHA1 5e158cb5befb560365f2aa596a4f474c9961e465
SHA512 342c3a5daedb267d40859c2dda96dfe8185750332f0c883f93989edc3e1f9378bb12289d8e9f7a2d4586651dc797951e4baf2ec5f2b05a3906751f21b83a6d65
SSDEEP 192:aONQ6IElQmiUyUCT1uIGmF0Lk90FX7027Hdsq5LU6:aONQ6DD41uIGmFAk9wXxHdTLU6
TLSH
T15B120B36E878BC7B5EE3A844F4873A23AEA54127E6887F84D5DC1A0D01EF25C130BD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

095d4e68-522c-420f-a9d5-e614df4b4422.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\095d4e68-522c-420f-a9d5-e614df4b4422.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c3a5f123a908ec66648ed8379556f4250736d90c0e0e7bfa3dcfa34ddd9064d0
MD5 e936614f5d6cfb2f094ef01c66e02f34
SHA1 711f462640ec8396db61b0a38ff8022b6aa708e7
SHA512 b3310d56d30714540d84daf04de730054a087e04dbdaa6cccbdc77486966c415ce507f915038dd4ce0da4e88fe45e081898b275fd64a589809023400b127b52e
TLSH
T19041265CA6FA1148B3B7AE5AABF7A82D487BB9772E06945D00110E0F0623A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download