5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-pcbx2e.htm
Size 194B
Sample260930-185f7asdrd
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{0E0A3779-35D3-4347-B7C5-2D6D68BB2E98}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4776	4544	msedge.exe	85
PID 4544 wrote to memory of 3992	4544	msedge.exe	86
PID 4544 wrote to memory of 3800	4544	msedge.exe	87
PID 4544 wrote to memory of 3800	4544	msedge.exe	87
PID 4544 wrote to memory of 3800	4544	msedge.exe	87
PID 4544 wrote to memory of 2936	4544	msedge.exe	88
PID 4544 wrote to memory of 2936	4544	msedge.exe	88
PID 4544 wrote to memory of 1492	4544	msedge.exe	89
PID 4544 wrote to memory of 1492	4544	msedge.exe	89
PID 4544 wrote to memory of 1492	4544	msedge.exe	89
PID 4544 wrote to memory of 4120	4544	msedge.exe	90
PID 4544 wrote to memory of 4120	4544	msedge.exe	90
PID 4544 wrote to memory of 4120	4544	msedge.exe	90
PID 4544 wrote to memory of 2372	4544	msedge.exe	92
PID 4544 wrote to memory of 2372	4544	msedge.exe	92
PID 4544 wrote to memory of 2372	4544	msedge.exe	92
PID 4544 wrote to memory of 5072	4544	msedge.exe	93
PID 4544 wrote to memory of 5072	4544	msedge.exe	93
PID 4544 wrote to memory of 5072	4544	msedge.exe	93
PID 4544 wrote to memory of 4032	4544	msedge.exe	98
PID 4544 wrote to memory of 4032	4544	msedge.exe	98
PID 4544 wrote to memory of 2004	4544	msedge.exe	99
PID 4544 wrote to memory of 2004	4544	msedge.exe	99
PID 4544 wrote to memory of 3780	4544	msedge.exe	104
PID 4544 wrote to memory of 840	4544	msedge.exe	112
PID 4544 wrote to memory of 3788	4544	msedge.exe	113
PID 4544 wrote to memory of 2432	4544	msedge.exe	114
PID 4544 wrote to memory of 3500	4544	msedge.exe	123
PID 4544 wrote to memory of 3500	4544	msedge.exe	123
PID 4544 wrote to memory of 2856	4544	msedge.exe	124
PID 4544 wrote to memory of 2856	4544	msedge.exe	124
PID 4544 wrote to memory of 4420	4544	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-pcbx2e.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa8ef0c188,0x7ffa8ef0c194,0x7ffa8ef0c1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,1091541413873860583,7848576665378429214,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13171495583529201533,7625779968241260679,262144 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,15374850502399595714,15719313240405894540,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2033716129988074103,8183605526588899903,2097152 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,3635119466936161001,9042079933569777706,2097152 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7551559937023825985,8231004723538499316,2097152 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,8768321469199575570,8793029345063888305,2097152 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6965037047691803083,2810180341718742078,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3315255247601998048,5947527801241931479,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10905862488840774928,8661541210977688207,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10905862488840774928,8661541210977688207,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10165611463917065055,6572009786476132455,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9298056525921346747,5379030156478809038,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,9019297401009844159,13941000661282075762,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2976,i,13500047901388052270,12745715626789895611,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14712219268792303885,16033316745564794798,524288 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,377423844876664467,12464956890075817404,262144 --field-trial-handle=2508,i,3063362880523084659,2056832031766379620,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 271d7b7eca8d9ef08757383530dd320d95c41c52de4c5245f18f363c157ea73b
MD5 cda7f11365d24e62b2882074023eea91
SHA1 d7f41071e15427e42dc57428a6461eb602986702
SHA512 65d0f97296ea04e256fcff8b51ba9fa19cf8a705a59a5f9548cc76a11de3bc0653e86eb1f8e1245c38d10b5ac7de930a8105770ca49eebd3067eff087d5ac093
TLSH
T14E6142CA5ED0287BFF6865B0C1FD154B3B3034B045A31F5A28E6F8741E8D7892D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e819.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e819.TMP
Size 3KB
SHA256 846d76d457b1d80e1371b739a3a448c8767525df5e240c5b516e04518dac9992
MD5 7fcaeddd36fd2846ba8db0e51e421f63
SHA1 f4f40de04132fdb13e733439e3745404181814dc
SHA512 08d366666b44eb8d7ddb014cc34c508ebc859fb498f3078fe107c84faf706a536587dfc1feb384fc870d805e909a3736efd50446d9524ca0e4c5897c7f271745
TLSH
T1356142CA5ED0287BFF6865B0C1FD154B3B3074B055A31F5A28E6F8751E8D7882D96238
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 a65958d81288fe06b21d539660a2fc89be076fbead427bfa91d8747c78f05a88
MD5 b12599de29ee77adb8961824d2acff3c
SHA1 0d71dddaa134856f5eb84589ff741cc11c705027
SHA512 f560b180a12b25f710899716c8f24020898bcc5c3739b3f2454ea588c42147bab3b8e491f854cf9bd45c5cce9f4042147bbf5eddf73f70769331ce398b35fa78
TLSH
T15C014CF3C3E595AE8A0196F06A18AE1BCE2D0946831C7C5AC5D4AE2B93E3475E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 98db7a61c6c75a9489cebc393b6c1ac8c2fa723394dca0569819f1bd1ca13386
MD5 b94fdf0244ab8cbcab1962524f91570f
SHA1 4471eadb69df556acb3a2f0e338e500da25d77ff
SHA512 ae245cd18bfa26dc773776afc189cc5dbec964267789dc3efa95d268a6b6c421cc0c920461d9d1730b996611e3b66fd2841e35bc36b064a3a512ce90abc93b77
SSDEEP 192:sxZQRmWn/f0sASJXN+IdpdYHW6+WNGYaQdQIgrJ:sxZQjn/f0slJXNvuHbGb9
TLSH
T10612B9526E28A97B8CC7D21DBB25BF53E6F9503251D41E58FAFC861C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a43d20f529b552f67802a348a17aa116129d9775f41e73c2d31a216dc6eba091
MD5 28623dc93eeb09dab892ef15d7244563
SHA1 2076a14395798157be5680d723ff5725f9080d6a
SHA512 e8ba91fd05929dd66e8c92561b80363e73efb9fe7426a63101c08d80218c04c283dfc527978f5c1d60c8d2441467f902867c13e0b2484aa4bf094a0836d5eff9
SSDEEP 192:sxZQRmWn/f0sTSSXN+IdpHYHW6+WNGYafdQIg5RJ:sxZQjn/f0sOSXNv4HbG2x
TLSH
T13622CA526E28A97B8CC7D21DBB55BF53E6F9503251941E4CE6FC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3507ddf3aaafd69e62b4e883e265c3e9f05f7d6e19c1acd3db37c8a4b5c28e33
MD5 3bd0f40a1d10abed80e912a57bce24cb
SHA1 4cdfba7069d79dbe18d2e8ad0a571541773831ea
SHA512 b9272e00409bea42c0f4b7c4aa330686f760178728a9e24e596a1bb763b7d7460d6b302348c2cd8230f40249dbe8abd6c5d711debc511ae7a6ee4699f1dbde56
SSDEEP 192:sxZQRmWn/f0sTSSXN+IdpdYHW6+WNGYa6dQIg5RJ:sxZQjn/f0sOSXNvuHbGtx
TLSH
T1E422B9516E28A97B8CCBE21DBB55BF43E6F9503251951E4CE6FC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 84e64c6267f7831e52af704559be2d1257d10aed2528973c586eafc5950fd745
MD5 d03f87c73242881fb672b506c96ec561
SHA1 9b3e4232202908cc811991799825d28081dc56ce
SHA512 7e0a7c16a7d26064450397c10264967247d138a794a849bb82c2e5841daede061dbefba8062cfcab8c8d65b1da4f3c72ebc829edbcb2c8142713e16cfa112270
SSDEEP 192:sxZQRmWn/f0sTSJXN+IdpdYHW6+WNGYaQdQIg5DJ:sxZQjn/f0sOJXNvuHbGbv
TLSH
T11822C8526E28A97B8CCBD21DBB55BF43E6F9503291D41E5CEAFC861C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2c80c0c1ed9baa1ba8436ff1bc4bde82641fb1f7e799c40790cfec081dbd89c6
MD5 e300b642e9bab66ad4c8b0e8f5a25445
SHA1 c214fe643c86802350b4c8a20c308d8865254f1d
SHA512 88246183dfd47a63cef07d1627b8b6a250869dc8ce0a6f3dae82df1f3a3d605f8fcf1d6d1016a29a69d27e599ed02cd3213695287d2fd1c101560ab9092ab711
SSDEEP 768:dKyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3mro5Z68:dKyQRbrWvvlpZu1jaXKLf33d5Z68
TLSH
T1CBC2FA3B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33dccc6ab72182b7fd169383cab93da6612976aaf74a1dcc10acdd3554ded9dc
MD5 efabb2964889fa418aa90f61cd1ebf2b
SHA1 74ed32508f9db647ca6fbbc7e0f451bccf44170f
SHA512 01d39386b2462dff54d3fe4e28e71026d8b02d49ba26b91694ec10cde47cfc595e17f82ef1d0e5a7eb823e7b5bf051c179f08c6d594c76ccd13caa5df29afbd3
SSDEEP 96:KgHmKQou6ucK3q8t0BdnDfkvDePh1kKJBh5EgKZz:AV3lt0BdnDfyDeJ1pBh2z
TLSH
T1BD91E551307B064038BE25A88276975F564132B33014FA6BBFBC01E55E6FE085EFEAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f260f66e-326e-4421-9f95-95dfc386f9b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f260f66e-326e-4421-9f95-95dfc386f9b8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d54b8b16f1c15927f6c91b889cffa9febe61dc12cd6bc2a9c36419b87445c19c
MD5 31cf6b3ece19fbfbd59e44a3bddeb948
SHA1 9ce66bee3de9ffe719f097c36613ca7f33f0e0ea
SHA512 56a16c31cc64fe01c4bc51391a5ee60dd726de9454a452107484775c00d285372018a85c5b40dd52f404dbe752d8fdc371909a029dd2ff5149bb8dc4644155e7
SSDEEP 384:YZcIhsNdjp4k1Mb3rp5u8ijOBHILtgOIwZOyFLpo/:mhQEzkIILXs2Ns
TLSH
T119827C325CB85C7A6DE7A545F68B77034FB8852BE3C86B94D4ED971E00EA2D8130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 93387dc32404d1d5abfdf4d62bf873c3ada388d67dd43ab7bb8eb67b440ba9dc
MD5 36cacc215e9d3314f7e2272d7d82b1c6
SHA1 804c1b86c2c75099d894c1617b831f1838a1bac0
SHA512 0ef774089505e98bd6884ef749f8d2a5ccf3782035925fbc186917685c07fbba0e224353f91dc43bebd05203687ad8b73131c5b5cf22ea35a6628272eb8d02f0
SSDEEP 384:qiFiZcICzsNn8TUNTUlIlap4k1Mb3rp5u8ijOBUILtgOIwZOyFLpo/:hFQKqwgGEzkhILXs2Ns
TLSH
T149A26B335CA8987FADFB9A85F64A37038FB44167D6C5AB94E6DC9A1D00E71D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea403811a9d7fb67f022adf82e67baeca9ceab82886a3b7acde9e19ecbecfd31
MD5 d432c3aa580c32cc3f017295e9a5f0ac
SHA1 8cf4261417aaf1622815faa37e0e0abcc2b2ffa1
SHA512 6907a6d2d7271ad1299344b8350819419b4a920a0b575ccfd2af41d18a21d441784ef771c6371effa825f4082df0e06e379e5151f73047226e0be0f071a7446c
SSDEEP 96:PqONkNQsjpfwDISp5ih/cIPURHl8h4otop5omD3BfPGxvw45RxmJm78lFUxFqseo:SONV6iDCQmiUyLxHq5u88PjaSqqcpLU6
TLSH
T11302E839AC783C7B9EF3AE45B5473B175FA4013FE6942B84D9E81A2D01D729C1307522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6e5b3bbdcb3d45bf2a61ef9c848bc5acb197f7918fd16a21847644465bfda58b
MD5 c4cb5b829d4f74a46d616d6d30951c4e
SHA1 e4de7937ec7b6f84e77d790fa391232391a02087
SHA512 976d9126b08120e28e100d34c08744db66bd618fc09add0a4ff491a91a0fc003f92e898228dbad80d63559d349db141a46cf51477853d2913492231a2d57e414
SSDEEP 384:DZcIhsNdap4k1Mb3rp5u8ijOBHILtgOIwZOyFLpo/:bh9EzkIILXs2Ns
TLSH
T188827C325CB85C7B6DE7A585F68777034FB8852BE3C86F9494EC971E00EA298130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bea905b1ddacff831709fea01dea9e61da6f8449b9307cd0e0c2b15a6d9e1146
MD5 0a9fbd3e124083bb3fc1dddaa9731781
SHA1 df037c53f95ba8df38ee88aad6f13088784d2cc1
SHA512 a5d97b42a7773a655dc0819ae2b31cb23aa19c851daeeb87ac173cb2c13faf82b03e622d45f749b0e7cab46436f97e6aa601ddbe989754679be4f111d729ff55
SSDEEP 192:SONg6iDnQmiUyCxpq5u88PjO7FbuZ5qtLU6:SONg6Ejpq5u8ijOBGILU6
TLSH
T152120936A8786C6B6DE3A951B54736135EA5423BE7883F84D5EC172C01EF29C230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6caed0aa-d35f-4d78-9c63-82f1a0756fa9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6caed0aa-d35f-4d78-9c63-82f1a0756fa9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 62cbe8f7b3a2eb780ddf05d32d0a7dbb3ac1603fe0b27f17736307f6e30f9c87
MD5 e508e13980de08ff0bcb49ad2e0c63c4
SHA1 7d6109bd4d5b01c08d50283580b8f3730e7c9195
SHA512 dff3accde76822de0d0e786cb33a437a145aac6226f25007b3b53d604bd94d674d6eb97f104b12bae73f9a5871d28a16ab8407c8c01c767abc2ee553d89a1003
TLSH
T18D411858B6FD1118B3B7AF16AFF6A46E447ABC372F46D45D00120E4E4A26E41C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3780-180-0x000001FC400F0000-0x000001FC40239000-memory.dmp

Download

memory/3780-179-0x000001FC400F0000-0x000001FC40239000-memory.dmp

Download