ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-qj1dl4.html
Size 116B
Sample260930-2k6vsassaw
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{D51D477C-35F9-4DA0-9600-481B31D527AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4996	3652	msedge.exe	88
PID 3652 wrote to memory of 5076	3652	msedge.exe	89
PID 3652 wrote to memory of 4620	3652	msedge.exe	90
PID 3652 wrote to memory of 4620	3652	msedge.exe	90
PID 3652 wrote to memory of 4620	3652	msedge.exe	90
PID 3652 wrote to memory of 4700	3652	msedge.exe	91
PID 3652 wrote to memory of 4700	3652	msedge.exe	91
PID 3652 wrote to memory of 4840	3652	msedge.exe	92
PID 3652 wrote to memory of 4808	3652	msedge.exe	93
PID 3652 wrote to memory of 4840	3652	msedge.exe	92
PID 3652 wrote to memory of 4840	3652	msedge.exe	92
PID 3652 wrote to memory of 4808	3652	msedge.exe	93
PID 3652 wrote to memory of 4808	3652	msedge.exe	93
PID 3652 wrote to memory of 1720	3652	msedge.exe	96
PID 3652 wrote to memory of 4816	3652	msedge.exe	95
PID 3652 wrote to memory of 1720	3652	msedge.exe	96
PID 3652 wrote to memory of 1720	3652	msedge.exe	96
PID 3652 wrote to memory of 4816	3652	msedge.exe	95
PID 3652 wrote to memory of 4816	3652	msedge.exe	95
PID 3652 wrote to memory of 4668	3652	msedge.exe	102
PID 3652 wrote to memory of 2204	3652	msedge.exe	103
PID 3652 wrote to memory of 4668	3652	msedge.exe	102
PID 3652 wrote to memory of 2204	3652	msedge.exe	103
PID 3652 wrote to memory of 1404	3652	msedge.exe	107
PID 3652 wrote to memory of 1760	3652	msedge.exe	117
PID 3652 wrote to memory of 212	3652	msedge.exe	118
PID 3652 wrote to memory of 4628	3652	msedge.exe	119
PID 3652 wrote to memory of 5084	3652	msedge.exe	122
PID 3652 wrote to memory of 5084	3652	msedge.exe	122
PID 3652 wrote to memory of 1884	3652	msedge.exe	123
PID 3652 wrote to memory of 1884	3652	msedge.exe	123
PID 3652 wrote to memory of 1708	3652	msedge.exe	126
PID 3652 wrote to memory of 1708	3652	msedge.exe	126
PID 3652 wrote to memory of 2532	3652	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-qj1dl4.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8f63ec188,0x7ff8f63ec194,0x7ff8f63ec1a0
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,5377943921460204041,6056383436169703645,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,12541301900557991338,13423610000230664506,262144 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,5368715126191024751,13912847352370075194,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,5036173078869630156,9591145370892260189,2097152 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11630291613132212437,1051652852189644240,2097152 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15840658426246550486,4071236234333443566,2097152 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2378172479958559048,1763237169691437433,2097152 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,14448786574234853459,4559913649719740762,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,1724581994746738001,2131694941068842788,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18040151549834446829,10681142826188490048,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18040151549834446829,10681142826188490048,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,14768403529627578650,181182715599995543,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,12850315521751142695,3219125288095844991,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,4856825260915002421,14352887639329512442,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12417047599502028073,14224854158554026647,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4262623852384507084,9416074436294441139,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11111305701471540509,17156000199567072282,524288 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,15853838661843798195,6410414058423964421,262144 --field-trial-handle=2316,i,9111802217382875481,2035774070269396140,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f07cb1849a8e29b1e71952c5bd00846c29c83766eb0fd7d2910a9aa0e3d6efb2
MD5 96e6ad38f66cb98435722736ac545edc
SHA1 2534884d6afaa68732e11c650247efb19b203ed1
SHA512 989fac11ac2e29e8cf62853601424dec184936ff1f885d1bbc8fbc44971ac7192b537469b3fed7f58e8739b988e085666a5122717b0a3231a795e06c4fe9d9b8
TLSH
T146E0208447C5C36DF110A98741B6570C83C03B1BB2CCAE051740C845714395076A15F8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 87ab31b0921e82e5feacbaee301bce9de8b46bb081f16411fa74c066c707b75b
MD5 a9e28271f8f63923ce0003fa8d563e67
SHA1 2d37b9932ef33007b5039f3e2a69d5937782bc6e
SHA512 9a8cf93d99dee3731f3dd1cf7f193087ad2be3776602cae9ae1789bf1cba333b0dba55ab5e6501bd12039c89f96b34b3e895b2669e1793644fb2f11db54fb283
TLSH
T1DB616E4BC5B34263FBD897F1C5E42187BA3B7E821A930D1E11A8E475840F7370C151E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5946c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5946c3.TMP
Size 3KB
SHA256 9ebfbc534beca8999ec3e49acbf9c8c5b406ecfd74ef80049c732dc988b1046f
MD5 56d652b3dff10ba7515aed6118e11935
SHA1 4efdec4b4724549798a8ca14135b867ca7bcbf88
SHA512 1d97a3e2dc1de2b71194102218dff3e05f79e450455ceede89d32489685b77faad419f87dd3dfb5f985489589a9e70c578b8d55c17004a400e51a9f446a8fc78
TLSH
T16C615D4BC6B34263FB9897F1D5E52187BA3B7E825A930D1E11A8E4B9840FB370C151E0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 9d2b001425bba2edcf4d922c783263f0f3b33aae55b7bf3205c9c817d8d2d32c
MD5 e9c2917d427817e6624c74efd4c9e612
SHA1 1e9117af0769ca87e123ced50916332dc8e0531a
SHA512 6b9ed3d9214be16aaa01ae4fb13e87e5441c6713d051185325f6d1ff6203b09c103446ac02cf9c3412fab9749f7d67ed70dfa537564b02102bc8866a85ebbe46
TLSH
T1981157F3C7E585AE891156F05A28AE2BDE2D0A06421C7C19C9D4EF2B93F3065E50259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 50fdb6ef3230e9888ccfc70f4ca6ffdf5df00d572911857468d25aed618ac206
MD5 52aeacbf98158384331a9c897f2d8649
SHA1 d4037af4d7c6cafac755c1c4413c753beecd284e
SHA512 4315affcc35da149a250bc1b37e68c86be8140ece24974b30b4e6737621b702a341a18e61c25ddc87f0259ed0dcf436f6e563d745759294251afc22a85d634f9
SSDEEP 192:sxZIRxW//f0s16IdpdvHW6+WNGY3RNgIgrJ:sxZIu//f0s1TdHbGb9
TLSH
T16A12A8126E38A57B8CC7D21DBB25BF53E6F9503291D41E58EAFC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6ceeeb88b822e434ab4d406ac1109f46cf6819792467e8f14f8d8e7d42bdaae4
MD5 4da2ee71afb26d7ab29e7d0ef26eb9f4
SHA1 912972167887b5843792e16f043ae04332e3e431
SHA512 11f6c88ff1a7b624b0315f73b1db550133e7d4028e2f45e1b8868d1f95d11701e60830f2c98a9f444d98ffeb0dc69d55f3cf488ff26658b1824d456747dfe584
SSDEEP 192:sxZIRxW//f0sY6IdpHvHW6+WNGY3wNgIg5pJ:sxZIu//f0sYTPHbGuR
TLSH
T15A22B7526E28A97B8CC7D20DBA15BF53E6F9503291D41E48AAFCC61C05E66CD124780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e2e0f0c5a186d366981c0103f07bb8ccacc6eaf896df236ff79949e692784a12
MD5 8938da1d9e3ad63651bf164c07e0764f
SHA1 17bab71f77a79e0cd6b570e96887fc1a4af27d64
SHA512 79ce60aa0e891faaeb310201536ab97e87de65b689d058466a4323407329a6fcc8662de2f086310e85280e27e7ee8dabb22faf897e50d2dcfe868d14c9c2e1f6
SSDEEP 192:sxZIRxW//f0sY6IdpdvHW6+WNGY3sNgIg5pJ:sxZIu//f0sYTdHbGmR
TLSH
T1B722B7526E28A97B8CC7E24DBB15BF53E6F9503291D41E58AAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2b5ddaf4960dbd45501e0c2d7af08ef8e07de736a5eae4d33e18c87b78d947c9
MD5 0cb1519528293aca9351123e0c63acc2
SHA1 19722f830fcd3e1782bbd0377ef4c5a6942929f5
SHA512 3c3f0e0ea0d8770193d3944afb3b43aae6a3ab1b65f5a9db41b24535f8e11e223b4c9ec6d7d0cfb0fd0872a379cbf9dc6a9e3b4614dd309e8c965f238f8e3d07
SSDEEP 192:sxZIRxW//f0sb6IdpdvHW6+WNGY3RNgIg5LJ:sxZIu//f0sbTdHbGbP
TLSH
T13422B7126E38A97B8CC7D21DBB15BF53E6F9503291D41E98AAFC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fb13d2a953c7e522dd3d7d24171490f7f8c6e86c81760926ab626d9b6e37a58f
MD5 2dcdaf239a0e968de736392f201eb53b
SHA1 4706d79dd8ef8cc0cf9dba3573abb14ca25d1d40
SHA512 97864fa50223e14539b82f6dc228a2612da037306d45c5780c2ee1c2b3695b2ac2ee3799767d52e703263f47d61fadd998d6ab3d7f4f43764ebd66dbf7788c41
SSDEEP 768:fN30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ728rolZMaJ:fN30AbSWvS2l9u1jaLmLZ12ndJ
TLSH
T1E2C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4447FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1bc8e1059e59bb3a54a188382816ca5f4b9b807ae4fcbf47b862b7118d7bf3fa
MD5 f8ab0aa849cce51d3a6a92e17f4022eb
SHA1 43c90c61353e86ff5ea826b4634ae88a3331b368
SHA512 f9355185f26925c25a2e099bb970bd9ee2eedc5a07b1b475e0c7ebead372714ebd479d88036840abbf2f828238ec97e8b463f592d94851da0be346b9e1e6c839
SSDEEP 96:KgHmK0UqSQgK9+TYJsoaGqgmuLzwwgKo1wygcAw7S4tSH:Q1jk96
TLSH
T12E91F311317B069039BE290985BACA2E468272B33114EA2F7BFD40D25F67F585CFC4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15158b76-8fb2-4e26-b1e6-bcfae52a0f81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\15158b76-8fb2-4e26-b1e6-bcfae52a0f81.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4bfb609fb69c1320e483d4ee30c9d3c63165d016a70eb7d396da403cbe31acb9
MD5 923480463acd3cfe3a9a889b2742095b
SHA1 ca0c554640521567d2c28f9b85c592c718a296a0
SHA512 ccbf0502d4377bc4be84f3fd47552194f80531c075deacc3d64b643d69eee1262e7e73e47b8f8cc5791e07a7db2a2d9960f7c0d6d224f58671267b31d00c91d0
SSDEEP 384:k4ZcIhsNiM/Mpuago99iX5FC/8TXX1i+2GztgOIwZOywoEoiN:bhzeojauMclGzXsoEXN
TLSH
T150827E32A8B89C7F58F3A185B54B36039FB98427E7C89F94D9EC572D01DA1E5134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9975e38db9223daa3f6459286e2c290fce780b8cc40c5e011c16decf800bde99
MD5 f43fd4217ffe284dd20c0e2176163ea1
SHA1 4c0802c9b2f60157de230879a2a50ecf79b8b08f
SHA512 f918aeaa183c311019b35552ea76ab8f6ecf6859aa09338565a030cc9ce90a5627f26c50979902ff2c9411fcc3537905ca93f7148a8f07bb330329c060e5e95a
SSDEEP 384:/PiFiZcISzsN68TUNTUlIl9/Mpuago99iX5FC/8TXX1i+23ztgOIwZOywoEoiN:yFQ6XwgIeojauMcl3zXsoEXN
TLSH
T1D5A26C3398A8DD7F6DF6AA84F54A32038FB54067DAD5EB90EADC5B2D01971D8034BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a03bff06c7e6bf410e3267aac8a0497b7acf83f26a9ac34023c986d19ce08c13
MD5 68c675111b5eb764c28484b3df8bb1c7
SHA1 3253f6e85cb4d3e21683561e6d40c55338096dd0
SHA512 414e17332972a248cbc1a8636df854d33f95a1981a3b3acb4483d58c06bc5d5275899fe1f4af051c540b345e05d661866d274522982318f1c2663aa821f2bdf9
SSDEEP 192:LONv6AmwprQmiUy2b6siX5FC3jzor9mylJioMU6:LONv6ipdJ6siX5FC/8TidU6
TLSH
T1AD02EB35AC786C7F8AF2AE45B58737179FA5116BEB942F84CAE8172C01D725C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c8dbf5ec790d72e693053204b667e5be31e0e4647136c3689374a0bd0f6eca6
MD5 a722bb1e810d7d71c05a21cbe5b0b83a
SHA1 46b3f1c284b0d14dde35a4bf194921113b09d400
SHA512 7d092777ff3e6044c5e55d6c29c0229f9944a5960c8469245409238fa2cca9effba845ef1575a3bee10d829a04ed4e338b7e45a051d96ae448d74b0d322bf44b
SSDEEP 192:LONz6AmwphQmiUyQb2siX5FC3jzor9myXXXFi+27lRZqWU6:LONz6ip/N2siX5FC/8TXX1i+2fzU6
TLSH
T12D120C36B8789C3F4DE2A595B08735139FA94217EB8C6F94D9EC1B2C01DB69C534AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 86cf001f9dbfad1679c7113337e1d4d0af6de0b29a0eb23d798041aeec0f0f35
MD5 88f4db9ba935a234d1436ff567a999fd
SHA1 fa763e435812aa5945417d60fa7fca1ebf89d170
SHA512 a55f2aa8bfc6fbf3e74f28379161b0f8492ec496c55f50ae2bcc25b1afbc55b4344ad0edd824fed5e8684a395e048c9e90effad8c81227ccd3df4d9e13176087
SSDEEP 384:34ZcIhsNi9/Mpuago99iX5FC/8TXX1i+2GztgOIwZOywoEoiN:WhAeojauMclGzXsoEXN
TLSH
T103827E32A8B89C7F58F3A185B54B36039FB98027E7C89F94D9EC572D01D65E5130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

780a06ef-cfbd-4981-8a4a-0900ea60b6ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\780a06ef-cfbd-4981-8a4a-0900ea60b6ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86bb572fbc396fa7e40477a8345abe9ab14a51fe825d62763cd95be1a17d99fa
MD5 73dcdf8c87c1c93bd7f86679bcca05e4
SHA1 830ce01c6d9d73c65ae18d679d340a6a0a02b0f0
SHA512 298867109819940583b7a9bc43d49b97f884bb5910c2e88b53ce10790aca53f22e26917b9eeadd733da84fcefff38659766efeeb80302e77f04339fb56d23c27
TLSH
T1A841E958BAEA1108B3B76F5AABF7A46D487BBC332E46D45D00110E4F4A67B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download