6eef93962594cb4503f7d8dedbdd0feb67da6b791388ef7e180180ebf743eb2b

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
downloads-attachments-streaming.html
Size 13KB
Sample260930-apavcsshnh
SHA256 6eef93962594cb4503f7d8dedbdd0feb67da6b791388ef7e180180ebf743eb2b
MD5 41dd82a22817d176668a89873e5a9893
SHA1 67de16a8bbf6422ddc79ddb122ab62de55dc5775
SHA512 327590c288a912d99fe34bc81b4aac3dcfb5c6675356f01f7b9a365e152de382fef9da9847a20f17e3be750150baca1c37c5db25ef4321f4eab28b591acd8246
SSDEEP 192:NhvCM72SwVAzz0AlwYiNlwg9alA6hKOSlwlXp0DlwDEolwsYDlwBBSzlwMjoE8DQ:76u70S5Fkxd
TLSH
T1FF52FD2A12F4942340D553C93B9A571A6EA2D60BD65E4712B2FC5E8BAFD3DC3CE6300D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{3343DAF9-5E60-4729-A622-E59C1C358BE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4260	1564	msedge.exe	88
PID 1564 wrote to memory of 3512	1564	msedge.exe	89
PID 1564 wrote to memory of 3068	1564	msedge.exe	90
PID 1564 wrote to memory of 2128	1564	msedge.exe	92
PID 1564 wrote to memory of 3512	1564	msedge.exe	89
PID 1564 wrote to memory of 3512	1564	msedge.exe	89
PID 1564 wrote to memory of 2128	1564	msedge.exe	92
PID 1564 wrote to memory of 4536	1564	msedge.exe	93
PID 1564 wrote to memory of 4536	1564	msedge.exe	93
PID 1564 wrote to memory of 4536	1564	msedge.exe	93
PID 1564 wrote to memory of 1796	1564	msedge.exe	94
PID 1564 wrote to memory of 1796	1564	msedge.exe	94
PID 1564 wrote to memory of 1796	1564	msedge.exe	94
PID 1564 wrote to memory of 1708	1564	msedge.exe	96
PID 1564 wrote to memory of 1708	1564	msedge.exe	96
PID 1564 wrote to memory of 1708	1564	msedge.exe	96
PID 1564 wrote to memory of 3684	1564	msedge.exe	95
PID 1564 wrote to memory of 3684	1564	msedge.exe	95
PID 1564 wrote to memory of 3684	1564	msedge.exe	95
PID 1564 wrote to memory of 832	1564	msedge.exe	102
PID 1564 wrote to memory of 832	1564	msedge.exe	102
PID 1564 wrote to memory of 4184	1564	msedge.exe	103
PID 1564 wrote to memory of 4184	1564	msedge.exe	103
PID 1564 wrote to memory of 3740	1564	msedge.exe	107
PID 1564 wrote to memory of 4032	1564	msedge.exe	117
PID 1564 wrote to memory of 4376	1564	msedge.exe	118
PID 1564 wrote to memory of 1220	1564	msedge.exe	119
PID 1564 wrote to memory of 3212	1564	msedge.exe	121
PID 1564 wrote to memory of 3212	1564	msedge.exe	121
PID 1564 wrote to memory of 4032	1564	msedge.exe	123
PID 1564 wrote to memory of 4032	1564	msedge.exe	123
PID 1564 wrote to memory of 4052	1564	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\downloads-attachments-streaming.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffda245c188,0x7ffda245c194,0x7ffda245c1a0
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,3278785336911933591,3134587522462040207,262144 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7494242309707695883,17665083850931952410,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,13926968961466642881,5310995020560042725,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5773855720460862257,17071121717299290225,2097152 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,8414172876200665999,6116813741542258562,2097152 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17232148304992728193,16330164965421442470,2097152 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3599110287590844616,3899587060291537931,2097152 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16391237492042167019,16578858970019223167,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2542701265052097726,3425547990002011809,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,15780129320611540494,1408125542794338277,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,15780129320611540494,1408125542794338277,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,10186089507111754079,17842031612169553071,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,675484988037527006,1778942957476962536,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,12629269213454264869,16821307337329335026,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,7342814224840048436,8837549309547919470,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3712888555696525306,5545224727833266365,524288 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5564,i,448770080575048523,3452471548717478090,262144 --field-trial-handle=2428,i,539735228432549596,4489679910032715990,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 26610521e49683074101266f33cffd913af8bbb982745e98c63cc113eb052d30
MD5 591a2e9740180977649c9edf4c68cec8
SHA1 9d321b45e2d3798905679aaeae01df7b1fa16095
SHA512 aad12559967e5a75b47c9af5d89633366b3707ed69114d6a577ce2b3645527d00ab7a33265cbe960ad5bf8892db773ae5935317a3682f8c69ae8c9bea3a82881
TLSH
T15361808C9B5DC3F1F7F9837E80E523473B72C58185834D420A9BE478989A3E7923B010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dd3c.TMP
Size 3KB
SHA256 e074e362d355ac650a771da04ca38b96b774f3d5e430396419892e720d58351b
MD5 64abebda82a15e652b7d940851fa4f64
SHA1 00076ebc3d1c63b17c08a8b42b6f6cb1fe2aef86
SHA512 2a11bdcf87c03a20d6948b6236aae61da032b6bdda2cc0d69267da95c01d1d87c09a9fe3c641e9057dab749ff521d1ba8f936983428def7b27ecc2980c99b000
TLSH
T12761808C9B1DC3F1F7F9837E80E533473A76C58184834D420A9BD478889A3E7923B010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6c6761ecb472a88579728677c234539310f58c4b1ef9c9a4a21c680b06bdb5ca
MD5 3d6209aff78492268c61a528ca7741b5
SHA1 2280eee008bfbf1b9e43626c910e06e91fe9f990
SHA512 804c9f26fa8266f20e57b64d20ab53e0b16d7d5a43e12f020be4ac507e6e713e0d1aabfc36e1e72aba62522f541c9ad81a308571fcc987bdd9c3915295afa524
TLSH
T100115BF3C3D595AE890156F09A24AE2BCE2D0606421C7C19C5D4EF2B93E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 20811cf8134055089a7199e661fdfa2c8620baf1504560327f2fe39bffdc50aa
MD5 e22db7f4b5b579f5d98422d622c47360
SHA1 34508877004799ac345aee46e511669f1f21a760
SHA512 710a3b1a6a39d923b3e3c376a3f90dc74ca297686bd698b2c9df794878a0a25acae7eb3620afb894ce6056b476c445e866e6bdd2ae44ebd2ffca54c839a19a99
SSDEEP 192:sxZgRNWV/fns0BBIdpdtHW6+WNGYapYoZgIgrJ:sxZguV/fns0AnHbGE9
TLSH
T1A722A9126E38A57B8CCBE21DBE55BF13D6F9503251D51E58EAFC852C04E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b2152a5557692939f85425f8b26bd463d4bd1f4fa7836391b58e49b41afbba13
MD5 42818014231c8b47ad146455d5ccf4c4
SHA1 a6e98871416aa58c9985ff4e32c0795a239f4898
SHA512 3dda56a8fad673ce8b4e2972023a954ca87c0d2a57f76f3bcdb5c0fe0be2a05bc1431660d98c7166c661237da75e6985535dcb03d4e005509d60bb83b1cd08b2
SSDEEP 192:sxZgRNWV/fnsgBBIdpHtHW6+WNGYap8oZgIg5JOJ:sxZguV/fnsgANHbGYm
TLSH
T1B622B9126E38A97B8CC7E21DBE55BF13E6F9503251D41E48AAFC862C05E7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 20b90d3e9a8d7bfed8c6b49ee8bf5e824b53b8fb8d5135a6510f6fd8c4737192
MD5 8a01202699d2ea4335b897c09b2c8f2c
SHA1 cd93a5de119bc11d3bffb53251a204f4fd74eaec
SHA512 563f23628bd67aa93352a5d3a318c624aa26d1f9e258fbb8db2e6c517e952856e63c6b38f2a43683b4a4e679282ed7e8b7c018b1f981700af5b440ce34b4fda9
SSDEEP 192:sxZgRNWV/fnsgBBIdpdtHW6+WNGYapDoZgIg5JOJ:sxZguV/fnsgAnHbGtm
TLSH
T12C22B9126E38A57B8CCBE20DBB55BF13E6F9503251D51E48AAFC862C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7b507b31f38a0dc5959ce7aa6bc69c1c28a0d15ab7eec923b363b40d258cb5e9
MD5 c3c550a1a80cc7eefab20e5db18a9e4b
SHA1 5c068683d3dd8d2e02e88179fae9c600b927e31f
SHA512 4495a46d51a1144e179329cdf89995d04da8c17196314bbba588ad594c979bbf8ecc35a71f5a87865a01f565c5c68823137d1893cae5d7208faf87333e4ea6ac
SSDEEP 192:sxZgRNWV/fnsVBBIdpdtHW6+WNGYapYoZgIg5JcJ:sxZguV/fnsVAnHbGEs
TLSH
T1DB22A8126E38A57B8CCBD21DBF55BF13D6F9503251D51E48AAFC862C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 352d8bc29b16680fa08cd0f3f082a819f055414cfcc4af5e2dba12772585a988
MD5 a7531a9f3e84c4cd5acf335a487f764f
SHA1 cf61d608a9bb4d7edb3a918dae6fe6dec73a74dd
SHA512 2747d94df74d04725044bd654be768a3464e4f58cd6ad9ba742f6b61c32cb9cbf40ba6e98c15e726926e5b0d8b0b9c2bf3345fa13be72b7b1253faf21e0951d0
SSDEEP 768:u+WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Vro4SfenmRL:u+WPcLKWvKeEeu1jaClLiF7u4SWnmRL
TLSH
T146C2EB3B644CCB7E4FC01A9DDC5A6FA77E9802C79A584D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 45356fe051f56d8c8469b3cb9268e011a21845b4845768e08385b00921ca5be3
MD5 4438f90c0093614c818272121439ffa1
SHA1 12c2bc67344b8c4dc96c4b962bb058d5b016cb38
SHA512 a6d2f25dfc9eaca88feb0379d2747aa4be563098525567c49bd6f59a6da3ace7b0268610737ec7551653f2cc654f189bbd3e3d832e63346edce0bd9067493a01
SSDEEP 48:K0KV4kKIYJbUzEIScJK9A16JxyZYLs46yLCNQ8CgARbcrMISURK9Y1iRxaBYDUUl:KgZKK6Aimd6Kmk5ZaKK8SWniKYcd
TLSH
T1D9B1D8113077224138BE295C98A5975E26413173309DFABBBBFD00629F2BE489DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597824.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8dd03bfbacf29cce195dd57e0a6ad3b3f4bd954416224f0c2cd88f3b01087914
MD5 1235430d23c0db3048dfbc72bb343860
SHA1 dfbbd97b5fa5f85fd3c8cdea19f06a9edd814e69
SHA512 dda228ce0c643465816e4067a3cf4fc846e512811cec29a78d380cc8374a97de253f0493ea2111895d8754db484626bd1acbeeb186112329e740e664187c5424
SSDEEP 384:BZcIhsN9VkQL19TRzIGmYMoULMXXSiJtgOIwZOynLRo3:Jh7SDdHMXMnSiJXs4N4
TLSH
T1E4827D339CB8EC7B6DF7A144F44A3A035E788567E2C95F54E9ED6B1C00DA294030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5f5ae2ab2d327267200677d20b89921bce380d5d8699e508acf5550f1c81eae0
MD5 5e40e825fbc95a0cc09763ed985f7293
SHA1 91bc7322da9dd8565780b83e400778f33b2ab6b5
SHA512 f8687c3028062dc63ec9b2b8950ec8be68a41d4b464e37f8bdd5b9cc0143b07f9637f7121f7d5d52c050e5dd181e419b0374663ca73ce5e9a8d30a40d30b3fb9
SSDEEP 384:iiFiZcINzsNH8TUNTUlIl0kQL19TRzIGmYMoULMXX39iJtgOIwZOynLRo3:pFQ1+wgVSDdHMXMn39iJXs4N4
TLSH
T17BA25C338CB8DC7FAEF79A44F54A36039EB44167D6C9AB94E6DD9B1C009B198030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 278de4d553de101187962bbf9f3a5340ea1b061bbc5af1818d594414c22e45f7
MD5 5e4193088f031c38f017c43b6dc69d7e
SHA1 1e8313f361d7949030951fae5c58472baeeb358c
SHA512 f401ed136e68761c890c93977bcb4b7535d6e2834cb47fe5eadfb50bbb32f0e80a285076414cb86acdb944037585b80dd590a60ca072cd797f290f42eb380d02
SSDEEP 192:aONg6IE7QmiUyBsTPuIGmYMgjzoFGtC7stkU6:aONg6DtdPuIGmYMoUVs2U6
TLSH
T1CD020A35AC78BCAB9FF36D49F4462B236FA5112BE5952F84EAE81B1C00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ab2a1df6d65fe24c2d2d630994f96675f17e36a25ec494a03f57a09b5078379
MD5 8e6004d8b868e811accf73cd62a071da
SHA1 6e6908ff1e8f224742d91c4cb23acdc755cf710b
SHA512 25fc7ccaa11dcc6739b8851a40a6be32548465705ff0d28ffc2c4444290e86e7d1cbb7417d437c6fc72c853948bcbccb3d5480331242f7844ac0e148e449972e
SSDEEP 384:iZcIhsN90kQL19TRzIGmYMoULMXXSiJtgOIwZOynLRo3:QhsSDdHMXMnSiJXs4N4
TLSH
T1FD827D329CB8EC7B5DF7A148F54A3A035EB88167E2C95F54E9ED6B2C00DA294030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d70ef87ae5263a06a33e2a8b7380e4cecd25cafc3ba09f18d473a8ec0f62819b
MD5 2db47193d33301358cdc031e0a1aede7
SHA1 f5063cf36930dd0161f59b8d493eb177f07c001c
SHA512 ab50f4d6f5c50ff6b1149a740db62065907a001a888ef24c363d9a606edc62d92020225f692d3c73bc442064660eaabc9d4759dcbd14a7ec4c306940b7dcaa4f
SSDEEP 192:aONg6IEvQmiUyAsTjuIGmYMgjzoFG8MXXxeU527HXqWU6:aONg6Dx6juIGmYMoULMXX0HJU6
TLSH
T1A112FB369C78FC7B5EE3A944F4463A135EA54217D6896F90E6DC2B1C01DF25C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 676ff643aa06eaaae32f1474ae051d48c78266bf0fac6bbae67ddbb40e99484d
MD5 a31b7b4561239f672af34a8de25d9f19
SHA1 7a3c6eece15cd098532f6cdc6490de436b53c636
SHA512 dc7a9a9006765872b0e8f75a4e0019eac0f0255700ee9e2f9739d5e34ee8f2259823e9f405c1d4dff5646f5bb5226bf610f12f9bd66bd48f111d301d3fb64c81
TLSH
T144412B58AAEA1148B3B77F56ABF6A96D487AB8332E06D49D00110D4F4A63F00CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download