6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-kqhm3n.htm
Size 34KB
Sample260930-c81w1ada33
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1E44222A-88DE-4A3B-B723-8C8248B771E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1552	4280	msedge.exe	87
PID 4280 wrote to memory of 1368	4280	msedge.exe	88
PID 4280 wrote to memory of 1384	4280	msedge.exe	89
PID 4280 wrote to memory of 1384	4280	msedge.exe	89
PID 4280 wrote to memory of 1384	4280	msedge.exe	89
PID 4280 wrote to memory of 4068	4280	msedge.exe	90
PID 4280 wrote to memory of 4068	4280	msedge.exe	90
PID 4280 wrote to memory of 2264	4280	msedge.exe	91
PID 4280 wrote to memory of 2264	4280	msedge.exe	91
PID 4280 wrote to memory of 2264	4280	msedge.exe	91
PID 4280 wrote to memory of 5104	4280	msedge.exe	92
PID 4280 wrote to memory of 5104	4280	msedge.exe	92
PID 4280 wrote to memory of 5104	4280	msedge.exe	92
PID 4280 wrote to memory of 732	4280	msedge.exe	94
PID 4280 wrote to memory of 732	4280	msedge.exe	94
PID 4280 wrote to memory of 732	4280	msedge.exe	94
PID 4280 wrote to memory of 5044	4280	msedge.exe	95
PID 4280 wrote to memory of 5044	4280	msedge.exe	95
PID 4280 wrote to memory of 5044	4280	msedge.exe	95
PID 4280 wrote to memory of 1184	4280	msedge.exe	99
PID 4280 wrote to memory of 4812	4280	msedge.exe	100
PID 4280 wrote to memory of 1184	4280	msedge.exe	99
PID 4280 wrote to memory of 4812	4280	msedge.exe	100
PID 4280 wrote to memory of 1836	4280	msedge.exe	102
PID 4280 wrote to memory of 4284	4280	msedge.exe	113
PID 4280 wrote to memory of 4304	4280	msedge.exe	114
PID 4280 wrote to memory of 5084	4280	msedge.exe	115
PID 4280 wrote to memory of 972	4280	msedge.exe	124
PID 4280 wrote to memory of 972	4280	msedge.exe	124
PID 4280 wrote to memory of 2808	4280	msedge.exe	127
PID 4280 wrote to memory of 2808	4280	msedge.exe	127
PID 4280 wrote to memory of 3468	4280	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-kqhm3n.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffe4499c188,0x7ffe4499c194,0x7ffe4499c1a0
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13730522174656281771,745831345412404694,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1816,i,493302776220176777,5195175141022268719,262144 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,5932328178264380001,5497799264864698472,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7793198059242021413,15617951109520132389,2097152 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5283335767767430505,1352266001528154575,2097152 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,13141506396865309087,900584391376304647,2097152 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,6838556992551989202,1116476894708882948,2097152 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,15332323497329205856,620486586289700498,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,599767579863656665,5035500518923079801,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12659737033911902641,3510255358895481441,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12659737033911902641,3510255358895481441,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,12572441181751401076,966677120614119947,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,16247904970390007712,1249443138248069330,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15625495253202965378,11090692447612683161,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,6822646918364491385,1358264036513122068,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,8507331782151411677,15415057290406150347,524288 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,5561060465720584093,15455382549467046254,262144 --field-trial-handle=2336,i,2877865422724095638,5982061046450368525,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d764f43850b79db25c14e1b1b721511b7c4b1df61739820a79edf8b0fc2e71f6
MD5 ada7bbfa347e11c976d6710fa1265606
SHA1 c66455a3e80324ffaac40a6f558b414541f396f3
SHA512 a2393da52155bb2e000281842a3258dbee6c8978ea80b6f40d680292fd14a1d43b16c2ca021e3c59636694fcaf8c56e4faec951c8c4407a83b2f07004834ef5e
TLSH
T1C661A4C055A3B448FBA8427881E9399F3E38258F55AF1DC29DB7E8759CCAB5C60B3244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902f4.TMP
Size 3KB
SHA256 425f1c81428575318c04fa8778c6b4a91daff651bed47c51d681709ea7a3532f
MD5 2dec1a094eca78b68fb33a7b1655d70e
SHA1 be5c753028e29dd277b83148df00963e4a8983f8
SHA512 cbfdc8d18dfd714f1d6317746e8920d6d39516e1b677a12ceb84807dddc9c99894b072d7fde446508b0b3f1a11ae1dcb59459482d055ffb889728adf22b95f78
TLSH
T15061B5C05593B448FBA8427481E8349F3E38258F11AF1DC29DB7E8758CCAB5C50F3204
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fe71f326ff7332d2163da7e7c7aad05b67ee8b53c7eda43629ea91a05922414e
MD5 cde777d36d068c0f36a3491b0d1939b6
SHA1 a1d89b01ae1863da6288f3c29ec5b31e06be1b92
SHA512 de6b54bc753733eb4a80a9bde282de0f3978b6664049715a5c201a7f8f3161a833f27e7674bd5774e88fe4238680817ae1d7eccf78562a14d9cacb0f777aa234
TLSH
T105117DB3C3D585AE890516F06A24AE2BCE1D0616831C7C1985D4EF2BA3E3075E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 4bf90a36e4813e75593f1c1bde668af8b012b744e8835fb1294c0ffc0141a7bf
MD5 b94609347cec482dda9383ad84b50672
SHA1 2d718ba4613e9073822ecb0e4e0862ac60aeb11f
SHA512 2a29902c31a83c1bd98e293d1574785c7ff15adbd96b513d4ae7bc3ff88ede39e49785e25ef99f35826220b8134c656394c834b8ac4e762fd7fe1a94a5cb93c1
SSDEEP 192:sxZZ1RcW5/fIszOIdpdJHW6+WNGYYBaaYIgrJ:sxZ7B5/fIszfXHbGfA9
TLSH
T12512A6116E78A97B8CC7E219BB55BF53E6F9503251901E48AAFC962C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9ff555be4c1d54534317940dde5ce2e3eee065b03c1e00cb1223014b7499cdf5
MD5 d6d5dedcbb68871a4c355153fa6812c4
SHA1 8faa788b08ac7a008639ee1bab4c8daef75d8a24
SHA512 ba4de6d8f39a1726d6b3f13b76f1118e4701106e183d2febd5fad189f1b4012d1d8af625fe649cc6e408da77667e70fb43f37c04591704b70641095fb2ef87fc
SSDEEP 192:sxZZ1RcW5/fIsx3OIdpHJHW6+WNGYYBEaYIg58LJ:sxZ7B5/fIsxfpHbGfa6
TLSH
T17722C7116E78697B8CCBE21DBB55BF53E6F9503251901E48A6FCD62C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bc2774e19acd96ef5367590064dae2905d17d103b778bf77a171168874b3a5c8
MD5 28382707608019762b20a648af2f4144
SHA1 65ddce1048027f02ffed85b26018156a9dfc29e7
SHA512 98c54ade6fb4a1c346c61e78e82b5d6f2b4059381cfca430ddf191c190b9bfad93199febfd2c5eda469f388f630c18ba7e06a3ae917cbe17fb0458e2067dd6f5
SSDEEP 192:sxZZ1RcW5/fIsx3OIdpdJHW6+WNGYYBQaYIg58LJ:sxZ7B5/fIsxfXHbGfO6
TLSH
T14522B6116E78A97B8CCBE209BB55BF53E6F9503251901E48A6FCD62C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 519991a0c122b7949e1ee562ca1692f250dad6db9eff5c6a6d24751a053a645e
MD5 3ddfccb538af4d15b4a9049a120a734b
SHA1 bf07aec1fc6f9be01e7c4e09284eb112416fde4e
SHA512 c3c082aea39c2794cb809afe943ebae543881ef7ffd33775c3d3c29feb9b9871b89bdc52946e6cc7046645c55529a617cf5ca3d0a21052d51df238c744c915ab
SSDEEP 192:sxZZ1RcW5/fIstOIdpdJHW6+WNGYYBaaYIg58RJ:sxZ7B5/fIstfXHbGfAg
TLSH
T14D22B7116E78A97B8CCBE21DBB55BF53E6F9503251D01E48AAFC962C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5661fce1414d8fdf10e1d7bada430ffc59c9c5eb334fa6ab3b1a822727477bdc
MD5 a53653ac9ae5b6d5f7a56f69c34caa17
SHA1 9edba32fa408b204b0f925f388ba5f7ed907e2d0
SHA512 27a19e05ee2295a4d5e6d3ec76b3d94396d3bfbb9926b6d673be4befa341811b5b393228698d587da610cd30e066a64023258a1a27dbe4b6129bfe52ba5388c0
SSDEEP 768:IdyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXXropr6J:IdyYR7jWv3NpBu1ja/CL8OXEc
TLSH
T1CDC2E83B644DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 689126d109d3c16775e328d9068d2605cce575b4e261309615f36db59377d869
MD5 07bc9c4483c1a2c88fea0ce0e16c5068
SHA1 0abc28adb082431c2bef52fd1a1d210f4bf415ea
SHA512 1c9bf52873eba290878b0f42d9b5f3400e8cdedacce36029e31e5e100fa6d7a8812a81f8c82b3de03f8709df664ede06f28dc82d8039959e787167d1d8047f90
SSDEEP 48:KgRAthrvzMb/KXIS5MK9Z1zMxxcYKbRVyLeZ04WcMFbwX4ISQFK901GFx+VYvws3:KAWEKXKKWdSK2gKWn+KIIGK
TLSH
T19C914140717A060539BE244D95A5971F86823273B45CEA7BBFBE00A19F2EE048DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599e69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599e69.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 28df9dfe323d9179ab8a842dae4ef6411c70c3d275fdca3650078c3c4c7ddc91
MD5 9664ecc9572c9bc660608b3785d50f53
SHA1 a78ca158fabc43fc15e79f7e2473d26e0a4bc871
SHA512 578a1d31d1bceb0aa987736288229855c6c4f66c8766e7e47baa1675fdc032180a9fe89ea743f116c5205dd0e9222c7efd879c5794fad573b1c1dda740ce7346
SSDEEP 384:AZcIhsNq/mOiqdAQX5+DtD8PXq+28W0tgOIwZOyDoKoF:+hAO3jkDSql8W0XsNKa
TLSH
T17D828E319CB4ACBB5DFBA185B5C732035FB85427A7C46B90D5ED6B3C01DA6A9130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 4b87f0e7408d3c254dbf1b073b33d5f9c28f991b87b3bdd1dd5944f286f8124b
MD5 8ef4e5c63f202fc7b0088c27142e1b55
SHA1 f5a04f51e8014a6f82427fbc95df88e144936294
SHA512 0d9345ab3ecd4a54b39b0c377063e2e517c1e0ecb8d9b241fd58c11cdb0a823af43b287b8c1a3d33e30d31c62b6cdeeae21708189ec6b5363d257fc4f9e6311f
SSDEEP 384:YiFiZcIxzsNy8TUNTUlIlGmOiqdAQX5+DtD8PXq+2oW0tgOIwZOyDoKoF:jFQBXwgdO3jkDSqloW0XsNKa
TLSH
T163A27E339CA4DD7BADFB9A85F58A32039FF45067D6C4EA90E6DD5B2C009B5D8130AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f28d396273724097da961db9b1a9f4e556060d7ea62d8f5c557ca501ed8f3bd8
MD5 f4d4ea65063d36622b08baf09b5d0c80
SHA1 ff8d3545345847e948c291ec1dd27bd4d93afc08
SHA512 27f98f3748c84eb235402f9fd3c8a6c88523e53694abf3be3ea515079b41d897e719094c08dce9962f1df758642d5df07b3b4216f2accf88a8cca258cfe74108
SSDEEP 192:EON56nnHGQmiUyxnQYcX5hQDP1Tjzor6s1mmMcblMU6:EON56nCqQNX5+DtD8Z5MU6
TLSH
T1B502DC34ACB46CB79AF7AD49B48737135FA5216B95942FC4DAE81A1C00D775C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bd58f4e07187d8de4b64fe8bacd0716aafcb2087c09ae42255996a1d88b11271
MD5 bfdea33ea3cd00e3375b41b5d8eeaa0e
SHA1 ae7fc7501419fa1563d881b324f5a95cd4acf4a6
SHA512 1b48be1e356fa911557d41d07fd6a35b373027341a62c6e17b658480be9e267acea2a05a226426d942aa1597576c7ea13d29c4209e413df52024a949092a74ef
SSDEEP 384:jZcIhsNqGmOiqdAQX5+DtD8PXq+28W0tgOIwZOyDoKoF:7hFO3jkDSql8W0XsNKa
TLSH
T13F828E319CB4AC775DFBE185B5C732035FB85027A7C45B90D5ED6B3D01DAAA9130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33d19631e8581a7a14234a819c9d92d33c8d82c64c8499a02c5c3f7320f19452
MD5 7e0cfb4b8e5951e02e6bc13d815175c7
SHA1 b72f4ab388366ba84b267b2136f97c9988ab3be6
SHA512 69b3f49dcb4c58abb5a639491c09af501e4a41c5299baa672ac070f2c00ee032c53d646de443222445e2390a9d88e8051a38d9c62fa647ddeef1559305185fb5
SSDEEP 192:EONT6nnHaQmiUyQngYcX5hQDP1Tjzor6s1mkXIx+2ng3Fq50U6:EONT6n2JgNX5+DtD8PXq+2MW0U6
TLSH
T16312EB31A8B8AC675DE3A595B0C732136FA55127DA856FC0D6EC2F2C01DFA5C5309C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 445af8944ed627235b9f1bc02d5a04c46b6ef29d8bbf3ab91f5b605ba3eec46c
MD5 273a15a6912c482f770fd09e8bdf7edd
SHA1 95333025c479fcda97a98723b28f1ac508a74beb
SHA512 a1a2e45e524e01fba34c8b16bade10136f7316b62091734560f2389afb9e94cab176613817017487cbe9a81d10722a7bd8fbb636960e88b2f06a902dc7aac78d
TLSH
T199412458A6F91148B3B7BF5A9BF6A82D58BBB8332F0AD45D00110E4F0A62A40C971733
MD5 SHA1 SHA512 TLSH

Submit Download