5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-q2g272.htm
Size 194B
Sample260930-d78e5adh66
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4680	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{4C080821-39B8-4FE6-BE15-EEE17D2B86A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2648	4388	msedge.exe	87
PID 4388 wrote to memory of 4904	4388	msedge.exe	88
PID 4388 wrote to memory of 4680	4388	msedge.exe	89
PID 4388 wrote to memory of 4904	4388	msedge.exe	88
PID 4388 wrote to memory of 4904	4388	msedge.exe	88
PID 4388 wrote to memory of 456	4388	msedge.exe	90
PID 4388 wrote to memory of 456	4388	msedge.exe	90
PID 4388 wrote to memory of 4300	4388	msedge.exe	92
PID 4388 wrote to memory of 1924	4388	msedge.exe	93
PID 4388 wrote to memory of 4300	4388	msedge.exe	92
PID 4388 wrote to memory of 4300	4388	msedge.exe	92
PID 4388 wrote to memory of 1924	4388	msedge.exe	93
PID 4388 wrote to memory of 1924	4388	msedge.exe	93
PID 4388 wrote to memory of 616	4388	msedge.exe	94
PID 4388 wrote to memory of 616	4388	msedge.exe	94
PID 4388 wrote to memory of 616	4388	msedge.exe	94
PID 4388 wrote to memory of 1532	4388	msedge.exe	95
PID 4388 wrote to memory of 1532	4388	msedge.exe	95
PID 4388 wrote to memory of 1532	4388	msedge.exe	95
PID 4388 wrote to memory of 4432	4388	msedge.exe	101
PID 4388 wrote to memory of 4432	4388	msedge.exe	101
PID 4388 wrote to memory of 804	4388	msedge.exe	102
PID 4388 wrote to memory of 804	4388	msedge.exe	102
PID 4388 wrote to memory of 4204	4388	msedge.exe	106
PID 4388 wrote to memory of 2200	4388	msedge.exe	120
PID 4388 wrote to memory of 4716	4388	msedge.exe	121
PID 4388 wrote to memory of 1620	4388	msedge.exe	122
PID 4388 wrote to memory of 4092	4388	msedge.exe	125
PID 4388 wrote to memory of 4092	4388	msedge.exe	125
PID 4388 wrote to memory of 2876	4388	msedge.exe	128
PID 4388 wrote to memory of 2876	4388	msedge.exe	128
PID 4388 wrote to memory of 3360	4388	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-q2g272.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90eb9c188,0x7ff90eb9c194,0x7ff90eb9c1a0
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,13726795055581914039,84506985542292618,262144 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4477470203649947653,11166959565850296953,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15163467466640113262,3951232421884511215,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2420143676656376984,16743725038907433615,2097152 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13784691271873897274,13283393022281764844,2097152 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,484306018168037239,483563683649597934,2097152 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8839672196149697644,3394626752151045690,2097152 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16235535444871869536,11302922782051737952,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15208391062545444737,3765999075771028314,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8478629572594295325,6869263538024913500,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8478629572594295325,6869263538024913500,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9418150654073070679,8309827711364360098,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10988703685604947774,11091679090022832488,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8306679440870276258,7193245333195358057,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5680541464667960996,7568763964574860003,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,11868824537105406927,18115407967345636794,524288 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5216,i,14703782972039628073,3783930491878282594,262144 --field-trial-handle=2264,i,13130680469858795946,12727848479138702496,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4826fdf2295eb1d96cd57543200127a507a4261c42a1af2c72a5e02b75d3097
MD5 e9c91612cef0770ced99812d5e0800d1
SHA1 1702480fe170335ce2656f574767fddc57cb9118
SHA512 f6c3e987bc4cef932cdc5781af506dd8c9241d1b36152a473b2046bb88dffa482657853f46f590eeb2a3d110547b9704cae3ce974462e070bc7946934cc46aac
TLSH
T1F7618265794860FCF7D9517189E212DF39B487500543CD231CBAEE38B80F31C2F28A90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c0f9.TMP
Size 3KB
SHA256 7cf56c532cfbf16e278289c35aaa0c322c31057806852ae773bd2e874d44c6de
MD5 24ff35271a318fa1752bd10249763486
SHA1 bcd08fde3e5f7b88d12c131da7129bf520c76e4f
SHA512 7f4f2837b1a728228321d45adf6f292661eda9cbb05158ddeb27f5d3777db0cb00648c5094e0e0763355a56f0c717e1fa1d51f9ac7014a47aa8d313099b2acdf
TLSH
T1E7617065754861FCFBD9517189E212DF39B487941543CE631CBAEE38B80F31C6F28AA4
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8ece4aa009f7c50bae8dc987c8216e58eaf8b80a661710ace261ed970c2ef378
MD5 d08ebed2557398dd851440a84d96d73f
SHA1 b7eebfe0f0016030fd712761f0c366171a1f6f8c
SHA512 f1ede24acc878ec64f52fa0f4931960db7c24c54f181b87e1b99878627f2596246df0539acc7781ef92a56dcd1931da681a723214e19a51279a5c85d6322b014
TLSH
T18E117DF3C3D585AE890116F06A24AE2BCE1D0A06422C7D69C9D4EF2793E3475E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f1bfb6e54a71ffcf0b8193dce09c886f3b587501439415f4cf959f9ddb284f7f
MD5 9b14832c03661c72f5b3fd42cf6404cc
SHA1 9af1c3bb2cca07102600883d63a4f50b9af65a8f
SHA512 cad95a5a93b88cd6b3d3eb795a4014d6dba17b07436aedf1f1f6b051845fd79cbf7b722f4e02fdf004f32cae4b448946f94338d1b09699a07d9b6ce3a7116b4e
SSDEEP 192:sxZFRHWO/fosD8Idpd/HW6+WNGY3RiTIgrJ:sxZFIO/fosDlFHbGp9
TLSH
T1ED12A7127E28A57B8CC7E21DBB25BF53E6F9503261D41E58A6FCD61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 15647ac55525c043d8c606b3ab2aae4d9c0e51a82bbb02997f8b0639f1b8aabb
MD5 39c4170bfb973aa2b228967acf4ff93a
SHA1 96467641b007f69081e163abc85819fd893ae689
SHA512 9fea85a3ea65c74293ec44b6c1c64ba7089ea1996c680c279713965524deab5a08236e7b6649dc5ab603db76a43a9bf421a472976edeaab3c6ff2e307dfa4869
SSDEEP 192:sxZFRHWO/fos28IdpH/HW6+WNGY3ciTIg5mJ:sxZFIO/fos2lfHbGAY
TLSH
T18822B7127E28A97B8CC7E21DBB25BF53E6F9503291941E58A6FCC61C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 62850801d950d60fb61f1025334f388dab07b38dab9afc8d0823eb197f854116
MD5 88db416be56bf38d98458aa93febb18c
SHA1 f2df14eb395a3d9b3cdfd2a5d2d8dd6cf9f91834
SHA512 622dc4dff9249900f337e77f5652a629873f65f21b550d0851d8e5b14b15223b83de02dbebe09380f146ae5b812c0c483fa8799c136053514ba41095cd85c0f1
SSDEEP 192:sxZFRHWO/fos58Idpd/HW6+WNGY3RiTIg5EJ:sxZFIO/fos5lFHbGpK
TLSH
T1E122B7127E38A57B8CC7E21DBB25BF53E6F9503251D41E58A6FC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fe864832fbbfe176ae7f07da6e683ef3f915327e043d6360979f2f859938262f
MD5 de28dfe2e69c4093a0852935762cdd25
SHA1 7a1c2383636ae50c1d31c8cca529b02b7c14d970
SHA512 2c76c8472f9ca90dbfa8f8613cf8ce022b18673fc0256e5ea60789e30f8724dd7f80931256b7392c78244106797b7187a558a178c1c30b67826be0a35acd8496
SSDEEP 192:sxZFRHWO/fos28Idpd/HW6+WNGY3GiTIg5mJ:sxZFIO/fos2lFHbGmY
TLSH
T12E22B7127E28A97B8CC7E25DBB15BF53E6F9503251941E58A6FCC61C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1d1c5fe46a82f5e3181eb95c52a8075178d9445e125e839a0e6fe8970a82f5ec
MD5 ccde715f956fb8bfb878827f501313e5
SHA1 d26dee5efbec4b0809349467f5253784c544f63a
SHA512 86ec479db8159b9940e399f7dabccd46af0cec2ca3050296ae25f44f5bb22dd7d7b390abaa8d0df61f2f63de0695e55b213ac09640555197488df0f83fee3e61
SSDEEP 768:Zf30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72SrolZMM:Zf30AbSWvS2l9u1jaLmLZ12Jb
TLSH
T1C6C2EB3B644CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 da9bf647bbab09ad0d3a379d09058706c24817f58814ba40a03e6398a074ca35
MD5 2d5dcc2ff16eacc13c889d3e4c384905
SHA1 802f17d97d02b3d853b3f161d68fa67ebc11351b
SHA512 3ad90db35d7833650a9547adf43f01bd5a1ab4fa4d43c387692875b74125c0db84bf0b800d8b7f75f082d1dc5d47a6365795433234a7aa6cf8b1a03abd5c3164
TLSH
T1E1213E80A3B92495AE89F991C22D554FD0F37A56210D9D32773E50F48F48D18CA2ED29
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595c01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595c01.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7c197ee4db54702d23fb937d9322846a1b5f1f5f5840095da145aa89e1d7512
MD5 abc09ac7837edb92fe34397c15e5292f
SHA1 30fc94f05d570c1292c1857ae1d16ad60602161a
SHA512 11536f857f7f2904065018b0cc67519364433847e823c80753c181b61fde4f3c9d4ae148b758f640e8729f60a1315cb107ee588d8021d023671177b367aeaedc
SSDEEP 384:+ZcIhsNNN7epuAuM9iX5FVajY2YoBlVZh6DKhHdoZ:8h6e2IahkJlfYGHdm
TLSH
T16F829E33A8B86C7B59F7F285F44736034EB48157D7C92E84C9EDAB1D00DA2981307E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d1c40884522a5a35f0f0d097a162ba583be86056d2fc53addd354105af99ff7c
MD5 b2c5567269311a63cfdd05a2ed1f47d6
SHA1 9b22248c911d76d69412a18ff2fed306e972e8f5
SHA512 bcf94fdc361e7ee3da0a15eea4c218a7361abfd5275f2db6bd41fafdf757fe13cdb2bcfd804b0374e95d746c41c81b6dcac911cfcf36b6ca3af5198bce8a9e40
SSDEEP 384:fiFiZcIJzsNX8TUNTUlIlo7epuAuM9iX5FVajY2YoYlVZh6DKhHdoZ:qFQpuwgAe2IahkglfYGHdm
TLSH
T1A5A27D3398A8987FADF7AB84F44736038EB44153C6C9AE94D6DC9E1D00D72D81307E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4fd9eeb2831f6f7d447c67ca0bc97e6b7ba3f087576fd1a22f43caaccf25fdca
MD5 bea5ff697b3d8b1119c09637c23bc8aa
SHA1 8da5822dac727b82e81cd5e7ee7639435a078695
SHA512 1b8548a42f85404f0100bbdf0a1ebd37eebcfeb10f9abafa47c6e90d273db0969ec176614f003a85882a5bea49f9083809052af0a6ce1653f435ea2efa314e59
SSDEEP 192:LONh6AmwprQmiUy6O6siX5FbRDfJi8NSU6:LONh6ipdo6siX5FVUdU6
TLSH
T17902E935B8B86C7F8AF3AE05B58B37135F95116BEA952F84CAE81B1C00D725C1306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a079621e474448cb5290bc2918e3ed4f41e09150a14d361655ff0b906c33ac72
MD5 f0e1e381c548b38de22bae33bd45dd9a
SHA1 cdf7446890a3206cc9d938b9f8052e296c115b0d
SHA512 44dbc51c341ba2bed21c91846fbe05159ab0bb8d54583428fb4a1523893f6c54bc60e987c518d04ea327c3dbae1bc884d8524240536f08b02f6adaa726562ad4
SSDEEP 384:xZcIhsNNo7epuAuM9iX5FVajY2YoBlVZh6DKhHdoZ:Zhje2IahkJlfYGHdm
TLSH
T1AE828D33A8B86C7B59F7F285F44736035EB48157E7C92E84C9EDAB1D00DA2981307E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c2d14009bf7f7768f8e0fcc0a3585ec7859581f541d5f31e8e551dd7224a686
MD5 9597dbf367a0a5b8e8be1097ad369681
SHA1 d0ff860ecb2505572fa448bf9493b1ae9b28af05
SHA512 cbe40d9dd46a130ad2b4a0c484d98d3f75f1b84cc54b79f0a5477e92bdba5480fcb52966765b8c77efd402ddb32ebc15b3ce0f6a8c8eb59e43889b7f2e36946e
SSDEEP 192:LONI6AmwpRQmiUybOcsiX5FbRDaHDY2PwozlR+q5U6:LONI6ipvXcsiX5FVajY2YonlU6
TLSH
T12F122B36B8B86C7F4EE3A590B48735135EA54217DB8D3F94CAEC1B1C05EB29C530B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7440db7-187e-401e-8a7f-1be20efca3e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7440db7-187e-401e-8a7f-1be20efca3e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d4c56521cb49eb229d1c182d960367ca6509c06177038620c4d75394081766fb
MD5 69d947d47eb78885201f064a5e69af2d
SHA1 8c3e458fb2d44ebd0baa8112dd8858886eef36df
SHA512 0d44ef0d1a18038de0e8ae41c3ebeafd40d8162195d57f777ac4603d4e0a8ffe4fa296327bb93182f4dea6665eceec9e21266c532ef773dd46b4a11a00e935a0
TLSH
T1E541279CA6E91108B3B76F1A9BF7A86E487A79772F07D05E10110D4F0A63B41D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download