6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-8rtwzc.htm
Size 34KB
Sample260930-ecfmaszyf1
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{B760B34D-FE77-4C53-A9EB-3180DEE33D21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	msedge.exe
536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 5068	1748	msedge.exe	85
PID 1748 wrote to memory of 3164	1748	msedge.exe	86
PID 1748 wrote to memory of 4968	1748	msedge.exe	87
PID 1748 wrote to memory of 4968	1748	msedge.exe	87
PID 1748 wrote to memory of 4968	1748	msedge.exe	87
PID 1748 wrote to memory of 2956	1748	msedge.exe	88
PID 1748 wrote to memory of 2956	1748	msedge.exe	88
PID 1748 wrote to memory of 4976	1748	msedge.exe	89
PID 1748 wrote to memory of 4976	1748	msedge.exe	89
PID 1748 wrote to memory of 4976	1748	msedge.exe	89
PID 1748 wrote to memory of 1324	1748	msedge.exe	90
PID 1748 wrote to memory of 1324	1748	msedge.exe	90
PID 1748 wrote to memory of 1324	1748	msedge.exe	90
PID 1748 wrote to memory of 3840	1748	msedge.exe	92
PID 1748 wrote to memory of 956	1748	msedge.exe	93
PID 1748 wrote to memory of 3840	1748	msedge.exe	92
PID 1748 wrote to memory of 3840	1748	msedge.exe	92
PID 1748 wrote to memory of 956	1748	msedge.exe	93
PID 1748 wrote to memory of 956	1748	msedge.exe	93
PID 1748 wrote to memory of 2504	1748	msedge.exe	98
PID 1748 wrote to memory of 2168	1748	msedge.exe	99
PID 1748 wrote to memory of 2504	1748	msedge.exe	98
PID 1748 wrote to memory of 2168	1748	msedge.exe	99
PID 1748 wrote to memory of 4872	1748	msedge.exe	101
PID 1748 wrote to memory of 2184	1748	msedge.exe	114
PID 1748 wrote to memory of 2328	1748	msedge.exe	115
PID 1748 wrote to memory of 3452	1748	msedge.exe	116
PID 1748 wrote to memory of 2032	1748	msedge.exe	126
PID 1748 wrote to memory of 2032	1748	msedge.exe	126
PID 1748 wrote to memory of 1208	1748	msedge.exe	128
PID 1748 wrote to memory of 1208	1748	msedge.exe	128
PID 1748 wrote to memory of 536	1748	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-8rtwzc.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa8aedc188,0x7ffa8aedc194,0x7ffa8aedc1a0
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,13988814799190646047,15619800664905985997,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,16209373802622997480,14485812665606055532,262144 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,11604035356184767016,17245620853960095789,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6930445523957943172,16623323483311208505,2097152 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6963525312845192021,9641121082164094176,2097152 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,15198836619406432907,9158785224123667103,2097152 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,16479181175546941090,15098518228837341172,2097152 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,15788899104784720115,16248988006874019553,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10205473979409015944,2565684286499577464,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,12825427452218034012,11963580392849163855,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,12825427452218034012,11963580392849163855,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15414656157830349312,8559222488783253729,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,13875998962967428665,15907459709207658133,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,5735773509107649860,2937500957495436676,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11000758200074789555,4375265814381220167,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,12379357538915637134,2722749273965732877,524288 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,416188375988978876,2042091789622518310,262144 --field-trial-handle=2232,i,16443409914478453822,7493552324984229576,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

17cacc88-1696-4f09-97bc-e6e4ef9a19f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17cacc88-1696-4f09-97bc-e6e4ef9a19f5.tmp
Size 9KB
SHA256 d5cccc551c826fb8e57baa893ce3bcea411dbe2f61393e69989d2c02d49a2916
MD5 02c8ecc140001e0488846a06948ece48
SHA1 584171dd0bdb39989f05d0ce15f68483e05ee886
SHA512 e7722ad6246f142c05f1e0ff48cb7544d91c4ed6e68e365422f57455eaa60012f047ffd8297fa861deaf12c25657b47c64533ab2d5654f58fc396f583f95f46a
SSDEEP 192:sxZ+RmWP/flsto9IdpdFHW6+WNGYRPR7eIgrJ:sxZ+bP/fls6+vHbGms9
TLSH
T16A22B8126E38A97B8CC7E21DBA15BF53E6F9503291D51E58BAFC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e8f395e879f713bd147f027e88c00f0cf44acb49305664ec864ee04226ade1a
MD5 3cd8e5504b16c5fd518cd1e8f474a1de
SHA1 3ebcd902a464c87ac05e5cf62a46d4cadcbc9993
SHA512 b2877077933098b8ed7cf8966721d97a7d02d7631bdbbac5baf1257952f6cdd4c33f279fe55a096adff8339e2f2cac53c90fe02d62a36e1d714d9f95c57d80c7
TLSH
T1125171845ED39C6DFBE883F045E7359BBDF5048C68837E0591AAE939EC0A74E8090324
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592b9a.TMP
Size 3KB
SHA256 cc1e864ff4a89dc874eb75a587e4d08ac36b0a3497b63877bfdddcb5a5e31501
MD5 8a3fe65366dd31691513dc86a53d8dfb
SHA1 dfaa8a0809238bb4e0d00ccbca484adf6cc1dc9e
SHA512 024cd09399aa79699875bb84f9c0d683941aa8f4081edea69458f3143530ff2e55e9c94db3acccc9ae8b21fda3b2a6c978f615747d9fa2c50480c987afd6ba87
TLSH
T10C5171845ED35C6DFBD883F085EB359FBDF5448C58837E0591AAE939EC0A74E8090324
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 7b2da3ec6751b9fbb9d0f0fe4c3268dc515a51c1fa8e527ac08db089e92f08d4
MD5 03dd28fe8808af137e7df87098bcf4e3
SHA1 7b4f1c74d74efc61e62ed58f1ba7d6a231388b5e
SHA512 593094e09bb643309fb0d70240a51ce62b3afa71a295ef26f72d49027a7db916d81e10a1ac87f865a77462c79c5996f892690b10626f4d59e9e9513f80848478
TLSH
T194019CF3C3E595AE8A0156F06A18AE2BDE2C0502831C7C1AC5D4BE2B93F34B5E50189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b2bd1fbac545cf1d195d4fca12e759c3f518cc5816c4134dda11338cbba4bd0b
MD5 0550513dc13b9c9d5ba235c383e44046
SHA1 9d55253ef8eac6fc0656508ed9fcaf0b55113a55
SHA512 1a1ea35be133bd145d8a63c44c709705df0733495d59d437b159286ea4a8a62140a8faa35d0ac366c77d417095a6f12bee11ba820cf645ede9cf9289aadd894f
SSDEEP 192:sxZ+RmWP/flsA49IdpHFHW6+WNGYRPS7eIg5tJ:sxZ+bP/flsd+lHbGmDV
TLSH
T11E22A7526E28A97B8CC7E20DBA15BF53E6F9503291D11E48AAFC861C05E67DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ebfbe869981bb81001429bc18e309dd62fdcbfc29db5846e50ea4deefbe1ba58
MD5 1d04b825927276350f44da4144dfcda2
SHA1 91404c04f07c248e449278d92d49e5d97af7a827
SHA512 463e512d47990f43e60389a46c45619288f6f96c397e38e4a62619e21a7cc7a780bbc81bc28cf963619391f4382ecc3218ec3ad750fdabfdce5e4e06125c66f6
SSDEEP 192:sxZ+RmWP/flsA49IdpdFHW6+WNGYRPz7eIg5tJ:sxZ+bP/flsd+vHbGmWV
TLSH
T15622A7526E28A97B8CC7E20DBA15BF53E6F9503291D51E48BAFC861C05E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 42d394c7ea186e41d8cdb1796b18b24084d0feecc0131a3908685003a519a986
MD5 2cc8e5d6b6839df19b5c01c83f488715
SHA1 d51480ed439935c961c2bce7c8dbc5e23275d917
SHA512 dcf05f878e304bc20fc7911944bde41da565154df4efaa1f729d95aafb381b6fa539482e2076a7d2f9552ce19cf67054969bc1803179cc388d7d24403fc8ab91
SSDEEP 192:sxZ+RmWP/flsAo9IdpdFHW6+WNGYRPR7eIg5PJ:sxZ+bP/flsx+vHbGmsj
TLSH
T17922B8526E38A97B8CC7E21DBA15BF53D6F9503291D51E48BAFC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 312dba94aa6d5664b9109670ddecd639e5fdc9726cff01e69c8be6f4aaa25b4c
MD5 f2a38574a97799cf1779d0ec94c7c5cb
SHA1 b6b1d8fc9c64b89f65f4a2a0483f707890f02348
SHA512 f588a1f79510521872732919d65a8f33b39d652b4f0e5855a3b562ccefd5d60c2402159ed51c67f254658912bdefaabf037e255a61ae2fef417ef93f49b5e6fd
SSDEEP 768:37K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3hrog+4U:37K9uzYWvcQWsu1ja0HL7Q3ag+4U
TLSH
T125C2FA3F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA944C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e058f1e49239e1686cd1e5172e7ac86b24ac7d35a5d4ce718bcf56aec44734cd
MD5 c17d5b0fe754f4600885b8604f9cc33f
SHA1 18b41e5847ce01d07b55740c066eb20256cab911
SHA512 46188b5230749412c44b11a952eb32886e7d348e7291fa4d4ca2879b4e7d363e0f63983c4da8bc05c038405f4ded9e1cea6fd122040d2c8c8a1e42e95c383ea2
SSDEEP 48:K0mImVUplXD34brOrIS94K9d1P4x9oYePlVyL+5UY28slbQ3YISwlK9U1mlxe1YF:K0mp6YKvq2GRiKac6WvuKEc3z
TLSH
T1A8B1DE0132BB121178BE255C81B4872F528272737118F62ABFBD14A68E6BE045DFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c692.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c692.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4618c9d1270e7ec50328f25ac3a2bf34e12d27c4a36a6c1bb332d3e772b12b9b
MD5 df09626088374c23368e592f0ad966fc
SHA1 453abfba308cf9a864ba21514cd56530c488dca0
SHA512 907fdc7f5d838204ccab9ba500959a2750d672890c55d58541eec1834ca122388796d60add6ff50cebf6ea2266364d9f013e6fc45e065a43a2a5ac4a2539e545
SSDEEP 384:XZcIhsN+rwMr1XcOjTVKjO7GzhjUu8tgOIwZOyTopou:fhL3nmOajUu8Xsxpp
TLSH
T123828E326C785DBB5CF7A245F58A32039FB89067D6896B90D4ED5B1C01DB6A8230FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6377cfaa01b90a86979c4195ad8cf15256ed9e9579af2522dcc01dba0cb8ba5f
MD5 1f8e7dd1517a46067f1314b28795f349
SHA1 d63e122034edac4eeead33ed3937e26ddbc20532
SHA512 84bf4e94c846bc2b0b71be9b8c8c5da81db5f704bc188de58b2ea2e7b2137c8a4f4926a6b44905766d1069d162796e62a3f293da1358e55367f8f1341b8b4e9c
SSDEEP 384:RiFiZcIczsNO8TUNTUlIlrwMr1XcOjTVKjO7GzhjUS8tgOIwZOyTopou:4FQgzwgn3nmOajUS8Xsxpp
TLSH
T176A28D335CA88DBBADF7AB84F58A32038FB45067C595AB90E6DD5B1C019B5EC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ad07e92a4b475d653deab3fe2ddf2732bd899dfe84deaf91eb4b008cc85ecb5
MD5 af57a0cec94fb4c067e8ed5712860411
SHA1 fe3639143ba9c0681ca3c27c43aea19c628877c2
SHA512 4ab2e0e75cf87f4d7653df5d117ed49a822f8367db52668dc94a7956dc8f1c5bf24292b18854b3254bd15a1a521c298e4316ea841efe867e6783864601a5e8d3
SSDEEP 192:SONl6ygpQmiUyADtOCTVg1jO7R0JzP9YEaU6:SONl6lHltOCTVKjO7GlS/U6
TLSH
T1DA02D734BC786CB78EB36E46F48737139FA4116BD9512F84DAE81A1C01D769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4548e79ea18419f77c1684f1a6447909fad72b2c351c7b9a2fdd0f0d5fce19f
MD5 0f9c2e57ad7a9a1478501412f0967acb
SHA1 8dec94e1dcb4497590329c28dcbc54bdaf2e33ff
SHA512 6fea0abd8665498e7aa28ff32d399b0134b0af7da8991a6b64bd4c5a0270ff7345933c5baf32b4ff8f701b8e72c2eef2a855361d77d8110189d47d5d5ebe5c19
SSDEEP 192:SONP6yHQmiUyuDMOCTVg1jO7R0zhj3Eb3U0q6U6:SONP6OdMOCTVKjO7GzhjUo8U6
TLSH
T1FA12093578786C775DD2A545F48B32139FA84167DA4A3F80D5EC1F1C01EB6AC234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ec143cefd94691fbfd99c58c37038c3a7f853ada78c8ff54642b11af80583fef
MD5 e84daada198de6162e660bdac74d678f
SHA1 76ac3fcd42d42d02c90b4214a2cf8f22380885af
SHA512 20313bf5d8fb8823718de76206f29524318be7a447b4a5e0846e846797c3d4b371e5259fcbecd42110c49c1b5ea5bc644cb2bfbd9b7579f3adf8e4d627001d5a
SSDEEP 384:bZcIhsN+OwMr1XcOjTVKjO7GzhjUu8tgOIwZOyTopou:Dhq3nmOajUu8Xsxpp
TLSH
T159828E325C785DBB5CF7A245F58A33039FB89067D6896B90D4ED6B1C01DB6A8130FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c4934e0-4738-459d-83e0-c82b12845650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c4934e0-4738-459d-83e0-c82b12845650.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 82dfabb1d1612d08e0676fb80301c2a74945a01d26f2068f0b3b406b2ab47365
MD5 8e3f8a9f50483db6e8645794153f183a
SHA1 8dfb47b96338e507a6fdc5c3015c4076e7515465
SHA512 44b31540080eb569696a41647574610cc2f24fb5e800e9b3226fb1e91279941500ec26bff3e3f5a462cfa29b7a0eb2c2791b7390ff220f8c7594f668c59154cf
TLSH
T178410688A7F90148B3B7AF4AABF668AD447FBC732F07D05D10110E4E0A62A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download