af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-ue6qf2.html
Size 214KB
Sample260930-fsp2cavthy
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{260CDFAF-069D-4B96-85EC-CB7999C232F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1800	2460	msedge.exe	87
PID 2460 wrote to memory of 4012	2460	msedge.exe	88
PID 2460 wrote to memory of 788	2460	msedge.exe	89
PID 2460 wrote to memory of 788	2460	msedge.exe	89
PID 2460 wrote to memory of 788	2460	msedge.exe	89
PID 2460 wrote to memory of 5092	2460	msedge.exe	91
PID 2460 wrote to memory of 5092	2460	msedge.exe	91
PID 2460 wrote to memory of 4296	2460	msedge.exe	92
PID 2460 wrote to memory of 2204	2460	msedge.exe	93
PID 2460 wrote to memory of 4296	2460	msedge.exe	92
PID 2460 wrote to memory of 4296	2460	msedge.exe	92
PID 2460 wrote to memory of 2204	2460	msedge.exe	93
PID 2460 wrote to memory of 2204	2460	msedge.exe	93
PID 2460 wrote to memory of 3344	2460	msedge.exe	94
PID 2460 wrote to memory of 3344	2460	msedge.exe	94
PID 2460 wrote to memory of 3344	2460	msedge.exe	94
PID 2460 wrote to memory of 2120	2460	msedge.exe	95
PID 2460 wrote to memory of 2120	2460	msedge.exe	95
PID 2460 wrote to memory of 2120	2460	msedge.exe	95
PID 2460 wrote to memory of 1992	2460	msedge.exe	101
PID 2460 wrote to memory of 4196	2460	msedge.exe	102
PID 2460 wrote to memory of 1992	2460	msedge.exe	101
PID 2460 wrote to memory of 4196	2460	msedge.exe	102
PID 2460 wrote to memory of 4016	2460	msedge.exe	106
PID 2460 wrote to memory of 1712	2460	msedge.exe	113
PID 2460 wrote to memory of 1340	2460	msedge.exe	114
PID 2460 wrote to memory of 4656	2460	msedge.exe	115
PID 2460 wrote to memory of 372	2460	msedge.exe	117
PID 2460 wrote to memory of 372	2460	msedge.exe	117
PID 2460 wrote to memory of 1344	2460	msedge.exe	124
PID 2460 wrote to memory of 1344	2460	msedge.exe	124
PID 2460 wrote to memory of 1316	2460	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-ue6qf2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc6bfcc188,0x7ffc6bfcc194,0x7ffc6bfcc1a0
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,6864571145343606024,8040742877612018910,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9110974918828352405,5461615636866828576,262144 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,11807969343027198190,11563490446018923335,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,9748492307811150545,1341218398378237862,2097152 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,5457210789306965064,11495225364395083434,2097152 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8260578047876537825,11912005634068497859,2097152 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,13023430629113437879,2282434327380633201,2097152 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16523124725495815078,13902948977883361637,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,263893402294281294,11824285497533260698,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10427210866808400692,14133042426479909314,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10427210866808400692,14133042426479909314,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,8227640157076741543,5046694474010960636,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,844444147465890779,12428989465161628301,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,10091884799846064621,16100405044527795820,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,6066425692372210914,13425411364492544228,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3445736692701263188,17942130279253522745,524288 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,2234217385802999718,11225185421582961095,262144 --field-trial-handle=2236,i,9606431836769401900,9912773406337232208,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d061ad09acde36b911add1d91ee79359c599ed641fb8d1259a2140925a4bcabb
MD5 e08a42d65559741178d06e3ff5ffbf10
SHA1 be4a6b24c418354bd5fdcb4c2113df3ee9594e7b
SHA512 1e7f94a38541dd4f2fdc8c8bf20f0b20d1fe7fba8b71748dede5f69644dc814751bd51c94664376d011bf27cce8c7119467c7bf006455d6a13a6d900526c8ba5
TLSH
T1AB4173875A804C82FF98C5FDFCD81A9F3FB0996F5C8B2E0B05AAC4B699B6B14510C034
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591498.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591498.TMP
Size 2KB
SHA256 d32fa3415c0917fd828ceb5a2c4ad6599834a03b2b76b4f6bbb34f00c46faa70
MD5 85db0ad0ec2d8f3c98dc02ca17c9c902
SHA1 f56ebbafd66433801b724f3c449e6e1b7d5dee8d
SHA512 bad781b2a817e352b5ae8d781a7675cbb483b3a6290d26e6f242b7e0a60bc5e01bf565fe70b962dc1e3a22c08b9fb516fcc58f3980ace76bd605116f2220665e
TLSH
T19F4175475A804C86FF94C5FDFCD41A9F3BB0996F5C8B2E0704AAC4B599B6B10510C034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f097cf66ec1b82cc15e81c8ef451eb504d14daf97ce0c001e46e84b3f719e5dd
MD5 e022e750ddf3501136907acb00c02143
SHA1 a8f0ae74c80dd6356c88513ba87516298347e3e0
SHA512 eb1c9653b21c3e8ea3c24dad7bf69033209cf72a0b1b7b97229f12dbcc6e0ab36eb890dd5c1ca9ef09f7a908c4a6e60e3290805d96ca8b53484858222dbe3e77
TLSH
T1D2113AF3C3D585AE8E1156F05A24EE2BCE2D0606421C7C1A9AD4EF2BD7E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5845c27a08ec741a65f4ca5b007f784c22905f5ec0994c9c7739e5d208522561
MD5 37f655817fe9dca4c6c8993849799060
SHA1 a414c3a0e46455d98c253012470dcd5361c42558
SHA512 9cf8d81554fcd539d6339cc806ab2ff2c93c8d0ee42ab159ad874a614ed10d17a31242bd54216a5b2abc9e77f9def31e78e24510508bc6679711f5e5285a873e
SSDEEP 192:sxZnRKW9/f1sjYIdpdYHW6+WNGYYBaWFIgrJ:sxZnD9/f1sjpeHbGf/9
TLSH
T15A22A6116E38A97B8CC7E20DBB65BF53E6F9503261D41E58AAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7149b1e6f9bdb6ae0168d93280f6e2a9d2c82e30564ea6cb31bf441f5a29bd0d
MD5 5fab7c7fd6011297597685f72c8ef7d2
SHA1 6eb2e16ba1ff56ea18eab6af973561ca8bc77df0
SHA512 b2a961ccef76ec331c8dcbb083b0c515f7af56dbe3e3c80ade22d3e7f0a56bd1217e894a2fa1a7ab967457f629ab42e85b0bf4fb252ccaf99408e609807f0bbc
SSDEEP 192:sxZnRKW9/f1sJYIdpHYHW6+WNGYYBiWFIg5AJ:sxZnD9/f1sJp4HbGfXu
TLSH
T1F822C7116E78A97B8CC7E20DBB65BF53E6F9503251D01E58AAFC861C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2221573a900998899aa2e3af2049e716a7d12583bad6cc9c8843d3725eb8c9b9
MD5 8e8a3f5a1310d614b9440ef13c27cd75
SHA1 434428840a9214bcdba28da762c403bfe3ab2d93
SHA512 ca1c3a4b588855321754811ef9b074976c29a789b561f571539a29c784d09aa54c8733d54fa47e1a7620dcd85523c9be6f0dd203dd1d50ae289df366f33c5693
SSDEEP 192:sxZnRKW9/f1sJYIdpdYHW6+WNGYYBKWFIg5AJ:sxZnD9/f1sJpeHbGfvu
TLSH
T15222C7116E78697B8CC7E20DBB65BF53E6F9503251D01E58AAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ffe3756c3638f126ea2f9483d64299552217f59b31547a6f8af91678b65a9812
MD5 cf888dbfa8584ef339d2641a5879723e
SHA1 ca0767aede9db162d63bf5c7629d5a7889878a42
SHA512 0bfe85d344ef5a93d2de2aafecc49a1d6b3f4fc2d158586a80502e2935187bd152b0c1cb9ce3cf3ee51e16c619d4a250ef4af4c1480121f7ec6c49cc31c58fbc
SSDEEP 192:sxZnRKW9/f1sIYIdpdYHW6+WNGYYBaWFIg5qJ:sxZnD9/f1sIpeHbGf/E
TLSH
T1B122B6116E38A97B8CCBE209BB65BF53E6F9503251D41E58AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b4c21da1c08a0fcb6ab685881a598518731c3f5a7c1e47a286175316d8cd1119
MD5 1991aa9e9c933c08b401b9037a567d63
SHA1 1b577ede4a78ea4ff7577209aa953c65713914f7
SHA512 43a4a87ce02acff0a50d77b9315a8c6f3641a429d3dd40de1250c5dfd8fa3d6643dd14c0e7809d8de902d2543dedd79fb86b89aaa5b2612e5549cd051a0e67b8
SSDEEP 768:QtyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXnropwjo:QtyYR7jWv3NpBu1ja/CL8OX0P
TLSH
T17FC2E93B644DCB7E4FC01E9DDC5A6FDB2E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e977f25214926010660a40033f5976ca9abf21098fb84144dd571367079b6cae
MD5 5ac6f8fdfdad1e7d9dee0a3272a1cf25
SHA1 5d86c639037b682d1b460355285f4f73f501e753
SHA512 5708a20068ef6242f52d60a83384ba26dfea09bba015a3f0b525cab5ce10c3ef0859c9edd550387c2c5d518f5875708c8bfad95d86c0ddbe3e05b7653e8361f9
SSDEEP 48:KgdcRtfLPwbD2jISlwK9l1Hwx1gYmnddyLmBcJ4FZDHb0bni/ISx0K9x1b0xZkYs:KwWYKHKiW+YKTiWSwwK5u+G78YGMK
TLSH
T1B1A1F510327F420238BE29C88675CB1F525132F77154E62BBF7C1496DA6AE586CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b07a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b07a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 51b2427fb9daacdf459de8e5510d7b9a8016abe85234fae13df39a28daa5997c
MD5 caea3fea44184f7fe4362c41b7930d93
SHA1 905404aaccac9b415f527728cd09b12f5febd5b5
SHA512 b8dfd24fc1c3a50310c9df896fd77ccc5ed31302afa77000fd376d560cf7582bd21b1d5e2d66f93b89348680700901a8fe668ed4f2d74e850ebc0cad9220f825
SSDEEP 384:rZcIhsNYgS8sihi2QX5+DtF8iL7XV6maVZh6DKhHaoZ:zhusT9kD5V6dfYGHa2
TLSH
T1C0828E329CB86C7A4DF6B585F48732139FB85053A2C86B80D5EDAF1D00D9AA82317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5d6b8451bfdfb4f6eeb4b94092582038c77960e63fdb419be7f0287e9df3451f
MD5 c4b73ecfc136bdef68438bc977c6f831
SHA1 0bb49d9ea39314f91060c7b6d7f6f45fe05dfe3e
SHA512 6d5f8e591375bf3731345128af518c6b23604e9d5bb32cabc7f01aab880f0c70b968a8b47d94dd908ea59229b645ba8562e1eaf3bf660b6f39cab7469c6fd885
SSDEEP 384:YiFiZcI0zsNI8TUNTUlIlFS8sihi2QX5+DtF8iL7X/6maVZh6DKhHaoZ:jFQIRwgPsT9kD5/6dfYGHa2
TLSH
T167A27D339C989D7B9DF6BA85F49632139FB84063D5C5BB80E6DCAE1D009A5DC1307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e5ed915e9c53cbc80b8029a2f505aff39d58d0be756ff3b203ff1cbe613c8cf
MD5 eb27f4c2a91ea08753c09d40bca2b4e5
SHA1 b7a721b934db744741627981890cf1ea8459eb1f
SHA512 12dbd7397fe80906bc9c8495951a18b0ffd47d765bdc8ece67843181cf5c304b241fc8b68360089fd4a51453577bec0b7c0dfcc5882226cdc7beea4e233f96b4
SSDEEP 192:EONk6nnHGQmiUyYkQYcX5hQDP1JjzoriLwMc0KvU6:EONk6nC0QNX5+DtF8iLkZvU6
TLSH
T17302DA34BCA87CBB8AF76D45B48633139FA5213BA5956B80DAE85E1C10D769C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 734bc62c88e0b53a97ad84158b3af64ad70e26ac39037991b6186246a1c274ff
MD5 2bc65370200597f2b458271bfa1eb97f
SHA1 cd0823952ae351fd191700dc17c99b2886ed302e
SHA512 ed46dc31ff3dc4185247d1459bc63fa5ae3224bc10a0cf2b424b47f55ca76674ec49231df96ddd4f6c147b45fdedd5b192b90d9e310f677d518f21fd2abb2b38
SSDEEP 384:kZcIhsNYFS8sihi2QX5+DtF8iL7XV6maVZh6DKhHaoZ:ChpsT9kD5V6dfYGHa2
TLSH
T17D828E329CB86C7649F6B585F4873213AFB8505392C86B80D5EDAF1D00D9AA82317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0e92ea0362a5b77412210390e3e9f9839f69dfce45e42e595f228eb4fa8dd0b8
MD5 d264d6c70dceee24ddc67d8833546bec
SHA1 1b0f49cef0a367d1f9b4c43ccaef94f384c9ea5c
SHA512 fe1ba347d5378cf11604aebcec604d75294e2a8599c136530a3ec96afebad277d7dea3802c852412ef799842d94027c6953231ac58a6c6ef9a0284bb745c9482
SSDEEP 192:EON56nnH0QmiUytkiYcX5hQDP1JjzoriL7XNetg3Jq5mN8U6:EON56nkDiNX5+DtF8iL7XP6maU6
TLSH
T1D9120C35EDA8BC7B4EE27495B08731139EA51117D6C57F80DAEC5E1C01DE65C230AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6eae4c2-97d3-4704-9e61-6cf38e00c1b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6eae4c2-97d3-4704-9e61-6cf38e00c1b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f5c41a8acf3fb5dfda29ed4043b740db91349e7a0975f38e3f3bda8d399d218f
MD5 d433d52b8bd775a77d15a50e49f4ebc9
SHA1 5e0f3f5382b4701ccda9a6e19ba0baf5aa2fd1c3
SHA512 0ec0c5926f0130db747f4bd7218b330afe61f9200e3e24df281e5709ff9a103c0317467d4625cff70445c96cdfc6494a7f3ff9bef72c22d6b83ffed913ccf0ad
TLSH
T17B410689AAEA0109B3B76F5AABF6A86D547B7C732E06D45D10110D8F0A23B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download