5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-i4ab1q.htm
Size 1KB
Sample260930-h1ddmaxbme
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{504A74A9-8D2C-4A59-A8B1-BCDA3300C4F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4552	3736	msedge.exe	86
PID 3736 wrote to memory of 2716	3736	msedge.exe	87
PID 3736 wrote to memory of 4468	3736	msedge.exe	88
PID 3736 wrote to memory of 4468	3736	msedge.exe	88
PID 3736 wrote to memory of 4468	3736	msedge.exe	88
PID 3736 wrote to memory of 4776	3736	msedge.exe	89
PID 3736 wrote to memory of 4776	3736	msedge.exe	89
PID 3736 wrote to memory of 3424	3736	msedge.exe	90
PID 3736 wrote to memory of 4356	3736	msedge.exe	91
PID 3736 wrote to memory of 3424	3736	msedge.exe	90
PID 3736 wrote to memory of 3424	3736	msedge.exe	90
PID 3736 wrote to memory of 4356	3736	msedge.exe	91
PID 3736 wrote to memory of 4356	3736	msedge.exe	91
PID 3736 wrote to memory of 1272	3736	msedge.exe	93
PID 3736 wrote to memory of 1840	3736	msedge.exe	94
PID 3736 wrote to memory of 1272	3736	msedge.exe	93
PID 3736 wrote to memory of 1272	3736	msedge.exe	93
PID 3736 wrote to memory of 1840	3736	msedge.exe	94
PID 3736 wrote to memory of 1840	3736	msedge.exe	94
PID 3736 wrote to memory of 4064	3736	msedge.exe	98
PID 3736 wrote to memory of 4064	3736	msedge.exe	98
PID 3736 wrote to memory of 2020	3736	msedge.exe	99
PID 3736 wrote to memory of 2020	3736	msedge.exe	99
PID 3736 wrote to memory of 4632	3736	msedge.exe	103
PID 3736 wrote to memory of 3020	3736	msedge.exe	114
PID 3736 wrote to memory of 2408	3736	msedge.exe	115
PID 3736 wrote to memory of 1452	3736	msedge.exe	116
PID 3736 wrote to memory of 1628	3736	msedge.exe	118
PID 3736 wrote to memory of 1628	3736	msedge.exe	118
PID 3736 wrote to memory of 1908	3736	msedge.exe	124
PID 3736 wrote to memory of 1908	3736	msedge.exe	124
PID 3736 wrote to memory of 1556	3736	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-i4ab1q.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff8cb41c188,0x7ff8cb41c194,0x7ff8cb41c1a0
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,14921314452129649755,1608341201465873607,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14352824479699663528,17912829493006653958,262144 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,7642518376132376261,17128172790062748523,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15676396834043273358,13181216184139722602,2097152 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17989028063689440130,11278594574241774894,2097152 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8741237963876225704,4548130957589973308,2097152 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,11746876993619969817,3074742849725379513,2097152 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13255315374671053464,3756064256225294477,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8713642024097805185,8622326886921016402,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14258867937044636629,6030081854484814000,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14258867937044636629,6030081854484814000,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,271511698323147475,10837481827991461533,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,5366329792789518331,2875947143654386927,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5321614365148528950,17614669409739609956,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,10800360980247957951,7237895951907550907,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4181532104114283662,10673182264977601048,524288 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,7413633664440912706,17483299246848238352,262144 --field-trial-handle=2256,i,15541317407485071221,7900521264923765939,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cffb205996cd0e682cc80e9be3fb1ac08e82dbce1d0c877530051e79511d1ca6
MD5 a34eb0a7a6b7f1843fe88a3fa09a24fb
SHA1 00de0049bcfe9ef8ff7ec21b31f4424e3064d71e
SHA512 821f041b57029c2354fad541192312643b8004ce607c0b833a22ae92fe8560d6c359c634cc18d65086ac37ad9b0127a256ec07c27b3bc5e97f4fbbffc03d784e
TLSH
T17061FB86E55101B5FBE8B033B6F057BF363849B29DEB1EAED1A4E278940E721313804C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f836.TMP
Size 3KB
SHA256 97505ccc6dd2b906aa8e84ddc9b3673e8e53d0109f9a04fd476cf9a9b314d37c
MD5 e9bfb7a14ee8a8ceb357b754c31a5a85
SHA1 cdc88b15b8aa2fc9453332e57aad733ed182c529
SHA512 929550172608049063f4b69521944552afcf8f92cdcb218d9d96a8854f85ce14a960ec3e5eeb0bdfd704fd976d5759a22c79267b2135ff9f307b20cca97a0b69
TLSH
T1A861FC85E55101B5FBE5B033B5F057BF363849B19DEB1E9ED0A4E278950E721313804C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 741570d5c8ca1627a8d1e2e14ea00b6bc392f5e39ff81914cfd8f6debc288293
MD5 d9a0a43593751dc2a6b186ff7e9c5f0b
SHA1 45f102a7557b96fd2dcea1635a6a1e90bccd8ae7
SHA512 93c32c40c5ef31996fcd704013cdccee49bdc81213c82f026330272e2027b4b9f9a6ff42d3d567d1a8a9f60436c4ee93cfc85edaca6e1bf58c475dd85a8a111f
TLSH
T157113DF3C3E585AE891116F06A24AE1BCE1D0505421C7C19C9D4EF6BD3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 178e777682c5a53eb4514c47598bb0781deebd7b3fd8dd58c4b6548e31723a4f
MD5 03ca6389ad8fa2b75b3f0104e48b5c47
SHA1 53415f7a2807ea88f11147528530cef7548ba77c
SHA512 ccc48abb1316f3a99322fe5505eb78000c69b72f93941c1f8ba64846ba8192e0fdc85a0212d7a4969ec7ab0c42c77ce7ec8d43a61b1f49346a43ce2e3a56197a
SSDEEP 192:sxZfRxWv/fCsCAIdpd/HW6+WNGY3R3JIgrJ:sxZf6v/fCsCBRHbGi9
TLSH
T1BB22C8117E28A97B8CC7D20DBB15BF53E6F9503291951E98AAFCC51C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d0090a17511d136e3fd37fd540ad614045f93fb0c0e901cbbb41790b2de73fb8
MD5 c39c7e416c10b98adf6259b8489ffffa
SHA1 93c332e91f7931af9a5bebc4b71498cc78c0669f
SHA512 db3b486623ab8528acfa0378dcf4e70f1e243c32b1bf43b867d77734a544df56b926d609b18aa5450bb3af2cb9fd312f477cb0867b2b0bea61f2234a9f54ae4f
SSDEEP 192:sxZfRxWv/fCsOAIdpH/HW6+WNGY3P3JIg5pJ:sxZf6v/fCsOBfHbG+Z
TLSH
T11D22C7167E68697B8CC7D20DBA55BF53E6F9503251911E88AAFCCA1C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 be39e14635b7e8aac205a5c1fb0355c93ab1e9a04ec2a56254010ca3ae40c318
MD5 fa450dd195f72f113125c835aafc134f
SHA1 993a70896c6431a1174ea21b758faecc4020f5ff
SHA512 39b489ffef1f9fd35560b3dcbcb342ebd980b604c3cb89fe844fafb330d2c70c0112fdd555c2a48eb8713968654e206781297f73117bc1701fdef8dc6bb09db3
SSDEEP 192:sxZfRxWv/fCsRAIdpd/HW6+WNGY3R3JIg5LJ:sxZf6v/fCsRBRHbGin
TLSH
T11E22C7167E68A97B8CC7D209BB55BF53E6F9503291951E88AAFCC61C04E76CD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 18463d207b5107f082e8eb0cdaae15e3fe59a579cda00480956d440d09b3d1a9
MD5 f4e4b4153fe46b982f8f3fbeba832880
SHA1 edad8f51c78d5e9ffddb63ec006c1a5cb28ab096
SHA512 f447ae55e21cfc65217aa5d6094ba2086c2760e557ca027ca67a4851ce553820cb789746a821a0f750ff558164e2c00be2d90c187d1ae1f8acc63b9af699f052
SSDEEP 768:eC30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72BrolZME6:eC30AbSWvS2l9u1jaLmLZ126F6
TLSH
T1F6C2DA3B640CCA7E4FC01A9DDC6AAF9B6F9C02C796544D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 659ad4e790010ae9166c28884e0b7248fc9aa482d55e66fcbd6b2f5c819216e7
MD5 55231623087f1626556aeb6201fb6d55
SHA1 72b3a5e2615640d3abb2f2f65b2ede7e4242edfa
SHA512 da75571c7ff6428b989788454e8156070187b4dea62c4fd8b733e46a54cd7adfad7032f53f18dbe0444d8fc5fcdc13c27d269b20cc6ddb3efaf26b7464a8b387
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL2xMwuUUNb4PgISINK9s1uNxmdYHYlh:KoZeK6kyeFGK20VzqKEE2J
TLSH
T1BE91710271BA169078FD294884E5867F0241366B3028EA7B7FBD50758F6FE159DFD8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c93be0d5-5e90-4c53-9807-b9456b399e27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c93be0d5-5e90-4c53-9807-b9456b399e27.tmp
Size 10KB
SHA256 0e698983f130cb1e582389d5a0047fa476f025192050025533a623e2b56dae67
MD5 a1e1bb1b8adb615f005851cb0e534fa4
SHA1 617f38f36afd6cc1ae46a29aa6bb49b5eb4d7d56
SHA512 7244b468fa30044054a01c72dc67612fe6dbfdc407c4302a5f595f6837f52cb827730eb3f3521465a50c38c83e5a3b00515acba1425f723758cf0913181d58c0
SSDEEP 192:sxZfRxWv/fCsOAIdpd/HW6+WNGY3M3JIg5pJ:sxZf6v/fCsOBRHbGBZ
TLSH
T17122D8157E68697B8CC7D209BB557F53E6F9503251911E88AAFCCA1C05E7ACD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59934d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59934d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ed32ede794ad4060a0a1366313dcd7c3e6286ed6e3024d0197ecb5b075719986
MD5 7edf3f813ba411d9ce9ffd9c0b980ff0
SHA1 ccbd7da3ae43f09c8918b5c8651b64f60bea618c
SHA512 70ac026d4e32ae8700b8f1d47dc24c5241f3b95ca630edb6a7772af2b9750edcc30d1c6f5d79fde606180d1dde9387041adf2a23b53df38f793339ad6ecc76ce
SSDEEP 384:iZcIhsNodBpu4kNu9iX5FQCwe3KtgOIwZOyFXoS:QhnisacLe3KXsAh
TLSH
T171827D36A8B86D7B6DE6D145F58B36034EB88127EBC86F84C9EC571D01E61E8130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5d6443b84dfed1c59274553acba089fdcdd439b2c8f95810c24a4b3f641c746d
MD5 06250d8c31059abc686d34ba18fb8fe2
SHA1 6156caf35733b0dadbe324bb420031770031fd01
SHA512 8ded7c2df5c1ad19851a47739d6b14e79e29f59b88d9d07790f1f2fffcfc720e4cc2c99a9c0c4a13cfa22345e7aed9b40906da72fdc56e04f13fd56fe15eba87
SSDEEP 384:liFiZcInzsNY8TUNTUlIlYBpu4kNu9iX5FQC7e3KtgOIwZOyFXoS:sFQzxwg6isac2e3KXsAh
TLSH
T130A27C3798F8997FADE69B44F58A32038EB44167DAC8EF94D6DC9A1C00E71D8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ff9bfa3afe4eb05f840cd9e27c233ffb92f616903541d9a7dc91c83a4b4d706
MD5 450a050f29b5d98495466264ce255072
SHA1 36e356063b0557f9af116be0b0abed3d09b162d4
SHA512 aff9f03b0a6842adc69f1db261e871c51ff6a21a7bf4339b20a1ab2e6a56d3b8d0877c3ee04db72438ef737b59df420b6a5754092c3af1fde84a395fe464eba2
SSDEEP 192:LONV6AmwprQmiUyg06siX5FQVZJiejLU6:LONV6ipdw6siX5FQceXU6
TLSH
T16602D839EC786C7B9EE2AE45B48B36135FE5116BEA942F84C9E81B1C41D729C1307933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 368ba4da0627845c9af76ce57cc274ab9e1f300b53f70a667bf1c5daf93ac523
MD5 07525658f5dd88cfca45fff417685f62
SHA1 b675f6d0dc2b6f0715a9391e0c6483a09a7f3aaa
SHA512 5c6ee5e0c3e59e192ac875ae1b0288180d2ffb96c8bec3b0ce5107f3aa0ba7b9795e8b61fb6fa6d7b9481f98a6ea9bd61a9abc4a71ffc58f2e70f82f25c7ba1d
SSDEEP 192:LONh6AmwpDQmiUye0YsiX5FQVQllReWrqrKU6:LONh6ip14YsiX5FQCde3KU6
TLSH
T12B12093AF8B86C6B9DD2A954F48735134EA5821BEF887F94C9EC161C05DB29C530A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 313e6e63015c9737d1c0d325499254acc03fa610a39b912309aba27cd153bf8a
MD5 94c92bb317f48311509087e8f9b72c34
SHA1 1f82082207f0a645df5c6274eacb843a1050b252
SHA512 136774b0b2cbb9deacca84e6ba051148984575e32227934f8f96d8ae5fb7662e133badc82148728757393753a0c7de6b4c58ca9806c253d1f48dc7add4d5c250
SSDEEP 384:0ZcIhsNoYBpu4kNu9iX5FQCwe3KtgOIwZOyFXoS:yhIisacLe3KXsAh
TLSH
T15A827D36A8B86D7B6DE6D144F58B36034EB88127E7C86F84C9EC571D01E61E8130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

550aca77-8c00-4762-945b-0f8a5a67a1a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\550aca77-8c00-4762-945b-0f8a5a67a1a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 234e42cb4b15fd6cdf86efef331154a0c7cf68a6ca0888cc56dacbf86dd0525e
MD5 9855ee3963332573e2dc3e6fe69cf166
SHA1 68267e028a71843768b212765fa1a569437372f7
SHA512 f0a86a07ef4c94969006d0235ad5428f20c78f2bc3734c2aadbced24f273202472dcafe1864472f332ebfc269a1250d9e2067231e245f62bccf85010f3f7bb98
TLSH
T1A241485DA6F91044F3B7AF56AFF6A46D447BB9332F0AD46E00010C4F0626A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download