6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-ghzhq1.htm
Size 34KB
Sample260930-h5vtgaxeke
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{FE48343B-6729-4B2B-AAC9-35A6AC368A6D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 6124	3864	msedge.exe	84
PID 3864 wrote to memory of 1124	3864	msedge.exe	87
PID 3864 wrote to memory of 5956	3864	msedge.exe	86
PID 3864 wrote to memory of 1124	3864	msedge.exe	87
PID 3864 wrote to memory of 1124	3864	msedge.exe	87
PID 3864 wrote to memory of 6032	3864	msedge.exe	88
PID 3864 wrote to memory of 6032	3864	msedge.exe	88
PID 3864 wrote to memory of 1316	3864	msedge.exe	89
PID 3864 wrote to memory of 5820	3864	msedge.exe	90
PID 3864 wrote to memory of 1316	3864	msedge.exe	89
PID 3864 wrote to memory of 1316	3864	msedge.exe	89
PID 3864 wrote to memory of 5820	3864	msedge.exe	90
PID 3864 wrote to memory of 5820	3864	msedge.exe	90
PID 3864 wrote to memory of 5576	3864	msedge.exe	98
PID 3864 wrote to memory of 5576	3864	msedge.exe	98
PID 3864 wrote to memory of 5984	3864	msedge.exe	99
PID 3864 wrote to memory of 5984	3864	msedge.exe	99
PID 3864 wrote to memory of 1964	3864	msedge.exe	102
PID 3864 wrote to memory of 2136	3864	msedge.exe	116
PID 3864 wrote to memory of 3524	3864	msedge.exe	117
PID 3864 wrote to memory of 6012	3864	msedge.exe	118
PID 3864 wrote to memory of 3064	3864	msedge.exe	121
PID 3864 wrote to memory of 3064	3864	msedge.exe	121
PID 3864 wrote to memory of 1876	3864	msedge.exe	123
PID 3864 wrote to memory of 1876	3864	msedge.exe	123
PID 3864 wrote to memory of 4448	3864	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-ghzhq1.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff12a3c188,0x7fff12a3c194,0x7fff12a3c1a0
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,7899715510488673884,9080953907211499474,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,6728110716615434561,10736671946657141089,262144 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,4295408069160501416,9264061033216040904,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14451648133087574325,7433281708737706829,2097152 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17295732484075640760,8728742293469892529,2097152 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,14422902844881254397,12627051987463549597,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,11464755244626973224,10548474069480055758,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,15798105629255266821,6718221769301176150,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,15798105629255266821,6718221769301176150,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,11963307362322582999,11739229028634873215,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6647751342357695336,2404169498470628798,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13432479339779598774,13236902690853586661,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8432626217948405215,14909654177639617003,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,16953181460207342432,5598386916547951112,524288 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,13129122507088082988,10289702588639111138,262144 --field-trial-handle=2312,i,12448169638895009945,2362206788044585714,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 81f0ca4a1f33931f5598d16a6a216ee1925527f6164f33923b1b687dac797541
MD5 ea57e43b7e83a1f128deccc45b6e7c61
SHA1 dd0328bc7ead7cb4a6722a1e82de28e6c00f10dc
SHA512 e42217882769e27dcd0be9506a87f1dcd2cbb97ab120d24ba4ab95e3f242471b45cba7431d5576dbba169ff773779ac01a116e9c6fb5a3acaed16a73d4fc768d
TLSH
T1C5F02DB5CD25BC3B08FC1B1D60550A46E751135B2780999F3B3D810D8FB5A37854695C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6c9da841f39c53a399b2bb886240bf036da00daea2871cd8c83126dc59611d91
MD5 7e486e69b382565d2d4bb2ab602c63a2
SHA1 b326b5f9997c34aab3371461018712d0d2a79cd2
SHA512 eb4dbd9d9444fbe682abb4a9c841b5a02a0d5f710d4e2e7d9fb6dcbd49cb224b73767968ab39da67309005432a38cd0519f207733cd806f64385042eaa89e8c5
TLSH
T13A31D2F7C3E8866EC901A6F0A718AE2BCE1D0954432C3D5AC5E4AF1B93E3471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 22971f53e0f89db91d701d436b4c2342854965854f289d3449fe2122032631d0
MD5 b88908a12780780d8879b5c9c5c29c3f
SHA1 60b08f82df15de3ea3a510fc686991ae48ceacb9
SHA512 b5223e721e51a5d6c7b64049d161a1edaccad29a07f577beb7d79d5cf2ab25019b7a5ac8b7f4b5e37e20bb39ca4a11f754929ef28b0421961989b4fcf80a7f62
SSDEEP 192:sxZvRRkF/fOsiQZZpizodpHiHW6+WNGYbIaeY0gIg5ZEJ:sxZvcF/fOsiOZpZCHbGFhYxjI
TLSH
T1F442D715AE78A97B8CC7D219FB55BF53D3F9503290941E48A6FC9A1C05EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e707bcf8035a0441bf01ee69e1a62fe43a07c62e029f666985a51b99c4ba59ea
MD5 ba404b72072ac0c55f9cdb2db7b65f3a
SHA1 42313ea5c156ac48788d1f9ba572293274995911
SHA512 50cd525557b12e47896240099fe75491df83bd7c63bb62b35c199766b38c2834d7874f1e7cb9de854b2aa76909692a72b27296f518d77aeaee8656f38a80f68b
SSDEEP 192:sxZvRRkF/fOseQZZpizodpHiHW6+WNGYbIieY0gIg5ZEJ:sxZvcF/fOseOZpZCHbGF5YxjI
TLSH
T17842D7156E38A97B8CC7D219FB55BF53D3F9503290951E48A6FC9A1C05EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 781e959955f414ad70bf08d79080f9b10eadd3b99c34393ee0866e785fd63f91
MD5 3674a5c29aec4090fed00ee27fb23be5
SHA1 5aa4202c3a1fafb4ce0126d1fc3553bb63e683e9
SHA512 28f3e9d2537381296f2455e42a5e755077b3fa0b5cbe49468eaf8fc4599b37368cad4a120cf94c492a5ac2a42897ab22070591dceebda4e053b0893e17bada82
SSDEEP 192:sxZvRRkF/fOsGQZZpizodpHiHW6+WNGYbIaeY0gIgjEJ:sxZvcF/fOsGOZpZCHbGFhYxjI
TLSH
T17342D815AE28A97B8CC7D219FB55BF53D3F9503290941E48A6FCDA1C05EBACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e78f2de31edacff73f7140c97187b89f5b2991ff4c84f511024a98336446f28a
MD5 d5b3557460f672284f5d8f46c12ebc90
SHA1 d7a05189c38189aad6597d6191794be3604243fd
SHA512 0c82ac2b042c9d653077790eeeb4a7d30431a7d9c9c258400f5758604a2f7c283eac12809e5955151199f2d44ac1b0bff96615a016420b4da8dd5f793b987c4b
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIzZJ:OtfFvpopPxrB4RhfIlJ
TLSH
T1ABB2141571BA421038FE690C81B59B2F064232733159EA3B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2a339046ee22d27b51145f896c87c4d720bba1c25f76cafcf4dadf034ee3ab66
MD5 cd2bfa4e5160790c2efebb5fb6a03cf8
SHA1 a89331d78b9ee0c956405aa665524eb65beace0d
SHA512 ff9942699ef1adb726ab60508767a1a75b43b55f688455a18ec7540eae854d7481c716393f1ec5781a8fe7e1f2230a11e3a5ed26a6fb78aacbb4ff26967889c5
SSDEEP 384:n0MiFiZcI63sNw8TUNTUlIm25mg5EnK2fMBOHLtuVnotv7O6R2FeoxgL/7IzKoG:03FQ63RwgSzQBOHLtRtv7TRVl
TLSH
T1F8C25B36EC94C9BBEDEB8F96A74A7A07DEF00163959C89C0DAD85D1D008759D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 52583373ecfc6ac5c0e06654f95c9dd476f3ed5c63f9f07b5fd92db538a9ebe1
MD5 0ad4e54bee9e8450704a064478e41d9f
SHA1 319732a486abecb4e8d76ceae79959d4f4b4260f
SHA512 fb7f0b0b5901985749676157863d521754d697afe2e98d0b92c16f0294a7dd96f475536ebea51c1e048013eb497920bcc8639f8e0336b29670aca44bcfb173dc
SSDEEP 384:n1MiFiZcIM3sNm8TUNTUlI4j5mgMnzK2fMBOHLtuVnpTtjtgOIwZOyLLXgL/7Izq:13FQM37wglFMBOHLtqtjXs8OV
TLSH
T17FC25B32E8A4C9BBECEB8E95B74A7603DEF04163D5CC9AC4D9D95D1C009B19D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 68d52312ed024edd9f38f3351ec5e94ed439525539547721f29824810b3ddd43
MD5 3526ff8448816fe4555012c8c4c49710
SHA1 084e267c11a462af2641776f8ae545a1ecf47f92
SHA512 f53e8b521465982981b83af19dbf7e3bcf78d38071dc551fb349851300fd98b80c2596121db955d7978bde180b2b4cdc492a0ada0c8a7c99302175dca194a039
SSDEEP 384:nziFiZcIIC3sNm8TUNTUlI4j5mgMnzK2fMBOHLtuVnpqtjtgOIwZOyLLXgL/7Izq:eFQH37wglFMBOHLtltjXs8OV
TLSH
T1F8C24B36E8A4C9BBECEB8E95B74A7A03DEF04163D5CC9AC4D9D95D1C009B19D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f12b1dc8-5d51-4855-a6a4-60a85b13b4e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f12b1dc8-5d51-4855-a6a4-60a85b13b4e3.tmp
Size 26KB
SHA256 e334617d882594a15bae4bda2eb40cc8cddd55577dcd662caff0f720e83994e7
MD5 04988de516fbf74f9824b0de6a6c7d10
SHA1 9480e7d7e4e3b7acbef2ebd6f171de5ecbf1f72c
SHA512 609c9e98336c062b0ac2c2373f268694b62e65cdf0a24642ae9a557b6615d2d89b4607ee215bf50cf60a35d92da5307757acedd9be9c1c91856aa9837bd22072
SSDEEP 384:nlMiFiZcIM3sNm8TUNTUlI4j5mg/nzK2fMBOHLtuVnpTtjtgOIwZOyLLXgL/7Izq:l3FQM37wglkMBOHLtqtjXs8OV
TLSH
T127C25B32E8A4C9BBECEB8E95B74A7603DEF04163D6CC9AC4D9D95D1D009B19D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1bd00e6a8a18c0af7ba614d4cb2e9f1e7c16cd8d5265a04289e602e27e433904
MD5 10b36e630df5d3d508b8fb700abac37d
SHA1 3f825c1b3006ecfbbe137b9f836b284b3b4389ab
SHA512 6c66a14aee10a4bb321b9fc5d4be1bc1fa9cc4a9fa9f086e5ce70e22eefe7c6fd682a09222af66a232e77c23cccfc71099a0279ef9853724cfd64a3d38672eb5
TLSH
T16D414458A6E91158B3B77E5AAFF6685D447F78772E47D45D00110E4F0613B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download