5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-a5a2s5.htm
Size 1KB
Sample260930-hkmx5astft
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{C9EEE435-2A54-4F90-8CFA-329DD59D6D7E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1128	976	msedge.exe	86
PID 976 wrote to memory of 2764	976	msedge.exe	88
PID 976 wrote to memory of 1084	976	msedge.exe	89
PID 976 wrote to memory of 1084	976	msedge.exe	89
PID 976 wrote to memory of 1084	976	msedge.exe	89
PID 976 wrote to memory of 3740	976	msedge.exe	90
PID 976 wrote to memory of 3740	976	msedge.exe	90
PID 976 wrote to memory of 2564	976	msedge.exe	91
PID 976 wrote to memory of 2564	976	msedge.exe	91
PID 976 wrote to memory of 2564	976	msedge.exe	91
PID 976 wrote to memory of 4996	976	msedge.exe	92
PID 976 wrote to memory of 4996	976	msedge.exe	92
PID 976 wrote to memory of 4996	976	msedge.exe	92
PID 976 wrote to memory of 1456	976	msedge.exe	93
PID 976 wrote to memory of 4292	976	msedge.exe	94
PID 976 wrote to memory of 1456	976	msedge.exe	93
PID 976 wrote to memory of 1456	976	msedge.exe	93
PID 976 wrote to memory of 4292	976	msedge.exe	94
PID 976 wrote to memory of 4292	976	msedge.exe	94
PID 976 wrote to memory of 3560	976	msedge.exe	102
PID 976 wrote to memory of 4632	976	msedge.exe	103
PID 976 wrote to memory of 3560	976	msedge.exe	102
PID 976 wrote to memory of 4632	976	msedge.exe	103
PID 976 wrote to memory of 1628	976	msedge.exe	106
PID 976 wrote to memory of 4604	976	msedge.exe	112
PID 976 wrote to memory of 3292	976	msedge.exe	113
PID 976 wrote to memory of 2456	976	msedge.exe	114
PID 976 wrote to memory of 1344	976	msedge.exe	122
PID 976 wrote to memory of 1344	976	msedge.exe	122
PID 976 wrote to memory of 3136	976	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-a5a2s5.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffbbc6c188,0x7fffbbc6c194,0x7fffbbc6c1a0
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6587757623688575136,2802751251486765996,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3573149589928232217,1569897832127216518,262144 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,13129479378563540815,11257671721903386175,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13438494385118145994,18090036547615204520,2097152 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7949463162435570171,7869310358423042105,2097152 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7631022232608330717,16624266911857948970,2097152 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12412749458011162879,14572195227271638650,2097152 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1995892360659817519,10934408943071612545,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2387356899663496732,16279960092390394419,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5604873490401661243,6179955192586648343,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5604873490401661243,6179955192586648343,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,5940110509475503936,458327654212283157,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,18223526999681062886,1385301229997093229,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,4884995760477509645,4428054792692234598,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,3696077935117975516,12136950083881781132,524288 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4364,i,8068308010650430564,12351729203621218167,262144 --field-trial-handle=2260,i,7001687530050856950,4328966830028982707,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f7428177c4e9af5e6a106d341017853db4ae397ff907c9974067462e4d394ea6
MD5 28d0fe94dc6ee24ef83d47acbe98262f
SHA1 d80cda65e645b13e6368815caed8e7760a603be8
SHA512 823f9f514b4462ef2deb31d5764431382e936abd4b7630b31ae5ac61ce9955571c26fc17b5f24ebe4373cc3b761a34746fe84cc3f801f08ffe7740e1ed9828b3
TLSH
T1B0514D8646A2FEC0F7A9073160D712A33730884D80B32E4A11A8CCB9BA0FF56B134C74
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b1b5e59b85eabfc9c3ce1cbde0a7f4f96319633d03874dae89649e1347ea3d06
MD5 26cbae59b29c9b7bb3761947fa88773e
SHA1 c82f27fa7b5d3bcacb135bc5658d2c89fe732cc2
SHA512 3ba963c3cc0a35688e6f27ea39bf2d8528f70bc3a34bc9b87236f187951380a41e68b0dd993191c3aa74153a528d4a0bf3f84d2f450dd099ea6e15e8dda8d3f2
TLSH
T155117DB3C7D589AE890116F05A24AE1BCE1D0506821C7D19C9D4EF2793E3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e2dae831013f602b41ab6317c49255ba801f7674cfb8a81fb2ab3e70e4eb2388
MD5 39e54fb3a5d298d85c893d6079efbd7c
SHA1 672ba383dd6e4b00819adfc44f1e0af87ead7c1c
SHA512 2bd22d4bc0db3d208c9e2a81360753a067daa7db44610d9de77e17f39110b4a953b17f229e63aa6e6c45dfc1e7546eaefab2398b069d8aaa76006bd6dac8e06c
SSDEEP 192:sxZaRYWG/fPsn9IdpdQHW6+WNGYYBaYfIgrJ:sxZaFG/fPsn+SHbGf39
TLSH
T18B22A7156E38A97B8CC7E20DBB15BF53E6F9503291941E98AAFC861C04E76DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c6eac1d25547cdbb2af9a7314e316984ef0bc073af29a9dd2d25b6905493ffa4
MD5 987ddd1db961edabb162803f8331c062
SHA1 f8522ce2255e42e5000d652fa37fa32fd5336174
SHA512 c06ad45782f609392dd32f64bddc2c027926ee1be077bc42da9afc91f6f57811d10327f1bb2490202f4c60b889b3030e86834e266fa3449e2ec667d88368d857
SSDEEP 192:sxZaRYWG/fPs59IdpHQHW6+WNGYYBfCYfIg5xJ:sxZaFG/fPs5+wHbGf3x
TLSH
T14B22B925AE38697B8CC7E21DBB55BF53E6F9503291941E88A6FCC61C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e2a7c9ca4e557537b50cfc9ca578b373ee7ef09039230e5fc381387fd8d91757
MD5 7e6a31b384880a2ac8bc04a9f463d1fb
SHA1 9ab6b3d7a9884af0548553abc31656653c38bf71
SHA512 4fabec31d85c201d7d5edf6808c6516020e404759259c5d28ff2bc5cab5ef5988b77741cb7b39f21a1f80eae5eea817cd82bd84f70db50f6e862fdd19dc51252
SSDEEP 192:sxZaRYWG/fPs59IdpdQHW6+WNGYYBuYfIg5xJ:sxZaFG/fPs5+SHbGfrx
TLSH
T13C22B9656E38697B8CC7E20DBB55BF53E6F9503291941E88A6FCC61C05E76CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1b2bb4b84e7a7090195f7c9eefd5024851c80d873ef8dd08daaca0c24e9bf555
MD5 e55e6324905e9f3a0b5b90d000ad31a1
SHA1 445c4f76435eeba0bcbf45ffe7eaf85dd2b166cb
SHA512 599c3c5374d2b66918f9021bc6e350c654ec1069ae61320cbb26c59e4251bdbe9b0ddab85027daa5545f7754867884b9c5724731d4f5c867fbf75b4ea1a57d83
SSDEEP 192:sxZaRYWG/fPsu9IdpdQHW6+WNGYYBaYfIg5jJ:sxZaFG/fPsu+SHbGf3v
TLSH
T1DA22B8156E38B97B8CC7E21DBB55BF53E6F9503291941E88A6FC861C04E76CD121B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cdc0e8bd42a636217f6ff90c570b2d67d7a7248df0c3dc016922612a909c9cea
MD5 d33364abf2eb8cb68d0a7b8d192c7342
SHA1 a23a369a930633fe772b42fad3b6c19c3d40f5ac
SHA512 f1cbdb7efe917d9e940a419b2c56db0dda1b3bcd679f1f111134c0bcafc164528eb9c185ddebe811b8f405ef2a785dc06d8d081b2001c018e17ad9e82ac3b14b
SSDEEP 768:n0yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXoropOklG:n0yYR7jWv3NpBu1ja/CL8OXTnY
TLSH
T1C4C2E93B640DCB7E4FC01E9DDC5AAF9B3E9802C7A6548D4047FA944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 09053903068e54aa6df0602cf4cf2e20ebf3dcb7310c19886a8d1ea921671231
MD5 e92bd6e9dede85397638fbac14e0ccb4
SHA1 062f8f6c2c4bcaab0a1378bdea751f9dd733e5cc
SHA512 1218e90b865dba17490c929b11eff401d3c7a66461bb87459957fd164e27f6252f97ca3a17edee3b64f5d925dd843071153a986b2a50b14400728d56660c3114
SSDEEP 48:KgLuvL1ttOb9wVISrOK9715OxjeY4JbPyLgvmqwaOPbmdGISCPK9e1kPxYfYlWmC:KIogKV2qOPyKQEfKsKry6/
TLSH
T1B591E151317B030039BE3948E1E68B5E465131A7745CED7ABFBA04B54E2BE088DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c326052-c36e-49b1-a479-8de2e4e2e57d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2c326052-c36e-49b1-a479-8de2e4e2e57d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599cd3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3b32651ec192fb14866c93587c941f77f1d1e01b1532f779731446a91fc82816
MD5 1d166de9939920e3c9f75216a2fdf719
SHA1 81762741fbef91f4fec11901d48452bd1fcdf8f7
SHA512 bec66adc6f3aac3f9ef4c5c970b861e2c2eca158baa059e40247af9dfd654da9ba56eecfee6c58d351a3598f1c87143475b82143afff3faf34eb0433a8b80179
SSDEEP 384:aiFiZcIizsN+8TUNTUlIlXziHHKQX5+DtXO7y8PHNGtgOIwZOyKo+oK:RFQqTwgdwZkDdO7dPHNGXsa+h
TLSH
T15CA25D339CA8D97BAEFB9685F58A32039FB41077D584AAD0E6DC5A1C019B5EC130FC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 463f973d228e56a9386ab3260387a723cc5643503c1c64228cee29d3886bcc74
MD5 cd369f2c4f8e18274a398c341c12f6fe
SHA1 fe22075140fa3a43aafa7ee1a115ff1a02e215e5
SHA512 9dd4a14dafcdd0c882d804037d1eca27bf51e779a0eb7d560f58b5f02917fb3e4286e65864708ad78a696ad23b653ce7f3e32f91b33cd2282a5ff2d27972aeac
SSDEEP 384:WZcIhsNuKziHHKQX5+DtXO7y8tHNGtgOIwZOyKo+oK:EhswZkDdO7dtHNGXsa+h
TLSH
T160827E319CB89D775DFB9185B58676039FB85037E6C8ABC0D4ED6B1C01EAAA8130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b8ab33f22bd2bb92902ad4ffede2a48e382ce77e00bcd075452f13754226df36
MD5 ed38888b9fa0ed5b9629fba258c7a4b8
SHA1 53da854e2e0ac5a846dc154e4c6c11a216a58c04
SHA512 1445411e87afbb3d5d9358aa54ff0b0662ae6590cb4a11e73459c7f2befd0d4fcbb3cfee7ab7a3fb12d0d22a1266f66e7138306d1fdf239e9b33e3368c398474
SSDEEP 384:/ZcIhsNuXziHHKQX5+DtXO7y8tHNGtgOIwZOyKo+oK:XhhwZkDdO7dtHNGXsa+h
TLSH
T1ED827E319CB89D775DFB9185B58676039FB85037E6C8ABC0D4ED6B1C01EAAA8130FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f31280cfdad629fad8e991eadedc94c300d53d89002238919059af8499e918ed
MD5 67cbb39286622f9b24014565c725df35
SHA1 e021b06557efc7e17d5f8c7b526edbb8f228041f
SHA512 3f4b7a3c17721b6ee783357f5892309cdbb092e2774b3470eb8911484192c36900cc6f69ddc8f3df1135a6d366ab0ec512ecfcb02712d73540cf520cb7d0ccec
SSDEEP 192:EONn6nnHwQmiUyi5WYcX5hQDP1XO7uFfECg3H+rq5GU6:EONn6nQNWNX5+DtXO7y89HNGU6
TLSH
T1BC120B31ACA4EC775EE2A595B08631539FA51127E5887FC0D5DC2E1C01EFAAC230EC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe900a5528c9a9ab9f55daad938ebce3416ac31cb1c0f71466e7f28356eed019
MD5 6041244b0ee22d6aa2e6e294596bd9d5
SHA1 1d9088e53665bb62b17449e8aa8036b0485f087a
SHA512 0ea51d854adce8ea0c4b9b3d102fb7375a66feb095eee44712528a0569a2d5da6e81742b506878475c415ebbcfd91dc8b9c9cb188cbe0eb8077a692da8db124d
SSDEEP 192:EONK6nnHGQmiUyf5QYcX5hQDP1XOEMcHDyHU6:EONK6nCaQNX5+DtXOgHmHU6
TLSH
T17502EB34ACA87C778EF7AD45B4873713AFA5217BE5846BC0D5E85E1C01D7A9C231AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cff0ea4-d308-4e4b-a570-7aaff0661ba1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1cff0ea4-d308-4e4b-a570-7aaff0661ba1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e48fafdaffee64dbb4e191fa15794d86592cb19e39f77fc50b05d1a7b98f52b0
MD5 8d73ff7500f7da48bedf65c55f89b942
SHA1 ebcd13f5a4337fed53d57220f28748795ad891eb
SHA512 38eb1c73c307bef894a288117e99b4fe9375e57fe3c9ec9d4be33310ab523ef24ebfc52de0e535935b79ebbccae2dd1ccc3acfe2e2a3fd6648113e32702069a1
TLSH
T1C6412958A6FA1108B3777E56ABF6A96E487FB8372E4AE45E10110E4F4622B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download