c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-8tmw3g.htm
Size 34KB
Sample260930-lh7rastthy
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{6D442441-0C05-4F0C-A66B-9382A57AEAA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3416	3928	msedge.exe	85
PID 3928 wrote to memory of 1776	3928	msedge.exe	86
PID 3928 wrote to memory of 4628	3928	msedge.exe	87
PID 3928 wrote to memory of 3120	3928	msedge.exe	88
PID 3928 wrote to memory of 1776	3928	msedge.exe	86
PID 3928 wrote to memory of 1776	3928	msedge.exe	86
PID 3928 wrote to memory of 3120	3928	msedge.exe	88
PID 3928 wrote to memory of 2752	3928	msedge.exe	89
PID 3928 wrote to memory of 2276	3928	msedge.exe	90
PID 3928 wrote to memory of 2752	3928	msedge.exe	89
PID 3928 wrote to memory of 2752	3928	msedge.exe	89
PID 3928 wrote to memory of 2276	3928	msedge.exe	90
PID 3928 wrote to memory of 2276	3928	msedge.exe	90
PID 3928 wrote to memory of 3948	3928	msedge.exe	92
PID 3928 wrote to memory of 3948	3928	msedge.exe	92
PID 3928 wrote to memory of 3948	3928	msedge.exe	92
PID 3928 wrote to memory of 1864	3928	msedge.exe	93
PID 3928 wrote to memory of 1864	3928	msedge.exe	93
PID 3928 wrote to memory of 1864	3928	msedge.exe	93
PID 3928 wrote to memory of 2332	3928	msedge.exe	98
PID 3928 wrote to memory of 1988	3928	msedge.exe	99
PID 3928 wrote to memory of 2332	3928	msedge.exe	98
PID 3928 wrote to memory of 1988	3928	msedge.exe	99
PID 3928 wrote to memory of 3308	3928	msedge.exe	101
PID 3928 wrote to memory of 4008	3928	msedge.exe	112
PID 3928 wrote to memory of 4600	3928	msedge.exe	113
PID 3928 wrote to memory of 536	3928	msedge.exe	114
PID 3928 wrote to memory of 1876	3928	msedge.exe	123
PID 3928 wrote to memory of 1876	3928	msedge.exe	123
PID 3928 wrote to memory of 4940	3928	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-8tmw3g.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe7bc5c188,0x7ffe7bc5c194,0x7ffe7bc5c1a0
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11118737921513796137,17578313269647387622,262144 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,5058177531088060613,3779239081634240372,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,8855876366126829186,18042034711228371878,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,4293820698185840063,13742118417685770434,2097152 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,14986986354017393161,11778831557523537900,2097152 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11405746318958879391,9840472731720088301,2097152 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11120954333045915248,17671594290629342511,2097152 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4745881386457737145,6894871060218654624,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15799979972259587792,12693073305151827900,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3452144849564514653,14865960016340638878,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3452144849564514653,14865960016340638878,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,865141008666411749,628690830347443419,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,5078343062406550995,6998791439722788109,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,3821124927814062270,14357075634207145046,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8733365676990259225,15280345175816405767,524288 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,11069058142409549461,12392489212342158716,262144 --field-trial-handle=2636,i,7604227236739589563,10886265450174962984,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

096de706-6f9a-4ce9-bd08-8a5b62c7b604.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\096de706-6f9a-4ce9-bd08-8a5b62c7b604.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7c44986a-1b3d-430e-8309-a28846553262.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c44986a-1b3d-430e-8309-a28846553262.tmp
Size 9KB
SHA256 a7a76a5b808bead2394b43caf77c88eee99071aca199f3079dec399a8a70f430
MD5 b0727ec9ee728ca38d9f0fbbfb249784
SHA1 ddf2e63f32b0f73dfc046b6c3d3ab25060fe02df
SHA512 03c9220bac42e85cea7b9efcaf8bd4177c046582a9e8a6f88bd1339ba343a01cc7e15d93b82c93316eb4bcef689fb027dffa0b1f262119ee00b88e35b28a058a
SSDEEP 192:sxZBRVWm/fdsBvfIdpdSHW6+WNGYaQ0+uIgrJ:sxZBim/fdsBvQwHbGdl9
TLSH
T17522B8116E78A57B8CCBD20DBA19BF43E6F9503261D51E4CAAFC862C04EA6CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5284e09cfce919a57b35eedf0690973afb76b374baebb254577662ea0bc270f6
MD5 39e92a51db8698b705c5feb4615b70c5
SHA1 b0e4d44ae150e0a98dc80fade788105f15cbec1b
SHA512 a8d22c4f586fb388ceb68539d425705e86fa3c8895426f8a8c74f152479e74886475241a4df97c24ffcfc15d1f99d00e7238d059d4eea27e84462db7d9791bbc
TLSH
T1B76151F16FA0A8E0F7F86B31AAD6048739F57581E5531D0FD064D4BD190A7B8181437E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ccc4718d282301b3e58e42ede381a644209ad32717659b81e3b39029389a4c5f
MD5 c17ca8908ef0c959636f494c389d41a3
SHA1 c9e578a56ca693fe69a4f54ddf381ce9bc69c887
SHA512 a44cc7e796219fbb93312b0d1e829111f1246cd0c9c133d6fc9736f72c18ebd1a95007c90ec76535ad6d7b8fc722c182b2f6e83631c4cfabeba82952be7034e0
TLSH
T14A117DF7C3D585AE891157F06A28AE2BCE1D0506421C7C19C5D4EF2B93E3075D00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b22495f6d09ac228bd19fd13030965e62d0ef56b75c14b74fc31a5537bc0b050
MD5 6eeb7740607435df9d4557fdf54bca3d
SHA1 ae94b7560baa276b97396647ff98c48357dec117
SHA512 53ca1691fe2dd24e7cbb09cd2ccdf1c423ce10d84a5391433f20ac9f83188af9a03ea89f632aebd799c638d044c40925159ddc565de98bd691c1d953a3ad1618
SSDEEP 192:sxZBRVWm/fdsFvfIdpHSHW6+WNGYa+/0+uIg5XJ:sxZBim/fdsFvQyHbGG8lb
TLSH
T10F22D8156E78697B8CCBD20DBB19BF53E6F9503251951E4CAAFC8A2C05E67CE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8fea4e9ed7d27fb543e3951dc127b3cdec288be0abb267e7ea60f27a58ef9c4c
MD5 349afcf39986aa05b7c56a79eff0fd2d
SHA1 6e6fbc3934361717367e78641d7b1dd0014d5080
SHA512 f7e0bf0cde8002ee45938e929aff06f291c1e993c11b01540a529ff59fbad5ff8d6f03b8c32a1d08d9a6ffa5fab84410799d500650a89baba3397d2a6b078c13
SSDEEP 192:sxZBRVWm/fdsFvfIdpdSHW6+WNGYaP0+uIg5XJ:sxZBim/fdsFvQwHbGUlb
TLSH
T1CA22C8556E78A97B8CCBD20DBB197F43E6F9503251951E4CA6FC8A2C05E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 80fc3f11a8898588bec940d6baab6a1e8877d53233020b54a92197cec57ef9d7
MD5 46534088fa4b424bf498e99a78c40fd8
SHA1 cf5523769c001ced397bdba6bfae9b4782421a77
SHA512 e6ac7448f756964a2fc0e8c97918d9b9a9662d3672d6550962024af05ced0a85afe3226c1037fba230b037fdcee4c6b64f4da126c46b87d65a102d63c97bf7a1
SSDEEP 192:sxZBRVWm/fds2vfIdpdSHW6+WNGYaQ0+uIg59J:sxZBim/fds2vQwHbGdl1
TLSH
T14922B8156E78A57B8CCBD21DBA19BF43D6F9503251D51E4CA6FC8A2C04E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7a3eb8dc2d34c84a71c296d753aebca2c4929ba0390dde479764e8a88bf184dd
MD5 268fc8d55fe81f925ac854a1685dc1c4
SHA1 3e1bbab6311b0c30b54df9aedf1b63b55d57a2a6
SHA512 a95c416b2f6d4d89756832f026d18778b4e0ed5e4453d6c7e520426c3581bf70edf50a2d08e8941da92b1b78e651ba9d5ae57044d0b51febadc71d2bb545ceb5
SSDEEP 768:/MyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3oroDZ9a:/MyQRbrWvvlpZu1jaXKLf33TDZ9a
TLSH
T1ADC2E92F640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 27b8a8ad156084b76d4e7538ce1257eacd9e4e38d2189e56d37bd85349d9994b
MD5 e7f0ab2d934a87afff7a3c911c0ce78d
SHA1 4e24297025eaff34d34747b28a2250a1ccf42932
SHA512 c6d3bb5ac15c685e34348e1e9de9b475e91703f57a7ea6a1e07b914910c4857f4392c055f60aaaf77b074a04d009d98bd0cc8ac5f422c73f4f421c8af12c40fc
SSDEEP 48:K03pYl5jn7UbHCfISRUK9R17Ux5EYCDZJyLAPGKQ6uvbG9mISivK9+1Evx4/YF2C:KU2wKrCee/yK8Y7haKiIqe
TLSH
T112912401717B129038BE294981A5975F524232B3725CFE3B7FBC54A25E6BE048CFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a33b4406-7a21-47ca-9f05-0951247d0f87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a33b4406-7a21-47ca-9f05-0951247d0f87.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5ccd531709d6b3333ac4c6d905340e84f6bc8f1aeafc052e03d72931688603d5
MD5 c08bb805b06ffb8d972baf2789564297
SHA1 8824d538a993d81c4ad1f11859d490ae27232e79
SHA512 5ff64163879a43f7af3b8d41f88140a96215fd91d21bcfd828ee1ae303f5a47da89dbec6f7eeac20636deac7039808ee89084730d40f76d7cb4e4b2d69f5162b
SSDEEP 384:2iFiZcIlzsND8TUNTUlIlbNYG+ep5u8irABZ+/tgOIwZOyq+oW:dFQdiwgjCskrA+/XsGh
TLSH
T156A25C3348E89C7BBCFB9A55F54B32039EB4406BD6D4AB84D6DD662D01EB0D80307D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 69bd2f4a01d61c5dc772f968bf077fd85bd9dcf84ece4fd9f1f51bc0defd64b4
MD5 9cff8c3c5821dc69925d66fdfad6c38e
SHA1 726916264eebef43a2701c5208ab649fa7cba878
SHA512 c8ff8f309bc46f26094390b4b0a438de9dc51f2d423ec2f8a379dc51a855391e774b68a8800229c75a8a7b318aaf2adc3201488ee88990c8b8a8ee435c856e7a
SSDEEP 384:eZcIhsN+UqNYG+ep5u8irABZ9/tgOIwZOyq+oW:ch1CskrA9/XsGh
TLSH
T137827C3258B85C7A6CEBD155B54B36035FB4806BE7C46B88D8ED672D02EA5D8030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 30398c5deb480be958ed108aa2bb94572c34ff7ac93fdebbc5950f3971c2340d
MD5 96354476ace68446037099b3d618b0d2
SHA1 cf18682ab1ba3ff3a63396460ebf677756f03720
SHA512 f04d53d73d34509c475f0436ed455bf70c9a1a1f4fa034a219f6c368fa67c9132e42303e8c3c5ca554fe0bf9830d9ab6bfa2825d3bfc46771411857045097fb7
SSDEEP 384:lZcIhsN+UbNYG+ep5u8irABZ9/tgOIwZOyq+oW:dhWCskrA9/XsGh
TLSH
T1E3827D3258B85C7B6CEBD155B54B36035FB4806BE7C46B88D8ED672D02EA5D8030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 541a97ee4da85b167df21e34f29963ac310fd9b4831c2621a6866288ed496d05
MD5 e914252e2a97843307ee50670af62cb9
SHA1 138e3bfb20d795b48dbf5639c308d2421dbaceaa
SHA512 064f257234d16fd48a07da1b7fefa554d0dc2dfc0a6f141ff16d8ab9259167395dff2e0f4ff1ead53437a8d69ebc00e8af28fc868f2d1a9f8a5ec489c212af7c
SSDEEP 192:SONz6iDCQmiUySTqHq5u88PwuhmwSqjYfHU6:SONz6/kHq5u8irA4SU6
TLSH
T1F402E7386C687C7B9DF3AD15B5873B279FA4113BE6941F84CAE81A2C01E769C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c070b44af704ece391550aa697141602565fccf841d79b8245eb58b1689562d
MD5 8c96184eed153307ff1157ac8dc850a6
SHA1 a8112dd281a3b767c05b0c9d9af2977b779066f6
SHA512 503f6e3c93623683adbd3c71d136b0190f3ff9f95fd4adb9d56c343f65579b9b0a36bc8aad9d7bd5639f24bbe8b871e9b3724a9982fd25a858b2a0592ff31c36
SSDEEP 192:SONM6iDCQmiUyS6qaq5u88PwuhmBUohYuZzqUU6:SONM6bdaq5u8irABZ//U6
TLSH
T1C3120A3568A86C7B6DE3A861B44736139EA4427BEB886F84D9DC272C01EF59C5307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5827ba03-7808-4168-9f1f-3dc2aa6b7243.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5827ba03-7808-4168-9f1f-3dc2aa6b7243.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 966da11e5912992f5baa2bb86c7cccc7adb8e9f20c4849d6f8abe279f962a9f0
MD5 ed52facfd30b04e19f3ddc9a8052f43e
SHA1 bf175bede8f2d4ee50dca18016bbeaf83d270b67
SHA512 6f0fb381427129bc0cd902669608bb033e71aca5d1edb186a34c7d540ba53e333e96795dcd3c5130f1c62f318e52e84a3823a9d525262bacc7456729deb583c3
TLSH
T16441DC99AAEE1148B3777F56ABB6A4AE547BBD732F06D05D00110D4E0663A41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download