5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-miwts1.htm
Size 194B
Sample260930-nsw4navale
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3264	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{5763ACB5-974D-4D6D-9751-F495D044C49D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 928	5092	msedge.exe	86
PID 5092 wrote to memory of 3264	5092	msedge.exe	87
PID 5092 wrote to memory of 4564	5092	msedge.exe	88
PID 5092 wrote to memory of 4564	5092	msedge.exe	88
PID 5092 wrote to memory of 4564	5092	msedge.exe	88
PID 5092 wrote to memory of 2264	5092	msedge.exe	89
PID 5092 wrote to memory of 2264	5092	msedge.exe	89
PID 5092 wrote to memory of 2168	5092	msedge.exe	91
PID 5092 wrote to memory of 2168	5092	msedge.exe	91
PID 5092 wrote to memory of 2168	5092	msedge.exe	91
PID 5092 wrote to memory of 5044	5092	msedge.exe	92
PID 5092 wrote to memory of 5044	5092	msedge.exe	92
PID 5092 wrote to memory of 5044	5092	msedge.exe	92
PID 5092 wrote to memory of 2700	5092	msedge.exe	93
PID 5092 wrote to memory of 2700	5092	msedge.exe	93
PID 5092 wrote to memory of 2700	5092	msedge.exe	93
PID 5092 wrote to memory of 4644	5092	msedge.exe	94
PID 5092 wrote to memory of 4644	5092	msedge.exe	94
PID 5092 wrote to memory of 4644	5092	msedge.exe	94
PID 5092 wrote to memory of 4520	5092	msedge.exe	100
PID 5092 wrote to memory of 4520	5092	msedge.exe	100
PID 5092 wrote to memory of 852	5092	msedge.exe	101
PID 5092 wrote to memory of 852	5092	msedge.exe	101
PID 5092 wrote to memory of 4344	5092	msedge.exe	103
PID 5092 wrote to memory of 2980	5092	msedge.exe	113
PID 5092 wrote to memory of 1588	5092	msedge.exe	114
PID 5092 wrote to memory of 3048	5092	msedge.exe	115
PID 5092 wrote to memory of 3808	5092	msedge.exe	123
PID 5092 wrote to memory of 3808	5092	msedge.exe	123
PID 5092 wrote to memory of 2080	5092	msedge.exe	126
PID 5092 wrote to memory of 2080	5092	msedge.exe	126
PID 5092 wrote to memory of 4680	5092	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-miwts1.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fffbac9c188,0x7fffbac9c194,0x7fffbac9c1a0
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,1984245414641860117,4515389497257720965,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3539909920039365543,12972901622792302988,262144 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,10508087918476438946,3858061818878778637,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17194254103205418090,12560256306780150276,2097152 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16176044791058364094,15517188108235272493,2097152 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4358286520575020897,998091750357204347,2097152 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12359290840207402682,14393925803165935297,2097152 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5825870430534946297,1617690653999180331,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5273279073488518516,1599633792935017705,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9175739880839196337,16738368399794435007,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9175739880839196337,16738368399794435007,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,13973584985886417023,7369398147354763353,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3396359308149406258,15898619734049278413,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,4630991118176860429,15710775969041958267,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3978023237011267445,14908310978974239440,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,18356216708754274903,2073563812285033537,524288 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,7323919697019670717,13216717815364296809,262144 --field-trial-handle=2196,i,12343702726565721662,1948527681388100641,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 095459a92dc46e41cf39d80f85f4151ef97fefd24f4f1883eb3284ff5c47f227
MD5 5ee7cadb9f022ee2b4be1621a96d9c46
SHA1 580f3dca2dc965f9cf362b42f04672c554f67ba9
SHA512 a27e56258e31553e2d2d467096ddbc1d8a0a20d29b6d2b935b829a2105dc424de56248ecb91d4ec3599a2f7aab09f2330aa2a247735a78ef6d6a608a1af4dc66
TLSH
T1C9512DE1D5845AA3FF989A3382F60BB7363655A2A6CF5F5E61ACF4B9480F724500318C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592ab0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592ab0.TMP
Size 3KB
SHA256 ea0597f6d17eb78d0846aeca25c0c9fd89acd7a9c624ef0f54e00133990f83ee
MD5 dcb0baa7f9c4b8559802f70e0c76ebb1
SHA1 a93a6bd51b686fb759cc21fbe6d7c481bf879342
SHA512 a7bd4b8c8deb6e582b33ab537ce746109a73d72b71a8e60320fab8b046e8ccba37169e93e011a5582a23eae14ca3898ef3b19a421297ea42caf095baeab23945
TLSH
T196513EE2D5C45AA3FF985A3382F607B7363695A2A6CF5F5E20ACF4B9480F724500318C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 52cc93489b9f48225d05e0ad9b73490d73b01042f19e6c3db53d29b5ce961512
MD5 e4f216d514663998cd0b3517f169c845
SHA1 ea12b9722c5d4be8e7186e60da859d1bca0c2c54
SHA512 1ee48fc0ceb3f7a4418b35c0ad10d161d755952d64154305a17104add0365fe10e3b2e90aa7736ac4063f523086c51a08b8466836a1a498ddafc5d49892fb13f
TLSH
T1AF117DF3C3D585AE890116F06A24AE2BCE1D0506421C7D1985D4FF2BD3E3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 faf4bb586ef49127080b8c286be12064546cd64f033c4bdcb7656e83ad5900dd
MD5 5a0cd372e02cb4d0359f6584b6c35008
SHA1 596da6e63835302c3e961b110fdf9e5013b384d3
SHA512 47021d563af1583adb3c969e087baef50e094598e64fbaa6e6b25da382d7955e17a47a6ab047c5f78559e4b32d594bb59bffd517caa9b9306bfffa679baf96c0
SSDEEP 192:sxZgRvWh/fysWuvxdIdpdlHW6+WNGYapYaFIgrJ:sxZgwh/fysvADHbGj9
TLSH
T18622B7526E78B57B8CCBD20DBA65BF13E6F9103291D11E48AAFC961C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bf23fa89228ccee61822c61f4498826329ba5801cb881c250b45c6889ee19c0
MD5 4d7d738d0908063ade2519451169fa3d
SHA1 b589899a127414caedbd49bef246e887925e5721
SHA512 5501801799efcd3a82083696ce89482eeb794d6adf6facd6178469e86953edee1a4168095b1d95ecabb0e7677f6f4858f087a01422eae2532eed9bbbcfeb5f8b
SSDEEP 192:sxZgRvWh/fysMurxdIdpHlHW6+WNGYapFaFIg56J:sxZgwh/fyslAFHbGW0
TLSH
T18922C7526E78797B8CCBE20DBA55BF13E6F9503290D11E48A6FC961C05E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f85c8c33465bed8f3ba828b5be0908769d02d990a7c4b2b574ea5a3b51fe65b3
MD5 e2a470257f2616d2ce0c769b76911354
SHA1 7d75033ccc76840e87809d9afeff758b7ef770fd
SHA512 2b754971ea6f4b25c4b4984f951df0b549dc94a007368bfcb16ead0a7ada58e0c021b414c57227d60b29021109e95eebb96e4a6c0559e2828c15ea2c8e0e9018
SSDEEP 192:sxZgRvWh/fysMurxdIdpdlHW6+WNGYapCaFIg56J:sxZgwh/fyslADHbGR0
TLSH
T16722B7526E68B97B8CCBE20DBB55BF13E6F9503290D11E48A6FC961C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a4a17a336c10dd53d3db31a4910509fc7c77bd4ceb3b83bd03f892f458ba5688
MD5 253dbad75da42db2d414854ab7cb35bf
SHA1 4797bedc7e5b443840afa92034c9ccdb56281934
SHA512 89169a30ef676a27e5af218185affa48101fd26b0bef670fb274d2f0544a5c3defe3e1a73ea596c3554b97e1e424845e403d47e886956a91504915c0e6a3eb34
SSDEEP 192:sxZgRvWh/fysMuvxdIdpdlHW6+WNGYapYaFIg5YJ:sxZgwh/fysNADHbGj2
TLSH
T11E22B6526E78B97B8CCBD20EBA55BF13D6F9103291D11E48A6FC961C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f4c6d12da4fdcc9869789ed496705e89ef7b3deb79541e96edef8221c82a1633
MD5 d5a0678b3f3ce08c6726d48eb9ffcba3
SHA1 45b48f4da2cac43339536bdb35edb9ceabe3d548
SHA512 3ab0998466518d93aca7eef717941c2a89a929a82d910529e12765fa03f0e8c12777100d57ad22e5b78bf424d39ecc6284a5c148fd0ddf12d52c776355e389d6
SSDEEP 768:13WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7qro4lfeBmR3:13WPcLKWvKeEeu1jaClLiF7B4lWBmR3
TLSH
T18AC2EA3B644CCB7E4FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4183d1ec4e2271719f02a384d639b60a0aa7c91aacdcb3a3b5c089bd6d9de108
MD5 acb09957fe635d428611312f155388fa
SHA1 978ddb210d34d18c71231ac4fdb6f778fa81c609
SHA512 65297e31bd7ee3c04487155be2d76960153a04744156f9b3815497247484a5e386d367cf47e95fb33cbca4963855bee8828c041dceccad6a384ce0ec689cc5ee
SSDEEP 48:K0Gh8g+kkdbofQIS4dK9c1edx2NY3IkmyLUjiu8+SbbiRqISGbK9i1wbxULY5anO:KI9KK+wKODKKgIX3SKYsGy
TLSH
T12E91F315347B131038FD255C96649AAE424331A73229EB7B7BBC24B68F2BE190CFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c673.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c673.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e157f6cdfd0db29c68dc9a970cb4e26d090045a0cb2bc955a459a1f5407e01e7
MD5 f85a4f48e1efdca24392c088bd25b6a0
SHA1 14e9db5a700c900751ff78368fd21f0c4436350a
SHA512 f6592d6ae755a40403a73aa123153a62052532b73d82017843f7e6752822d64295f1fce27da6d57d6c20d12c009620e42a58d442a28d48711246a3566cc25c38
SSDEEP 384:Q+iFiZcICzsN28TUNTUlIlxcYup14yAzIGmAl89IXhrWiMtgOIwZOyTeoz:QVFQKXwgYZpzy7CohrWiMXsvs
TLSH
T129A26C738DA8ED7BADF79A44F54A3213DEB44067C6C5AB64E6DC6B1C009B1A8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3615913536224cd25d5c357df6dec0ff2cd5012db0dd4fd9bdd5dfc615f177de
MD5 615379eca5edffdf403a91eeb6b6f888
SHA1 d5d6dd19486c56f87a2bc7106fabde28171dcd7e
SHA512 e740a0165b39529ecdf4f9aacb5703eb6fa6447a3dc01da633f4e6e389195016840e6cd9fa100d7def627c174da6fe0ba2f636b0a7a71ee885f7e1a19b7b7374
SSDEEP 192:aONQ6IE7QmiUyWMTPuIGmApjzor2Ro0nC7sSsqU6:aONQ6DtKPuIGmAl8HsEU6
TLSH
T11102EA75ACB8BC6B9FF3AD09B4873A239EA5113BD6951F44DAE81B1C00D725C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfcf3c5187c35ef4e45837e4d07880d6149a454505d580153a7e611ee866881a
MD5 ecd5d43ae174113808809984627d20ae
SHA1 0e884ee1e0de90c3343fc1340d246b614c24677b
SHA512 98ada7b95e10fdf7023b4b5771f6a98dfb5b60f2b682bdd369230c6ec7f642e93788f74273994056bd3f6028db386fe62dbb1e132ee9614dfa4d86cbcc90b752
SSDEEP 192:aON/6IE4QmiUy8MTguIGmApjzor2Ro0eIXXRz27HS/rqYU6:aON/6DYeguIGmAl89IXhAHMU6
TLSH
T149120972ACB8BC6B5EE3A944F4473A239DA54227D7C56F50D6DC2B1C00EF26C530A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1b60baaeda9834539ef8d03c13261e86f4e7dc02246fe3f1ce3d4754b80fae34
MD5 91e5045bcbf6d3d2175c1e5c15aad260
SHA1 668ea78427250a394436986120dedc9347f84259
SHA512 de2a0d8665d2ab478281f71f857f6895963fb7de66bea2d2ef7fea128cafc0cc386ee6a5fdd7e1fd3a64e2ec1ff685b4f4026dad1345c373feffed0bb7fa9747
SSDEEP 384:0ZcIhsN2xcYup14yAzIGmAl89IXh3iMtgOIwZOyTeoz:yhQZpzy7Coh3iMXsvs
TLSH
T13F827C7298B8AD7B6DF7A548F44637139EB8802BD6C55F54D5EC6B1C00DA2A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b1f265730c657cff871c1a3cde3786bc72a29d36b6259bb0ae30434b4c55df0e
MD5 75a48067d6c27b9fa1b88a2a06445a4f
SHA1 e5054c8eb443de8caefe02b768ae62caf6b330ce
SHA512 47b654021ed974dec9dd18bc8b6e03cea4bca3801a953559d066ebdb0ecbc895ba03f2fbd28a6dfe9cde84030e7306b4ab2a3c60e266c7aa0d9a0c1deb37b9f0
SSDEEP 384:4ZcIhsN24cYup14yAzIGmAl89IXh3iMtgOIwZOyTeoz:GhjZpzy7Coh3iMXsvs
TLSH
T151827C7298B8AC7B6DF7A548F44636139EB88027D6C56F94D5EC6B1C00DA2A8030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52996458-e549-47d7-b53f-a32128388670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\52996458-e549-47d7-b53f-a32128388670.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6070591880c4f360b16d21cce37537250394278589cb2cef99ff2a2dceb3fed6
MD5 521927d96237d2075a6a06cd5b99a795
SHA1 63db2a8c696c7bc6805a4b31296ceb487f68534f
SHA512 6d77162cfad71da713b8319d0db97bec63c3238b9deb25920ec559c41e3257bd609fd3cf7217b5d30f7236628cd3f0753b30f081159f3c9c97d4ead927b9e19c
TLSH
T1A8411858B6F91158B3777F5A9BF6A46D983AB9372E06945E00120E4F0A26E04CC71737
MD5 SHA1 SHA512 TLSH

Submit Download