3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-lgq9oy.html
Size 171B
Sample260930-pmta9afc39
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{8010E1FE-9DC8-43AA-9F7E-F3CF9989BDA4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	msedge.exe
872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1000	4796	msedge.exe	86
PID 4796 wrote to memory of 3772	4796	msedge.exe	87
PID 4796 wrote to memory of 3900	4796	msedge.exe	88
PID 4796 wrote to memory of 3900	4796	msedge.exe	88
PID 4796 wrote to memory of 3900	4796	msedge.exe	88
PID 4796 wrote to memory of 4256	4796	msedge.exe	89
PID 4796 wrote to memory of 4256	4796	msedge.exe	89
PID 4796 wrote to memory of 5084	4796	msedge.exe	90
PID 4796 wrote to memory of 5084	4796	msedge.exe	90
PID 4796 wrote to memory of 5084	4796	msedge.exe	90
PID 4796 wrote to memory of 4964	4796	msedge.exe	91
PID 4796 wrote to memory of 4964	4796	msedge.exe	91
PID 4796 wrote to memory of 4964	4796	msedge.exe	91
PID 4796 wrote to memory of 3364	4796	msedge.exe	93
PID 4796 wrote to memory of 3364	4796	msedge.exe	93
PID 4796 wrote to memory of 3364	4796	msedge.exe	93
PID 4796 wrote to memory of 4152	4796	msedge.exe	94
PID 4796 wrote to memory of 4152	4796	msedge.exe	94
PID 4796 wrote to memory of 4152	4796	msedge.exe	94
PID 4796 wrote to memory of 2804	4796	msedge.exe	98
PID 4796 wrote to memory of 2804	4796	msedge.exe	98
PID 4796 wrote to memory of 2572	4796	msedge.exe	99
PID 4796 wrote to memory of 2572	4796	msedge.exe	99
PID 4796 wrote to memory of 2536	4796	msedge.exe	101
PID 4796 wrote to memory of 2040	4796	msedge.exe	112
PID 4796 wrote to memory of 4612	4796	msedge.exe	113
PID 4796 wrote to memory of 4780	4796	msedge.exe	114
PID 4796 wrote to memory of 3180	4796	msedge.exe	123
PID 4796 wrote to memory of 3180	4796	msedge.exe	123
PID 4796 wrote to memory of 872	4796	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-lgq9oy.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff50a6c188,0x7fff50a6c194,0x7fff50a6c1a0
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,12910972300829353088,6168697217378276554,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11556557864518801869,15213057843003520792,262144 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,14366922044019777115,7434155108579315037,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,2895961445411897120,2179365559704312205,2097152 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,15858327852053482439,5918420429249546182,2097152 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,2530578320779332135,6663590392371116549,2097152 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6351201424675550375,1380673819206283021,2097152 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5999182135917955061,8306848161524862374,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10024768538756082636,5297131203555226394,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,15441128167089741047,17365129940310928815,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,15441128167089741047,17365129940310928815,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,3017608740122028174,17571439484481457881,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,3341813272059892807,9753726995769369189,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10070935503319122811,7455102463800583323,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,2847193413873075986,6735741112021475419,524288 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4820,i,13226783663097035376,16382987870799521335,262144 --field-trial-handle=2200,i,18168488801981734512,6725313355746734674,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d1e7e4a6edbab408723d40054be16283dd7e00157bd6d21ca67ea4bed4728715
MD5 40f0180ecc3a59951e71649062b662da
SHA1 a281bd4cee4a045a6864b54771d6fc74240b1c13
SHA512 5b0b841141a62ee4e004b85885ea3018ac02021d625844bc873f28a992d90c553576d64eab7cc8a2dc39cdcf75d7c88cb4a8d31dd9812aac962057851fe571a4
TLSH
T16E518384954DCBC0F3EA4CB149D9078BFF32318447A7BEA632A8DBB95456764C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591004.TMP
Size 2KB
SHA256 3c0e1db7b8adbd090d6f1c4a1bfe94d66ab46c318b3131c580def82ecccfd7bd
MD5 364fb2ada9f3243bf442a23fa3db8bbf
SHA1 b4abc196f19581ba23c17cb008af0d35db0fe243
SHA512 e6f74542378b08ce68445fa35aad77587316507f95fa042095b90b37b0f999594973992169c5e94b7eca3ea84e659109df438c993ca93bcec356a442372278ea
TLSH
T137516585554DCBC0F3E64CB145D9478BFF32358447A77EA632A8DB795456754C2300D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b32bacdaf2586ccb843d085b22e3a95a003d6d0698f9532d2f3a8e401011ad62
MD5 692dea03424c2b7f40da41f72f42acb8
SHA1 dd9e69b932e567a31bb8342a2a52572d97a5a66d
SHA512 ff778b8627bc5259c584a7664ad42d56c96af059ff12029a33083f27306af9edf2db0dcd101f75febdff670d2e990a9fdb88ab54151d548bbca716de385065fd
TLSH
T14B117AB3C3E585AE891516F05A28EE2BDE2D0A06825C7C19C9D4EF2BD3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f6f6512e5a8e321f91eeb09db03ef91173707eebd1111a2c63c77b56b713812a
MD5 586b28a1628dcafaae5029a2c3252c92
SHA1 2887852983131cde8c707e111c61b5e52845f357
SHA512 d2696ee9fa2c3436035bb9518380a0e3e6291c52ab59c360455b4b46ba6dde798fd84c82644730109eb8fc98df5becc110b6eb38ee679f213e2e3d9db8d36523
SSDEEP 192:sxZYRdWJ/fOsIh8IdpdoHW6+WNGYYBa31jIgrJ:sxZYyJ/fOssleHbGfIb9
TLSH
T14112B6526E28A57B8CCBE209BB25BF13E5F9503251D51E48AAFCC61C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 80d7753d3ed3c0f430eab3eeb54813e041bb84996da48a9a833db24c62d99753
MD5 4e7febfe251074e34d0cfaed89f12862
SHA1 eea0aec963333b38da57e4593209122254a66a60
SHA512 85aa1d9644a40105999cbd57bfa8b49d2d91be7c5732a0b8a7120dc7df013fd428b001598e6fc73853eb8e41a6f9e0913e18c0676c58ae75a4ff9fb28b9784f4
SSDEEP 192:sxZYRdWJ/fOspk8IdpHoHW6+WNGYYB331jIg5IJ:sxZYyJ/fOsWlIHbGf1bW
TLSH
T18422B6526E28A97B8CC7E21DBB55BF53E6F9503291D11E48A6FCC61C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 009a046b8c2456ae3898081002a0eebf8381431d766b985d012a8dbe784d30ab
MD5 807c5e2fdbf832faa6b6927627b8402a
SHA1 889629fc8ef7dd76dc94631453d794301da131eb
SHA512 311947265e03d2b353e3ceaf15388f70d425e2c18af6b8d2d2a316d107b60e7ddab16ae6ae63fc63f8bb2177c256d9a49ce1de2b096992cbd6df284f331e0042
SSDEEP 192:sxZYRdWJ/fOspk8IdpdoHW6+WNGYYB631jIg5IJ:sxZYyJ/fOsWleHbGfobW
TLSH
T1A322B7516E28A97B8CCBE21DBB55BF53E6F9503251D11E48A6FCC61C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 03e16bc0fa6fe233fee5135c1e6e2eea518246d7180997d99f3d8cc44efa5f26
MD5 5ca6813c7cf44bcb6de96ff604345ca9
SHA1 681c189036ae97311170670146e4fa317a9d8018
SHA512 f3cbdab60ad85f4ebe0ae409ad4ac115a011d30d12919ae3f0f32b1b130664f5db15ca6543205a2e9be96451ba8900403c1fe2d0dfb2f61c14be7633950cf91b
SSDEEP 192:sxZYRdWJ/fOsph8IdpdoHW6+WNGYYBa31jIg5iJ:sxZYyJ/fOsnleHbGfIbc
TLSH
T12422B6526E28A57B8CCBE21DBB55BF53E5F9503251D11E48A6FCC61C04E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fc4376ddc7a39f7bfaa427beb58e3f07c682c6ab502db63be4942b66f0cb7e4c
MD5 c773ab7a0226a5b818d7467b6fecaae6
SHA1 5fdfc410090819a464d63a7d2f6a89e37a0c005e
SHA512 d1ab68e6b47cd7805067451c6e1d7a705388f6a9cbe9ea9a7f5935b87094ef2c2b7d04dca8e324e48292b8d8aa02b3df20a08f9090adf034add25df23daa2bd6
SSDEEP 768:k9yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX3ropTwP:k9yYR7jWv3NpBu1ja/CL8OXkg
TLSH
T149C2E93B640DCB7E4FC01E9DDC5A6F9B2E9802C7A6548D4047FA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 05ccb0012462e8d793b8f5220eb1775ab182ab1ed26173b30d60ee8c3da5b672
MD5 0c50d933db46908dd5013a4906702195
SHA1 c88e46131069f43f7f1131ed588c762adf96e29b
SHA512 02407d476e3ddbe634ab7ac47901b7948a3152ad3a967e75af2a774fabefa45651293daeb5f2c7b2796f98895723797bb6f6ce60cef582ed13f3b0b7969e02a5
SSDEEP 96:KhrANJD1l1GBqIEh1KMEET1IeyMKHqeO/KKYUfOsKnR:GrANJD1lkBqFhHEETSDDxPR
TLSH
T11CA12640317B460838BE298981B6C71E514132B3701DEABBFF7D40668AAEE445DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aa7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aa7f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 244d939cdc4945425045eca10ab54a3ff5f2f9bc330a1cea93680356fdb2d1fc
MD5 be988741e96774b1b0db7ce0f020b136
SHA1 c7b6b9b9db447def3c100b12e534e5f44f907305
SHA512 f6b20e68c7327486c280384b231561504ebce0e63bee69e8d2392b3e10c3f169ee4f1170f2119d808ebac6e6324144e7e35bf907816d8c06287f7c24e664ad71
SSDEEP 384:hZcIhsNMfPLEiDcoQX5+DtCM8l/+Xv8rvPJvtgOIwZOySLGo/:ph7EZbkDY/u0rvPBXs5Sg
TLSH
T147829F329CB89CB75DFBA181B48632035FB85477D6C96B80D6FC5B1D00EA6A9130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 531c6ae4374d388a0fc3c09a13bfe058e3cdf09bea8462d40a2e368c75da0826
MD5 2f6a9e08d5a2c51a295f7a6affd41ede
SHA1 c57b139f3e0f84169458c5d94bbea8467c059ee2
SHA512 7a4a5a70cdb8f5d03059e85484dd6c6c01e26d883483d937baf16dc5949a0fef54213978d33cf550385be1275b89d0e183cbfcba7053203b64c1c7423778c2f5
SSDEEP 384:xiFiZcIQzsNE8TUNTUlIlEPLEiDcoQX5+DtCM8l/+Xv8rjPJvtgOIwZOySLGo/:YFQM5wgIEZbkDY/u0rjPBXs5Sg
TLSH
T1F8A27D339CA8DD7BADFB9A81F54932038EB45067D585AA90E7EC9B1D00AB1D8030BD52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0901b039a67f2d5153d21af6c16bc8e2662255910252d0c5ca138d0e456f3a05
MD5 2bd936e1b788cf2c378fb32e830c8a9c
SHA1 9fb48d3d8c2145c8d170e3163b7154b756aea63c
SHA512 9c8fc923283a242b883671842a3851b246c5ede630b7530566d87d144e0a9c592c2d5b8b64e6dcdcf25f1bd853fc4f9e9a6b91279d9a51acadbe9167aae82e7e
SSDEEP 192:EONq6nnHGQmiUydbQYcX5hQDP1C8jzorqo/qMcMp4U6:EONq6nC6QNX5+DtCM8l/SLU6
TLSH
T10002C935BCB87CBB8EF36E46B48622139F95212BE5952B80DAF85F1C00D765C2306D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b59bcccbb74b2d21e22c70f01940ee33c947c8e50954316b6dc8c2cf8a949076
MD5 43dc08ef72b3e04506242b5be7ada4eb
SHA1 1304ef756c31738933a4b118fed12e83fb4b2322
SHA512 0187daeaafa7fb8281fbc8ba429ce4945b75697e20ccd0bd192826287506d31553a36bdc1ef06a5d5c7e2ebde9c543247ea1a5e6097839f874ebf76c3c7377d1
SSDEEP 192:EONN6nnHmQmiUybbYYcX5hQDP1C8jzorqo/+XEcFfErhg30q5JvU6:EONN6ni+YNX5+DtCM8l/+Xv8r2PJvU6
TLSH
T1D7120B31B8A8AC675EE26595748731139EA52127EA497BC0D7FC1B1C01EF6AC130AD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e437fec27cb75c354c53fb720c4a164612ea02183364fab01c09e4c63e57034e
MD5 0fb27c8c0005fa71cbea02f55b892ae9
SHA1 be85583a0e076d587baf45b6af0c6d8958ccb90e
SHA512 57b55893bca00903f03b562743b91fa03d924e6f4a1f3f90b13ff28b0d84d76fd9dd2edcf1a2776dc2b37d0f3deb4f1867b5fb3a98cc0729a5590c3e991af82b
SSDEEP 384:TZcIhsNMEPLEiDcoQX5+DtCM8l/+Xv8rvPJvtgOIwZOySLGo/:Lh+EZbkDY/u0rvPBXs5Sg
TLSH
T1F5829F329CB89CB75DFBA141B44632035FB85467D6C96F80D6FC5B1D00EA6A9130BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eccb9324-17d2-4266-8d71-0752c23ed18f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eccb9324-17d2-4266-8d71-0752c23ed18f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d97652c929490a19dc38d7913dee9b7b1e924bf22c99dbd689fe434f111258e
MD5 57260531606eaf147f9d7a67b2ea7ca6
SHA1 9a16689970a4a54e01000d332148fd5baa20708f
SHA512 dac5f1a77b1646cc884b10dd42936682c4a262ba725d27dbe26130f85b4bf8d21de6b681686fdddbba0777a437135923372df1d7c44992a612628249c7f5140b
TLSH
T1EC412D59A6F9114CB3B76E1AABF6A82D487F79772F0AD45D10010E4F0B66B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download