5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-dcofp8.htm
Size 194B
Sample260930-qk2ehsgb75
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{F2386174-B481-48A6-94E3-A3BBA27EA962}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
428	msedge.exe
428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4036	3276	msedge.exe	87
PID 3276 wrote to memory of 4636	3276	msedge.exe	88
PID 3276 wrote to memory of 3184	3276	msedge.exe	89
PID 3276 wrote to memory of 3184	3276	msedge.exe	89
PID 3276 wrote to memory of 3184	3276	msedge.exe	89
PID 3276 wrote to memory of 4312	3276	msedge.exe	90
PID 3276 wrote to memory of 4312	3276	msedge.exe	90
PID 3276 wrote to memory of 3996	3276	msedge.exe	91
PID 3276 wrote to memory of 3996	3276	msedge.exe	91
PID 3276 wrote to memory of 3996	3276	msedge.exe	91
PID 3276 wrote to memory of 8	3276	msedge.exe	92
PID 3276 wrote to memory of 8	3276	msedge.exe	92
PID 3276 wrote to memory of 8	3276	msedge.exe	92
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4608	3276	msedge.exe	94
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 4276	3276	msedge.exe	95
PID 3276 wrote to memory of 2940	3276	msedge.exe	99
PID 3276 wrote to memory of 1560	3276	msedge.exe	100
PID 3276 wrote to memory of 2940	3276	msedge.exe	99
PID 3276 wrote to memory of 1560	3276	msedge.exe	100
PID 3276 wrote to memory of 760	3276	msedge.exe	102
PID 3276 wrote to memory of 3652	3276	msedge.exe	113
PID 3276 wrote to memory of 1020	3276	msedge.exe	114
PID 3276 wrote to memory of 3172	3276	msedge.exe	115
PID 3276 wrote to memory of 3372	3276	msedge.exe	124
PID 3276 wrote to memory of 3372	3276	msedge.exe	124
PID 3276 wrote to memory of 428	3276	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-dcofp8.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffc8a49c188,0x7ffc8a49c194,0x7ffc8a49c1a0
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,6602550623772755268,4431045239620973315,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,18416632767083970276,8060653966962074360,262144 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,922622792651380711,10893511628208253547,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12875528575366846882,6817148167487260153,2097152 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7058242570554652665,2331616051267384215,2097152 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1977644144850704532,18227766950614659269,2097152 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,5017086864726389843,9943855350663876308,2097152 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,4515038763499275955,4026164777881872764,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,16020684865951512265,15422110663987509478,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7315320778593056143,2393939852174665960,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7315320778593056143,2393939852174665960,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,6357865068450714826,6953359260472197517,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,7472576885256248257,18213455769296273329,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,4918116646631013162,7667608335801033737,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,18133031786241549502,8285915013801546267,524288 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,8243640863326588941,16792532487529010243,262144 --field-trial-handle=2320,i,9975151524926442681,16743484632753838619,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f53164d320e6a7a4172c31fff3aef41a133c0a154b30d3b506bee1906d406258
MD5 eafd5c0476cb58c9e7cf1e53b1f7f533
SHA1 53f4259f56039ce90260f7da9382492c50211316
SHA512 18f690bd3796eced474470c8d3a51cee93ac3dce78591bf743a5ee50911501da5b852940b5692dffeff63aa7a1bb28d2874c50e4ce82f06c15f451119708720d
TLSH
T19661A5865590CC61FF6CC8F591F91F973A72658119932EC565ACFCF668663C6C07203C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f3e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f3e1.TMP
Size 3KB
SHA256 929244d1474552e6538696b84fcb58a5481d309ce7a38d3f0e3f3b386337a69e
MD5 1a6292b55e1cca1ff65c38d401f54f33
SHA1 06b08863b94721c818e2c8b139c97862ee445195
SHA512 b9dbb923b70a3a64399a7c6c2d09511f5b80dbbba418671bd53cbd261df1b9d7622eaf87996f6d5c3ef594345e8a1ad6b3e8d560ebc0c435db5b482aeeed638c
TLSH
T19C6193865580CC60FF6CC8F591F92F8B3A72668019932EC565ACFCFA68663C6C07203C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5f549b7483256830d9bf8139f338e3fa73b9037329cf3751ce1aab1472a41f7b
MD5 46100e664f45b0c6c9048bf3740a53cd
SHA1 b00977f13c34753d8fb15ffe73b2633c20a9fcd7
SHA512 aaefa0dc655d3a90bc4b252125cf597452a2f9001f43e5d7890402b11aae79604a29db78efbde6ff37688122fa44c4ca3c0e1be5a1f0f2b29b303d5215ab35bb
TLSH
T151117DF7C3D585AE890156F05A28EE2BCE1D0505422C7D19C9D4EF2B93E3079D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 73e72b0d8c87021c54192d4e4e46fcfacea17a0cfa4a24b17c8cb7497657f394
MD5 9432e882f8c1183be670a61dbdadbd79
SHA1 4d1705a6c5951f6e0af2fabffe2d871b2131f5ac
SHA512 87fdded9848bf7f118d2583535b90e0efd22fc31b5ffe9d31b3648fff9192d6a8492ce17c54c79a7344f17563331c2c1be059b007edf7550d636c761e64e6cf9
SSDEEP 192:sxZsRdW3/fEsBOIdpdyHW6+WNGY36ajeIgrJ:sxZsG3/fEsBf0HbGXZ9
TLSH
T16F12B7526F28A57B8CCBD209BA25BF53E6F95032A1D51E48EAFC861C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2bee3be868b7020e627101bb6923338c8e4f7db935b3b1409493efd4b0350dd6
MD5 7496ce371166990c1c57efb5daac5862
SHA1 86ee7ef24045c29a4b4f172c7a6398de34dd83dd
SHA512 32ae2b6f3c2ed14fdb6df503067dc5ff5b92d7257ce3d7c29df75a5b6b4ea215ce5c5fa852776a788e8b2d1a6c160e06bdff2bff30c73f1eae80581e6dbfae52
SSDEEP 192:sxZsRdW3/fEsSOIdpHyHW6+WNGY36LjeIg5WJ:sxZsG3/fEsSfSHbGXmU
TLSH
T1BB22B7526F68697B8CC7E209BA25BF53E6F9503291D51E48AAFC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ba381450ee3f6c8919ea3303d3998dc707201d5df24bf3da9e01de6e0acc3bb8
MD5 dd0af26422518e87fda10f246e3a311f
SHA1 04c402364c62d5a2705ba5eb17757812130d8075
SHA512 8992038ab4bd751dec1dc87b8faeac4d2f3e47a4b284089c7cb96c3a4379611b61cc5581444a413ea7ccbf081e349c16d0d48ab861ea4980f9216938e9a185b4
SSDEEP 192:sxZsRdW3/fEsSOIdpdyHW6+WNGY365jeIg5WJ:sxZsG3/fEsSf0HbGXIU
TLSH
T18122A6526F68697B8CCBE209BB25BF53E6F9503251D51E48AAFC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0cf8a57d010438732e995abfd9c11340eb540910cd95ff2b232890ff8cc80b5b
MD5 e15f22e58c3b2121a2ee4d154f4513a7
SHA1 a94cd2cb793ae7d2ce45f7809a4f979b7e488aa5
SHA512 2dabe41c0a37e89560ae94f664891f1ba0729b5576ec3e86368f1e935a00c502be67f3c257d2079bdabeb2101368f286b135bf7231d8aaedf4fba954c38930ba
SSDEEP 192:sxZsRdW3/fEsIOIdpdyHW6+WNGY36ajeIg50J:sxZsG3/fEsIf0HbGXZW
TLSH
T17222B5526F38A57B8CCBD209BB25BF53E6F95032A1D51E48AAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3962b76300a277d67f2ba946117363049f6260993d8b8668431c3f2c6fb6b8db
MD5 e86ee897979c7c48fea90ebb5f5a06c1
SHA1 819db79983672dfe15ceeaf214ab66910064ea60
SHA512 d4b3b382741519176f199111c5531f42bc7f505fc7505e1ca159765e9dc919ec256cd18077f356ca99b03d644849901914d738636b25cc204df6f0bfd7e24c41
SSDEEP 768:brKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/YroZe:brKlm7QWvUYe0u1ja8/L/E/jZe
TLSH
T1B6C2FA3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D404BFA994C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 efa79a1d979c54d19143c36cdf14dde3d2b6812b471f6d7def2d8b0dacc0ae13
MD5 398d43134d1407207c7acda16e675db6
SHA1 06cd54eac4035b7ee72859f115a4b0f617f20aa1
SHA512 9b451e4ec16f9a023290db90971f09abf6e7ce6ed3d93c927c493cbe592c336432fb47ca3258530f764e31d8b19fd16152237a5e4f91da4cc20b515612881f33
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyLMb6G02aDbqpyIS+DK9aXfI1KEE4Xyu:KsIoKxiGGr+KwXf+KEEKSycKr1
TLSH
T195913692327B0240787E7884857DCB2F566172A2341CEF6BBBBC41A19E2AE444DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4f53903-0de8-4273-b0d3-a1b55c1afad8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a4f53903-0de8-4273-b0d3-a1b55c1afad8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cc15640f30c7210717ea828ce7e630a7f14cd1b538f79245261fa2c083e007ec
MD5 4e0dc3fd13b5a35d3ee4578cab0a06b3
SHA1 faa8b6a88fea7bda6d26497488e676076e1ae8aa
SHA512 496a891c9ebe7288cd68daf8b1919bb28add4348489504f8cc0bb1a136e8982f8c81d9ff026967e690346f81c8b667054fb32fa0d7d7506e4a3225624f85c77a
SSDEEP 384:2ZcIhsNKukfLbRmJh//afVMSVZh6DKhHfoH:kh5fAH/CNMSfYGHfA
TLSH
T189827C72ACB8AC769DE7A185F44736138EB480A7D7C95F98D5DCAB1D02DA1A81303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 97d3cf0b2f632772fa1c069a4961607b1be5d1c79820533d90f2989ffdab7dd2
MD5 a8ab92f292c61e6c37347066af5ab225
SHA1 4e66815a9701fb2ec5d004d9fefc1cc6b1b6cc6a
SHA512 b5247ffc5d6d540e4bf8c1c60acac2bbe744ce7fd93f11619b9e0014f6778a445307e37988945a89b222b2448378aa31bb32a85035b2ef9059775f1a739ccb39
SSDEEP 384:YiFiZcIbzsNS8TUNTUlIlbkfLbRmJh//afVcSVZh6DKhHfoH:jFQPvwgWfAH/CNcSfYGHfA
TLSH
T1B9A27E735DA8D87B9DF79A85F44B32138EB480A7D6C5AB94E6CCAB1D01D71A81303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e9635119d5013f95c7cb2aff4d4605301786319101d6ac34af8504aba072c45
MD5 9b580996db4b059ef03cbe7a2455b8ac
SHA1 f5d3c14d79ef202d706f1e99b45165cb646e5a83
SHA512 1801c98fa16c933b1375149386d025e57aed0e7650d1c7e5024fbc8332e17d0c66e226ae9ac2d52f557fdd5c81e2ee04d6324dc0401844149d6150d789f232ed
SSDEEP 96:KqONknQsjpfbUmjH5ih/cIPURHl8h4otop5OaDrgBKP4v+Y1xf//ojdOx5YEqsoi:BONr6JUm0QmiUyDrEso//aOBCJaU6
TLSH
T12102D839BC68ACBB9EE3AE49B04737239FA4106BA6915F84DAD92B1C01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b2b29db549fad1e6baf8300c981386bcad58bb3c98462366c7c9c80973c4cd00
MD5 13b36f727a3569e8918870ed112dca74
SHA1 4edd930523de862caa68c9d0dbcbdf638151a1ad
SHA512 db667394913a0758ce0d4729a0f45a143074c595c3112f0767805752943ffe0f161c23b479d5a108f4ad6fc5cc8bdc94cbacabed459b98737b6a1a727895181d
SSDEEP 384:QZcIhsNKbkfLbRmJh//afVMSVZh6DKhHfoH:uhmfAH/CNMSfYGHfA
TLSH
T168827C726CB8AC769DE7A185F44736138EB48067D7C95F98D5DCAB1D02DA1A81303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 489cd5f905ae0d454c021e485b73f8d2e5c635d884c8a33c1b8efb46aa15f123
MD5 2ff10119581c028fd85a3c51f332e1dd
SHA1 6fba4f19975b9a2fa2e96bfdd440e839c15625a1
SHA512 25767522b99fedeb4783486a35d896e22380790c003543e6eb86a5e7d98e1837745b594bc50e40b5d4954d60f40fad778b095b1525bdf9dd0be11a1a17d59272
SSDEEP 96:KqONkPQsjpfbUuH5ih/cIPURHl8h4otop5OSDrgB7P4v+Y1xf//ojdOx5YEqso0I:BONr6JUlQmiUyLrEro//afViNxpqzU6
TLSH
T1CA12E7356868EC779D93A484F08736139EB44177EB856F94D6DD2B2C06DA16C6307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83cd634d-197c-414a-abd1-de35f9d19335.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83cd634d-197c-414a-abd1-de35f9d19335.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14519751c137d8499e38e2f79cf87d905e269af3a82f877ccfffc3299a576120
MD5 6008df6a885a45e2649784b30b2edef4
SHA1 3083c940b04251af0937ee4b7dab4086ed25c538
SHA512 1c4796157f3e3f1a79b9b7f924422c9878c515515a5d4318f76729f57dbbcc635137602474145ce61fb1b13f787685f8be3bcef33158733b48e55546f5b24ef4
TLSH
T10E411758A6FA1148B3B77F1AABFA686E447FB9772E06955D10010E4F0A33A41CD71B33
MD5 SHA1 SHA512 TLSH

Submit Download