3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-mk9xbu.html
Size 171B
Sample260930-r1clrss1az
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{777EAF59-B53D-4B51-89F2-ED9C442E5B86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3280	4276	msedge.exe	86
PID 4276 wrote to memory of 3600	4276	msedge.exe	87
PID 4276 wrote to memory of 4380	4276	msedge.exe	88
PID 4276 wrote to memory of 3600	4276	msedge.exe	87
PID 4276 wrote to memory of 3600	4276	msedge.exe	87
PID 4276 wrote to memory of 4004	4276	msedge.exe	90
PID 4276 wrote to memory of 4004	4276	msedge.exe	90
PID 4276 wrote to memory of 2304	4276	msedge.exe	91
PID 4276 wrote to memory of 2304	4276	msedge.exe	91
PID 4276 wrote to memory of 2304	4276	msedge.exe	91
PID 4276 wrote to memory of 5044	4276	msedge.exe	92
PID 4276 wrote to memory of 5044	4276	msedge.exe	92
PID 4276 wrote to memory of 5044	4276	msedge.exe	92
PID 4276 wrote to memory of 3284	4276	msedge.exe	93
PID 4276 wrote to memory of 3284	4276	msedge.exe	93
PID 4276 wrote to memory of 3284	4276	msedge.exe	93
PID 4276 wrote to memory of 2056	4276	msedge.exe	94
PID 4276 wrote to memory of 2056	4276	msedge.exe	94
PID 4276 wrote to memory of 2056	4276	msedge.exe	94
PID 4276 wrote to memory of 2484	4276	msedge.exe	98
PID 4276 wrote to memory of 2588	4276	msedge.exe	99
PID 4276 wrote to memory of 2484	4276	msedge.exe	98
PID 4276 wrote to memory of 2588	4276	msedge.exe	99
PID 4276 wrote to memory of 4448	4276	msedge.exe	101
PID 4276 wrote to memory of 5032	4276	msedge.exe	112
PID 4276 wrote to memory of 4488	4276	msedge.exe	113
PID 4276 wrote to memory of 3324	4276	msedge.exe	114
PID 4276 wrote to memory of 3884	4276	msedge.exe	123
PID 4276 wrote to memory of 3884	4276	msedge.exe	123
PID 4276 wrote to memory of 4152	4276	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-mk9xbu.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffab249c188,0x7ffab249c194,0x7ffab249c1a0
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9909048262607488931,13378894851360569628,262144 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,14497648361371387171,3760981185341081570,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,6427858425812897417,16989585905256863210,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3894961119080790889,10859555402815316741,2097152 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2583997424134275235,9237004794425982542,2097152 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,6793196524534575448,17583532868454720077,2097152 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,5946581052724972542,17485717759158721761,2097152 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16544341175677139395,17877741588665752643,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,239789021905474226,14231114980297176769,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,8640458706319902007,15417713523842869618,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,8640458706319902007,15417713523842869618,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,5455082564866816106,10026599644599160633,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,2503771530650304437,3570853355966943633,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,1128470278353390484,6299538844589098988,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,13494875743431543430,12795604117158118475,524288 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,6925150205508151851,15151232505474826762,262144 --field-trial-handle=2108,i,14956442807753435901,2371907440110407581,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a665486b897d6ccc7593f441a68cd07bd71f56febca8d7adb4baba3c1506989
MD5 a1563bc19d2ac6aeeed61e249128ad7e
SHA1 bc70bd2a3ae8a16f32ea05702b39b33378b5206b
SHA512 d7dfc90772d984df71a1e700927966e8ca0167516da3c2d709314a7efd208d5eee39d5076d96259a58db78b220a9a16e83412cb8aec787398b27f2e8dc951ee9
TLSH
T1F85192B0BF8481A9F798627C9ECA02473E34998558B77FCC11E7CD7AF80A71E1124E44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591bac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591bac.TMP
Size 3KB
SHA256 e9491641a579b58e76a6d0ff570ec63d0093b972eaa186e6738de05486f97564
MD5 0340c98bc0b3e48e3246655e98867afd
SHA1 747311fc8996c3767df524e073aa6ddaaa7d256d
SHA512 96f66a453ca783a125a1b3a95de2860ad5bdace2455a2ae44b92289b7e90d756c37ddecae8584624d2a7457cdae05b0b94b0080d1462d08a8184ebfd64bb4bf1
TLSH
T12D5192B4BF8481A9F798627C9DCA02473E34998558B77FCD21EBCD7AF80A71E1124E44
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

004b9440-9c4e-4e49-9d6b-ec5a8ab7604b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\004b9440-9c4e-4e49-9d6b-ec5a8ab7604b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a3b90dc27f8b80fcb08bbc2d70bb21d3771a25add9eb82c3f6401c72d83a9ad6
MD5 56af6b53115ae6303271854e683efdc6
SHA1 f83c8c67b95eb1bc165ed7547d8db3db164b8718
SHA512 3a89297f55163d59ec4ca2a8a4d9df5b1d043b772606ad763f3dd4280188944f6720e763b703a92ad6d0b517b3277123ca984d24565e54de04c7962c2650b78c
TLSH
T15F117DF3C7D595AE8A0156F05A24AE2BCE1D0506821C7C19C9D4EF27D3E3075D00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 390dbf3c4467d62636a7d7541fa3bb312629bb900916af8e7218323c96f7fb34
MD5 36e6f2b5294c42afbdf5c9262b14b911
SHA1 d781f871f12af3113c33d39b153b8ac54c95148d
SHA512 0271534597fb915b562fb012b71d066e838e11318ef29b785f10ab6604f7d49d0dd62f3cc39ecf33ed73f1ee2a379ec7388d57c37885da83be3e25ce4436958e
SSDEEP 192:sxZjrRtWw/f5suXIdpd9HW6+WNGYgUPfIgrJ:sxZjrGw/f5su4rHbGK9
TLSH
T18822A8516E28A97B8CC7D21DBB15BF53E6F95031A1D11D88AAFCC61C04E66DD120BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9f08ff4b0e01e4759357852ead9ca97d98b4d6a0c73e0c8ecbeb43f66129ba4f
MD5 c65e5344930e0103d037db6c566b11d1
SHA1 7a108dfc666f1afc8cd297e1593bcbd57b26f709
SHA512 a4c87e77170af4bb0b8ae8100dd55dcd6200afd49d05c0f6bbda2944275ff155bc65641ef3976a6cbdf8ec421ae454aec0cac1f0ea670d8b411f4e203cb64f95
SSDEEP 192:sxZjrRtWw/f5sEXIdpH9HW6+WNGYgYPfIg5WJ:sxZjrGw/f5sE4dHbGiE
TLSH
T1FB22B8526E68697B8CC7D31DBB15BF53E6F95032A1901E88AAFCC61C05E66DD120BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dff30885a9cc2914b35078bd7f11a7c741f372f836cd2089f132e2b4efbe8cb9
MD5 8c617847264ba37bbfdee4b260e2a12c
SHA1 a6bbcc84aaaa2734cac4f8f69f6bad6d2e6229b1
SHA512 9f6159e6ca7f15bd414842d4c1a747d899e97cc3c2ad41f7d94b17d5aa000996931806e993937c9330ff88655a18705ae48355143446776584fe0453c9078990
SSDEEP 192:sxZjrRtWw/f5sEXIdpd9HW6+WNGYgQPfIg5WJ:sxZjrGw/f5sE4rHbGSE
TLSH
T1AD22A7516E68697B8CC7D21DBB15BF53E6F9503291911E88AAFCC61C05E66CD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 44c7e75037ab42a963d7f7ca1084749bdf425a44ea363e1113bb4718bb031547
MD5 afb2d4816af5629e0f13855659afcb50
SHA1 d003959927a4ce3af2ad688319765da0488d1d62
SHA512 062b610fa2fca06552c2fdba21023239dc2308cc52b454e0c5413e73c267fc2e299e84a82d0fc058eeefcd60b68feaa42554f64120ac14d3955087213c18c3a6
SSDEEP 192:sxZjrRtWw/f5sVXIdpd9HW6+WNGYgUPfIg50J:sxZjrGw/f5sV4rHbGKG
TLSH
T1CA22A7526E68A97B8CC7D31DBB15BF53E6F9503191D11E88AAFC861C04E66DD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c4fecac992658e4120ad9330f5b5f4ed91b2882a07e7adef8dda1625a279ef54
MD5 48d9c6c13360f2b9247bdc06250fbe07
SHA1 defa890d38ae82008e9d7baec9ef8944a15aa85a
SHA512 f4fca084700e9db1b939fd072698e6f7ee93d38585826c90dbc3a3a13ab53ffad12106d5c6b5f6c3634d4a493976a7fafdb793469fff98a6952ec22e9899d6b4
SSDEEP 768:YVichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzXroC5+:YVichfPWvPZplu1jan+LKgzEq+
TLSH
T142C2FA7B640CCB7E4FC01E9DDD5A6F9A7E9802C7AA588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e077dfbb85afcf730600af7a60bd99555b794d0ff0203f5750776cb119ed4f5d
MD5 edc428c64b345ec98817e1ea7422a6d8
SHA1 abe84dd1abb643a3dadb962a8281e8cf31c66862
SHA512 73853ec67bfeaa6fef5e73975cac140bb8e621e5d0ebdefd774b15e758e7d88f1dd27623a66175746ccb067d6700008812dab465645471f2a6e665e7a36ece23
SSDEEP 48:K0CNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLJ4FZDHb0bni/ISx0K9x1b0xZkYijo+:KQNqKu0CC+oKDCMtSKm0aA
TLSH
T10D911D5232BB030038BD384890A59AAF464231B77514EF2A7FB915EA8E6FF051DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b637.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b637.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f16470cfb6a9f830f65a1c6d33d7b3593723eadb6d0544bcc86a9b95a4808b5b
MD5 7afc40493baa6511251df743bc7968df
SHA1 692afed5cd3afdc1e53324e2e8803b39332ebb40
SHA512 74a03b8ce37a47f4b1954892e13aa9a3c43e7da5f131110e1f80c8bb65629b5abaa39bcf72d8233f4010032ae09cb99a8b6e95b7848211e20b57062b87e74eac
SSDEEP 384:DZcIhsNzfxYO58gFBGYX5EXLEs9XlaYo7fFmvtgOIwZOyKWot:bhgYODXGYuXLEs9ETFcXsC2
TLSH
T12D827D3298B86D7B6CE7A245B58B36075FF8902BD7C46F9494EC5B1C01DA198030FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 84ee339c636e563d272a4b9cbb037315318336bf629e77cb73ebbd356de3537c
MD5 883265599574f6e13635a918af438c22
SHA1 48c9ea539d58683346640abfe242041326ab8dd4
SHA512 f2a2a1e0ce7825c2a590c7a8de132d4d4c6d33057191affd2f1b35711ec527e8895acbfd8cef96f8036c95049124bc524add055a3bfa1a6a65c8dd0f39dc37a6
SSDEEP 384:WiFiZcIjzsNN8TUNTUlIlGxYO58gFBGYX5EXLEs9XlaYo7fnmvtgOIwZOyKWot:9FQnowgYYODXGYuXLEs9ETncXsC2
TLSH
T1E0A26C3388B89D7BADF79785F54A32078FF49067DAC5BB9496DC5A1C009B1D8030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9dd648dcb5cc5578128bf8548c2377ecfe712520c481cfc17b0f6ecdc4a83b8
MD5 b687525a6b4635b90a0ba631c4b55707
SHA1 71d5d738fad5ae678824ba6745c71f102f3f4dd9
SHA512 c91f7fd29d03bf3909931c2ba09489a4c6907d7bde96b7e6158e78c7f393f8fee909d3f57212244e7592e8fc68f59dace0550dc88ee8a1a496a9b9e1538aa86b
SSDEEP 192:LJONV6DphmqQmiUyd8q8wGYX59ezWCLEsXkk7tbU6:lONV619xRwGYX5EXLEs/JU6
TLSH
T1BE02FA39A8787CBB9DE36E45B58B26179FE4112FAA906F84D6E81A1D00C768C1307D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 73fded6efb8e1e7ea3e64e2ec5f8ad3bef5293ccead278dce14ad8d13f553d12
MD5 40bd42934603fb12f45ca1e7b4837af7
SHA1 f390ab086e24f7d9fb3ff2583cc70aabec00c182
SHA512 1d84f333241acedbc79edd3e43df75355f07fe1c7b697c2f6bdd64ad4cab92fb70daed7c3af4bfdc464cb741d2f3323f0d9b5e05e03951663b9e6f73cfe19dda
SSDEEP 384:LZcIhsNzGxYO58gFBGYX5EXLEs9XlaYo7fFmvtgOIwZOyKWot:ThNYODXGYuXLEs9ETFcXsC2
TLSH
T121827D3298B86D7B6CE7A245B18B36075FF8902BD7C46F9494EC5B1D01DA198130FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5f1998ff2a86880a29219611320c6d67579dfca24c6776e2d22478b4ead1752
MD5 4d21a1851695c4974c3f91c9fe7e1c9f
SHA1 dd99f0ea439174439d4666dc687bbbf2331b20a5
SHA512 063ef75290813f4460c5db0a4912335c21ba0fb2702c317998e7950626ac0328b666a4762a53030aef45c5d76bdfce42b66411ce3450af991d61550e228873ac
SSDEEP 192:LJONm6DphSqQmiUyP83wGYX59ezWCLEs9XlaPwo7fAkIIJq5TDLU6:lONm61Jh3wGYX5EXLEs9XlaYo7fJmvU6
TLSH
T1D9122935A8B8BC6B5DE3A594B08B35135EE4922BEB847F84C5DC1A1C00DF29C530BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

420adb9c-646a-4652-a5fc-9399e9ef874d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\420adb9c-646a-4652-a5fc-9399e9ef874d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 212b259f05f8e0b7a09eb0ffd26df8e87c436399ef02eb69fcd9769be3833ca6
MD5 3587ffc6a837402084e3aa42abd4c508
SHA1 45d7497f8fe2d9dfd4637e71dd21d7c4fd216eae
SHA512 1a031d289f5537e028813e4fbfe7c01b7be85e3ca7b5ba94c967b3399aac923ef67f6d7123c6ba48614b2960b4244175ff6654deb13b485d912828bf19e4d8b1
TLSH
T195410759BAE90144B3B76E4A9BF6B86D487FB9772E4AD49D00110D4F0A27B40C972B33
MD5 SHA1 SHA512 TLSH

Submit Download