5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-eptw9p.htm
Size 194B
Sample260930-rfpetshb64
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{7D2D41FF-5FAC-4EFB-BCDF-D0A2A7A21392}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
560	msedge.exe
560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4540	4320	msedge.exe	87
PID 4320 wrote to memory of 4304	4320	msedge.exe	88
PID 4320 wrote to memory of 1056	4320	msedge.exe	89
PID 4320 wrote to memory of 1056	4320	msedge.exe	89
PID 4320 wrote to memory of 1056	4320	msedge.exe	89
PID 4320 wrote to memory of 836	4320	msedge.exe	91
PID 4320 wrote to memory of 836	4320	msedge.exe	91
PID 4320 wrote to memory of 4104	4320	msedge.exe	92
PID 4320 wrote to memory of 4104	4320	msedge.exe	92
PID 4320 wrote to memory of 4104	4320	msedge.exe	92
PID 4320 wrote to memory of 2644	4320	msedge.exe	93
PID 4320 wrote to memory of 2644	4320	msedge.exe	93
PID 4320 wrote to memory of 2644	4320	msedge.exe	93
PID 4320 wrote to memory of 5056	4320	msedge.exe	94
PID 4320 wrote to memory of 5056	4320	msedge.exe	94
PID 4320 wrote to memory of 5056	4320	msedge.exe	94
PID 4320 wrote to memory of 3860	4320	msedge.exe	95
PID 4320 wrote to memory of 3860	4320	msedge.exe	95
PID 4320 wrote to memory of 3860	4320	msedge.exe	95
PID 4320 wrote to memory of 4816	4320	msedge.exe	100
PID 4320 wrote to memory of 4816	4320	msedge.exe	100
PID 4320 wrote to memory of 4724	4320	msedge.exe	101
PID 4320 wrote to memory of 4724	4320	msedge.exe	101
PID 4320 wrote to memory of 4356	4320	msedge.exe	103
PID 4320 wrote to memory of 3020	4320	msedge.exe	115
PID 4320 wrote to memory of 4076	4320	msedge.exe	116
PID 4320 wrote to memory of 4360	4320	msedge.exe	117
PID 4320 wrote to memory of 4872	4320	msedge.exe	120
PID 4320 wrote to memory of 4872	4320	msedge.exe	120
PID 4320 wrote to memory of 3400	4320	msedge.exe	121
PID 4320 wrote to memory of 3400	4320	msedge.exe	121
PID 4320 wrote to memory of 560	4320	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-eptw9p.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffb81b8c188,0x7ffb81b8c194,0x7ffb81b8c1a0
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2585896328882445704,2225998405850674864,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,7236463830988856876,443868328251716326,262144 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,13028602437267390801,3710945630353756322,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11746537914828435582,14040731838768963674,2097152 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1194916046618557291,7861915281657643675,2097152 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4471614571626400142,5919483970692631221,2097152 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,6332918131384576574,16781803637971001729,2097152 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,5082867907637451708,1555291574870327574,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,16795366913928947146,3833571304507299694,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16467270974542695188,8302554771835384050,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16467270974542695188,8302554771835384050,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,7679492754352732689,9656606011328485884,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,13651879752614074631,971005959644058537,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,619501212303702342,7740516247484381326,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1721785832189402751,10941746166559543560,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10940853289790168353,14424554580478551949,524288 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,11210556729284397120,5582543582336870734,262144 --field-trial-handle=2312,i,12077361187692909222,13864289545148565815,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b09c708c06e018d68a2544430a6feea4020879aedd291e5d9b00606b35576305
MD5 b0969ab4b64589c5642f41e89c70ab96
SHA1 afee412b1754bed7ef1518068848f5743fa6dbae
SHA512 afc0c530dd69cc5159140638891d64981dd493adbb7d11844ac8dad5061ed3789e8ef1bfd0814a89f1fd391db2e8d8fae413540af306d671e88f70662a0589d7
TLSH
T13351DB91CEED8468FB9C46BFA9D37E873EF05A40695F5FD524E4E3B85F063418100855
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f77abf49fc02ac3be0c33a2ff387aab517e35e52af67234ea3a98f234cdd9435
MD5 a0c6bb53021085f9cd14cd5aea572c67
SHA1 4391be5d31e4f375105a8ce495420b103cfd75d5
SHA512 422b706099b946ed5107147d9bbdd6afb499bfa21842cd433f60faaf58dfc7553f4902d090b5a10c1b5d8a1bf6f29ed6a256a635cadb9bc358b008bcf8fb1473
TLSH
T14F117AF3C3D585AE8D1156F06A28AE2BDE2D0606821C7C19C9D4EF2B93F3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e8dab1fd7250d3601c097ef89a594904ad236197f1f6919f23a0933e3a760222
MD5 b1ff17ff60bbd6e4d069dcdb154a9229
SHA1 c020577715924af10531a80ed189ed84b53e1775
SHA512 70ff3adfb16425adab43d5eaf20dec9bc2058b4090970acdaa7c27f59b1cea977d79438fcb67422fd61562cd0b92b090f6e34bff7f0a9329b3c267d946c82a83
SSDEEP 192:sxZnRQW5/fgs27hIdpdKHW6+WNGYapYoOIgrJ:sxZn95/fgs2e8HbGy9
TLSH
T1C62296126E78A57B8CD7D20DBA65BF13E6F9503291D41E88A6FC861C09E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 da735e29658e7737a4eacaf68f2ab06b21ad05584c0cec9e0c01dfb443693587
MD5 867990901a087d55938240cf89b175be
SHA1 1f863a45a065366a6e4727bc8ca07e3d90737a8b
SHA512 75119a4528006409ee5546cbe6e8106899d8f537722a36955608f3ca540f941f4b5d37cb098cdd9c9190f39f0238c5f393ed435a2bbc2922c0a400917cce877d
SSDEEP 192:sxZnRQW5/fgsc7hIdpdKHW6+WNGYapooOIg5cJ:sxZn95/fgsce8HbGye
TLSH
T1E222A8126E78A97B8CD7D20DBA65BF13E6F9503291941E88A6FCC61C09E76DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d5a45ca7572b92e89d6fdc8dd5a156f2f5e777c3a9842655f3410560ce9be8aa
MD5 3077a545dc328b3a03394d184140e99a
SHA1 80b0d54c0e6b5f03828f9e71be1b9f423735d35f
SHA512 64231b4e9bc91f276d71afa93ad40f171ae637f818e537a2b8fea6c57bbf9439975d8e295230c5346f1d6a0cc390dd77b2e9cc6463a62f2bf52134506914ca8d
SSDEEP 192:sxZnRQW5/fgsD7hIdpdKHW6+WNGYapYoOIg52J:sxZn95/fgsDe8HbGy0
TLSH
T1F722B7126E78A57B8CC7D21DBB65BF13E6F9503291D41E88A6FC861C08E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f9888116a10b6bb6215959704cec2437ba841ccaea80ee86e13c67024533eb1c
MD5 435b59115777f29c323c3aed529a61ba
SHA1 4d56445e65d3f222161a473ef906b6dc1aee9e9f
SHA512 a694c09e2fbbdeeef3236ffa2242c11a7621672ed4c2334d71a80b09a5f0cd48a85c01b30fa3c69ad0659ccacdae8a59c6c80c3bb14a24a09364b9de8b6ecf48
SSDEEP 192:sxZnRQW5/fgsc7hIdpHKHW6+WNGYapnoOIg5cJ:sxZn95/fgsceqHbGZe
TLSH
T14822C8126E78A97B8CD7D20DBA65BF13E6F9503291901E88A6FCC61C09E76DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a67dc26371320ef42ea524a52cf17bd450f904303ba12eb368c8e1e0ba9d01da
MD5 3f3283efcb7d8592a9e83003151dbd29
SHA1 4d83babff58c9867daadc88da9f2a2d12cc22cb1
SHA512 26d5bec429ecac57c4d7bce3290b5284b420e597a6f2bf76b72edb26632113c8e327af09e2bf5f0bab1a460fd5cfc9173cb671e2a4b469997211a9215681acf5
SSDEEP 768:hvWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Pro4IfekmRV:hvWPcLKWvKeEeu1jaClLiF7c4IWkmRV
TLSH
T194C2FA3B644CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 156b0eaec9859259860e2b580442625a1d7e5e3d627917f40fb31d38ed67f4ce
MD5 8838c8c725e8e1dcbb9d1cff0d83a7f2
SHA1 2f34aec708dfc60ab22ed4262c3deb17c8e1aba9
SHA512 2fcadc38878bbf256981fadf7b19704be3708f3ae09b8ba69e06de74a70981cba74d9f1313f4f2b09714298a66efe5ecfe8f021c040d8becfe04a710371cddb5
SSDEEP 96:KyFkBFnvvu1/21HluKfbHjuLtluzVvYtMpNv3H213+9HN2KfTHb2LltWrxuAKb6M:5FkBFnvvq/2VlFbHjmtluzVvYtMpNv3s
TLSH
T19B911314727B1250397F2A4891A4876F464131B33518FF2BBFBC15BA5E2AE590CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5982b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5982b3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f3b6e36d189037b0683794c4c64b7f91f9b0741f5b193a5eb31768cbeb69e39f
MD5 7189314f855eba5a3f811c5f4758390a
SHA1 076d9b8214345e66c0063b5f71675127fb77ae0a
SHA512 4567d9519fc855b3e122aeae458c4e6c485f05ba69b8ca2ccbeb90c8ac72d5502ebfe4f273d44ebccb148e44b8b4683bacdfb47e3ac730319354ead5a064f634
SSDEEP 384:jZcIhsNkZMvW1mo1zIGmS/IICViftgOIwZOyKLuoq:7hF+Wn51gFifXsFK5
TLSH
T1A5828E329C78ACBB5DF7A544F5863B035EB4912BE3C86B9494EC971D00EB298030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2418319b30969155ca0a33da552c32234a79a82f1c4b2ee54f1b71a19571f53c
MD5 8e821ade4c15ff369722c648584dcb8b
SHA1 1c9d4adaa265f24e9b95c9ab518eb14b109b41a4
SHA512 3431f5911287ba37fa1f201c1cdf742bbeda5fc9ad146eeb42b37fa738528ee2601e845ae259467ca55a91d9b2a5972a989db89c02767f8d7398c26df6654fea
SSDEEP 384:xiFiZcIVzsNs8TUNTUlIlYMvW1mo1zIGmS/IICT8iftgOIwZOyKLuoq:YFQtNwg++Wn51gD8ifXsFK5
TLSH
T12DA26C738CB8D87BADF79A44F98A37039EB58167D6C5AB94E6DC9A0D00DB19C030BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bd6f7b9f818d183188d699d68ecf8d4c72775679a24c0e12064e1e2cf92914c0
MD5 c284d744164219d47eb634bc8f1f67d6
SHA1 900597d171a8a8d043b993c703d4e22e4c592e3d
SHA512 7a2b8a3e3884dbec6d6a425055d2fd9825dfb0277a122533920d51fdc41ec64f786db507c05a9e572e79c841670c757e2de24349e6950ed981b0b6da2f30e60f
SSDEEP 384:oZcIhsNkYMvW1mo1zIGmS/IICViftgOIwZOyKLuoq:WhM+Wn51gFifXsFK5
TLSH
T102828E329C78ACBB9DF7A544F5863B175EB4912BE3C85F9494EC9B1D00EB298030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1f85b2b4cbe3594141a631096086eeedac89aab1575ec2ab626592f9ae96a0e
MD5 597e6caf2eaf87f6fe81041cb58c23fa
SHA1 56950cdd4df9ecc589403d93daa0b69c0c3011d8
SHA512 6f54f1521b7c522f90df42d143caffd10bb3262f1d3c797893195791353a51d2c143487ea14a3bc82d7fd7a3b149c11dc5cbefb7479b536fe845b1ae65cfe64f
SSDEEP 192:aONd6IEsQmiUyZOTAGuIGmSrLIICL27HxqCU6:aONd6D8ZHuIGmS/IIC4HfU6
TLSH
T1D9121C32AC78BC779EA3A844F4873A276DA54227E6887F94D5DC1A0C01EF25C130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 156dc08265c447a363b8797a9f517599d9519c2e54f9481301dfef456ff909d9
MD5 924d68d64ae4d19cd7a7ba9c21bbf666
SHA1 e925a05fa3ced2b83ebc89245710940a05e97663
SHA512 4d4f79afee3dfd4a6213d997466112a43100706372ff708d9bae47f6c8b0eb3bca2c2c5db8f242f47156f7d7a6f0a356367bc76ff5f9a061b95d26f7000970c1
SSDEEP 96:3qONk2Qsjpfe/tyng7X5ih/cIPURHl8h4otop5GYDONBnP9ZvEI0IG2jbZ0rLYy5:aONC6IE7QmiUybOTPuIGmSrLRC7sa6U6
TLSH
T17F020935EC7C7CBB9EF3AD48F4873B236EA5112BE6942F84D9E81A1D00D724C1302926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22f9c12f-0c92-4a1d-9642-075179525fc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22f9c12f-0c92-4a1d-9642-075179525fc6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2614d8b1107102bca0b43e9f7c2b433b697798291da40625ab9458cb5a5aba2b
MD5 30741445de5d7e6a3e99332d4e9e7649
SHA1 8226504b5b7499d2389e7351976dadd38a4030ac
SHA512 d4afb9ebaec6d574f1143baf1de3db8d8d2a6b657dfcbef9ec14d9895bdb0c9e6d738f08dd96dd926a696d442aa63789fc23f960a95ae7f43e5049ff2ba26c3f
TLSH
T12F412E58B7EA1148B3B77E5A6FF6A86D487BB9732E06D46E00110E4F0666A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download