5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-381tfl.htm
Size 194B
Sample260930-rnjvbahd79
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{5C706676-F5B5-4583-9871-031DC65FD49C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1340	1704	msedge.exe	87
PID 1704 wrote to memory of 1012	1704	msedge.exe	88
PID 1704 wrote to memory of 4564	1704	msedge.exe	89
PID 1704 wrote to memory of 4564	1704	msedge.exe	89
PID 1704 wrote to memory of 4564	1704	msedge.exe	89
PID 1704 wrote to memory of 2676	1704	msedge.exe	90
PID 1704 wrote to memory of 2676	1704	msedge.exe	90
PID 1704 wrote to memory of 3156	1704	msedge.exe	92
PID 1704 wrote to memory of 2636	1704	msedge.exe	93
PID 1704 wrote to memory of 3156	1704	msedge.exe	92
PID 1704 wrote to memory of 3156	1704	msedge.exe	92
PID 1704 wrote to memory of 2636	1704	msedge.exe	93
PID 1704 wrote to memory of 2636	1704	msedge.exe	93
PID 1704 wrote to memory of 4468	1704	msedge.exe	94
PID 1704 wrote to memory of 4468	1704	msedge.exe	94
PID 1704 wrote to memory of 4468	1704	msedge.exe	94
PID 1704 wrote to memory of 4364	1704	msedge.exe	95
PID 1704 wrote to memory of 4364	1704	msedge.exe	95
PID 1704 wrote to memory of 4364	1704	msedge.exe	95
PID 1704 wrote to memory of 2848	1704	msedge.exe	100
PID 1704 wrote to memory of 2848	1704	msedge.exe	100
PID 1704 wrote to memory of 1136	1704	msedge.exe	101
PID 1704 wrote to memory of 1136	1704	msedge.exe	101
PID 1704 wrote to memory of 5012	1704	msedge.exe	105
PID 1704 wrote to memory of 4872	1704	msedge.exe	113
PID 1704 wrote to memory of 4152	1704	msedge.exe	114
PID 1704 wrote to memory of 3472	1704	msedge.exe	115
PID 1704 wrote to memory of 1956	1704	msedge.exe	124
PID 1704 wrote to memory of 1956	1704	msedge.exe	124
PID 1704 wrote to memory of 2956	1704	msedge.exe	126
PID 1704 wrote to memory of 2956	1704	msedge.exe	126
PID 1704 wrote to memory of 3744	1704	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-381tfl.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7fff7337c188,0x7fff7337c194,0x7fff7337c1a0
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11329736393520864669,8778992247936060254,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15135849755588844526,16054715320141368908,262144 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,7361331661141138228,3106922507122702791,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7521821297290834350,9032758927692806066,2097152 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13372490320566023978,18354276762024984083,2097152 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,10780835504426895838,14448846613234410646,2097152 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,10100172522877156061,1333430270374475217,2097152 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8909914637220784462,6193218282204436571,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2076623531268762044,276169300577920469,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1804839163479479707,18188078400331957150,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1804839163479479707,18188078400331957150,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,5213692671351733075,9772226608091983760,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,5838174137178557186,10444008646783776621,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,17978788210609471563,15541719556605476617,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,10213101565813986067,5103521353029378618,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,18250214419755373145,7977374690805302264,524288 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6424,i,10391055100077301894,11178140311455156624,262144 --field-trial-handle=2540,i,15101617992050314346,2800494471656502470,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6375b61a930bcb4f8ce9c9bd28dde60ee357d07e7d50d3709659b868547d2031
MD5 18d7c1d575ebd72fd05a642e970301b2
SHA1 9ff96147ee779462693495a37d95c8711fc9b9aa
SHA512 5c52d45d77935da67556225cad23dd37b52385e9cdfa58720b99944769b8c9ff0921247ddca1aa2487c50241d582f4a6d902bdc2084d1c14e8246444c94ccebb
TLSH
T17A510FCE67D44461FBEBA17C81DD3E87363755C1249FAEC234A8C9BB940BBA04118464
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 79e0ef3d177a187422866bdf751a22554aeac8b0c4c2b0dda13aedf8cc534b17
MD5 1fbd764c981c804e8dc49f88517f5a56
SHA1 061e524583481404d7c8acf78a00aaf99449492a
SHA512 c25d2fc73ccf4ac4cd07a867909b5ab16400a0643b86acbd0a2745a72c918d7db5e679ca02dea3285fd497f4c2b3d054774c8bd4bc1d95e02793f1e9bbf0efc2
TLSH
T11D117DF3C7D585AEC90116F09A24AE2BCE2D0605421C7D19D9D4EF27D3E3476E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6caeefe862005d7fbf79fc4796de444ff14fc8e1547a520c668c92fd5d14936c
MD5 f138423d4d2e96379946a4ec4eab6aa8
SHA1 fa103ae848b0a4ec979cb18ffa035545bca7b560
SHA512 c885d85244664bb3f2fce8981e7c1209c796afdc62ee51e044dda8baeae4e9e5d6cdd06d6f1fb0c39011a1efe88d15f2d74bf2cf77dece8a66f6804787cf73be
SSDEEP 192:sxZGRrWF/fqsEiIdpdKHW6+WNGY36aEjIgrJ:sxZGAF/fqsELQHbGXP9
TLSH
T14C22B8116E78A97B8CCBD20DBA25BF53D6F95032A1D51E48E6FC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7d3c92e97f5a16d660be9561940ef6781960fec61d297ed8c6761d2fe7cae719
MD5 4afe7ada67f6a686701ca36b76a07f38
SHA1 2a6b51f6d8367b08205b16f97efa3f9136784a3e
SHA512 e1e684c2f36183290676991958510deebcaf25b34b0449b4df41aa746bc654ef4096a59723ea960acd7f3187a4df693cfc2dfb81cf58e9d44b44812d9b1c23b0
SSDEEP 192:sxZGRrWF/fqs0iIdpHKHW6+WNGY367EjIg57J:sxZGAF/fqs0LqHbGXef
TLSH
T1B322C8526E68A97B8CCBD20DFA15BF53E6F9503291D11E48A6FC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 93cc1c4d6c344b8c8fd12780e73ebf49a8d2f8dc3c241782077ca0bf2386fbd6
MD5 f41d9bd02aa6552ed156c576236e8cbf
SHA1 2bd9d734a334061741b606a46cd028bd6546444d
SHA512 4f2379d36423b339b2fdbda37c4b4bae5263d66da1a0e390a1eaa50e274bbdcd0037e44455f2b4b594657236f68c5f661c65e403bba27a461ab6eb0eeef9f073
SSDEEP 192:sxZGRrWF/fqs0iIdpdKHW6+WNGY36xEjIg57J:sxZGAF/fqs0LQHbGXgf
TLSH
T18E22B7516E68A97B8CCBD20DFA25BF53E6F9503291D51E88A6FCC61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6ae777b1c78bd5970416aebd87d6a0cc9bc00c5ea4088989aaa8b729685951ed
MD5 49bf9639fd335dfaeeeef55e134153ee
SHA1 dfdb777430d9f96793a6b28c5e2e40c0fe8b25fa
SHA512 a3db5a01112ef5b21c9590d7962805ef56fa009eba8e7e9697bb1e8a4732456b31b199575e37181b473ec36a1fb4c04a2b2acfd585c7ee40aa6187bd39930eb9
SSDEEP 192:sxZGRrWF/fqsmiIdpdKHW6+WNGY36aEjIg5BJ:sxZGAF/fqsmLQHbGXPJ
TLSH
T12522B7116E78A97B8CCBD209FA25BF53D6F95032A1D51E88A6FC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 965e770a9c324b028748f7ab72c76dd1893cdb41aaf10598feef612686b768be
MD5 cd6f8bb939d9cd0dbeebb719e1b23def
SHA1 0bbc47739f364920ea5554c3844e13d6c52bdc67
SHA512 37900ee9dc84da7a86e634d47f502a695eb4a782597ccd15a6ea0566a92209be85ce3c9e1f095dabdcb0f54205866d57698419712fa29deb37fb595cd761a0be
SSDEEP 768:phKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/2roNvo:phKlm7QWvUYe0u1ja8/L/E/NNvo
TLSH
T14DC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fd709bad4d62657ed0dda7e5389a6482b85e36c155374d4fbd6e1b4a2ee57da7
MD5 4398d5a09cd5f60302e666ece2ad3488
SHA1 8965d0b1e67b140cd43a8b95f8fd9422479d5d88
SHA512 87d8a9a147bdeb57d8bfe2e6e8d927e54200427f46ba38cf6ecc44370f2c2501821662d4b8528fe18eaacdba2488254513d5c60bbe6f5fd55e584958ba179c65
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayLo3uyYCmnb+l+ISKnK9m1cnxw3YNuRN:KIZCK6QK2/eKgIDTiK4YC7
TLSH
T16391FD46347B124038BD294C92B4D66F965232F23018EE6B7BBC54E68F6EE140DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b433.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6e5313c2d09037f8bd472591ffdacc263e9424f4a44d0e00ed40c9b74d9814e3
MD5 ec0c533ec26107f2d79ab6744c553fa5
SHA1 6e832541eeb4f0f1d629ddbda8283586af38b362
SHA512 480317a7ed61529e52c8cdd9a7347a87499794249b85cb5ec8389c1a2a7cc2a6ad07eb33fa90253152496195c9d615e94a4a6393ccbd66651ebd6e85bcd35dd5
SSDEEP 384:bZcIhsNkbelzmb1K8LQh//WIC1ehtgOIwZOyTL2o2:DhiwNLs/rhXs8Kl
TLSH
T1E7827D329878AC7A5DFBD181F04776039F748467D7C99F9499EDAB1D01EA498030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f2f6b122c32a0e086559747b8ce3228c51e7c40ce62c5007d8c45056ec15e8cc
MD5 0d5ac9c4b904ac933311233bfc6dfeb6
SHA1 a557fc988e0ce55f3dbd1dbf4c538098ed1710ec
SHA512 0e073c52fe030c0396498c4b070d73c9d3f2a018865b77be1f216763c839eab53a510410ff97141d0f7ec2d307e21e1eef92306f1bbce7c0ed58813dc1b4541f
SSDEEP 384:qiFiZcIqzsNs8TUNTUlIlOelzmb1K8LQh//WIC1KhtgOIwZOyTL2o2:hFQihwgzwNLs/9hXs8Kl
TLSH
T1C1A25C3398A4D87FADFB9A85F44A32139F7440A7D6C5EF94E6DDAB1D01AA0D8034BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a6d2de0bb532913ea930c36846ecf63ce5d0cb606ae71483cfa8f89d98d6b2c
MD5 85d64a2129f4922920078ba63c2ebb59
SHA1 85575a7c506e4d68876a9b206b4244ee3a904bde
SHA512 493f0f4f64ec2f9d9be2692d5e51bc1c50e428ee8ec071b5b664cb58ab52aa3e3a673cd6139df955d4eec449e5e5bc6af0b8124f888d42b0eca0c42a226dfba3
SSDEEP 96:KqONkLQsjpfbUmjH5ih/cIPURHl8h4otop5aaD9gBKP4v+Y1xf//ojdhxlDeYu77:BONz6JUm0QmiUyH9Eso//WA7MBC/PU6
TLSH
T17402C639AC68BCBB8EF39E45F04777239FA4106BA6951F84DAE92E2D01D755C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6c1074fa4270e574c2a2a3c6c3e556d17f92b3ae50c03f59c2bd143022b78090
MD5 1495dc401d88e719b5025fba054304b3
SHA1 6ebe6f6ebc7f2ea20e25b55718d0e11e8dff9117
SHA512 86debae9347c867ea07d9bed274b0661eb0c1865167c71fb58f3c78b318a985b8321d78df6c30816783a296356660aa033ebd95dbb3b47477325886942003cdd
SSDEEP 384:ZZcIhsNkOelzmb1K8LQh//WIC1ehtgOIwZOyTL2o2:xhNwNLs/rhXs8Kl
TLSH
T1A6827D32A878EC7A5DFBD581F04776039F748467D7C99F9499EDAB1D01EA498030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6511c98ed32d214bc19b057229ea18bfe919a491e1b470ceeef080b6fdd304f2
MD5 2303d2bb4ff6d9320cb12bcfa0ba8a27
SHA1 fd6ffb8d73898afc01706acbab8c6cdfb3379cb4
SHA512 87cf30edcfef8abe7d66642905347064d1cea2f2151b51d70540778c8bf4fcece401f74da5d25be5af5f3aeb5e479b87714379b824f47d67b02aa4b7b678254a
SSDEEP 192:BONF6JUy5QmiUyB9ELQo//WA7C1GezmNx6qpU6:BONF6+yXzLQo//WIC1WhU6
TLSH
T1DE120936A864EC7B5DE3A994F04736139E744167EB896F90D9DC3B2C02DB49C534BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f622e6c-0fa5-448f-a228-bd66db494067.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f622e6c-0fa5-448f-a228-bd66db494067.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db622f1ac1c9e67e662f0f4ae84adb515c31a2892db8871b09c42fb90668041d
MD5 b4350bd926d5ea45df69fa52d7a55d7f
SHA1 5599e92195fdca13e354f333691080da6de51b91
SHA512 433e9739759554184e68b47101218b30348fee4cc5bd039807f2dc5ee55bed9d78e47351c41ff312f4b35b7a0615bb7c0aa850c0a69ae21d4b310cea1f4db47b
TLSH
T14A411A5CA6F91148F3B7AF16ABF6A86D547AB9372E0AD49E10010D4F0A32B41CD72733
MD5 SHA1 SHA512 TLSH

Submit Download