5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-429995-wqvze6.htm
Size 1KB
Sample260930-tzpaaach96
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{F9B5D86A-CB8B-447A-BBFC-ABCCECA710BA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4672	1196	msedge.exe	87
PID 1196 wrote to memory of 4180	1196	msedge.exe	88
PID 1196 wrote to memory of 1884	1196	msedge.exe	89
PID 1196 wrote to memory of 1884	1196	msedge.exe	89
PID 1196 wrote to memory of 1884	1196	msedge.exe	89
PID 1196 wrote to memory of 4512	1196	msedge.exe	90
PID 1196 wrote to memory of 4512	1196	msedge.exe	90
PID 1196 wrote to memory of 4592	1196	msedge.exe	91
PID 1196 wrote to memory of 4592	1196	msedge.exe	91
PID 1196 wrote to memory of 4592	1196	msedge.exe	91
PID 1196 wrote to memory of 3068	1196	msedge.exe	92
PID 1196 wrote to memory of 3068	1196	msedge.exe	92
PID 1196 wrote to memory of 3068	1196	msedge.exe	92
PID 1196 wrote to memory of 2368	1196	msedge.exe	94
PID 1196 wrote to memory of 2368	1196	msedge.exe	94
PID 1196 wrote to memory of 2368	1196	msedge.exe	94
PID 1196 wrote to memory of 4768	1196	msedge.exe	95
PID 1196 wrote to memory of 4768	1196	msedge.exe	95
PID 1196 wrote to memory of 4768	1196	msedge.exe	95
PID 1196 wrote to memory of 4280	1196	msedge.exe	103
PID 1196 wrote to memory of 4148	1196	msedge.exe	104
PID 1196 wrote to memory of 4280	1196	msedge.exe	103
PID 1196 wrote to memory of 4148	1196	msedge.exe	104
PID 1196 wrote to memory of 1260	1196	msedge.exe	106
PID 1196 wrote to memory of 4996	1196	msedge.exe	120
PID 1196 wrote to memory of 1192	1196	msedge.exe	121
PID 1196 wrote to memory of 2064	1196	msedge.exe	122
PID 1196 wrote to memory of 3248	1196	msedge.exe	124
PID 1196 wrote to memory of 3248	1196	msedge.exe	124
PID 1196 wrote to memory of 3416	1196	msedge.exe	126
PID 1196 wrote to memory of 3416	1196	msedge.exe	126
PID 1196 wrote to memory of 5008	1196	msedge.exe	129
PID 1196 wrote to memory of 5008	1196	msedge.exe	129
PID 1196 wrote to memory of 1792	1196	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-429995-wqvze6.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff9d26fc188,0x7ff9d26fc194,0x7ff9d26fc1a0
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,6917386511793051014,11030202102606340302,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13955293250394484626,13808875333022573247,262144 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1836389561168474292,5492638399603301872,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11486762514690004022,18165268103071265372,2097152 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16681723405983466864,11464492189116831767,2097152 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,6182234087627072727,9801525563940673273,2097152 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,212647224186680437,12892220900111817015,2097152 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,18445640778141778632,17574816677992571720,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9049633653235898228,4811582351927404912,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,16660496295663191603,17518570269264099849,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,16660496295663191603,17518570269264099849,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,11711375552727327251,7908703053069604381,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,15507060515225577080,14631448571008076843,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,1737187734883873976,4437918730234521080,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,11287667134687861384,9032599325889898552,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17883978224211636435,12968592855721935059,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,15322440187684700460,4217514274890262958,524288 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2788,i,8385573228912070359,17762852108922529015,262144 --field-trial-handle=2240,i,3286124980384217965,9314766180025041209,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7b0eccf48fe82cec3641fa05efdbeb5daaadea3023bda5883e0db27f7e687523
MD5 a6bb55e546aabf18d8865861d9510e23
SHA1 3aadc56d5d84c5fa6f6347e83e25eff851ea561f
SHA512 ff5e671f5174519ad7edb95ce6ff0f1307fb3e9d90eeaa24c68141d58af7d178d05f2f17dbf3ac6b618b0256c4c83b9d5bab291c3421f250ce5690cf4dd84389
TLSH
T150E0268546C8C32EE20EA44F43689B2CD3E03F8ED2CCAE1E27008488B041048E2BAAD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4809fad6a70ee0fb043f2acf78819d584bf37117824f992ca34a9700b00d3fc4
MD5 f12b60c57c0d00e80a4af68602315642
SHA1 af2a8568aa60fa5d9766bc867e527d9b05c7c2b2
SHA512 6b806093d2efae368bae58583d30c4f7d57e19b128f9fea6c6e15220bb7ece9af9bc28135c5891cfa795e38e6ef961e1e1155c769ce2d6e25955b4cf33655dd3
TLSH
T185612C9F95709A91FB99613163DA35C334253483A6436FB310F8EB7858BAF571ACC0C1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4dde5e0563abcd200b5c02b70d521340f62b8e899b63d281acbe292f7c34830e
MD5 8aa6aae0d99eea29262abe7fc67a44cc
SHA1 dd6c959484ed30b704ebc119ee59eed2ff28f481
SHA512 c599f0fd007ee433d25f72414494cdbcc81470e859e79148d7adf9ad989aa5a6e49a43f76c267c587ca62c1344edadb2862e7f99aa12f9601bf3f82f7016cebd
TLSH
T11411BDF3C3D585AE891156F05A28AE1BCE2C0505421C3C1989D4EF2793E3475E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3f174bb93119dc21738bb77b465db6b3c0fb874f1cd05c287161b6c1f723f3af
MD5 81f12f5847ef56fcb10a94e90dc8e291
SHA1 1fb6a983ab5301396ff40d9ee2857060c72991f0
SHA512 029094d018c676ac9d2877e30a25b15b89c8bedc2fe3d9e5275feca1edc06ce7ebb401203b01a6d78718af0c988c01cec6604f3a76d47933016a1952a5a931c4
SSDEEP 192:sxZVRAWC/f4sJhIdpdKHW6+WNGY3RPZIgrJ:sxZVFC/f4sJKgHbG29
TLSH
T1C122B8116E78A97B8CC7D20DBA15BF53E6F9503291D51E98A6FC861C04E7ADD120BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 34aed6ba3ad93cecc5ed03f3aa8aca53b07d106540c28ce869bf4e1edf5938d7
MD5 f5f8affd3a78d501aa3e22a2e5aca8fa
SHA1 3144b14e1e9edb1886f9aae45f7deef7288c0e43
SHA512 72bdde36b2adc33de4047a86ba478fff4f534286fb08c6a9c470c66db8a344168de159fc7ea22be236261817177f40a663d28fb7d3bc22dba9504469bbaf0c0d
SSDEEP 192:sxZVRAWC/f4sQmhIdpHKHW6+WNGY3bPZIg5FJ:sxZVFC/f4sjKqHbGql
TLSH
T1F822D9516E78A97B8CC7D20DBB15BF53E6F9503291D11E88A6FC8A1C05E7ADD120BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b5ccf3a673d8f29b3e01887e723a103c2b08938d4c9d27d4a8cec3b754ef86f9
MD5 964780737c9da9fcaaf02db9778e2ae2
SHA1 cd781a4889f59c398f0293ea5a7017dc15c15065
SHA512 a86830b18c583137d5654fab73a707a00338b2779befdae7c508cc9e6c7e00da73875123057d42aaebdaa39230b0f5a8c7d2923d72744e810389c66a9993a83c
SSDEEP 192:sxZVRAWC/f4sQmhIdpdKHW6+WNGY3YPZIg5FJ:sxZVFC/f4sjKgHbGtl
TLSH
T10722D8516E78A97B8CC7D20DBB157F53E6F9503290D11E98A6FC8A1C05E7ACD220BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 723b85cfa032a0bc367fec24022ae5f208e4a1d39203e37f3162d6ae313f30bd
MD5 36560edfc56e21107393f91426717b26
SHA1 1224b6d6cac8612653fc3dca225673d5cd70c134
SHA512 825b98ad078532a570724688689daa4a57832d9702b6a1d71ad91a2ad97378a7bb00515b71e26a5c06b69b59406e7feadc5299eac0bab68ccf936a8e0c3b0e88
SSDEEP 192:sxZVRAWC/f4sQuhIdpdKHW6+WNGY3RPZIg53J:sxZVFC/f4srKgHbG2z
TLSH
T17C22C8516E78A97B8CC7D20DBA15BF53E6F9503291D41E98A6FC861C04E76DD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 01de44399e47f2b3fd163cbffa65311481e41228854bb575094872958323ac16
MD5 8bb0cbdd9f0396123d853882eddf789e
SHA1 bf1fedf6f024321c2db3ed9bb4a8075575c27826
SHA512 ef406dd007ed6c9cfc1eb0267372694ddaef0342f7b8a0d72ec5b3c8554d9d5cebeeb9abccd81baed998babb03132c71fe47212e22a5259bc4058c012f2be910
SSDEEP 768:9f30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72SrolZM2:9f30AbSWvS2l9u1jaLmLZ12Jx
TLSH
T166C2DA3B644CCB7E4FC01A9DDC6AAF9B6F9802C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 346c0b1ec8d4547fa2d34739d4aacd6a3c63293cac52f84ab1477920aec59235
MD5 769ad21acdf739d1fa33148df1c205e0
SHA1 05a914f2197fc706ba580e4094f4fa418f0429ff
SHA512 0ae90e038dc02d7eb658ff659feb1fb62ed409f1be06d282fd4cfcf1831f93c624f5d070a363022f6f7468dda7b0f97aa3d43913965062d772fb9b235055bc33
SSDEEP 48:K0TW3Td1FGbV4tISTGK9D1xGxbWYgBzXyLQiQtQwQcQiQAQgQxbQ8QLQsISQ0Qxw:KE0AKdGWCsAKp2qioKzqqWz
TLSH
T1CB915411317B1392387E6588C6A4C66F438231B27158EE2B7FBD40668E6FE194DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59621b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59621b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c28ae4208d6722e0005cebc544e9415d18b1899f208b116a9fa0878e98b0bfb
MD5 6b4a76cf8b8a943070383f4a6c83ef62
SHA1 989c5e4e17ddf13a2da34dee4c9cb8bf1a17fee5
SHA512 d8d2f3c67ddf07e45484111395292b736b5ef4c241bb1e314d395abd3e3d0e04ef8c7c71b78ac2d7771d2d11b02bd9ca6833c8d6979d38ce4b07b57847612dca
SSDEEP 384:EZcIhsNs/P/puDvS9iX5F1WwVZh6DKhHeoc:ihjuWaQwfYGHeL
TLSH
T10B827C32DCB86C7A8DE2E546F4873A075FB88143E7C86F84C5E96B2D41DB2981317D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f02f24c20d09a76b26abb48f3c27173ea26c8f038215f8465a20c080f3ec9dd3
MD5 b73b44ebe24aca23546e5e64c9c9cab2
SHA1 ba88af83fb92ce107966db75d653c70f6f571285
SHA512 881831097c6b87aac247178fbb18204d55a15ab56065f895e9aad32e504974a08341272cb499a5b54ace8bed35d1120358e54c66c88968812d8bcbcabdc8337f
SSDEEP 384:JiFiZcI7zsNk8TUNTUlIlCP/puDvS9iX5F15wVZh6DKhHeoc:gFQv1wgCuWaLwfYGHeL
TLSH
T172A27C339CA8987F9DF7DA46F94B36079FB48153D6C8AA94D2D89A1D00DB1DC030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 99d02b2cc7c0e0415eba00e82b0884b18fb7c109b391199eba4ff7255258087d
MD5 cea1c3804208737dc6d9681beeded496
SHA1 589c0036ce2576b200abde312b5dcdceb12342f4
SHA512 2389939e6425ea54cd24d2509fe066728a2b5c2c67c53849d765d8d3d3dd92c962912446f224cc17f30b6ad4d34e8ba70ed8435890a62b95836d0d0cabf99bfa
SSDEEP 96:gqONkdQsjpfuMVwptaL5ih/cIPURHl8h4otop5UOiCDaBIPuva6zx8X5FxmxQWm9:LONl6AmwprQmiUyDK6siX5FqmgJinJU6
TLSH
T14D02FA35AC787C7B8EF3AE05B48737179F95112BEB942F84CAE4162C01D729C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4b8d66ad115c68dc3d6bd7439e36c882606ad2d9b14eef7ba26c5e588b273363
MD5 83c1722410055fce9697f18ba8492807
SHA1 4d4f27283819533b94f041301c2d8102ada03005
SHA512 42ec99047696de082f62d50eb6fc6124432d475e08dfcbf214627944a5e93235ab8424d517fe98b6fc10a8a55e10e6b1e905be0ebf4f131d01db36d13953965e
SSDEEP 384:GZcIhsNsCP/puDvS9iX5F1WwVZh6DKhHeoc:UhAuWaQwfYGHeL
TLSH
T14E827C329CB86C7A8DE2E546F4873A075FB48143E7C86F84C5E8AB2D01DB2981317D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6490ab06f9474f991d3be36187b91540ba502cf8fbc56b8132f5e7f3ee45a472
MD5 f0da7102667ea5135ab83e6fc6ba8654
SHA1 be890593e46a427327bb91ba76a33d62b63b9de3
SHA512 53bc84d36ad175644bca2b31a9e7adfa2be59b39a372f7919775be114d36675db9abd315863608a28b077ffe4ab3c08c8cc4318f897b043783b536f0876ab802
SSDEEP 192:LONt6Amwp7QmiUyFKOsiX5Fqm9GglROgqZU6:LONt6iptZOsiX5F1nwU6
TLSH
T137121A36A8B86C3B5EE3A551F4873A175FA58217EB887FC4D5EC162C01DF29C530B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d26c11d9-46e5-40b0-b029-7f92e5007aef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d26c11d9-46e5-40b0-b029-7f92e5007aef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2dc09bc10d82662203e36d4c713a4bcc488d2c78608593baf6cd8d36f6c10c5
MD5 bd2b8d09e6c394674dee12cc5d97d55e
SHA1 ae8466575b135c5f0b479070f244e0fc7050a224
SHA512 ecc2ff1ef2005808ca08dec43921a701529cdea48da277270c53c01488a47ef40dfdd7c7085bbef5c5956e6e3d1b9961f3dfecb62777cedeee4539d211d11612
TLSH
T1DA411B5DB6F91108B3B76F5AABF2A86D487F79771E06D45D10110E4F0A26B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download