6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-429995-mvsx9u.htm
Size 34KB
Sample260930-vb1h3sdd48
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3676	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{BAEF6F2B-7222-4AC2-A51C-48338514E301}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4348	512	msedge.exe	89
PID 512 wrote to memory of 3676	512	msedge.exe	90
PID 512 wrote to memory of 3124	512	msedge.exe	91
PID 512 wrote to memory of 3124	512	msedge.exe	91
PID 512 wrote to memory of 3124	512	msedge.exe	91
PID 512 wrote to memory of 4116	512	msedge.exe	92
PID 512 wrote to memory of 4116	512	msedge.exe	92
PID 512 wrote to memory of 4080	512	msedge.exe	93
PID 512 wrote to memory of 4080	512	msedge.exe	93
PID 512 wrote to memory of 4080	512	msedge.exe	93
PID 512 wrote to memory of 1460	512	msedge.exe	94
PID 512 wrote to memory of 1460	512	msedge.exe	94
PID 512 wrote to memory of 1460	512	msedge.exe	94
PID 512 wrote to memory of 1160	512	msedge.exe	95
PID 512 wrote to memory of 1812	512	msedge.exe	96
PID 512 wrote to memory of 1160	512	msedge.exe	95
PID 512 wrote to memory of 1160	512	msedge.exe	95
PID 512 wrote to memory of 1812	512	msedge.exe	96
PID 512 wrote to memory of 1812	512	msedge.exe	96
PID 512 wrote to memory of 4204	512	msedge.exe	103
PID 512 wrote to memory of 4208	512	msedge.exe	104
PID 512 wrote to memory of 4204	512	msedge.exe	103
PID 512 wrote to memory of 4208	512	msedge.exe	104
PID 512 wrote to memory of 3792	512	msedge.exe	106
PID 512 wrote to memory of 912	512	msedge.exe	115
PID 512 wrote to memory of 1256	512	msedge.exe	116
PID 512 wrote to memory of 1740	512	msedge.exe	117
PID 512 wrote to memory of 3976	512	msedge.exe	124
PID 512 wrote to memory of 3976	512	msedge.exe	124
PID 512 wrote to memory of 1328	512	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-429995-mvsx9u.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffa090c188,0x7fffa090c194,0x7fffa090c1a0
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,18343072735253393154,15071590177556894373,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11693764476915646639,9725138838526049622,262144 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14274436295563396384,8338486224696837518,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12032525911077970239,13107842727154605169,2097152 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12547619677309009150,12577795963098090242,2097152 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10512941123645856904,7940653040038077063,2097152 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4555228379172714008,17248582893718176887,2097152 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14550350843558746464,16784409698100756287,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,4373588249208407353,2879678353069877362,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,2858377242295178560,7615000293666614993,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,2858377242295178560,7615000293666614993,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,489752537684374751,6691387650146610870,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,13642726586701570322,1236526131057474215,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,14584826914874740963,8058632590545659408,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,13569668247151453800,6630307002265464592,524288 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2172,i,7871342099569123146,13955094131014458122,262144 --field-trial-handle=2240,i,190279116037496819,9672145486595194496,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4c3d8b4d172da21b08f1dc74642644a885942a18bd89463fc3fbd6b80c877bdf
MD5 055f18cc8baf55f6955fc51f09f27d24
SHA1 f278e3c9acbcd4a48531d7e3ee3d67ec408b8a2d
SHA512 7d56dd04262e626b602c4d4e3f1369d294fe2d30216953632ddc16e3716fffb78842e0e8cac7790be79219336ec4ebcff9bfc66f96c193e6c2e2c5b8c62e26bc
TLSH
T1EF61F98591A00F5BFF98003892F672BF3674A88288C3DD6E30A9F8795C5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eea1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eea1.TMP
Size 3KB
SHA256 7abcb7a2009322a5b2b7cfa09ebb5f0609347dc002ed116bd009531af286332e
MD5 f5a9b761887a672cdbd57f7ce66e7c46
SHA1 b3d967961b027da6c41de5f1cfccc83fb350658b
SHA512 94b1832b4505ca03af314b5d4f20e44a9ade83d5f8488e201651d706285a26cc3599e8517ea23060842f51ef176b86ca7a9f2224ac5e982478bae8e4964b3733
TLSH
T1B161F94581A00F5BFF98003992F672BF3674A88288C3DE6E30A9F8795D5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a31907c535403ee8face4bdfab286e8fa243ccc45dc3cd79b0ddc57a07a6c54c
MD5 e26af2ab71d234b747a0f5e5ab1491f9
SHA1 d41b048a4da03733531ccd3a7c446afb162e2c81
SHA512 5cf33fd26e37d7ef3477d3ed0d51715cdf7804e8180dbf0bda37093df4fb2a98dd007489b96927b7282afc169b636fd33a7aa3dda19f6de57e0618a4c8598a42
TLSH
T196117DF3C3D595AE89011AF05A24BE2BCE1D0605421C7D1AC5D4EF27D3E3475E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8ebb7d3f8004a5e3c1a08445ee17e93df9adf51a2004ba618026e84114943258
MD5 76412490abe0b026667800c8c85fd942
SHA1 4498f69fc414d0b99eec1b7123ca5348c4c7abe7
SHA512 12dc1a7f2117e5d37ed40fb6f201655f835ad8c27a0242ad94080bc941918b1d77cb099dc2b79eb23cac3e3d1b1d9a338a2577b36ab45ed47be2809bcd637016
SSDEEP 192:sxZpRnWt/fHsjjcIdpd+HW6+WNGYaQtIIgrJ:sxZp4t/fHsjjFwHbGH9
TLSH
T19312A6116E68B97B8CC7D21DBB25BF43E6FA503251D41E48AAFC951C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 da618dd020b6bba14ef6c9df140b79e59632d6089f653e350a969fa70dceb057
MD5 097cd3275a78c298faca064b3d9f5f4b
SHA1 623c3ca6b6cbefea3ceec75b47565670d209d75c
SHA512 6311e6b1df4cac5cb82fe65ee89dd5b6bc946b723ccc93ea4f8f7432ccf558b27df4a1d79129a68a9a81b3a97fb85190bf02ce7835bfd912f4fc2ef06048807c
SSDEEP 192:sxZpRnWt/fHs9jcIdpH+HW6+WNGYaItIIg5VJ:sxZp4t/fHs9jFeHbG/V
TLSH
T16122C7516E68A9BB8CC7D20DBB55BF43E6F9503251D01E48ABFC961C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2ae34ad9d9d5adfc4db93b4bc7393082b47c221b4b345399bf72366224106491
MD5 80ba25a71bce272a8b2a0744ee2ebcc1
SHA1 c101044e7ee1bc95e6acccc7709c228b763becd1
SHA512 e31ab59377accf615ea7f9b4dacbd3bf98eeb5621f6b071fd51da074036780b3df17d1eb90599126e46e092e07998fad488a1359b80f19ce31abb7f8ef7c3a4e
SSDEEP 192:sxZpRnWt/fHs9jcIdpd+HW6+WNGYaJtIIg5VJ:sxZp4t/fHs9jFwHbGkV
TLSH
T1F222C7116E68A9BB9CC7D20DBB55BF43E6FA503251D01E48A6FC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 faa3bcaf62482b9bfab3c17d47c48ba6e5e2b8b29ca98ca795093025800ffc5c
MD5 5fcc954aa24670ab412f3f0cdf5b8c88
SHA1 fa3d67beef58d3f0fd82b767c2fea3167d9ae6ff
SHA512 9e146bf33994c83b9f798af1131c9d453042e5d24f891d024e965681022a37b7f9779db2e11e36b3fd67f0da508b2311fd6196d3ac93d06e4b0eb2f4ec4c9d6e
SSDEEP 192:sxZpRnWt/fHsHjcIdpd+HW6+WNGYaQtIIg5HJ:sxZp4t/fHsHjFwHbGHj
TLSH
T18422A6116E78A9BB8CCBD21DBB55BF43E6FA503251D41E48AAFC951C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9c742bc44fa1ac135d954dd5d2782b686d3d2d3f89eaeb20d3a654fd16c6e735
MD5 4ab4d39e7c151e8d03bed220b3f8203b
SHA1 1c15bebe3af8fdccc1fc8ced6691a48da11c507c
SHA512 b37a2bc12a6e6a9459aeeede54d5f80bb137e0117bdb58dccb2c89273923e72b902658a6218c994c3cafae176d54284cb4d106aee199e6cf8e30570b64adfd6c
SSDEEP 768:ubyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3Nro+Zgl:ubyQRbrWvvlpZu1jaXKLf33m+Zgl
TLSH
T11CC2FA2B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e45abbca30e08df9b3b7731a86f15c0b14b19f017a23de5577c875845dc00f4
MD5 1c9fe0ac69ea8bd5f31cccd1f94989b9
SHA1 9dff498f334989dc8516486a4555be2665acf74c
SHA512 2cbf3ebc7887d2f065cc6467a79b597f22b9554a90a5de04e95eee80be915536f4be5f5249c729f55defd255b5e5648259970daa625c914fff6193cd1e6038d2
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyL6lI064I5bkjUISQdIZK2cELytTINKX:KkyAKvqe2d2dGK2ciGTSKscl
TLSH
T193912110307B0350797E389981E5DA3E524132A37519FA6B7FB800B68F6BE484DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

215efdf0-c155-4e7c-8e4b-a2df76b3bb84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\215efdf0-c155-4e7c-8e4b-a2df76b3bb84.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c60358eabd7f9fbc58931bb7ecc2d416b47c41d7364195b7ade9af6bf7b3eeb
MD5 138f0595ec33799ce488188482c8748f
SHA1 d8593d25f8baadb7e0aa13fe64bbb1517afd00c5
SHA512 f03291de00fea5d0324e475a19ac6be412ed4feec9f0a6fdaa6f8dc6f7c8928b201a4908ab8448fe08d148d27691adfc63df41fdc7e8dc48083facfa05bb5bec
SSDEEP 384:iZcIhsNJrNP+o5wnHQdmp5u8iNL+PtgOIwZOyELUoS:QhHYd0k4PXs3wR
TLSH
T174827C366CB86CBB6DEB9554F44736035F78846BE3C8AF84D8ED6B1D01EA994030B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 4a7d901f9bc7d89de1107c0ca16d891fd016a0089dd6530bf4ee870ab1f368f2
MD5 dc414ee7d5b70965353a3eaa86695ebb
SHA1 4786a60fca6d154a0f825448db170726d9bec727
SHA512 2ccafb1879dba7447d2241ad73937fc8a94fc86b1a9ddd9021cdf9656d633fab19abc4750e6cab55de32a08f3ca08d4641f261c82b8dcb5534c28904bb8a56cf
SSDEEP 384:viFiZcIxzsNr8TUNTUlIlKNP+o5wnHQdmp5u8iNLrPtgOIwZOyELUoS:6FQB2wgxYd0ktPXs3wR
TLSH
T1ACA26C335CA8AC7FBDFB9A44F54A32038EB4417BD6C5EB94D6DD6A1D00A7598030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6692b853af39e6628be5895a6a69427ffe66eda698bf7fed5bd42d49114d5ef2
MD5 90e8ca3bac96b932607836cdc34350cb
SHA1 e530bbd3276136d212b2d9dfe736668b0e8c8e1c
SHA512 51735e0acb3dfd59c68d806c01c972ba0bde05f28496722074a00d660a2956ba94ca15c250421b8cc48b8721dd0aecf87d267a9d360999016c62be1e6e7ce73f
SSDEEP 192:SONU6iDCQmiUyeEHq5u88PN0SqgEBxsU6:SONU6/oHq5u8iNkd+U6
TLSH
T16C0209386C787CBB9EE3AD05B44737175FA8113BE7942F84DAE81A2C01D768C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c78b1c3babde763a32a27ae7edb31925e13d7b7fff5d889bce78b1cb4e180b53
MD5 22ae0546cd6441210c2a712cdb5adf87
SHA1 a1f94376f2ddc61b0d9bb0493f3bc1cce2ae7d3a
SHA512 6f5dca7217ef2515a0f01df0601af20f0692ad934bf8a3f2c8ec8271e4b8f08fd694532260a694de5b7d1e6e922162b49a6af232fb6ec6f72e468a6a3d986584
SSDEEP 192:SON86iDhQmiUyLEyq5u88PNLbet5uZg4qgU6:SON86e/yq5u8iNLXPU6
TLSH
T14D122936A878BC7B6D93A860F48736139EA5426BD7886F84D5DC2B2C01EF59C130B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41a3bff2c440e706b111d846ff8eb578a3e129cc7b662931e3747fac3bfddb34
MD5 9a13a16b9dd12637e33ea7d1a079d964
SHA1 e34390e9262d20fb8802dc1b42f435cb989d681d
SHA512 cdff2a58e805cab51d56efe8ebf8d29cb016d5695829c3414df4348481c68e253552279fb9588d61c155c62df1022d98010d1ba18b0ee6149469f0e11a4ff71c
SSDEEP 384:RZcIhsNJKNP+o5wnHQdmp5u8iNL+PtgOIwZOyELUoS:5h+Yd0k4PXs3wR
TLSH
T1FB827C366CB86C7B6CEB9554F44736035F78846BE3C8AF84D5ED6B1D01EA994030B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5af570f5d71c890ffb90191740adf55fafb1787ccbb318b7fb4f34688e7c4b74
MD5 59c9a10bf7a6fc40975c70df07e65a15
SHA1 3f1a86774d8d15f09f9d31d322a71ec6029d9a68
SHA512 29811910b902d69efec95a1d61c8f021c1a58ee43c1137490f7de5bb4cb65203c3144359dbcc51de7475a811b52fb7cb8184428c11711a6fe4739638a5ff63c2
TLSH
T10C412C5CB6FA1148B3B77F5AAFF2986D487EB8772F06D45E00110D4E4562B00D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download