3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-429995-ot9kfx.html
Size 171B
Sample260930-vbqzmsscph
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{D352C282-B57D-4EBE-AEF0-5B86C64A7156}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1576	4552	msedge.exe	86
PID 4552 wrote to memory of 3244	4552	msedge.exe	87
PID 4552 wrote to memory of 1896	4552	msedge.exe	88
PID 4552 wrote to memory of 1896	4552	msedge.exe	88
PID 4552 wrote to memory of 1896	4552	msedge.exe	88
PID 4552 wrote to memory of 2624	4552	msedge.exe	89
PID 4552 wrote to memory of 2624	4552	msedge.exe	89
PID 4552 wrote to memory of 4580	4552	msedge.exe	90
PID 4552 wrote to memory of 2596	4552	msedge.exe	91
PID 4552 wrote to memory of 4580	4552	msedge.exe	90
PID 4552 wrote to memory of 4580	4552	msedge.exe	90
PID 4552 wrote to memory of 2596	4552	msedge.exe	91
PID 4552 wrote to memory of 2596	4552	msedge.exe	91
PID 4552 wrote to memory of 4644	4552	msedge.exe	93
PID 4552 wrote to memory of 1956	4552	msedge.exe	94
PID 4552 wrote to memory of 4644	4552	msedge.exe	93
PID 4552 wrote to memory of 4644	4552	msedge.exe	93
PID 4552 wrote to memory of 1956	4552	msedge.exe	94
PID 4552 wrote to memory of 1956	4552	msedge.exe	94
PID 4552 wrote to memory of 1084	4552	msedge.exe	102
PID 4552 wrote to memory of 1084	4552	msedge.exe	102
PID 4552 wrote to memory of 4040	4552	msedge.exe	103
PID 4552 wrote to memory of 4040	4552	msedge.exe	103
PID 4552 wrote to memory of 2796	4552	msedge.exe	105
PID 4552 wrote to memory of 3676	4552	msedge.exe	114
PID 4552 wrote to memory of 3784	4552	msedge.exe	115
PID 4552 wrote to memory of 4208	4552	msedge.exe	116
PID 4552 wrote to memory of 2296	4552	msedge.exe	125
PID 4552 wrote to memory of 2296	4552	msedge.exe	125
PID 4552 wrote to memory of 60	4552	msedge.exe	128
PID 4552 wrote to memory of 60	4552	msedge.exe	128
PID 4552 wrote to memory of 3060	4552	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-429995-ot9kfx.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffc17ec188,0x7fffc17ec194,0x7fffc17ec1a0
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15990465048883514321,8120389537789955737,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11280704735567385995,3674850439663471020,262144 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,7388258642467059693,15457281206005396386,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,14452245085372020986,5652379321522162790,2097152 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5656800553771350935,10379481394707258887,2097152 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,567552683743355025,9683103732233343013,2097152 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,2128756887195502462,10186237843917846212,2097152 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,16222819757818121935,10989965725588621083,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9114119576191142839,17052769154315121992,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17130783510312983567,15475410974512890353,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17130783510312983567,15475410974512890353,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,6768773005717758635,10307629102723001976,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,18213287827157439610,7034378172515610517,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,4644121389111174530,10073828849924630629,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11771520192141307984,16343923324176306560,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,13015039792965147040,13192443001435267028,524288 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,14708058792056803048,15520363059735618655,262144 --field-trial-handle=2332,i,6931821361565969369,17603816068426867132,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8b1bc9e4-db7b-4c19-b53c-d3d62e119c54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b1bc9e4-db7b-4c19-b53c-d3d62e119c54.tmp
Size 8KB
SHA256 6f28aff0eec112a340ecc444926428985d92294610a18b9de446b106e2ea4275
MD5 dbf5f9ec69374e0821a6ded41fe473ed
SHA1 b7de6f985b381367a563f8ff45f90ae7b1cfc52d
SHA512 40617e1452ad29f67eeb49841e1ed3c35f72d609a464dd21183366265039b298d490a232807a836f31ed76189167d1d9c12630ee40635700d98ddcf1f363d564
SSDEEP 192:EON76nnHGQmiUyjYQYcX5hQDP1UjzorA1WXMcIGU6:EON76nCvQNX5+DtE8A1WLvU6
TLSH
T1D402EC35F8787CBB8EF36D46B08637136F952167E5946BC4DAE81E1C00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 24ed9f35208fcf8f50c746a42f61c871860352e70d67bfd9eb54f1f211c3c088
MD5 acd1c57515ba43eb5fcd56ed19e56897
SHA1 e24f2884b8aabeda98a55d49674c1191d60b1024
SHA512 10226e6847b4bba504ce91398a1ded14dfb43b96fcda325f3152ff76e4dd751fda681a4738767e5090a9b51a99b62dd4d5847286e591399d2b1380f802a9b714
TLSH
T1A761978257934C90FF9885BCE1C5258B39B0E44B9FAB9E5F0DB4C87B5836314D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a25.TMP
Size 3KB
SHA256 67dc45b3478667450334044b1b0e9bbb8347b636afc0f7a714882f4ec8641923
MD5 b6f7ad3a35323b2fa6b67b1b57d43de9
SHA1 f7845549f07b7766a58823a8d4beb84d4bfde3fa
SHA512 68d8917b85461d5d88a7bd5acac3ed30b7aaa0a1ec7a1b1369de80082f21a576e1550eed4f44a90389db14797f650a5d5cc98c8ea74cfb36f8d29df1d6fed409
TLSH
T17261968257834C90FF9885BCE1C5158B39B0E48B9FAB9E5F0DB8C87B5936714D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fa34a1eb59822f41cb9c55889b7ab8c6087db072c649413c426482501c3c83ca
MD5 2b6a737d870e00ee64c4e4b5fda804ff
SHA1 71bc25f3710e86f4efc8e0a37d1af48f335c2598
SHA512 7f941ce8b6fd5b79e88d3c3c52736128da501ad6a5a479277b1c1914422dace00c591d13e9a7e8cd4d7aad5ccaa4e12565be7305e7087ff481b462f609b6e411
TLSH
T1E6117DF3C3D585AE890156F05A24AE2BCE1D0505431C7C1995D4EF6793E3475E00199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9ec7509354327dfdd74961e0f15833a5a3bdb4beb7e0e7739c0b1d9ba8f73c3a
MD5 83ff49759cbf454ea924400dde7363b0
SHA1 1f019a976e7c862e965dde2ffc6eea3eda9d66e9
SHA512 7a39581eeadfb910e00c59e9b7841d2bb568cf9f627a05e1878112744817fe0b9d8884ba5d98084356c569d365e740fdc844f8462ac65201734310894c630d04
SSDEEP 192:sxZIRSWY/fJs20IIdpdXHW6+WNGYYBadlIgrJ:sxZITY/fJs205xHbGf49
TLSH
T12E12A6116E78A57B8CC7D20DBB15BF53E6F9503251D51E58AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ad99b96359e370a003a8fc9f8928911d00e953607d711bbf95c80859eee396d6
MD5 2f04fd50a11f27ed5364526ac093c596
SHA1 540f385cc63b3a595f448b01c5f27c6e38b3a6fe
SHA512 82a0dd34168633c90f688140f209e7c826866eff5eb5736317ded1d2e8cb56f64b017e52ab87afd26d454611369739e75b8001d7208a5d399a27100222b8e6a3
SSDEEP 192:sxZIRSWY/fJsAIIIdpHXHW6+WNGYYBcdlIg53J:sxZITY/fJsAI53HbGf6D
TLSH
T1FC22D8126E3869B79CC7E20DBB15BF53E6F9503291D11E48A6FCC61C04E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 728e87bd25af55aa82fc2bad3aec15a410b6047c3ee3734247fb3eb20eb6e8e6
MD5 163d34f4c654d16633a291887293c43f
SHA1 7cebd0dfaebf86a0dc68c3cb68301a13ac5e55c2
SHA512 a50a9ce9e0440470d048c930f1d056ed0ea4ea131cce5a801657c24d3f5044f2f267836739c8ed282aa2e4d9edd0c202975556f3f0ff99c7f7ebadf343040006
SSDEEP 192:sxZIRSWY/fJsAIIIdpdXHW6+WNGYYBrdlIg53J:sxZITY/fJsAI5xHbGf7D
TLSH
T1CC22B7126E7865BB9CC7E20DBB55BF53E6F9503291D11E48A6FCC61C05E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 273e26d273af26d0f7a329677e207738ec36f939b9d3f3d2beb7033e44b608d4
MD5 c9bed3c8ac217ac3d979f3f08d40ca3a
SHA1 bbaba7719b00dba9075b2c7932248b1987226d4d
SHA512 1a4e42f8d20f75d6bde87b68376befdb4db7f635162325c03090aa4e50687ca4345b44809b6e75bdbaae2df4efc11c1d1272a6c3611dffa470af26008a45386e
SSDEEP 192:sxZIRSWY/fJsA0IIdpdXHW6+WNGYYBadlIg5dJ:sxZITY/fJsA05xHbGf4N
TLSH
T17822B7126E78A5BB8CC7D20DBB55BF53E6F9503291D51E58AAFC861C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2475841ba14ac5c49131352a93402becd99b949419e89279b4c934b0d04dfa5b
MD5 2baad2190a6d465b377c928290f292de
SHA1 fa559b8db5eb3cacaec88993f4583c1fcd56ab52
SHA512 d2646a2d9cdc31b5ced9ad67398e7ac1f55a98094150aaf38fc35c1f5909c1657ef1424270e2ab2a76fe7a3e2bfc8ff5389f232a5e43339cc991e9173f498f6d
SSDEEP 768:k5yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXHrop12Xr:k5yYR7jWv3NpBu1ja/CL8OXUg
TLSH
T1F3C2E82B640DCB7E4FC01E9DDC5A6FDB6E9802C796548D4047FA984C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 df7ca9aa394f1f02af1fa8c5fffff2e73fe64ae9e701656f6c2cdd3c358e4c9c
MD5 3267121f3886fe0411837772406ac93f
SHA1 c23853cdf41f8ff3623ba6d872639ae42857babf
SHA512 4400db2f08db3926f6c4b45b1e9ba609dc90b0c2a7d759b6bd67138e906cc04f494491c32fb1ab8ab3cbabe45c49cc13afc90989da9e689af14743c028f2ee1e
SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYY/:KAmYKDKmut+KmsNfWKIY2CL
TLSH
T10E913010727B1344387E299882E5876F564231A27459EA3B7FBC10B5DF2EE085CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b6c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b6c3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83506f3cf3034aa0cdab9c8f5a84acec9e590ecda5504f762c951649448c5b03
MD5 01101a56089697e83406050012f65343
SHA1 a9d7568136aae040671e53f39d93ad3624d84b83
SHA512 1ebdfe2ac2bbe74070ffcd111b2a94d7f07078d47c027eaf746f79568cae4a2b2a5be02e3dec67726a4c3ece65d7a237542b7403ca8f33fd3655e2198f8fdb3c
SSDEEP 384:/ZcIhsN5nzUikN2QX5+DtE8A1WpXMS/UtgOIwZOy7boT:XhNh9kDrD/UXsyo
TLSH
T1F5828F3299B45CBB5DE7A145B18A32035FB85027D6C47BC4D9FC5F1C019AAA9030FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 fd52bd234f8b644df83f03ccc272434d11c07a58479a87c77e6718cc7b908756
MD5 d8daf878aa1df52f01f8d9742c058779
SHA1 e11cda0e80bf479215541d739e0d2ebde9e0c60d
SHA512 a5286725b0024f644b3bebb02b3f9902d79b65ccc8b6a0976350b922726c168c596acb53fdfbfc66d14b9f290486fde740a36e7c97133d479f83cb6690bb1bcf
SSDEEP 384:h+iFiZcIUzsNb8TUNTUlIlSzUikN2QX5+DtE8A1WpXMe/UtgOIwZOy7boT:LFQo+wg7h9kDrt/UXsyo
TLSH
T119A27C3389E49CBB6DF79A85F18A32039EB55067D5C4ABD0E6EC5E1C009A5D9030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71daaa94cac08b6c71c82012e4f2cc6a7710b13a326fe99521385ad122619643
MD5 1c404d49f58de394b9a47a66f74226b5
SHA1 a517f6f684fd24b4feda9b442aa3e2fdcc9f6bea
SHA512 26b84ea5064c2e91fc7004383499d0794d8514736f21bc9881c473715e96f3d7342d87c3cc95f5f8e7ddc1b963fd4b3a635327f33864612ae67d3ea12f42adc2
SSDEEP 192:EONc6nnH4QmiUyAYiYcX5hQDP1UjzorA1WpXRqlhg3Qrq5qRU6:EONc6n4iiNX5+DtE8A1WpXMM/UU6
TLSH
T144121C35E9B8AC6B5ED36586B08631536EE55127EA847FC0D6EC2E1C01DF6AC130DD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ea45b526be496c8f09e1e73c9410dfe7ffbf3068f66bc040d2e88d53b75896a
MD5 b18b867a48dbeb0007178a97b03751ef
SHA1 8bd5bbc1d3442c9e13e60017a5792f65a49acd44
SHA512 6c11d53cc51bf320d94144b1d50f87149af048f3d6aa5ac31c3b9c28c2a204f39edcbcef6520edd2de9c0df23e92451b33cd4002c5e2bd37167796ac2b5b3599
SSDEEP 384:TZcIhsN5SzUikN2QX5+DtE8A1WpXMS/UtgOIwZOy7boT:LhSh9kDrD/UXsyo
TLSH
T170828E3299B45CBB5DE7A145B18A32036FB85027D6C46BC4D9FC5F1C019AAA9130FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07fc6417-0f39-42b9-aa16-d4c25e388a82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07fc6417-0f39-42b9-aa16-d4c25e388a82.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bface6d3852d324178fa4ec2938b69b319e0f60779b01364dba22dc947517648
MD5 cb0e0ecd36e2b812cb495ca5f93216fc
SHA1 af08993ac0bc36f4a40575f665a43b46327bc2b0
SHA512 5865affb0e22b8f376ff6973c418ad52e13ae75e5ff35edc77eb695052642b30bfed88e0357cbad97a495007ea48113a7ac88203912a94617d10ae5175ec5640
TLSH
T116410958BAEE1148B3B76F56ABF6A86E447EBD372F07955D00110D8F0A62B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download