c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-ocwh4u.htm
Size 34KB
Sample260930-x9m2rasdrd
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{26CBA9A7-4290-4234-BA75-013484F5C687}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 3220	2632	msedge.exe	86
PID 2632 wrote to memory of 4988	2632	msedge.exe	87
PID 2632 wrote to memory of 4100	2632	msedge.exe	88
PID 2632 wrote to memory of 4100	2632	msedge.exe	88
PID 2632 wrote to memory of 4100	2632	msedge.exe	88
PID 2632 wrote to memory of 2560	2632	msedge.exe	89
PID 2632 wrote to memory of 2560	2632	msedge.exe	89
PID 2632 wrote to memory of 3264	2632	msedge.exe	91
PID 2632 wrote to memory of 3264	2632	msedge.exe	91
PID 2632 wrote to memory of 3264	2632	msedge.exe	91
PID 2632 wrote to memory of 4376	2632	msedge.exe	92
PID 2632 wrote to memory of 4376	2632	msedge.exe	92
PID 2632 wrote to memory of 4376	2632	msedge.exe	92
PID 2632 wrote to memory of 4556	2632	msedge.exe	93
PID 2632 wrote to memory of 2656	2632	msedge.exe	94
PID 2632 wrote to memory of 4556	2632	msedge.exe	93
PID 2632 wrote to memory of 4556	2632	msedge.exe	93
PID 2632 wrote to memory of 2656	2632	msedge.exe	94
PID 2632 wrote to memory of 2656	2632	msedge.exe	94
PID 2632 wrote to memory of 748	2632	msedge.exe	103
PID 2632 wrote to memory of 408	2632	msedge.exe	104
PID 2632 wrote to memory of 748	2632	msedge.exe	103
PID 2632 wrote to memory of 408	2632	msedge.exe	104
PID 2632 wrote to memory of 4296	2632	msedge.exe	106
PID 2632 wrote to memory of 1320	2632	msedge.exe	113
PID 2632 wrote to memory of 1016	2632	msedge.exe	114
PID 2632 wrote to memory of 4544	2632	msedge.exe	115
PID 2632 wrote to memory of 948	2632	msedge.exe	122
PID 2632 wrote to memory of 948	2632	msedge.exe	122
PID 2632 wrote to memory of 2652	2632	msedge.exe	123
PID 2632 wrote to memory of 2652	2632	msedge.exe	123
PID 2632 wrote to memory of 4604	2632	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-ocwh4u.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9418dc188,0x7ff9418dc194,0x7ff9418dc1a0
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,14985141967616960072,3382291604723812126,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,9111924413842708706,12800596987238889823,262144 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,15731716106349614020,8657010031651464240,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,15684123252668066024,1453359600008328004,2097152 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,7946890110515015511,9906821303454730617,2097152 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,17532600391836755867,3669245826286203253,2097152 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,2748892500326954270,7024912292726456449,2097152 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,6040296358143419995,8614617966049924929,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6476079677494608024,970262332102707843,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17061081732144009492,2658871666305386135,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17061081732144009492,2658871666305386135,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,17389501701336473647,2460975156115155,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,10245676262635360996,18138827275027580898,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,11079308564337838760,9263673122613877058,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,18156482930175779476,4879854406279612348,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18259253032409007262,11661034933866863792,524288 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5540,i,5325770779259101804,4848694501615694048,262144 --field-trial-handle=2312,i,18274093964688323593,8469668621370535315,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35128ca3e4c33f158f5c592d92da2d74783eff26ed059a0d02918c5d2a439085
MD5 98ff3e93334fb25286b7233c42cfb083
SHA1 251b9b31903f48c10a5002bab8f9699c2f633fd4
SHA512 db1951d6527096277ebe8afe82933129cc28a3ba8172651880e9e94b512f44a5bbfec197126a8a8bb90f82d274a283dd2fe98125d63ae4ffefc44ba627035ac4
TLSH
T1595192B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009105044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f3e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f3e1.TMP
Size 3KB
SHA256 7a1b5d1372411c717275876cdfdb54bf63faacd1bc33f8c6c547aa16e63e345e
MD5 132cb74bbe65be3057baeb735e470b01
SHA1 c7bf326a731f51d4ab7176fce44fa029cc85db49
SHA512 bc43d783396fdd7143274e773310b2c783e703b63119e14831666c0a22f2d776f7993cd2a5549f67691107163394209ff63b2981d720dcb1e99b6b43122bbc61
TLSH
T1305192B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009145044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 239fcebbd64bb74f73a3163ef230d492b2183c75d833b169f611c238bf99b744
MD5 ff0179f271b8ddfe4c05845e39c1d4f7
SHA1 242310fe7aa3e5194c8020a1b64ebe4c3188205c
SHA512 d76c869d5c152a9443fee6eee85b4beca5548e92a28bf880b167e08cf34129ec69b75ca30d0e5acb9f68209b0939f4312918fe043c676145d5f427c536a42756
TLSH
T190117DB3C7D595AEC90116F06A24EE2BCE1D0605421C7C19C9D4EF2793E3475E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7b581381fcbdde496882b1efb3a7cfe22b65cdf1f93bb0d6f87d60fd6fbdb08c
MD5 113f111251ff2cf2c1164f7bfdba83a7
SHA1 e3cd7534fa9f657eb17616687c853236d1d044ea
SHA512 539ec42403487ed480cb85c7e3e6d6f1581883b8de042266a6cb83efcbdc29c92d62a0546ec0a6c4b33807d913838969496ca878f8a6e5bf9e0f90f244fcaa3b
SSDEEP 192:sxZ6sRiWU/f+sTtIdpd1HW6+WNGYYBaO5IgrJ:sxZ6szU/f+sTO7HbGfd9
TLSH
T13A12A7116E38A57B8CC7E209BB65BF53E6F9503261D41E58EAFCC61C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 981b289e6688a8320ce167eea8790c0252519c183076cb4f42cc5e437d534e28
MD5 3b6fac4aa9d4ce93b097e923d3a04dab
SHA1 2e861af3630dc44d3ec1740ea0a706250f20a5e6
SHA512 a650dbf15d4492047040b67da9c92057cfd63fdc08dab732a8af94183dc8865b420956afa3367b61560b446921f553de16a8544f650643d52b5323f3fccab52a
SSDEEP 192:sxZ6sRiWU/f+sAtIdpH1HW6+WNGYYB6AO5Ig5BJ:sxZ6szU/f+sAOVHbGfmZ
TLSH
T11822B7516E28697B8CC7E20DBB65BF53E6F9503291901E48A6FCC71C05E7ACE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 93918415a1596bbffc770c5b1cce6be8a30520815e826c3e849e5224273ca644
MD5 e99cbbf565b63dd00555d90481bd422d
SHA1 87ac6997135c2066b85be58fea68bae732497234
SHA512 01b90f735b8cf8425527a192e19d8427131bea169f1c6f1262ed8e21a296c255004d8dc2680eaf8f52c4938380132ba9147d26d45dc1a66ce13c34c31ae1ce1c
SSDEEP 192:sxZ6sRiWU/f+sAtIdpd1HW6+WNGYYBJ7O5Ig5BJ:sxZ6szU/f+sAO7HbGfsZ
TLSH
T1DB22A6116E28697B8CCBE209BB65BF53E6F9503251941E58A6FCC71C05E7ACE234780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 17509629d2b53be237929f6cf4b892adecefa489238112227314664713b75daa
MD5 2d8ca8d09eee45c0339ea91e3fd484c5
SHA1 1ba48d72d055a1ede4e03b9ab9487b64ee51f246
SHA512 0bdc6a08a8d5bdf65d9738ff56071eb7ed19179f75c8f49e472bf19df46906a3225693412abe71cd6c7bdb538626ff3dfd00ba724c166e3f06f18d30ef90d405
SSDEEP 192:sxZ6sRiWU/f+sNtIdpd1HW6+WNGYYBaO5Ig5zJ:sxZ6szU/f+sNO7HbGfdn
TLSH
T16A22B6116E38A57B8CCBE20DBB65BF53E6F9503251D41E48EAFC961C05E66CE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 80b935568fd0bb6aa16bbef25328e6e2f6abeff5ce664bd55ed75f7558cfe2c4
MD5 d48c0da4f6670f86454442ba2215d2b5
SHA1 60d0a6fec95ad4b0c77ae21947647a5c3fa6c8a2
SHA512 b9dc2d0ece64b4ee3edec6cf7d52c2d9bc926ffe13ebc313d3626edbd58932dc19b32e1b627053e9a9fcbfe75d38eb77075d073a9e5f41a55361f2fdcb67debe
SSDEEP 768:qHyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXRropvMC:qHyYR7jWv3NpBu1ja/CL8OXqB
TLSH
T160C2EA3B644DCB7E4FC01E9DDC5A6F9B2E9802C796548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e3395a2e21896f242d7268117bc9aa013b949c68612fe7a864021d9116c1f1b9
MD5 01c81946f39a8a70b400b34b8a858200
SHA1 340ccf23b0b6968618890a7570b708aad4fe0717
SHA512 41f68c2aa0caa2a3157cdef8efdf36227458800de68cb78ac1084276f6a5a9a2f9020513ac561aedafc67de1cde7fce8240e4ccce9aef5280536e809659f90ab
SSDEEP 48:KgvSbvRxRqbpkZIS/qK9f1VqxP6YcdfDyLVUplXD34brOrIS94K9d1P4x9oYePlf:KAkgKdaOiKMK7KkCEKTqKOJqKiIlz
TLSH
T10FC1FE5036BB065178BD299886B68B1F124132773119F63BBFBC11B19E7AE040CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598ed8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598ed8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ecebb43db906b22356a1da081d44fcbb3370f8b40faadc76bffd8e10a567963d
MD5 f728fb71bd330eecec4917185ab11798
SHA1 0cb8c7a2516295a3505894cc0aa26b8713ef1d88
SHA512 128bfeb864bb637ca45806d8e3f77a42ef45eae2561f7ffb0279029db7bba534b485e57873930bcf5d549d99e1b2951caee267c367335304f84a4e10c8bfeb94
SSDEEP 384:aZcIhsN+MMtxiBGivQX5+DtH80gXm3rrtgOIwZOy6oVom:Yh5FiYkD9QArrXsGVV
TLSH
T1F8828D31ACB89D7B1DF7A185B18A35039FB89427E6C4ABC0D9FD5B1C01D96E9130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e4c09b5caa1b6194f6cf21a4e5dc7e95716fa1cae7a08b2c4652d24166065cf8
MD5 7895929fe3e77791beaaf1e1acbb14c8
SHA1 3f26aceebef91e2e42018156569c5de326cc493d
SHA512 836f190763da0c9d6c9d1dac936de327bdd0b051a17e588d583ca9120f7f9cb61a642c3906a9c9c856c00708fa2c38d72e669aaa69ac069fd84bb3deb87baca7
SSDEEP 384:CiFiZcI3zsNO8TUNTUlIlNMtxiBGivQX5+DtH80gXmTrrtgOIwZOy6oVom:JFQj7wgwFiYkD9Q6rrXsGVV
TLSH
T170A25B3298E8CD7F6DF7AA85F58A32038FB45467D685EB90E6EC5B1C019A1DC030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53fe45fdf041883e9c9beb372273ac9ab59dfbce0d6f09a03084d62e92f9e587
MD5 ec612f210c4140f408b0c84f23a008e9
SHA1 d37bbd8b33f3774843976a8defc19eedb4027544
SHA512 04179f250f1ad63ac898b538519e999b9564dea132eb8ea5f9138c684292f3f41e1adb51a8f3f82cbd11d5cd54202d75dd9e78d7debe9b584eaca277d8822658
SSDEEP 192:EONI6nnHGQmiUyLdQYcX5hQDP1fjzorLoaMc+RU6:EONI6nCaQNX5+DtH80CuU6
TLSH
T1C202EA34ACB87CBB8EF3AD45748632139FA4212BE5952B84DAF85F1C01D765C2306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 00fb38649a3fab575c9824e0d0e3723487039c4dc590acb7eb7e8a0ad1455071
MD5 7128cca4cbce9d618804b060db04692c
SHA1 7c1df145c0241e16d49574568642e35d93535b54
SHA512 9724aaab1b867cd4f59df10aba6b53be59e68085dc3c611b606766379e53f542b76e984b8ba03813c55b2e618dad88edbcb341de2583dab4eba1d149553443dc
SSDEEP 384:4ZcIhsN+NMtxiBGivQX5+DtH80gXm3rrtgOIwZOy6oVom:GhMFiYkD9QArrXsGVV
TLSH
T1DF828D31A8B89D7B1DF7A185B18A35039FB89427E6C4AFC0D9FC5B1C01D96E9130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5923db98351775333154cf15dddd3f6e30cabfd5193f2e2e6eee3c32c77517c5
MD5 7cc5f097766e0eaedf914626bdad36ac
SHA1 9d5a9f17363ad4dfceb3b333e0bfb8df54d1c357
SHA512 f4f961f07f4007959c58704191aa441f87108d07fdc1ffd02dcdbd469df85445f0ea58339d581a13b34a8124d269ff8b40c7f93cfb1f2097364c37af916acf89
SSDEEP 192:EONn6nnHDQmiUyBditYcX5hQDP1fjzorLogXXbKDg3Qq5rU6:EONn6nVeitNX5+DtH80gXm4rrU6
TLSH
T111120B31A8B8AC675ED36595B08631139EE55127EA887FC0D6FC1B1C01EE65C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbef1c75-106e-4d38-9e00-7ff9fd76d784.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fbef1c75-106e-4d38-9e00-7ff9fd76d784.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 108a08bcef4ac5c08891d3a232f99695a6b734454fc33e42da8076d6d5b726b4
MD5 c5287629acc57224b2e6d28c2d82238c
SHA1 128a81bd8cea5dff0209ff3b74e6118d9a3be7f6
SHA512 b5fe90330c4345194c1db44a2f914edad52f955d283000865465d5cca1fdb4b56faa8156ed679352caa833583c304f4652ef648be6d999e730b07daa281fa186
TLSH
T1CC414C58AAFA1148B3B36F566BF7A86D487F7C772E0AD05E10110D4F0A63A44C871B37
MD5 SHA1 SHA512 TLSH

Submit Download