5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-eib1if.htm
Size 194B
Sample261001-kzhytsff78
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3240	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{1FBB1534-4C40-4877-B999-8216AF115516}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 540	4908	msedge.exe	88
PID 4908 wrote to memory of 3240	4908	msedge.exe	89
PID 4908 wrote to memory of 4924	4908	msedge.exe	90
PID 4908 wrote to memory of 4924	4908	msedge.exe	90
PID 4908 wrote to memory of 4924	4908	msedge.exe	90
PID 4908 wrote to memory of 4676	4908	msedge.exe	91
PID 4908 wrote to memory of 4676	4908	msedge.exe	91
PID 4908 wrote to memory of 1744	4908	msedge.exe	92
PID 4908 wrote to memory of 1744	4908	msedge.exe	92
PID 4908 wrote to memory of 1744	4908	msedge.exe	92
PID 4908 wrote to memory of 4320	4908	msedge.exe	93
PID 4908 wrote to memory of 4320	4908	msedge.exe	93
PID 4908 wrote to memory of 4320	4908	msedge.exe	93
PID 4908 wrote to memory of 2244	4908	msedge.exe	95
PID 4908 wrote to memory of 1964	4908	msedge.exe	96
PID 4908 wrote to memory of 2244	4908	msedge.exe	95
PID 4908 wrote to memory of 2244	4908	msedge.exe	95
PID 4908 wrote to memory of 1964	4908	msedge.exe	96
PID 4908 wrote to memory of 1964	4908	msedge.exe	96
PID 4908 wrote to memory of 3428	4908	msedge.exe	102
PID 4908 wrote to memory of 2028	4908	msedge.exe	103
PID 4908 wrote to memory of 3428	4908	msedge.exe	102
PID 4908 wrote to memory of 2028	4908	msedge.exe	103
PID 4908 wrote to memory of 4204	4908	msedge.exe	105
PID 4908 wrote to memory of 3964	4908	msedge.exe	114
PID 4908 wrote to memory of 2576	4908	msedge.exe	115
PID 4908 wrote to memory of 4728	4908	msedge.exe	116
PID 4908 wrote to memory of 3008	4908	msedge.exe	125
PID 4908 wrote to memory of 3008	4908	msedge.exe	125
PID 4908 wrote to memory of 2896	4908	msedge.exe	126
PID 4908 wrote to memory of 2896	4908	msedge.exe	126
PID 4908 wrote to memory of 4384	4908	msedge.exe	129
PID 4908 wrote to memory of 4384	4908	msedge.exe	129
PID 4908 wrote to memory of 2492	4908	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-eib1if.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f4,0x7ffece9bc188,0x7ffece9bc194,0x7ffece9bc1a0
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6968609547900292248,10321997483052183401,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16116634906318098187,14282827045741868562,262144 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,16331711090877159559,13908497752550179239,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10461765727522019598,5095853758624152253,2097152 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13586682825741930443,2225719023568716099,2097152 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4639223039233186121,15830282919170901577,2097152 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,8484135944201013935,1079326204005540788,2097152 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,9288886999293272752,871528145598552290,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6935312470213294272,6859816113052188221,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,10167928927246382857,9008315307647182196,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,10167928927246382857,9008315307647182196,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,6764293648724039195,5054649103819989237,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,16913957515166732202,8244637476523593811,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,2199303816230565787,4023370786629270653,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7959420981081861155,8260850703513197664,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,8469095750510918869,3794319000502201294,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,18211620906192216052,1724111803355433370,524288 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,15102408920926759674,7852740064690893954,262144 --field-trial-handle=2312,i,1593451678188600694,13949041166813192954,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e50da18b0d75d38f0454f525b12e7bbcd1d5ee225f88e2fb0fc1aa0cf3199125
MD5 b3081732800231a54498cfba01dd1bdd
SHA1 9c6feba912eb7db9feb6911a7c2a60521c818e71
SHA512 f4f5bf11df4f4a8be4fe5fcfbc2e1c28576c6e2cc44360e544cd0f8a5901a04833433704d654135a5e3ebabb5bfff1068e7a67aa1c7c87d2c155325854b2601f
TLSH
T1D1E026F84CECC22FA70CA4870368532DCB80371B93C0698E3740C5B57886858E7866A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bc6f3952039dda5a5cf6f1ad707eac4a0a4c2ea56fea6d648a2be410dd0e218
MD5 809e1ddf7a5176b98ff4ed3e73a57b00
SHA1 4beb19cff18bddf21ffc23408e85d4d53cf8852d
SHA512 ecd4caca2f8d6d562f2a4a9ef3e5e2d66f8e68fe2c53563a4cf20167099b801676e84dabd5a87bcb81736d098895d2275a4400fc501965b5bacff89a7c6aa1d2
TLSH
T1E5612A81077154BACB68613895E509CEB6684CF5A583CF8223A6FC6FEF063744B680E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590517.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590517.TMP
Size 3KB
SHA256 e48e272aa5eab2cfa84717be48484357c56003543365ba2b3364675447245f3b
MD5 6faa68dda178c04d5cc822f35fe9513c
SHA1 10f73de5918633177994f5326d6081ab55e3e796
SHA512 003ba7048347cd062c6d74afbe51834abd795dc593593220e511a1b629c66b2f6b263c9eab0d283fadc61f918233b968ebbdf78e6d56c1da701235e7f1bd62c2
TLSH
T1B4612C81077054B9CB68613895E909CEB6785CF5E583CF8223A6FC6FEF063744B640E2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0a72eb58bb0d71ee8e2c48e41cde3f9e7d4f139f7ee8006a5016e2864f060ddc
MD5 a87e400a403fc32423493d3543c9f3ec
SHA1 fe9886201a197eab5f8c63a0b367cdfb1170eed9
SHA512 c080e3bf5dd1b5f35cbdff7449a653b98846234d69c4e33d39aee1fbdecc67390e8659955f04cebc2888b5dbf31c1d8959968c4e1974fcc2d0b0e272cb79db31
TLSH
T124117AF3C3E595AE891516F05A24AE2BCE2D0606431C7C1A99D4EF2BD3E3475E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 246d874ee2fdb1f2d654dab2c467f00e7a31e999c902a722903b6b9a0bc453b7
MD5 8542771b2449c8162e7272c4ee01dc4d
SHA1 f995625cf7b8b2e7228af93399ad4d928845835b
SHA512 2abbfb93836cd221ef0a19b66019c6ce8158e2bf572d2663921112d94d2f21e7eaecbf56af5063f695cf85c039b1c4adb336576039348280c909d3d4d6ff1288
SSDEEP 192:sxZ1RkWe/fjsxylASIdpd6HW6+WNGY3R0IRIgrJ:sxZ1le/fjsolGUHbG49
TLSH
T17212C8526E28A57B8CC7E21DBA257F13E7F9507261D01E58E6FCD61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5f5178bb02aa2a578582e7e3cf28e32beda9b5ed894564dcd5ae87531a5a5a73
MD5 6d31edd3a107bb0693fccdb8a6943943
SHA1 ec6a360c6f0149af9bc3ed98d09677c73b42d19f
SHA512 91f4175aa3df20fd88c73e6611ef6db267a9726921304b9e472e9efe1fcd77c08833cb8cdc8dc7988e4f3f979a4b0b5abccb6e74cf7131bdcbe70bb4f0a27667
SSDEEP 192:sxZ1RkWe/fjsX+lASIdpH6HW6+WNGY3F0IRIg5lJ:sxZ1le/fjsOlGaHbGy5
TLSH
T16E22D8526E28697B8CC7F21DBA15BF53E7F95072A1901E48A6FCD61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8b2caf979f9c743213ab73355a637e08ed24870570c13e1a224765846be91372
MD5 3a8097a222153396d05315498375616b
SHA1 3387f1b73805b63d37f82acf148653d765e8f8b1
SHA512 ace526969c1ee0e90ae2597cdd4fd808eb7c45b80f98afbb044bcb7104e7b5023b4fcc08262d5c3063be3d4b6c4b3b4526a1dc3e370f1de44b39f4cad70b2245
SSDEEP 192:sxZ1RkWe/fjsX+lASIdpd6HW6+WNGY3P0IRIg5lJ:sxZ1le/fjsOlGUHbG85
TLSH
T1F722D8526E28697B8CC7F21DBA257F43E7F95072A1901E58A6FCD61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f44580b88d8f4f355aa2b052a58f16715240099e1dfe5b6e8fcf38d98b9977fd
MD5 a044e27708c5b92154cfc8c607161fca
SHA1 502d70ab4ae0f24ab9ea8f2a7700b967a80f90e7
SHA512 dc4dcd6e86af23f4f8f7f5fe07e29c8c84dca025d5818f2bee7cba10a24f2c2b004dc70c6110ff5cab42855907e50b00aa1a5f62e8c0d3bd12371b2d4c16abf5
SSDEEP 192:sxZ1RkWe/fjsXylASIdpd6HW6+WNGY3R0IRIg5XJ:sxZ1le/fjsClGUHbG4H
TLSH
T1CF22C8526E28657B8CC7E21DBA25BF13E7F95072A1D01E58E6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 da2b882884da66f1e4fd90fa142ff2b16cc6cb9f469687f6fa7da513bf87fb54
MD5 1224362b5926e19e084bd77d3fe5a54e
SHA1 d68af4a8b1e47421e52a1fd83ef8a8034e7b3477
SHA512 c267cc22cd51ccefb81c6603a71863064dd8ed8169beab3b3103203cdfc35392ddc6d4e6b56e1e2ce255e1ee3ffd423ea5bc8f40a863d116cfbe24b70f6b467d
SSDEEP 768:Vz30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72urolZMS:Vz30AbSWvS2l9u1jaLmLZ12lZ
TLSH
T186C2DA3B640CCB7E4FC01A9DDC6AAF9B6F9802C796548D4447FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3422b5299ae3b40b35d1721454c7913efab1baa64f999d8726aa967d29889825
MD5 3397b9467222d86234adaa28e95124ed
SHA1 b4e265e679b1b8b5ace7c2007ada2c5dda944a9b
SHA512 49b851225cf617dd7fa2d2235e8ea5c3df78d9198660fa81db1e1c4ed6abeb09b4fdaa98b36f7c3ab8d908bcbff6dbc648f644ece25111049583a32dd363069f
SSDEEP 48:K0YdYcYRYtYfYLYPYwbYDY2YjISYlYwK9Yl1YHYwxY1YgYYmYnYdYdyL5IVpztc/:KQN2K+g6HcAKNCGaC0KbCG
TLSH
T1E0915311367E4240797E3A4D84BC966B425139F33829E46F7BE881568EAFE104EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a00f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a00f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41044a4153526bfe9e846887786f04f7c7a7d2c94f36cb948c40eb49f25ef9a0
MD5 b124bf84d03bb8e38faecc6198006f7c
SHA1 b1fdc0a2c5d2b5c20a3b4228db7ad12674a00695
SHA512 41e526ad5b25710a2c1e6c28c33c8530b3908921baa4dab8b2d22cd043404a6c0db9c871a03eb122d0d7a989749256cea42cadd1afa4b2a54dee321278afa32d
SSDEEP 384:WZcIhsNIqMsWpupgs9iX5FrnfqVZh6DKhH+/SfoM:Ehvh1oa3fqfYGH5b
TLSH
T143828C32AC786C3A5CE2F555F4463A039FB890A7D7C82F9499DD7B2D01EA594230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3d0531bbcf0e17aea2e195e88476b36039304516d9d9b706b9c16b0ce33e26b9
MD5 ffcf1bdc217760d5b805de5d029d7542
SHA1 826e3d2f406a3054f7ca73b5c102db7b3f5d3d3b
SHA512 ea07fc1727f0447a2c30074b25f9414cfc18267a9b04aab13d60709526f2c053851221aa031116de46e3cdcb51307d21f793d5c1aa2c1800ad0ab352b1f523c3
SSDEEP 384:5iFiZcIfzsN48TUNTUlIlfMsWpupgs9iX5FrnpqVZh6DKhH+/SfoM:QFQbNwgah1oa3pqfYGH5b
TLSH
T1E4A28D339CA8983E9DF7AA95F54636039FF490A7C6C4AE94D6CD7B1C01D71982307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 896d45e3bb4eaa5ff0fc62b3ad56c09a26afd4a7b59babdf259b9665b14cc5b3
MD5 6e2f9056ef9fdf4bd7f071a71256edd1
SHA1 1839994baba1e63f471b435fc93f40d43a2f8a5f
SHA512 e0c601bc59159066c4c2067b2a5b9d011d0afaf628683075c473897ee916d0b9f93454ab1a7f132a6e2e15991b31da809cdcef6b3831d8fa7531bb4aaa61d484
SSDEEP 192:LONH6AmwprQmiUyAuAq6siX5FGyhaJiJ05BU6:LONH6ipda6siX5FrRyfU6
TLSH
T12A02E935AC786C7B8AF3AE19B58736136FA5116BEA941F44CAE82B2C01D765C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fc713b17d8cb7e021905027c58ffb905f72f48906e6e08d8567bcff4594c676f
MD5 0e5a7077c2994369d073cd25316b6cdd
SHA1 b4b7ac34a4caf238139b76177b191318a4774b52
SHA512 5afaf6e8e836ebeb8f272dbdd7c9ed8110aa217abb250e68972f6431876b55a9c1c125b883340d20af00e5876795ae84532414e4655acfa6ca12782e510bc0cd
SSDEEP 384:eZcIhsNIfMsWpupgs9iX5FrnfqVZh6DKhH+/SfoM:chwh1oa3fqfYGH5b
TLSH
T19B828D32AC786C3A5CE2F555F4463A039FB89067D7C82F9499DD7B2D01EA594230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c888ae70b019d1fc74f04507aa5755ac6a53c8c2decf50c2047ba770889ce1c
MD5 435069071d7992d0d6824048dd2cb21b
SHA1 39ec90f43b1ec3de309e874945176c01f2cd493d
SHA512 e859c912c0f2847c24ed780a47f5bc58eb96435eb066c97e8a9b20ae2729a19e111c434f5629dbc38dcbbd396658c276b82ae441a4649a137b47a6c7956d123e
SSDEEP 192:LONSQ6AmwpIiQmiUyAqAqOjsiX5FGyhd/lRJtq4eU6:LONZ6ipZO8siX5FrnTqU6
TLSH
T1FD122A36A878AC3F4DD3A464F04735139EA5526BDB886F94C9DC3B2C02DB598630B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9546f0da-05ca-4048-bd58-d3b389befe28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9546f0da-05ca-4048-bd58-d3b389befe28.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 831398132ed59a262e179be7f0e4dc55456a0a00e8f0af84600a5388cf2cbfab
MD5 73fe807636856f01b83de4fba8ce1399
SHA1 ab163947f3344ef9fac1878d42cef5eca881c33e
SHA512 a3036cef0f6dee754b2b428eb382d964879e70f509a00a941414793ccf09cf7bd03741fea8a07210b0b0f29d321472e426ff92667df7cff9db4914e5bad71891
TLSH
T10F41265CBAFA1108B3B76F5A5BF6A46E847B7D332E06D15D00020E4F0673A40C962737
MD5 SHA1 SHA512 TLSH

Submit Download