5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-qgp3gh.htm
Size 194B
Sample261001-m45pha1tcx
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{BC20BE47-4D98-4BE0-8DB4-3D50526746F9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4928	1540	msedge.exe	84
PID 1540 wrote to memory of 1028	1540	msedge.exe	86
PID 1540 wrote to memory of 2316	1540	msedge.exe	87
PID 1540 wrote to memory of 2316	1540	msedge.exe	87
PID 1540 wrote to memory of 2316	1540	msedge.exe	87
PID 1540 wrote to memory of 3612	1540	msedge.exe	88
PID 1540 wrote to memory of 3612	1540	msedge.exe	88
PID 1540 wrote to memory of 1616	1540	msedge.exe	90
PID 1540 wrote to memory of 3160	1540	msedge.exe	89
PID 1540 wrote to memory of 1616	1540	msedge.exe	90
PID 1540 wrote to memory of 1616	1540	msedge.exe	90
PID 1540 wrote to memory of 3160	1540	msedge.exe	89
PID 1540 wrote to memory of 3160	1540	msedge.exe	89
PID 1540 wrote to memory of 1576	1540	msedge.exe	91
PID 1540 wrote to memory of 1576	1540	msedge.exe	91
PID 1540 wrote to memory of 1576	1540	msedge.exe	91
PID 1540 wrote to memory of 3808	1540	msedge.exe	92
PID 1540 wrote to memory of 3808	1540	msedge.exe	92
PID 1540 wrote to memory of 3808	1540	msedge.exe	92
PID 1540 wrote to memory of 4920	1540	msedge.exe	96
PID 1540 wrote to memory of 2068	1540	msedge.exe	97
PID 1540 wrote to memory of 4920	1540	msedge.exe	96
PID 1540 wrote to memory of 2068	1540	msedge.exe	97
PID 1540 wrote to memory of 4888	1540	msedge.exe	99
PID 1540 wrote to memory of 2416	1540	msedge.exe	112
PID 1540 wrote to memory of 3412	1540	msedge.exe	113
PID 1540 wrote to memory of 2184	1540	msedge.exe	114
PID 1540 wrote to memory of 312	1540	msedge.exe	123
PID 1540 wrote to memory of 312	1540	msedge.exe	123
PID 1540 wrote to memory of 4044	1540	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-qgp3gh.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffacf12c188,0x7ffacf12c194,0x7ffacf12c1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,17140845731866833424,17540607803024606106,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8082014803852588759,14895383954203187341,262144 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,14832952450093922555,11926242625236891019,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11091295827110514772,17544295549718581752,2097152 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14548785330369421103,16939269686979415843,2097152 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,6015139449567734665,15679254391541249768,2097152 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,3769021385927354550,9341236646552327895,2097152 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,724445884634294571,1497195567718160296,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,8792034059532741473,4983813250440967222,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5611231775511950504,16136999890876515700,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,5611231775511950504,16136999890876515700,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,2353598700559744388,1094791369915742590,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,12241442981521377516,9273867840203776958,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,1962254625366298540,6885338280678371075,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14226026450170569085,5888048464229810012,524288 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,11805708376232119793,13805243120150078849,262144 --field-trial-handle=2272,i,14617679840438783056,7570478807727361555,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 59cbebef048150bcc9e69c74953dd2309ae614fca5dd53fcae8e8b67f2283312
MD5 5865d1ee7b08f380d80dc83bb18aca8e
SHA1 ead0effa43d0abf3fb8f8e1bb3c0bc82d1f2753b
SHA512 6015a505f30cf4d1f9eda1ad97abb27c21220ec79e325abd4d99a174f27d2b6d28f8d6d869de555fe9a626cd50516f840fea86bacd86d00a9a0053979785aca8
TLSH
T182618364CE604459FFB803BA89CC3D8B353779A054B39F2A087CD6FAD83A38498890C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bf81af1d39818a79a892a171c45aeb698d175356891a69bbe9a3b62b32be7cf8
MD5 cfd822a3f8a9a2caebd35ad79e645cfb
SHA1 65db2547c8cb214e2b522163359b91f858d67ee2
SHA512 d5d699d2f8a5097101cc1317a3014468723148815c4f026fd293bccb77c7361a36a06e4f3feaedffacf4a567e11deeba7864a14c5e2e12e318bb87a591fcd04d
TLSH
T197617364CE604459FFB403B689CC3D8B353779A054B39F2A087CD6FAD83638498890C4
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d3e678524caff9aef5bcc8dd913a92d2c2adbdc63c52f4375fbf44d7f88578e0
MD5 2491ad8affcf1589a7412b867ef160c3
SHA1 8e4ec1d2fa034dfb21b2ac621ebb88745bf0a05e
SHA512 0285b48f2808e07d65a815a2b6973e22ac3746d0fa91b30d79f68d0d596a6332f46e41858f3b46fb454c871caf0614e1ebae3bb1d3008b3f3be98741fea4dea2
TLSH
T16E117AB3C3D595AE891516F05A24AE2BDE2D0606832C7C1A89D4EF2BD3F3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ff13488a5ba6676e0bb35ede17ff7741be32a048a5bcbc8649facb0289d0f2a0
MD5 47d612ddd41b1e4bb74fc9ce262a01b0
SHA1 541458a2b110fd3176eb83963fd375d330050614
SHA512 ecd4c6d5089d93fc7381e3d35a0c26d9dd395f3bdc519430334f25ef7dbf8e87de92dc95cb2e361c7273b516c5eba735a46a63bbe24b26641314ece95e26981c
SSDEEP 192:sxZMmR1WH/fUsq/7IdpHpHW6+WNGYazXEIg5aOJ:sxZLOH/fUsq/kJHbGM1
TLSH
T1B022C8566E28A97B8CC7E20DFB557F53E6F9503251901E4CAAFCD61C05EAACE130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7a1c3960e7226d2bbc53e6636d5a4fd18c4e7f7bd2d351a512cfec2dce43afdb
MD5 53f42fef03167c198728a84743cd34f3
SHA1 d2cea23d7e677980bc1629f78625fb29176b9d39
SHA512 c56c47d30d90c20b6e5e8e468b808535425155ad5ac0a5d7dcc3875dcd94d0d34ef415294afacabddc0bb31cb971bb15a825934290298907485c4206a3dd6704
SSDEEP 192:sxZMmR1WH/fUsp/7IdpdpHW6+WNGYaQXEIgrJ:sxZLOH/fUsp/kbHbGh9
TLSH
T17112B7516E28A57B8CC7E20EFB657F43E6F9543251941E4CAAFC961C04EAADE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 75dfad52382e7feb4b026969439a8358c2149af4549ed510b3093f629751022e
MD5 0a4891411f502b4bd3cc352226a80fa6
SHA1 135a00c0f3efadf4dfc86eed45d0e7d1282d6308
SHA512 93f8a7cbe3b06ca001dffc4b400df14da4469539bec9857e88fd35bbc35e50bec3976c49c9b5dcd4bf9339ec8bbef2257a137cc611ec0251be21ac5342f772f4
SSDEEP 192:sxZMmR1WH/fUsq/7IdpdpHW6+WNGYaXXEIg5aOJ:sxZLOH/fUsq/kbHbGg1
TLSH
T1DF22C7556E28A97B8CC7E20DFB557F03E6F9503251901E4CAAFCDA1C05EAACE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a3c19451861fb9aa5f8982c98c9e1e6da1b007add39a2f0b8e2846be718dd621
MD5 96d652dd5c7f060213dcbb89081ef082
SHA1 ea64eb1e3f80ff4447c0b9069798b336777e99cc
SHA512 404ec8c891dce84abcd5728fb68395ed4fc4682a18117f0b4c0c57181dfecdb5faaa0ca240c982728c792be34256d73456955797aa4f1c1f624f97ab231404c8
SSDEEP 192:sxZMmR1WH/fUs2/7IdpdpHW6+WNGYaQXEIg5acJ:sxZLOH/fUs2/kbHbGhD
TLSH
T1CB22C7556E28A57B8CC7D20EFB55BF43E6F9503251941E4CAAFC961C04EAACE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1ec625a416e85a484b1533c243278204690df1b16ea6e607b858682581e8cdb2
MD5 c46ebc379f9da12d089651bcc83a0fc2
SHA1 23f8cd57e33c122e60bd80a6cb488d7828fc7e36
SHA512 1c2e8628e2731e91f8b793caf4af51f5e5ab6165a622d005d00c869754d3a7c6dc4e63f62ba5bc6fdd6dde9b7611d479aefebe026194589faeaa77a9aa7c1d46
SSDEEP 768:8pyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3LroqZS9:8pyQRbrWvvlpZu1jaXKLf334qZS9
TLSH
T18EC2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 729B
SHA256 45c3da80babc321bc028dff1d5955cdd0865541314342f736ed1cddb1cc06641
MD5 79728fc5192095443fcd9edcad9e2266
SHA1 d991e4263b5966ee6f74130e94ccb2545a6a1112
SHA512 86d459e18d19d24710d3307f299f142d8ed24759cd5b8afc86fa7dfd9204d9b92db6d8c62aa1391dc419f501b9c9a186a9905e7293b5b6b48d9305135278316a
TLSH
T150017D0032194140347DAEAC9268E5D70251A4B13426677E3EF8A3510DDAE309DB86ED
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1493.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1493.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 af6113c9d547944c301dd7c17369c192f302e81bf28ac99315272cf0fb4b9a65
MD5 69dd10916e41ea0b57ca08ce192b22d4
SHA1 6a8282259654914bac91167e29f8beae54056b02
SHA512 0fb24c4d915c371d3a17ac688b4368736ac8fa0d1fc84fcae21cfff60e889422cee2b38a6a9bcb27f8546768bac766b0b3e67d4e67bdaa78c9470a0338578b49
SSDEEP 384:LiFiZcIizsN58TUNTUlIlzRgZNxp5u8iAr5JVZh6DKhHv/KoF:mFQqcwgrKNkA1JfYGHae
TLSH
T148A27D339C68987BADF6DE45F94736038EF481A7D6C9AB84E2CCA61D01EB1D81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 becafc5c1d6de08c15d835a88c8285519a78a340222a05c77f776f867c2394a6
MD5 6cdf2aee3e355cd5d4048d1685214295
SHA1 10c0fbd9aadc2f0bc5b740df83cef71e523cba44
SHA512 1c97ffade6ee2a83d39030b8e9666f0bb8465f2897f9b3f28f86d3fc6e130149635ff95d50df994be52f56fba8d3fd6cfa49220c4ff37f30c094653d42a17637
SSDEEP 192:SONa6iDCQmiUyD5Hq5u88Ppuh3SqATx9bU6:SONa6/YHq5u8iAvArbU6
TLSH
T16A02F839AC693C7BAEF3AD15F58737175FA4113BE6842B84D9E81A2C41E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4bab26d281caf0e7f6deb64c4cd2f70b5a2bffee6acb8922980756ff95cbdcf1
MD5 cc93fb1bb953a1cf2577d545b56337cc
SHA1 9e0f340f57c2b20b12ca5e655af121c9989c0f97
SHA512 e1796953697a79e2ba044ef7764799780e4261df784952d2e48fb816466aef75e089622339909909c414338e78d81584053d4966eb048775ad07bfc43b34b9ec
SSDEEP 192:SON66iDvQmiUyF5Dq5u88PpuhdJIxuZFrqPkU6:SON66kwDq5u8iAr5JU6
TLSH
T153121A36A8786C6B6DE3A951F48736135EA5422BE7C87F84D5DC261C01EF29C130B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8296cf9859e101464629d2d0ac2a50803929be57c5030d4593b5ffb99e944e5a
MD5 ed147afd0a1c4ae7b20cdb6d32013516
SHA1 95189530fadb80c3cae5391c8110478b715ac4cf
SHA512 7049a628dd94fbcf7f7697a1471a32850fe6c04fca2087269e98f9922239ae136b82e8901145c089503634da0aa7a56cd83bb2786fdf4a07f8750278779ea340
SSDEEP 384:GZcIhsNnzRgZNxp5u8iArMJVZh6DKhHv/KoF:UhEKNkAYJfYGHae
TLSH
T18D828D32AC7C6C766DE6E951F9473A034EB48167A7C82F84D4DCB71D01EB2991307A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 887a59208bcc886aae1157e69daf189fdcb4b2065ea866d729788c6320d0ea6e
MD5 41d7be9f17632bdea51e66c3822209e9
SHA1 b375cb01f55276cee7e04e9dd0b98e95d7c0b0a8
SHA512 c1dab4d40a25e5262e62f096ee78d424ddb5cd858c616eb5ec23c1533f92e1f341c6770048aef00d7c715f2d525b4f04e72f7960ee3276bca2ece28b845b23ca
SSDEEP 384:GZcIhsNnuRgZNxp5u8iArMJVZh6DKhHv/KoF:UhPKNkAYJfYGHae
TLSH
T104828D32AC7C6C7A6DE6E951F8473A034EB88167A7C82F84D4DCB71D01EB2991307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c6e07e9-68d4-4ae0-beab-a2e97b956c6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9c6e07e9-68d4-4ae0-beab-a2e97b956c6e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3798185f67a53b2eced1745b91db90eeadfcb7fac8fc34620961d6ee3119971a
MD5 eba03ffe288f8678216091e9915bd738
SHA1 47f69ef34849751811f04d2754781d0c5aba4eb0
SHA512 207dbc13f97439504c167ccfe25155c8c7fe0e124304fc88f584effaf0452861813e9a9d5adfcd8470d7b46ba0c921b4f06410ca279e4766d4dff2cca9ba6ca6
TLSH
T154412A59A6F91148B3B76F56AFF6B86D487B79772E06D49D00120D0E0673A01C871737
MD5 SHA1 SHA512 TLSH

Submit Download