30be2be87d508a99afce2718eadc7f2f88de56d5dae7959b136433a135de42fb

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L1.html
Size 3KB
Sample260620-wtppzagt8p
SHA256 30be2be87d508a99afce2718eadc7f2f88de56d5dae7959b136433a135de42fb
MD5 64941801292a11b9df670e8a36cd0fbd
SHA1 561c91f46edf2838261f22e143cb3cbb2f517fe8
SHA512 a97b1b6650557200ecea4585364842421fb4c2f4d915fa45a4ed3ac70b955871c130ce800c0f907572392c02d43d8788dd792ea59c91ab28077ebe5d25905bc4
TLSH
T1EA518741B4F07156506B12B63FDF105CB661900B7908CE24789C83615F95F595877BFC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264527963163029"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{0329FBBB-B737-4221-B684-8358A843BA48}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3604	2720	msedge.exe	87
PID 2720 wrote to memory of 4320	2720	msedge.exe	89
PID 2720 wrote to memory of 4752	2720	msedge.exe	90
PID 2720 wrote to memory of 4320	2720	msedge.exe	89
PID 2720 wrote to memory of 4320	2720	msedge.exe	89
PID 2720 wrote to memory of 2412	2720	msedge.exe	91
PID 2720 wrote to memory of 2412	2720	msedge.exe	91
PID 2720 wrote to memory of 3396	2720	msedge.exe	92
PID 2720 wrote to memory of 2176	2720	msedge.exe	93
PID 2720 wrote to memory of 3396	2720	msedge.exe	92
PID 2720 wrote to memory of 3396	2720	msedge.exe	92
PID 2720 wrote to memory of 2176	2720	msedge.exe	93
PID 2720 wrote to memory of 2176	2720	msedge.exe	93
PID 2720 wrote to memory of 2712	2720	msedge.exe	94
PID 2720 wrote to memory of 2712	2720	msedge.exe	94
PID 2720 wrote to memory of 2712	2720	msedge.exe	94
PID 2720 wrote to memory of 3368	2720	msedge.exe	95
PID 2720 wrote to memory of 3368	2720	msedge.exe	95
PID 2720 wrote to memory of 3368	2720	msedge.exe	95
PID 2720 wrote to memory of 4112	2720	msedge.exe	100
PID 2720 wrote to memory of 1252	2720	msedge.exe	101
PID 2720 wrote to memory of 4112	2720	msedge.exe	100
PID 2720 wrote to memory of 1252	2720	msedge.exe	101
PID 2720 wrote to memory of 552	2720	msedge.exe	103
PID 2720 wrote to memory of 2856	2720	msedge.exe	113
PID 2720 wrote to memory of 2824	2720	msedge.exe	114
PID 2720 wrote to memory of 3276	2720	msedge.exe	115
PID 2720 wrote to memory of 2876	2720	msedge.exe	116
PID 2720 wrote to memory of 2876	2720	msedge.exe	116
PID 2720 wrote to memory of 1412	2720	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\L1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffd88d7c188,0x7ffd88d7c194,0x7ffd88d7c1a0
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,17092639699055387377,14658856385313477751,262144 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,24752000854914143,17810440316278800040,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12241961048751883540,15747894136521673559,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9637227101919622176,16490235480747312172,2097152 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4734884899836328109,2064838004759402515,2097152 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4548808626583278437,2343943396129480526,2097152 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5781706026584119879,9562431863908224397,2097152 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14093099494151425225,11189093348410597276,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16260236660183124190,7506201887448781023,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9695840553337407720,4062388941803926714,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9695840553337407720,4062388941803926714,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,11489923123649556386,16723117415283139244,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,4424084361900332505,1522600787999527770,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,1348863253992365069,14904254369947362229,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,18379477353459951447,15146902905682807970,524288 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,3548864637586640805,6659733381789833014,262144 --field-trial-handle=2284,i,9106262839415871651,10978992065802287093,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e5343d31c88bf59d2a5991e5a56799af267885f775f2230e010317a52f0ddc4
MD5 5b92e7e376d3359c1e916c4b49250933
SHA1 33da3dab164d12c10dff1058b17475800c197e56
SHA512 e216f956cc23a4938f02091380901ae858c70cc26c9ec01858d7958a3bf3e78244ac502655f2d8ee981d0a328ed024b39d687dade1c86a6c56bfde2b036f0dc0
TLSH
T12361603B8612C1A3EF9D0133DCD245D738BE88D9F6232E9A129E19BD360571CD279369
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 49ce76884da4d28bbefb55d0083d98dba371bb2a3ebbe302fbe011ab8b8fe3c6
MD5 b3f20966af8a118f6794b32081a0d5c5
SHA1 520a0f9562c892bc3d3708b930865911fb058df4
SHA512 4ef57b95d4caf84d4069c8a7930fbc7ae477461ba7b5f51e8eeb941a6e1db9b21348aea2d9f1c9cce17f465bba69ca2bfde48c575e2606f4de8c1ef246ea6696
TLSH
T136219CF7C3D486AE991146F4BA247E1BCD1D0516522C3C5A89E0EF1BA3E24B4E10154F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1627d05730e54cbedb4f679a66c4210d7d10db2198c1808927a7d344a66c9e9
MD5 ad2061ee990d96d412c69205b0ab1600
SHA1 70ba3819a0bd3335cd81eba8be4aeeaeef17b4bb
SHA512 95afa6750b88282487e16ea8342b05fce9e5a5f25d2771977066633bb4d7b55e0a3cc36ce489e74a4e081bc6f98b1f8cd43e2c8dfe5d9eb46b56de2bdf714288
SSDEEP 192:sxZORjyM/jK1Ml8Mks/fHsY/47Idpd3HW6+WNGYCkyV5SIgrJ:sxZOnMs/fHsY/4kVHbGh89
TLSH
T1CB42FA156A34A977CCDBD209F951BF53D6F91572E2900E44A9FCCA0C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f8cb8826c200aadc4b96aea110b6a1509895e2bc0d54dc3a679ea489877a77b0
MD5 39c80fca4c9de55cd4964feff6cd56f1
SHA1 ee42fc024530e7e56003767d18788262e119a0b9
SHA512 6101804e78b62bb53fd9b1fde926e7efee5e4939909742f70ba918c0895fbb7e44387410fb35cd8195aa240b9a5ec880237cac9da7d2d7d1ce9983401ace2131
SSDEEP 192:sxZORjyM/jK1Ml8UQ+ks/fHsWh47IdpH3HW6+WNGYC9JYvz5SIg5/J:sxZOnqVs/fHsWh4kXHbGJJE8b
TLSH
T11352D916AA349977CCDBE209F591BF63D6F95572E2900E44A9FCCA0C04E6EDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6504b1035ea71ac70446702d50b327f092470542eed8b2c21cc3dbecacc3ae2c
MD5 0194e2008a785a5382149f844127e5d9
SHA1 93819c3d3879977a9789488feb8ec4d7d72161cc
SHA512 ef47e82c69bddcdf984c158b7e523e5f2a02ea4984b6af46be64c3f2afd1f9fa0869c7b0b4b4ab35d5e7ff707baa5e6e27e1da2fbd42402a59f5a8bc06b923bb
SSDEEP 768:8F8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVTro9:8F8bqn+WvSCt6u1jaCZLbWVg9
TLSH
T112D20A3B280CCB7E4F845E5CEC266F966DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db1e40016ef8f51592176ee518c755c1e6e9430d26cd356e7f2e42d157f8d04a
MD5 691400f4d486647b159ae6b2e1f542c5
SHA1 03daa8c7e36a8afe15da26f0dcfc77ca165e363e
SHA512 77ec15e4e88c5891d963ffba39446b1ca7cfb623f79fe7152c34fdd4d79978c36840bd72ae8df14ecaf591eb58f1a70ba9d52358b48549ebc976816cf4c3e9e0
SSDEEP 48:KcaIvK3qwbyVFIdK2gA66I/KHq03y2M5QciuCYz:KcaEK3qu2FGK2gN6oKHqeTM5QciuCYz
TLSH
T17B91B606313B97212CBD644DA1A1952F0F8231D23169646F3FB862E71E7AE510EFE9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b8c4c73-e95d-4585-af0f-f87f78c97ed9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8b8c4c73-e95d-4585-af0f-f87f78c97ed9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e6f60ac3b21afe1ec1aa105da37e0aa0153b6f02e4ae6b2651d90ddbcb04e3a3
MD5 9d1018ec833790696a0a0e76c6e42c51
SHA1 23f4b947c272e15e9398c9f44669864dc1997be2
SHA512 e9b7612176e5eaecc61971075c0735a01ea5138b0bf9ef0b13efbd63915cf9cb180d48d759cfb2b9be04030621b02de67c45c98097b38350d7cb7a76e0e2be25
SSDEEP 384:9tNn/s3n9SfsN5RYlUK5yXZEa+Rdrg+2zHdITGT0Inx9U:9j+9U/KyasdglzHdi+0WvU
TLSH
T196928D335938AC6B8DD2A455F44B36170FF445A7DACA3B95D6EC9F0C00DA7AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed3ad3d08a93f4fe11fde0d546b3f31db06b5576cbf171c3efb43af4d352d41d
MD5 0ed88d582598db2bd125381dcc4a3ff0
SHA1 f2c2092b73eb08b2cc6e59cf802d32f03d84529c
SHA512 6469e25a93ba9b6492d824e084b906af0cb0a5f4b24f9d81673c33821d76a1313084e94771f7e23daab4de3b4e2476d576d032e9e812e7c370c434edf59a2ee7
SSDEEP 192:vON46Db6QmiUy/yHBa+j36+FdCuRgQvU6:vON46ujHBa+RdmGU6
TLSH
T1DF02E83968782CB79AE26E49F48737275FE4103B9A962B94DADC5F0C00D765C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7c4a645a9defe73fc2ff4a526258ea11ef5f67243d61b88e7d5dc961dd388a57
MD5 255eea96694b2ef0ec9459e4b0d2a47a
SHA1 affa9e2d16b0fda116a9afedefc332018da5c7c9
SHA512 fa88985972d37bb7a4968a79c9f9db6a21a993134a02c79984fcac4e8605fff3479bc7bc0b6ea57db18faa09255c146a6be4cd66c19fc679d8f3dee4b19ed0e7
SSDEEP 384:TtNn/s3n9SfsN5wYlUK5yXZEa+Rdrg+2zHdITGT0Inx9U:Tj+9UYKyasdglzHdi+0WvU
TLSH
T189928D325838AC6B8DD2A455F44B36271FF445A7D6CA3B95E6EC9F0C00DA7AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 fc81c710b77cf84fe34d8a553fa9148fcd69ea995c428eaeb4a7e79c73d1ffaa
MD5 c6510305cc016c5ed30bf3ce8f872630
SHA1 8387c00f01925594e817c7658de9549c24c8438f
SHA512 4a3e75e8c056e9062420b8bd0e31c1d63cb734c0c37385a6e3d94fd2f79fca5abc38a44e23048f8b592705703dca62dc2cd08d8118b19d77857daf188e2244d7
SSDEEP 384:LiF1tNn/s3n9SgzsNb8TUNTUlIlwYlUK5yXZEa+Rdrg+2z2dITGT0Inx9U:mF1j+9jmwgpKyasdglz2di+0WvU
TLSH
T116A26B334828DD7B9EE66A45F44A32174FF401A7C9C67AA5E7DC9E0C00DA2AC134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8140bdf11431478156ac3e3437ed2d25061d2bb23a7ffdb3565034ad0645313
MD5 9365a4b813a474ca83c4636abdb8a318
SHA1 631c5b11ddb12394c3f215bbd49c598e30f81cdf
SHA512 a06cb102ef1d51295536b2c702b8ede99fb5d87c644c1d68bb5600c05b812083bc243b8f6e846ff5f8c7d9719674acfc5ca1a8b6712634feb69110a2d0ef2249
SSDEEP 192:zONM6DbAQmiUyWdybBa+j36+FdCkQ60+2zA2Nztq4U6:zONM6YlUbBa+Rdrg+2z3dU6
TLSH
T10C12093668786C7B8DD2B954F48736135FE45127DA8A6B91E5DC5F0C00EB6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26491fcd-f61a-43aa-93d7-ce0457ea4177.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26491fcd-f61a-43aa-93d7-ce0457ea4177.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 579c5179fe242e61c2937171d5412139ae47284b73f92729519836dad79e10af
MD5 b657b94bbcf6b694f84ec06f144a47e5
SHA1 63076a1c383079b55908fc4488399a694b11f8eb
SHA512 f32bef3d7616f73b71d951836d26e21bb4333d7edcd079edee907f78bfa924a509f1a55e1fb9202fa4a6c50ed35b05c017b1231750bed1388bbfb630bf40debc
TLSH
T15141285CB6EA1158B3B77E59ABF6A86D487FB9272E0BD19D00010E4F0662A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download