45497db68000420ff020b72ab828991c6ee51ea9d81a1184124654a9d7c06f9c

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
verifynationalID/index.html
Size 514B
Sample260623-pdplpscx5x
SHA256 45497db68000420ff020b72ab828991c6ee51ea9d81a1184124654a9d7c06f9c
MD5 9862aff47e17a32fb27cad969ea8a8ab
SHA1 c80a795de597c89fffc241b40cf6f4e15625ae1b
SHA512 9cdebf3902901bee9dd6d37438759914438234a358b558f3b16aacabec728694123ef3eebc19ba91205a34871e8d66153b4584ed22e3b650ab66f1b46f9bf2bd
TLSH
T14FF059C744D0028692F362111DDAB21D2173A5AA1746D8006D9DE19A0DF9B8FCA6F6DD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266903863910127"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{618C54C3-F677-4F23-BB47-8CFFA70C59F8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1076	3280	msedge.exe	89
PID 3280 wrote to memory of 4832	3280	msedge.exe	90
PID 3280 wrote to memory of 1844	3280	msedge.exe	91
PID 3280 wrote to memory of 1844	3280	msedge.exe	91
PID 3280 wrote to memory of 1844	3280	msedge.exe	91
PID 3280 wrote to memory of 1140	3280	msedge.exe	92
PID 3280 wrote to memory of 1140	3280	msedge.exe	92
PID 3280 wrote to memory of 2052	3280	msedge.exe	93
PID 3280 wrote to memory of 2188	3280	msedge.exe	94
PID 3280 wrote to memory of 2052	3280	msedge.exe	93
PID 3280 wrote to memory of 2052	3280	msedge.exe	93
PID 3280 wrote to memory of 2188	3280	msedge.exe	94
PID 3280 wrote to memory of 2188	3280	msedge.exe	94
PID 3280 wrote to memory of 1488	3280	msedge.exe	97
PID 3280 wrote to memory of 1488	3280	msedge.exe	97
PID 3280 wrote to memory of 1488	3280	msedge.exe	97
PID 3280 wrote to memory of 3980	3280	msedge.exe	96
PID 3280 wrote to memory of 3980	3280	msedge.exe	96
PID 3280 wrote to memory of 3980	3280	msedge.exe	96
PID 3280 wrote to memory of 1016	3280	msedge.exe	100
PID 3280 wrote to memory of 2884	3280	msedge.exe	101
PID 3280 wrote to memory of 1016	3280	msedge.exe	100
PID 3280 wrote to memory of 2884	3280	msedge.exe	101
PID 3280 wrote to memory of 5104	3280	msedge.exe	103
PID 3280 wrote to memory of 2908	3280	msedge.exe	107
PID 3280 wrote to memory of 1200	3280	msedge.exe	108
PID 3280 wrote to memory of 3832	3280	msedge.exe	109
PID 3280 wrote to memory of 3140	3280	msedge.exe	117
PID 3280 wrote to memory of 3140	3280	msedge.exe	117
PID 3280 wrote to memory of 3824	3280	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\verifynationalID\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffc32c5c188,0x7ffc32c5c194,0x7ffc32c5c1a0
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16926676677245779251,8055914745801908571,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8079425842735776407,4603301019565828250,262144 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,10493236765449161884,8711438833547485481,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3124607525792009223,3800728022454057763,2097152 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,2798752338271909523,18248425806399687566,2097152 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1751281844402913707,17717768075229378792,2097152 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3169294021043999969,2806304494649654189,2097152 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12444968378007845448,9531448280287185495,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,9813307821616302656,6715567650634647524,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8664714149011453426,2661586380951548543,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8664714149011453426,2661586380951548543,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5779821126814600923,7189025853343762628,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,2831229443933820088,11604350022620925118,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7471304808379376983,16833897916818486622,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9235807152115453984,5997579128127091637,524288 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,14583610834466267744,14714458974661784704,262144 --field-trial-handle=2452,i,10736778523777899688,3744885876880347093,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 751f78f0682c58aff66bceb23239cb8788c72bf89c76523e65ccacd32ab814a9
MD5 e161c09e990e9f399a01dc231ae88e40
SHA1 3e92fc08058973e1001371b1c36d84c7f991cf56
SHA512 f70fb8faaed9daf05c58bdb011f623e8e80f759348b1ef1cb5d1625f3bc12b0b11161879b7da9b06616ebefaa8dd033166fefe788bab2c20aa6d721d0e7bbd31
TLSH
T12B61C43829237590DFC002307FD241B4F4BC8AD8F56FAE7A1D1399733A08721728A6CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 981B
SHA256 689f21ff6708739bb77d16dec339779ccd8c5bf21a6262bb868f2c1f24cdc67f
MD5 dd807bbec7315a9d77a9ca6a00681656
SHA1 dc7c777f77b4c808c436de18d52eacd7ace42c9d
SHA512 1b2fb1cda4fdcd3c4609896964f681a198b2def85ccf8c03d4bedf97a602c6ad21554956f78a6340cbd53629616d5267100b93ce5e935b30feaac69dae71c9a5
TLSH
T1C4119EF3C3D5896EC91156F0AA247E2BCE1D090553283D1A89E4EF5B93E3479E00194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2fffce126d8ff1bd487baa27b59fb1798ddb36af6cf6bae3db9a4282c3e74183
MD5 a39402a6f7080198022fc170d303c6d7
SHA1 b4134e1dbfec10087eefb851881b1bd5bc89a2d5
SHA512 899eb91238953c538e63210ee51f518e01525eb96b6fde0b3f9419e6ad93a31d95962cfcd02747827fb91c570086f7e83083b500d00326304983ea51312be002
SSDEEP 192:sxZ9RhyM/jK1Ml8UQPkw/fasDIUIdpHOHW6+WNGYC5+EuwIg5DJ:sxZ9Rq8w/fasDINuHbGLLn
TLSH
T16152E9166A349977CCDBD619FA41BF53D6F95472A2900E48A9FCCE0C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d68201219870978fd23329b1c1555114436a2e4c293ea72d03b84420f273c18f
MD5 113f8ab669f5db9791e79150f8469abf
SHA1 b6ebdcd184fdbc7426aed80f14252dc264583aa4
SHA512 fcd19da821c2dac708aab1ebd1238122c99877dac6808d825b2629765f93ae85d29111ddbf6ca638d5cab0becff9683d19562758538737adc97e609e9ab93174
SSDEEP 192:sxZ9RhyM/jK1Ml8Mkw/fasBfUIdpdOHW6+WNGYCkVOuwIgrJ:sxZ9RMw/fasBfNUHbGlL9
TLSH
T11542F9166A349977CCDBD219FA45BF53D6F91472A2900D48EAFCCA0C04E6EEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69f31bc25d18348f244cd5c16936d9ba12c2b4d2104eff28197f22d777f0694f
MD5 cc2cc549e4380cc760b0e87031537e11
SHA1 d3ceff10372075a120acf7f77bcf7dff5181b924
SHA512 9762e2eed070828ffdfcc4c3e3f9021884c50c548d9bd00dc9b51038e898198a5e5df9913c916a62d19e0f81db510e564eb1621b19dfe6183f452de8784eaeda
SSDEEP 768:rE8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVsroS:rE8bqn+WvSCt6u1jaCZLbWV3S
TLSH
T14CD20A3B280CCB7E4F805E5DED26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2cd430dda9f01eb22ec22ced2b860f011b15e2896241ea7a2b113a2352824c3b
MD5 2ad1070b6e6dfc97031454ca0a54f293
SHA1 1c278191292301c502e614f3c3af754a7b3eb571
SHA512 fcf07bd5f4ab5148c0c628e8bd799839b811171a811fae0e742df7579ac0f4764ab99b113ad63ad4641bc8c9a4029735df0ee79c5162854f32f454365c19268f
SSDEEP 48:K0TQ3D5FRkhFmPIm7kKfBX5jsnTRtZkpt6PI6bkK/BH5kLz08aRz5yxoIvKx2EJg:KEIgKJB0QKp+ayoAKx2KiYKTN
TLSH
T1B7914707B57A5202387D394CBBA696765F9531933058F5AF3FB810A20E26E610DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 29a2b151cbb76a138d55fbc54751014cac1eefd216ac366aec8931d25acd901c
MD5 f245a747cfe0d165c81659a2f6442456
SHA1 f960895a3d74ac39c7fb22628d95f82e9d2ac887
SHA512 22a10e644ceee179bc0b8c9a788e46c203b35cba6054eba7825591b93c633f8e53a4a654e3ac62d23a0cef63da40828b48f87704e0e30a31a0add1cdd4151ab7
SSDEEP 192:u8LsN6cQeNbi2FQmiU1QsL4Ea+jROmDRkeamUqtn3QvR2r7I4ZRphQH/fyj/:JsN6cCIbUEa+NOjmPn3kIXtZa3g
TLSH
T1EE725B3268789C6749E29A85F94736139FF840B7D689BB54E6DC5F0C00DA6DC231AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae91f0bdf492b9ee90745f3b394cc1af1961f6e49720dcfbabf291923bce9d65
MD5 f81be2ceaa807ff524154eae07b734f1
SHA1 2095cb4258756b4661f8b74664062ea96f85f701
SHA512 2864dbd1fe37ebdf39e02a25dfa8bad07b5d9ff994571a7dab919e4753cc1cc3944288baf7c0651b1cc8724c28e706c397a98fdda13ce52494a6b6b78da518ea
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop5SnDGBfPgvE5BzatIRdy+88OmlmsR1Y:vON76Db6QmiUy2WHBa+jROmDRuRgPSU6
TLSH
T10D02E835697C6CBB9EA26E49F88737275FD4103BDA966B44D6D81F0C00D768C234783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2d0cf5fa8bb13a8a6dc56a2a534aa71c715c07ab5eff347ae3a8b7753f4b535e
MD5 0bc4a57d6c196f4951f0cf3219e0627d
SHA1 ab1f8d43b6c50f290516f2812a78f87880eeaea9
SHA512 9855e9aff24da9eea70fc111a294cf32929ba17401b74c5e92ff6372d980432aa2dc7436725036b94c14a7d0a3064d962bc48c89e83bfd607341a59115684c78
SSDEEP 384:btNn/s3n9SfsN6kCIbUEa+NOjmPn3kIXtZa3Ix9b:bj+9UOvaIOjmPpaYvb
TLSH
T1D7927C3218789D674DE29988FA473A175EF840B796C5BB58E5DC9F0C00DA6DC231BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 210f157bc1524f1972120594623168917002197cab34fc81a1cdec9627414190
MD5 8da0a9fda4ccce0f80692692d267d374
SHA1 4ef18ce7f27ffffcb79c1b4eb1fe74c28925c131
SHA512 0a5841b51734909ada278729ecd92cd1765702a642ec1cffecca85c08684a91709a06f18e35c77584e128064479cf4d35c170afed4767a3886666681fc845726
SSDEEP 384:HtNn/s3n9ShUzsN6kCIbUEa+NOjpPn3kIXtZa3Ix9b:Hj+9ZOvaIOjpPpaYvb
TLSH
T114926C3258789D6749E29988FA473A175EF840B796C57B58E5DC9F0C00DA69C230B82E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5488608fd936d1aafac2f5518d010fde84af675e7fa8c51b7c238720d9c5cf92
MD5 a838a6ce4cd6a62c7c8f91998a8039d1
SHA1 8ff8da2afd13d23819151d873b642f08cdc153cd
SHA512 9211e5959dfa0bdad5ee6f2687fa25a4024e92a3009bf1c92159e6d557ae6a54c405d6501f402e104ae68f1e57149d5763d5692a1d5fc134a5f6a1d73f4c8e26
SSDEEP 192:fONT6DboQmiUyPW0Ba+jROmDRkcNzUqtU6:fONT6gN0Ba+NOjcPU6
TLSH
T1B7120A36787C9C675DD26955F88736135EE84127EB8ABF94D5CC1F0C01EFA9C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ac72d9a15295ccf48d099ece0fe65957d2c631e0913ccf7edfe688ac850d88ff
MD5 8a7fe989f5875939d9e46d21ec48c578
SHA1 87d103daaf5cee03b93ce9b1fb2416ff6e69e28e
SHA512 ed9e9139bc6aa4ba3dfc0a228a271087dfc7d9aead9eac4d942f2c4156f775ebbd1f1dd9485d9bf214571f66b5dfe0ee3a2dd401342048005be7f9b32c2a8320
SSDEEP 384:BtNn/s3n9SfsN6RCIbUEa+NOjmPn3kIXtZa3Ix9b:Bj+9UVvaIOjmPpaYvb
TLSH
T106927C3218789D674DE29988F9473A175EF840B796C5BB98E5DC9F0C00DA6DC231BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e415f27b-b954-4a4d-be88-c05c4431d361.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e415f27b-b954-4a4d-be88-c05c4431d361.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27feea9e5fe2e4ecf88c9a8302f0a4e475d1e058bd846a90b3540a74aacd4175
MD5 344017398eaeb7e20e1dca0f6bfee5c0
SHA1 8496fa332766414d4f4430105aef0c64ca91c0d8
SHA512 1a43c048e226071f49b1caaa24d643415f3c2f76dcad65e941fa054b28b3c11bfe12110179a7c5034d155302320c4e5f3f5c8305a4dded15d052d8d701c043a7
TLSH
T16E410348B7EA1148B3B77E56ABF6A56E087AB9732E07C59D00110E8E0673A80C971737
MD5 SHA1 SHA512 TLSH

Submit Download