3f9b5fa9ae326440c6e09e738748b9b46eb557724f99f52a2d64b23ebef802c2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Templates/main colored.html
Size 53KB
Sample260628-wt7wjsbs2v
SHA256 3f9b5fa9ae326440c6e09e738748b9b46eb557724f99f52a2d64b23ebef802c2
MD5 41d49b5bb416aebcadea7f5e03aa839c
SHA1 b41c079fff8c234f94043a2aaeb5cf447994d308
SHA512 8661c84cea3250f7d0dc87e8c73f53d056ac369fe8a054116c24f4518bc7ae742fd01e7193353f998dd4e565d8ff8791b9d06281ca0db93198616152894b8c8a
SSDEEP 384:Mb5/q8VDF58UVJvdOKbTCpWIk+QqWPV3sAp0:MbNq8+UVJdbTCpWIk+QqWPVl0
TLSH
T1F933BA25A9C1613751B3C5C58A607FAAFFE2814BD70B8A0432FD2BAB5FB7E849C03515
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271440649560121"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9C4077B2-8597-4AA1-B000-F755B9D7EB00}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3780	4792	msedge.exe	83
PID 4792 wrote to memory of 5056	4792	msedge.exe	85
PID 4792 wrote to memory of 4380	4792	msedge.exe	86
PID 4792 wrote to memory of 5056	4792	msedge.exe	85
PID 4792 wrote to memory of 5056	4792	msedge.exe	85
PID 4792 wrote to memory of 2068	4792	msedge.exe	87
PID 4792 wrote to memory of 2068	4792	msedge.exe	87
PID 4792 wrote to memory of 4968	4792	msedge.exe	88
PID 4792 wrote to memory of 4428	4792	msedge.exe	89
PID 4792 wrote to memory of 4968	4792	msedge.exe	88
PID 4792 wrote to memory of 4968	4792	msedge.exe	88
PID 4792 wrote to memory of 4428	4792	msedge.exe	89
PID 4792 wrote to memory of 4428	4792	msedge.exe	89
PID 4792 wrote to memory of 816	4792	msedge.exe	90
PID 4792 wrote to memory of 3980	4792	msedge.exe	91
PID 4792 wrote to memory of 816	4792	msedge.exe	90
PID 4792 wrote to memory of 816	4792	msedge.exe	90
PID 4792 wrote to memory of 3980	4792	msedge.exe	91
PID 4792 wrote to memory of 3980	4792	msedge.exe	91
PID 4792 wrote to memory of 2904	4792	msedge.exe	95
PID 4792 wrote to memory of 784	4792	msedge.exe	96
PID 4792 wrote to memory of 2904	4792	msedge.exe	95
PID 4792 wrote to memory of 784	4792	msedge.exe	96
PID 4792 wrote to memory of 3992	4792	msedge.exe	98
PID 4792 wrote to memory of 4528	4792	msedge.exe	112
PID 4792 wrote to memory of 748	4792	msedge.exe	113
PID 4792 wrote to memory of 2116	4792	msedge.exe	114
PID 4792 wrote to memory of 2764	4792	msedge.exe	116
PID 4792 wrote to memory of 2764	4792	msedge.exe	116
PID 4792 wrote to memory of 3928	4792	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Templates\main colored.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff87066c188,0x7ff87066c194,0x7ff87066c1a0
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3561857666525013852,1451730613776239802,262144 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,7666938835339501667,14859551883775244391,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,7667750156585085336,7075594895941434556,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4336203280198351955,1070080798747212431,2097152 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15406211818532107287,8711797631245695932,2097152 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13652040151732374714,11932396895649296021,2097152 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,13030818717858362074,9300942107916095778,2097152 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,12609962492891396547,17737125217077630749,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1493915305909483640,15231177170350273336,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4031449764720471816,9201653632119311527,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4031449764720471816,9201653632119311527,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,17644300997618479086,16808503873357736161,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,16507906552096029994,8907972040291173706,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,65299169021048500,10751905877826763685,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,6915287861637919266,3760817848610193087,524288 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,16365712940935149250,11259788052468013868,262144 --field-trial-handle=2412,i,16460505166979778655,14040233529762680638,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c05788a80cd6d4ca7fcb0a6027cd303e2eab0fe49b6054dd7a8f8760839aff70
MD5 96867c8cd55c84397ba4ea1337bf9abc
SHA1 3a4c8487fd1ee0549f4f1d1e32497a5926a87c80
SHA512 e497a7cbf5e86d39fce9e5283bba13d078bcb9d8a9b6bb36e3e87d59a389f5e70079794c4601744b1d57e59901d5c184e7b9ea43f21ed502909eb74155daf84a
TLSH
T1DE615D73021238E4EB324273A7D22744747746D8FE6BDD677C90BBB81A5535DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5860d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5860d8.TMP
Size 3KB
SHA256 645bde89ce7250c7e15779b666fa01b36c21a24e2baea887dbc9219e24cdfb6b
MD5 bb2c9268b0f64fdbcc2090283f8d9afe
SHA1 77fb81114d188c24661f56a1856c9196972a0ccf
SHA512 241a6163f4fffd4817288bcddfbcce2fb9450567cfbae4cde1834d0e12bf5fc213f58b134e28f1f60311f3ad1bf602fe14bf063d4b7fada0cabef158d365fa67
TLSH
T1AD615C73021238E4EB324273A7D22744747746D8FE6BDD6B7C90BBB81A4635DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 256afc37a616375cdd38942a1e0bec1de2f980b0b105f8fb172c8f571b536f68
MD5 e01f08c49d0833447cd8a536522a2b0d
SHA1 dc0f82f91dcade7a4f0c103272a005e478af6ec4
SHA512 e7ea8b81065c69d96ecfc91bde6728626a362f2420f64e643ee6f364c288267c1b4f30efe5b974f2c5fcff366b4d31bb45f8975d817c986490df51ae4d1896e5
TLSH
T18D317CB7C3D4866EC91156F06A25BE2BCE1D0516822C3C1689E4FF5BA3E2075E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bf3519194b2b5bf45643ea8040713e696961a7b477ea707477d9361e9f878e3f
MD5 707e4f314456c6883b4c331c2c0370ed
SHA1 bc71c778e0bee1f4c479dd278391b8a2bd826f44
SHA512 c3bd53342cbe0380fb277bf03fcd9add5df1cea539e37f01ef82483c7ae334aaab35259d102e2315ad8e3603d28e8ba2c64f923ecb3d3a0d1f8607f2bfba88a3
SSDEEP 192:sxZIRqyM/jK1Ml8UQukv/ffsK7TPdBVrIdpHWHW6+WNGYvevjzqIg5eJ:sxZIMqFv/ffsSZg2HbGnmI
TLSH
T18752E7126A349977CCCBE209FA56BF53D6F5447392900E44AAFCDA1C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ee1085ca02d84d196bed1b3d8359f11063f981605fd5a75228f653734df54952
MD5 85da4ee6e6e55016e1dec5a7e442741f
SHA1 40a0b10b1efd088c888a0c1eac641b7d782a8483
SHA512 2232dfff64bccc405b45b2e706493543438ef240b3cf3a912df30926b8e2489df67007a9e33d79afbf7b917427e08bd424aeaed9c44dcbd6c75419a6d63f1c6a
SSDEEP 768:OAseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppPro4M:OAseJ3xWvhfynu1jaVcL88pcH
TLSH
T11DD20B2B280CCB7E4F844E6DEC266F966EE801CB5B944D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8613b0e3e8f70b426233afff1b8dde3badd66657a682d96baf49dfe7b32077fe
MD5 a6efee9d7e72ff12865123011022aef7
SHA1 c87d39cd8d38f08071d118bf41629b66dcce5f9c
SHA512 fc16b20488946bbb68663aa2402b3f21494748a522af18bc0710a2727a77d08961544b2d654ccac4d8431f931f0710356c18d9bb085a4e61eed915185b8e9925
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnGvyK0YqCz:49zT9BK
TLSH
T127918216357B13423C7E2848A2A5953B4E4235E330E5B46FBBB804D55E67E111EFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feb4ca46-1108-484b-9483-881ccbe6927d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\feb4ca46-1108-484b-9483-881ccbe6927d.tmp
Size 12KB
SHA256 9ca4ba72435580648ea23cf1c3c1de01df8eebbfec4add1eb149db71b7fbf99d
MD5 18d7df6ff442d30ef57198692a85a177
SHA1 1c12f688c1f8bda32b7162b395d2d9096fe7aac0
SHA512 c6da23397aa0bce8ab12de1d63c1646aaf209ada011f0d5538b41179e2b1b4a231945174a0b8cad24f3a350a835571b3840f87c63d82a638ff8e0fb626dd0afb
SSDEEP 192:sxZIRqyM/jK1Ml8Mkv/ffsY7xPdBVrIdpdWHW6+WNGYvr4jzqIgrJ:sxZIMMv/ffs8ngIHbGpm9
TLSH
T18842E8126A349977CCCBD209FA56BF53D6F54463A2900E44AAFCDA1C05E7AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fc2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fc2e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 388ed23f53fe8dffdbbe926da2a8ba98ab1eee8643bc092e2bd29c3afd5c87be
MD5 8b427e9f56fd180cfc0bcaa07d105c80
SHA1 677f54e87f95c7449acd335f616eb8af97548bd4
SHA512 760b540fe88cbceae05a97fe431b7b46ad75b36108eb6b2251d37f0c5e3b2e3c60cef477b492f9e30a0595dff5dc935ae323819f106021363837d505ec0ec49c
SSDEEP 192:u+TSNWMsnMcPPQLz3XX9VofsNrPQe7faj3M7n+JQmiU1k044MTxQClqyNI8z1DqN:ftNn/s3n9SfsNrPBTajc7+nzHIlvBalt
TLSH
T15C625B32AC749D6B9DA3A980F04A37075EF4916B92C52F90E5DC7F1D05DF268130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 750ec578bd69c4f6a0c29dcad3d34e88708830f6267d04f3ced274c285aa55aa
MD5 c6871f83b0169a2ff4a1fd52222a48e7
SHA1 c1ba9d972c6ba32b26cf5b9aa6f03fc5e668f497
SHA512 fefcf9d8b3dbce19a0b061c40ca45817ab0b3593e75b753703581b2969df748c48181cabafcefca3c0b87f52a15f65d293fb3221939af92738f3169052e7e8bb
SSDEEP 384:KiF1tNn/s3n9SlzsN18TUNTUlIluBTajc7+nzHIlvJalt:BF1j+9SAwgQWIioXalt
TLSH
T15F823A339C64897FEDA79E84F54A33079EF091ABC6C1AA90E6DC6E1D01DB19C130BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5d85981cd7c058cd13b5077a90423c04c55f53e68174386be65bd7adaa8cc40
MD5 9f0bd8f75d35ca0b49b2553fd4e92a8c
SHA1 762eb4f30a556405d3c763e17df8ae71047d244a
SHA512 41fb1e4ee7f9edeb2618f17179252a8d0570792ced7722b20b2900c453094f8b9fac4c56e3e2c1947189294a6c187e900e0e48b3045301c83c265b179558db93
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop5GODABjPYvlCr5pgz6qNGemL5XuV:lONP6vMtPQmiUy3kThTxQClT847mLU/u
TLSH
T18B02E835AC686C7BEAA7AD45F48A23172FF4606FA5905B50EAE83F1C00D765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6df2075e19d4ac621bd8df0ce25ea12e675b13fe8dbe518091d8f71c2bb9b48f
MD5 8910c102a5cc4a5847e888dc0cd9c5c3
SHA1 f590049935c85a1e73967b19b4eec0261280feec
SHA512 f7aeb17070424c463c1d7400cf7b663dfde642b62dacae96348348bf936e8ce64ac47ebcd986aeae27f28ebf425a8b18634fc6104a05030839890ea1657f9334
SSDEEP 192:uETSNWMsnMcPPQLz3XX9VofsNruQe7faj3M7n+JQmiU1k044MTxQClqyNI8z1DqN:dtNn/s3n9SfsNruBTajc7+nzHIlvBalt
TLSH
T1CC625B326C349D6B9DA3E980F04A37075EF4916B92C51F50E5DC7F1D05DB258130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bd9408ed25d881be40330ae3865cf3486a8f728f2d4d6ecdbaac83ee6807a56c
MD5 023ed0d7b615fb33e606f10c39a60408
SHA1 11eda04675ad9fab6b78250ae26955562d04e5c6
SHA512 170ddcc33fe083f33ea8d2eac51baccf0247a5fdfc50df37fc3106948185ad5ad29c83ad1bdac3745aaaf3d3c88ab0bf4c1ba1472da7b7155f77d76c5feddf14
SSDEEP 192:ZON+6vMsPQmiUyDk1hTxQClqyND80IDqxU/u:ZON+6UsRl1blv0aU/u
TLSH
T16B121B76AC689C6B9D93B541F08A33071EB0916BEAC49F50F6DC3F1C01EB55C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01b6190a-e62d-42b2-a94a-0b88c3119527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\01b6190a-e62d-42b2-a94a-0b88c3119527.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd3f8c3c493a4eb2e01741d76120cd4be7d77b708874c60d870b75088b2a7d30
MD5 6bdf5c064095031cd3f5dbf5e71554f8
SHA1 5d7abd98b6ac9198f7dd543ae66010c8d1f1717e
SHA512 71d8ee82062d39ec51e39ae987238ab0b5f0443fbedcbd06dd022b5b248e51ce58b25db115aa9abc34701f037ce40397f2403672fdb866567c39dd62d4369611
TLSH
T169413B5CB6E91148B3B76E16DBF6686E087E79772E06D49E00410E4F0A22B01C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download