ba7ab577aee88de83005db0ea0a59fdb87af249f9f0967f28a6e67252a9247d2

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/1033/HTML/IDR_OEMPG_EN.html
Size 1KB
Sample260629-e2clyacz9x
SHA256 ba7ab577aee88de83005db0ea0a59fdb87af249f9f0967f28a6e67252a9247d2
MD5 aa883df23b01475d16ca857e87a4b9ac
SHA1 6747d0a36ba4463b55445df2b699af59d64d09b0
SHA512 a1d9b6a9887998ce6115e85fd7735dd74f40616454ac219fd39e7109b2da673df3fc7f13beec5d9abdc205e9844e0e703f3f8b99c1dc53c8739666518e310f99
TLSH
T117413322B5F12B5A8950D0E0B695BE165DD08123C7464460F4DE26BA0FDDC83553BBAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271807549476731"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{507B088C-9E18-4030-8E21-4FB21EC18047}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 840	3480	msedge.exe	85
PID 3480 wrote to memory of 4776	3480	msedge.exe	87
PID 3480 wrote to memory of 4344	3480	msedge.exe	86
PID 3480 wrote to memory of 4776	3480	msedge.exe	87
PID 3480 wrote to memory of 4776	3480	msedge.exe	87
PID 3480 wrote to memory of 4372	3480	msedge.exe	88
PID 3480 wrote to memory of 4372	3480	msedge.exe	88
PID 3480 wrote to memory of 2288	3480	msedge.exe	90
PID 3480 wrote to memory of 2288	3480	msedge.exe	90
PID 3480 wrote to memory of 2288	3480	msedge.exe	90
PID 3480 wrote to memory of 1824	3480	msedge.exe	91
PID 3480 wrote to memory of 1824	3480	msedge.exe	91
PID 3480 wrote to memory of 1824	3480	msedge.exe	91
PID 3480 wrote to memory of 3868	3480	msedge.exe	92
PID 3480 wrote to memory of 1536	3480	msedge.exe	93
PID 3480 wrote to memory of 3868	3480	msedge.exe	92
PID 3480 wrote to memory of 3868	3480	msedge.exe	92
PID 3480 wrote to memory of 1536	3480	msedge.exe	93
PID 3480 wrote to memory of 1536	3480	msedge.exe	93
PID 3480 wrote to memory of 4996	3480	msedge.exe	97
PID 3480 wrote to memory of 3852	3480	msedge.exe	98
PID 3480 wrote to memory of 4996	3480	msedge.exe	97
PID 3480 wrote to memory of 3852	3480	msedge.exe	98
PID 3480 wrote to memory of 3816	3480	msedge.exe	100
PID 3480 wrote to memory of 2400	3480	msedge.exe	115
PID 3480 wrote to memory of 456	3480	msedge.exe	116
PID 3480 wrote to memory of 4092	3480	msedge.exe	117
PID 3480 wrote to memory of 716	3480	msedge.exe	124
PID 3480 wrote to memory of 716	3480	msedge.exe	124
PID 3480 wrote to memory of 2820	3480	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.rsrc\1033\HTML\IDR_OEMPG_EN.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,16692202414041241636,5064168247824195085,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4007811168276224219,16212457464873987908,262144 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,5207566296394909609,1344349375654304163,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17376402610103991453,12680783447132920312,2097152 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,5689043750553085041,9150725163219767027,2097152 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3567528713048520558,5690518011845391172,2097152 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3598126559611910094,16665889726836997972,2097152 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7343437502030072085,12375653200725373582,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13253478170129446314,6593214493826043269,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,1788318093922060989,3033987072063019418,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,1788318093922060989,3033987072063019418,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,5195194440312525996,5541413842094777021,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,12142786281870794038,12442054697356638917,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,11810743250722611931,16183441262304796393,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,18072464016721131944,17643958055250649605,524288 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,10875441459985449866,3138040289559591389,262144 --field-trial-handle=2372,i,6612141084622509931,6080610037927834894,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a94fbf9db06365eac9d89487ff60882da5657ab1157c156bc0efb633c71e98ab
MD5 40301ad0eaa5085de2e4deb71d4f2353
SHA1 ddcc45dcb676c5ab4a4d72db807c8af22630b2ca
SHA512 4a339b805cf9e4d84419fbb05c0b5f60c25475f95b03280ace4024818f17c22f8360296b822e8b5ca454e8f2f0851f018d87d00a885ff1fcdfec8efa56dc4076
TLSH
T1CD71A20B06693E95EFE71170F3ED420D38F283F54D632E661DACD83D652AB274491308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5904b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5904b9.TMP
Size 3KB
SHA256 56e545fa9975b6a82a3a5917baf72700e3fd20ac89a81c3d6cb68fdc0ed18d6c
MD5 321c18e50c2189609f1fb52a44fce66f
SHA1 2ea1d35838aaaf43ddb74dab2c77313f588c1c87
SHA512 ffdd37266db68c9ec66ed49290feb4237c9aac2fc7142e4aca46e65c66a77316d73314bc2389f87aa2377dafedee60c9430873a78ce5026d9ea3f8299abb1ccc
TLSH
T19971A20B06693E95EFE71070F3ED420D38F283F94D632E661DACC83D652AB274491308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0fe695e6f3dd9e1b90c2e9e85bdcf0cb2fa91f128ba5e4094a9b7c3504c65261
MD5 b8f67ee82a82c2e7c017fbe5cc08602d
SHA1 645bd7626a98071dac59163c89c9a4c628b9bbc9
SHA512 c054387bda91761ce8b1356100c0ba57b71a6e7212d4afe190572f154ecaaf2eaccf258e9a5628d2627eea290609c8d1b2a6f2dac224fc4837300d63be959e28
TLSH
T19B21A0F3C3D5856EDA1156F06A14BE1BCE2D0505432C7D1A9AE4EF1793E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d995980856b7b39f810fe49e81e33da85d0968707f381318fac1ce68ef733cd8
MD5 0e0192d9cc691566b960457f6356b02b
SHA1 0b645c36ac5698222868099669b624fed20999ca
SHA512 c5ce85aa6866b81b2fdd752841f79dabdf4e57ad97ea3de093222cc6c6244df1d9e7e1fffa81429ad87e7f94a0684109587b355b2aff100595c594b3456730c4
SSDEEP 192:sxZmRSyM/jK1Ml8Mkw/f9soiQgIdpdyHW6+WNGY4wD/YIgrJ:sxZmIMw/f9soiQhAHbGn9
TLSH
T1D942EA126A34997BCCDBD209FA55BF53D6F5447292900D44AAFCCA0C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a7521126c7a66d2a46fa2befc4d4c01345ae849e0795a4cf119a1134984e9b38
MD5 48753687af10299e064ff9d042c3c354
SHA1 5f827816002321ec88282c620ccdb6f05287b1bb
SHA512 10f1eb8958c949ef5d82906be34bc47fd9253296cb6811765263b3a2b8f3766c065266e9034487a5b1ce8e495e599341cd3267e39385d6a99a1f6fb58a912824
SSDEEP 192:sxZmRSyM/jK1Ml8UQGkw/f9sPkQgIdpHyHW6+WNGY4NVUsYIg5hJ:sxZmIqtw/f9sPkQhSHbGLUh
TLSH
T1D952D712AA389D77CCDBD209FA55BF53D6F5447292900E44AAFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb80464e9f397e39d6d196d5aeb316db6bd75de6236e9187d64584fe01b3e6ab
MD5 4abe643028c73b23a5c094054168e5db
SHA1 ec3fbdf03fa2fc59ece5ab35fcab857f799d2680
SHA512 b1f2e615fc97c631ec888f2b0f31e2f7ca5772048da201384fff57a7236e93e519aeea9c52bc9562015274afa739cf4ffb8e72b909b31f3d6c12ac10c3212eda
SSDEEP 768:nT8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdIroQk0Unh:nT8iJPNWvx76ru1jahALocdzIUh
TLSH
T15ED2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a179aeb264c6dae4df7a109a541296317c63083711509f803d8e603f8e8bc7e
MD5 876d4c247871fcf4d9728fbd50247026
SHA1 e9f3596eed2b0b9f8153bbfd7458dcebb3282352
SHA512 9c562ac2f045c649019d8c94a74de8701e7c4291bb97dddda665741ea350e181411598dd267211d68f3598ec701b199b2dc8a844e7754d387e13af1639741f6c
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGM5CI/Kjik7yN:KEIgK9WK6A4KBGiCwKjiqK
TLSH
T1BF916F1235BF13012C3F291DD366875B468170A7304DA52B3BAE51A24EA7E620DFEEDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a07c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a07c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3ac0a442c96c9b4b54200cad03923f36fffd9f5d504285149e822cb73a752161
MD5 d579fda83676d03bfd3a5cd789755c2f
SHA1 c73a613a2539b52b8bec6b00f38bda399e602d12
SHA512 ab793d3024e09f8cffc982482bd0cc9ceb5de4cb05a7616029f0fec08b23d57e1172eb5db65cb19af4f2dd0e2581ac66c44d212da5465c7972ae006c048752bf
SSDEEP 384:kDtNn/s3n9SfsN35CYmRcskvMlImn15wbAjEJByw:kDj+9UQwImn12bfJow
TLSH
T174929C3298785D7B6DD39489F04A372B9FB88077D7C82F60D5EC8B0D06DB2E81316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1387cd00dca1f211fa81d9f3bce9d9d8228887f238a84f74409d4dd159f37c8d
MD5 7d2e020be4b05f1ccdac081fccfd1535
SHA1 f1314b3762870252f1e3cab459e21e5f58a2be2e
SHA512 eefbdf6eb1b474df2a7b08835eb03b5c6b22deeb2fd941b0b539eff78e76498eb4c0932c82696b03c8a3d8e9974f24fd7b1729fd94fa3f2f026aaae927ee04c5
SSDEEP 384:XEiF1tNn/s3n9SGzsNJ8TUNTUlIlICYmRcskvMwImn15wbAjEJByw:XfF1j+9Zgwgw/Imn12bfJow
TLSH
T1C5A27D338CA88D7BADE39A99F54A37179FB48077C6C56E60E6DC8B0D01DB2D81306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 165301a0c2ddf19d5159337bc178ccfd268cd3534bb4c744cb803bf98866265e
MD5 d3249a9713dac80b41f964b13adbdfee
SHA1 07468b14a1c7eef105a57dcc95c674b2184846de
SHA512 0b7f22869030efea79ccce446226677c2e0bc5d2db8ad2fb7e0a67ff675d7febd665c9110ec73b94b3e5ea9b00c2b3e85258bc1280734204f795edf205a4d06f
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5+5D4BhPwivh50xy0SFYK7Ax6YLg7:gONc6kDfQmiUyoMZ903NIQiqEU6
TLSH
T13702EA356C786CBB8EA3AE15F48737175FA5113BEAD42F81D9E8171C40D728C1742827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 32b6b17bec07e01fdb3f4f8e28cfaa2dd61b8fe00447976388514dbe53fe6f96
MD5 9cd905581b7909b5ff74317ded0c97af
SHA1 70d2330d10867052a6407c7c68adc3bca089428c
SHA512 22da6bb7031a085be43052755cf33fabe07612939529bde68132406f74aa462fafdfdd9621b23d04a56d8bd73da5e080ba59fa9d1d425622dd056035f7340dfa
SSDEEP 384:PDtNn/s3n9SfsN3ICYmRcskvMlImn15wbAjEJByw:PDj+9UDwImn12bfJow
TLSH
T11A929D3298785D7B5DD39489F04A372BAFB88077D7C82F60D5EC8B0D06DB2D81316A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b65c1a3aad84bb26c1515aafcf78839698a3e7109af0359f82fd7525c9926d5b
MD5 8e3f313476c0c7d03a9246dac9d929f1
SHA1 1b1bb46f6e53942a84a9b71adba6eaabb23ce24d
SHA512 84e45083bc1adfbb78638f00ae7a6e4dfdf8006dbbe703e4725c68e7313e2748313cd15f49fc77b99373f80b4a89c225ad6b407587546f65f4db262ea9de430b
SSDEEP 96:pqONkeQsjpfmUT+K5ih/cIPURHl8h4otop5+q6D4B6Pwivh50xy0SFYK7Ax6YLgW:QONK6kLQmiUygM8903NoeNpcRlqhU6
TLSH
T1DB123B31A878AC7B5DD36955F08737175EA48127EFC96F91D9EC270C05DB69C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

991e3eee-c32c-468d-be35-99aa9f4e500d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\991e3eee-c32c-468d-be35-99aa9f4e500d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f280316bf8dd3bca066b105422196fed326c967918f6911a7b2e4baf52254e2
MD5 16587cea1389573d90e4d2f8a647376c
SHA1 cbe71b4aeba6eab6c9a1fc4550ee082186e5a544
SHA512 850327a181016296ee147ab354621795fa94bbfdaa1d006c83d790de86d161201296e2c4a90eac4513e98bd9528aecc40962ac2440068e4a22d5eca075b02489
TLSH
T13941D658A6FA0148B3B76F169FF6A86D447ABD672E07D49E10010D4F0A66A40DDA1B33
MD5 SHA1 SHA512 TLSH

Submit Download