ec806188d29e4bc170b5aef3b9755fe60b245a8cca75e08b8d23777f6b15b7f8

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/1033/HTML/IDR_OEMPG_EN_GB.html
Size 1KB
Sample260629-e2clyacz9x
SHA256 ec806188d29e4bc170b5aef3b9755fe60b245a8cca75e08b8d23777f6b15b7f8
MD5 166c72a1c61b16d752d3c82aa5f12b89
SHA1 f2145afbefd9a184a599d0fa8f1651fe9b96769a
SHA512 40495759da650be14dcf2ba1d4317d07ea7f05c3f488bf811e7ca46f4805170cd15a491f84dbfa4ca971c8eca9ae28195d844fd5c05718f28589493bdbd289d3
TLSH
T183415322B5F127598950D0A0B395BF165DD08123C7464460F0EE26BA0FDDC83953BBAC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271807542460530"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{99B8F945-B223-480E-964D-37063D1262FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1508	740	msedge.exe	88
PID 740 wrote to memory of 2788	740	msedge.exe	89
PID 740 wrote to memory of 2808	740	msedge.exe	90
PID 740 wrote to memory of 2808	740	msedge.exe	90
PID 740 wrote to memory of 2808	740	msedge.exe	90
PID 740 wrote to memory of 2312	740	msedge.exe	91
PID 740 wrote to memory of 2312	740	msedge.exe	91
PID 740 wrote to memory of 1592	740	msedge.exe	93
PID 740 wrote to memory of 1592	740	msedge.exe	93
PID 740 wrote to memory of 1592	740	msedge.exe	93
PID 740 wrote to memory of 3960	740	msedge.exe	94
PID 740 wrote to memory of 3960	740	msedge.exe	94
PID 740 wrote to memory of 3960	740	msedge.exe	94
PID 740 wrote to memory of 3424	740	msedge.exe	95
PID 740 wrote to memory of 3424	740	msedge.exe	95
PID 740 wrote to memory of 3424	740	msedge.exe	95
PID 740 wrote to memory of 228	740	msedge.exe	96
PID 740 wrote to memory of 228	740	msedge.exe	96
PID 740 wrote to memory of 228	740	msedge.exe	96
PID 740 wrote to memory of 1980	740	msedge.exe	99
PID 740 wrote to memory of 3312	740	msedge.exe	100
PID 740 wrote to memory of 1980	740	msedge.exe	99
PID 740 wrote to memory of 3312	740	msedge.exe	100
PID 740 wrote to memory of 1048	740	msedge.exe	102
PID 740 wrote to memory of 4652	740	msedge.exe	114
PID 740 wrote to memory of 4564	740	msedge.exe	115
PID 740 wrote to memory of 3144	740	msedge.exe	116
PID 740 wrote to memory of 2840	740	msedge.exe	118
PID 740 wrote to memory of 2840	740	msedge.exe	118
PID 740 wrote to memory of 2196	740	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.rsrc\1033\HTML\IDR_OEMPG_EN_GB.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,8661888261282838187,17288796267761327254,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14670064614282251926,2364234220350478453,262144 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,17387937691250389610,15764526600996369356,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10081178358023761878,10648141859240537394,2097152 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,732034481822712378,3312038055502683821,2097152 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2398530277837283377,11386135181482137300,2097152 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,7820810918554175848,7153974868653942042,2097152 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16601541460362705962,2497661220751096621,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11390403262526419463,16923522774791181804,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,318368917047505738,15430505795975049280,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,318368917047505738,15430505795975049280,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,2199515666112594525,10149214128718406077,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,9676624658899129890,15461999767722702262,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12793037918508762185,10454127795027996127,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9250220579354193858,11484553740599308318,524288 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,2487161303237681341,12970687436176496014,262144 --field-trial-handle=2168,i,3188042708603051746,7478368938517023130,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d51cd695a21d853db8d698b03684efd744291c72c9dde684f1effdb6ea6fcbe
MD5 9dd035676a1c54f365675d59519e0548
SHA1 b745f2c61f5d9d75fbe3c00b3f91e8c8d98fe41c
SHA512 f4f93168250013ec6332de4d6eb4f652c2585a0b54b7d23248bf1de785cb259236d22440c1ad2996abc19a9b94e6f1ccdb58c092eb47d5a687577b10d277630f
TLSH
T12F71E93D040E4469D3AA03F364F213167D71BBDBF6D32E957190AAF028053D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588f6a.TMP
Size 3KB
SHA256 218ced2f479729553f501eb2e54fa931e3ec9a91b297d40e165dfc73933c07a1
MD5 425b1cea974d08d5c67324c36ecea664
SHA1 a8c3081a8290d69700c11b78db58b49aab9f8a6f
SHA512 3eeb63034b4ccc515401bd577be1e19c244466758a964e43dd25eedb6f1c114ba8bb99fc6b5b6e5d9a852bac4d2bb081f167f6144607dae7816a065fe9a2534e
TLSH
T1B471D83D040E4469D3AA03F364F11716BD71BBDBF5D32EA571949AF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 69ed73b783aec5b1f60e791b0a1c0dde78b3c5d69eaee1659452eb0c21f511bd
MD5 89d02b63c8dc9f064e7acd5f17277653
SHA1 8398f004912520b476f3ee620eb59214235a4117
SHA512 adce08e6d6ba9c78da62edc6339e1b61521bc19f3b9b9eb7d0542830d6cedc6da5cf01289d118f075f84dd9662dbad93faabec273faad586dff109848954a869
TLSH
T14721A0F7C3D5856ECE1196F06A14BE2BCE1D0605432C3D199AE4EF1793E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a7dd14abdc3323d48a9823c462a088cfc6f824209f3f1bf552d6028f4df407b0
MD5 13852bd5546b371d86b8a8a5c1b3a4cc
SHA1 e529f5b846bef88ff9def7a86f4074f721a3cd2f
SHA512 3d9cbb3db31ec7743d1331a121da5cfc2fdcaae9f4677232adb3a0e31cf067ee7e63aa91e4e4cb0385e7f7a057be5549e3d714d8a8f33d120440be9967089132
SSDEEP 192:sxZ4RsyM/jK1Ml8Mk9/flsaTjv+EUIdpd0HW6+WNGYzQrvRJIgrJ:sxZ4yM9/flsaTq+WHbGT9
TLSH
T15D42E8526A34997BCCCBD209FA55BF53D6F9547392900E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5df3b479d02388f8a707e5c8b96cd3d0767f63067e0b7ab918a3ba863cb983a4
MD5 31bce64d89c172fe69fc412024f8fd34
SHA1 9acd6e1f76b21160935fb90a9e9eb52b9646d2f8
SHA512 2acd9d74b804073a1834a4d0b30b81f3f8dc50ec6259fdedc865d8279dc51fc767d53208077ad9c8dd5dcf52efb3267f170e6a0152b2dccb975066d0cf0c9f86
SSDEEP 192:sxZ4RsyM/jK1Ml8UQWk9/fls5TjvDEUIdpH0HW6+WNGYz46vRJIg5VJ:sxZ4yq99/fls5T/+UHbG49
TLSH
T1E952C6566A34997BCCDBD209FA41BF53D6F5547392900E44AAFCCA0C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b2fe0a13ab79bcf166f1ab38c0d3eca0f124b41e61eaff4d16e6c7c7b666df8a
MD5 630916a8b6cd216701a48114d09806a1
SHA1 b3c0326a5c60b187846b6ec88271b83bcecbddff
SHA512 3b906cd2278d3ad808ed5b400fbb6cfa7b984f996ce177a5c683dff0befbca6faf86a2e5cf6b79e4f47fb43fce1301c1c419c8c9a52ec08171fdbf8e9a5fe6e8
SSDEEP 768:E3W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjrroI7i/YG:E3W7kf0Wvqidau1jaa5LA3jYYG
TLSH
T10AD2FA3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 83ed9d61e43130745164bd51b5075ce2562ea8889d6323e30d96e58fe6556fbc
MD5 376c80bc49d971a875f5eb19000ead8e
SHA1 cfc1d8b77687d54552d9292f1bfe91c4170254da
SHA512 25086a2bf4c3344a377d505f08d4f30debfbec5d4a05df01d023c11c4898203647b8fe0de2c6021268615ae4c6b66146b2b571a06fdd3f4d0c906d7b129e184b
SSDEEP 96:KIbCKcfTWKIsSSgAK1GafQ98guC+giqDzoogKg1oGgsR:si17bJ1
TLSH
T1D9916F06347E2F10387E7849A3AA856A0B4631533045E4BB7FF950A11E6BE914EFEDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592adf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592adf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 17b9560e3f3882a60aaea9ce19576b26a9524931ddddbf5befbe53c1d645b1fe
MD5 34aa8b75b4d310b58c1e50b79055608a
SHA1 b1719b6d8ee5296950761f0ef109dac39c7d5eb8
SHA512 be0a3334c4f85c160641b52737e824edb476325dde9e819b2ffd7091cedcd8f3260d5dd539a6e3ea71e9fbf2816dabb1a0846214a05ff671d336f699fe839125
SSDEEP 384:OUiF1tNn/s3n9SozsNH8TUNTUlIl/5Bwk2bIo0lQd0mEM96mn15wbAjEJByxM:OvF1j+9rOwgFKk1WkM96mn12bfJoxM
TLSH
T12AA27D334C688D7BAEA29A85F54A37079FF88167C6C56A64E3DC8F0D01EB2DC130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b2267c91d7cc699ffa17593df9ec3288ce524c30c26f3893b710dac93c6031f
MD5 276eed5929d1d4ae22e8912b8036ea97
SHA1 32409b5fef75859d238afcc70e532e65ea1a14f0
SHA512 1546f956ca6be2d35053de6268a94b4c29c4a4055933719f27d4f20ad838a6850b53ab1ca459105769a59201e08e5d5986691fd055b23f37e13d0ec444fe043c
SSDEEP 192:MONf64BAQmiUyl1kW5GBPKcl+FdGuom1baDg5U6:MONf6eASGWzd0mSgU6
TLSH
T110020A35AC796C7B9EB2BE45F4863B175FD8103BA6945B44EBE81B0C00E724C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd5ff58915c29bb31af1c4097d53d7d5efd734892f09950080e90a01bed2c9af
MD5 c9afaefbe6b2b547f014d823191856e1
SHA1 56c2580f78a07d44ac7e621e5641880a8cb56852
SHA512 ca494f8729993498974596d2fb804e9ed41121a5843658898f74d23d54424d5983c46617acb3afc1da2916c70ebd0cdc50b8cd4283e14527c2daa7e63f597cfd
SSDEEP 192:mzONo64B1jQmiUylkX5GBPKcl+FdGuom1YKEMBWwOqOU6:mzONo6e1VHXzd0mEMl6U6
TLSH
T151121B316C74AC7B5E92B545F4873B175EE4412BEB846F90E7DC2B1C06EF2AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a4fa73caa76e3902c46632f95bfe016fd5a3aba5383471c13a8c82c57e1eb237
MD5 63dda5599b1e4310fd3558b0fbb6fcbc
SHA1 2f02c769915feb34676e8234de558425d534a247
SHA512 1a95d9abab84f9b70bb5ba76443d9b14005c2db280a9aacefa3b1f042cbaaa5fbd7591581b226d1539c3b325e2d3f66f4d8cbb078aaa96e5cc36bc1bce70ced9
SSDEEP 384:oFtNn/s3n9SfsN9O5Bwk2bIo0lQd0mEMs6mn15wbAjEJByxM:oFj+9U/Kk1WkMs6mn12bfJoxM
TLSH
T173929D325C398D775DA3E149F44A3B079FB8816B96C42E54E2EC9F0D02EF3E8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 923be7755c3acb56a93fc99d4943b742b9f5b8480ebf8dd50fb786744f666fc2
MD5 a4c15886e5f45c725fafccd683e8c701
SHA1 e0e79b5dfbffcf7bed6f25fe79b8e8d1e8270f64
SHA512 96ef70b509a58af080d32ff3da6f57635f4963c2d112367eafe26947add292663d4499e84f40585a32966074a25f4a63c22756a73cb1f9251e7342a4e3fad98d
SSDEEP 384:2FtNn/s3n9SfsN9/5Bwk2bIo0lQd0mEMs6mn15wbAjEJByxM:2Fj+9UWKk1WkMs6mn12bfJoxM
TLSH
T106929D325C398D775D93E149F44A3B079FB8C16B96C42E64E2EC9F0D06EB3E8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4688b34-7984-485f-9e2e-968f2dfd43a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c4688b34-7984-485f-9e2e-968f2dfd43a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b194e8bc81f63e4d6c0bd8e8bac198727ef06c8aa1495c7ddec286ff67df15b
MD5 46b9bef156ff2e7ecfc7f8d448c4f446
SHA1 44f632184b6dc8853e77ca4f862e860cdc7a1951
SHA512 4b275c548fbf2499977c0b63762f7d376ef524019e1a8942af16a336480a66f22baadfce8fd26355d524e4d85d80f0446ec8e48c2e3032fc609e1112aaf7d788
TLSH
T11A410B58AAF91148B3B37E5A5FF6A46E447BBD772E46D45D00010D4F0A23B00CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download