cd72c67fa2a86ff74e468c00398ba9ced9d05bac8b6b545fe2fe95c4e5b26b19

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/1033/HTML/IDR_OEMPG_ES.html
Size 1KB
Sample260629-e2clyacz9x
SHA256 cd72c67fa2a86ff74e468c00398ba9ced9d05bac8b6b545fe2fe95c4e5b26b19
MD5 1bd12d2527cf896a739729b86c0bd5a2
SHA1 d405e3c8e9937b60f1019fb71a227dbee2fe33b3
SHA512 507d7fdc99e69ec10c7a82899b70ba72747e947c3c18b3f920a1382295b7110b1fb3b84f41dc5931699b534e6b5fac26bf6ca3d2a4bfcb1437ef444a24baa59a
TLSH
T13B410F12B5F22A8A4A55D094B3A2AF175DC08123C705D4A0F09E52B65FDDC83D867BEC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271807548320376"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{81487542-4C7F-445A-9618-9EC368B4D9E7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2716	4464	msedge.exe	85
PID 4464 wrote to memory of 4052	4464	msedge.exe	87
PID 4464 wrote to memory of 2284	4464	msedge.exe	88
PID 4464 wrote to memory of 2284	4464	msedge.exe	88
PID 4464 wrote to memory of 2284	4464	msedge.exe	88
PID 4464 wrote to memory of 4460	4464	msedge.exe	89
PID 4464 wrote to memory of 4460	4464	msedge.exe	89
PID 4464 wrote to memory of 4620	4464	msedge.exe	90
PID 4464 wrote to memory of 632	4464	msedge.exe	91
PID 4464 wrote to memory of 4620	4464	msedge.exe	90
PID 4464 wrote to memory of 4620	4464	msedge.exe	90
PID 4464 wrote to memory of 632	4464	msedge.exe	91
PID 4464 wrote to memory of 632	4464	msedge.exe	91
PID 4464 wrote to memory of 4508	4464	msedge.exe	92
PID 4464 wrote to memory of 3948	4464	msedge.exe	93
PID 4464 wrote to memory of 4508	4464	msedge.exe	92
PID 4464 wrote to memory of 4508	4464	msedge.exe	92
PID 4464 wrote to memory of 3948	4464	msedge.exe	93
PID 4464 wrote to memory of 3948	4464	msedge.exe	93
PID 4464 wrote to memory of 2196	4464	msedge.exe	97
PID 4464 wrote to memory of 4504	4464	msedge.exe	98
PID 4464 wrote to memory of 2196	4464	msedge.exe	97
PID 4464 wrote to memory of 4504	4464	msedge.exe	98
PID 4464 wrote to memory of 4368	4464	msedge.exe	100
PID 4464 wrote to memory of 456	4464	msedge.exe	109
PID 4464 wrote to memory of 4968	4464	msedge.exe	110
PID 4464 wrote to memory of 4076	4464	msedge.exe	111
PID 4464 wrote to memory of 668	4464	msedge.exe	113
PID 4464 wrote to memory of 668	4464	msedge.exe	113
PID 4464 wrote to memory of 2900	4464	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.rsrc\1033\HTML\IDR_OEMPG_ES.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,9994476718236978190,42475115449273802,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14194681813975851687,8376106978593181844,262144 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,4178480141076286470,12152782645544671325,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10146465937812242605,10569742383366362932,2097152 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2789389926636516293,7179977361758331278,2097152 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,11354207693536810480,8314596019656790511,2097152 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2629920594072211611,12222315556224689876,2097152 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12562297879859521620,18312747849565331049,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12493933145426963480,5430298013569744741,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9466449939645042584,11465179626456099424,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9466449939645042584,11465179626456099424,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,1294204709106265360,18118288108756294596,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,17421854782679736938,12599225921674010789,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6867691550636638742,9317584409408775939,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,12673516168832120089,13871641367335974889,524288 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3284,i,5492347313155981895,13165955939412716359,262144 --field-trial-handle=2244,i,16509404496726969150,13705492876167740241,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d796334d41c939fe3e2522be6b5e002dd96bfd0b5a3126a7a88252c84943ad60
MD5 d11a25092d5c380d604b160965a518ff
SHA1 719e44af8d6c1ff6547b4c99fd2f3dbbfc14c1ce
SHA512 a6e84987782026a79adc99371e889a1d9425f65a802f840cdbeed641836047d7785686eaad5d6e96e627c06c3595f263397319ac6407e38ebda0cecae16bfa27
TLSH
T15C715DB04DDB0563FB60813168E333667731B7FAFC175E9502E24B342795762F05A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58756a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58756a.TMP
Size 3KB
SHA256 fb2237c85fd860044c877c780aca97509497924959df91e347f8da973a17a163
MD5 3969633f8f4b5fdb42bc90f663b0d95d
SHA1 51152aebd56068b135143c5d88a72e16caef0bf0
SHA512 e83fb4a2b7d571ea128975afa2d312557e58a52196ae0927b5fb5a4f0c11024b34294144e4a7dfe8e020510d869e28375efae57aedd4b9bcac80af93cf8f195b
TLSH
T12E715DB04EDB0563FB60803168E33366B731B7FAFC175E9902E24B302795762F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 4699a69c7b7410f1077e969c0bdea0f5e193371b6d02047bf9c6921423804728
MD5 c483fe3a3d9a6a4b99e9050d679a1e8a
SHA1 2218d3090b6273454bdd11853ea539ae85cc36fb
SHA512 8521a118f650d8bffc6d0a779fc0a9b59cff432b453abc2c71773156d7d8161005723d74fdebe5f58b9f9f9c26442388b3e33f958619d58412c91ddcc28b84e9
TLSH
T1650190F3C7D4956E890196F06A149E17CE2D0506832C7C1AD5D4AF1B93E3475D50145F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e2696e9c-06e9-497b-91f3-7400d499a49a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2696e9c-06e9-497b-91f3-7400d499a49a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e0595b89443f2a91cb7b681d237300185dbefbcebd4855b3acff653e7d86e63a
MD5 63cf143ec4abc86b25faef8edb4ad287
SHA1 28b8b0ed8ab42a2b2e8634e56296c334ce26ce05
SHA512 95f0dacce05ed02e94e98ab9e3f916e2d3bbc1899cf21807baf8010f4fec263a171232d128d88522080197983719a867683d9c5f2863556f297c38010d230861
SSDEEP 192:sxZ5RByM/jK1Ml8MkN/f1sOUKIdpdGHW6+WNGYIkfK4vbIgrJ:sxZ5XMN/f1sOUDAHbGEvz9
TLSH
T1A142E8126A349D7BCCDBD209BA55BF53D6F54472A2900E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 201b7d869b0965b7bba47a736ebeb8eaf72758bdf761ede9b5c3c056a4574376
MD5 91b5c7defe3e3b5b812567d2c1bd6fa7
SHA1 237e01489a0de8645d30da8c50bbbf2437eef5c4
SHA512 90f3bb3e7e2267bb3a208064bc51152afe2e4001ed83cd360f693e12f038d8ef918050a21ddd9db9e3173e9f134ccad5ec0f208439cca21b25d3d32a3b6ecd1e
SSDEEP 192:sxZ5RByM/jK1Ml8UQkkN/f1sH2KIdpHGHW6+WNGYIOyI4vbIg5KJ:sxZ5Xq/N/f1sH2DmHbGnvzU
TLSH
T16752E812AA389D77CCDBD209FA55BF53D6F5447292900E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 65fe935045885158fa05a4adfd3c1937fda9dbe45fe12fe0cc58acdfe4baf196
MD5 cb5d0f7762d1b8173c99a3eafb8e2227
SHA1 22ce8301e0ce5aa74daf58d56f2413f6a37abaf0
SHA512 6fe2f525ad98ba2cbcd4d9c4c0dd87ad8eeb268bf9521895f9f1cf9d26be583e178c1504b07667c52dcfc4e60774638a7a5ba11f26f87d9f5acd29d3afcf283b
SSDEEP 768:8asqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR93roDCv:8asqxXlWvJD6Tu1ja54LAs9kDs
TLSH
T153D21B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3b6ac81b26123aa6c80b87dfd88a0d578cae0c4de108b1604d30b1181b45e018
MD5 9e76aa549fae9e1f1328037378909039
SHA1 964a8529a55ccd236d18c8109f45a6ce879e6cf2
SHA512 dce6fd1067ecdd256d39434a8b5bab2132c6662905b7419ff10ab5b62ff9fcad555197883ff16743fd3c97e8672f4c8904dde2bd3804995bf4a2de989a9705c5
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2mz:ExZBdPxzV
TLSH
T169E18E42713B821238BD6908A27695374E8373A77518A56F7FB870B24E66E110DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61a2d90b-d624-4f50-9415-fbbae1b0c1e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\61a2d90b-d624-4f50-9415-fbbae1b0c1e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 abcc9f2c030483c2a6cc8ab69406a2dc3c5afb9bf18417488284e5d96c3db147
MD5 d8621c3b6f4f025602f5a6f017176202
SHA1 38c158c750e338f7c4f40391507250e4520b4c46
SHA512 80057206a620a28e7aaa34aa060cbc902375fd1bfd3f6a5a0d3747a7cefc1cac97669257373f099fd541e05539b5f7db032c99f564cc2bee63846ccb0583402d
SSDEEP 384:CtNn/s3n9SfsNa5ZDbp0g4VRNVOK+t9FC/Tmn15wbAjEJTyThu:Cj+9UhaguHVOKs9A/Tmn12bfJuThu
TLSH
T1E2927D325C284C775EE39589F54B37179FA884B7E7C52A94C0EC4F0D02DB6D8131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9316e9e756b1abcdde7f0f6b088807d04e6634ed1f75f804652f2467759452f
MD5 982a73ee585edf9f4d1aa0c669d833a4
SHA1 1437ce66264f6e9a0bf3fd0ddb4479fb1f07d25b
SHA512 b7447805dedecad6a863426a8250e241581713905cfade6d18f2c70fdea77bcee69ac635177c33bae6a3ec4302971c959c1cc8e9820be05cb6028ac227ffc879
SSDEEP 192:tONc6JkRtQmiUy2EW+RNVOmSY+y9h3bReU6:tONc6UrKW+RNVOK+GAU6
TLSH
T1AE02E835AD385CBB9EF26E0AB48B27175FA8203BE9852B84D6D81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7650ff3a0504e145ad292792da5ad6e3fa7f9a0c35a79416521202194e816506
MD5 ca6e5451b5fa0c53749913993895e3d1
SHA1 f995fb81bbcb253c2ae5892a06a9976ff13ba427
SHA512 3c07cb616ef62697f078047d68a05aef37a79642c3727ee3d4eaca294aa86804e0892244aee6875fffc7216c45c6e6d58ce2836278f04e889dd67025fad0fb8c
SSDEEP 384:ptNn/s3n9SfsNa4ZDbp0g4VRNVOK+t9FC/Tmn15wbAjEJTyThu:pj+9UKaguHVOKs9A/Tmn12bfJuThu
TLSH
T12C927D325C284C775DE39589F54B37179FA890B7E7C92AA0C0EC4F0D02DB6D8231AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d084e1716b79fada28c9351f1afc8117e6afa577e1e84d1f26f1b2675dd67cc1
MD5 97b49fd7be614c74dc35e042ca96d2a5
SHA1 781014cd1e0dc77e8c5be5c8774a1232d1da323a
SHA512 146de1372823b2bfc5de1ed546065ee082fc14d7dec5132acf856202e53a9f64e37996c5aa2da17ea9c03016d4189a5763c8b1cae900affdaa12da5c215dfc9d
SSDEEP 192:wONj6JkR8QmiUyGEz+RNVOmSY+y6l9nFgVcYq0UTU6:wONj6UMMz+RNVOK+t9FH/TU6
TLSH
T129121A36AC385C7B9EE26945F48736174EA85127EB897FD0D1DC1F0C02DFA9C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e418c02-7a65-4219-b3e7-5ede8f89d024.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e418c02-7a65-4219-b3e7-5ede8f89d024.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f9959cae-3bf3-49f5-ab7d-2c35effdcf1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9959cae-3bf3-49f5-ab7d-2c35effdcf1c.tmp
Size 22KB
SHA256 be750f185025b3d6e790e101297d2f35b6fb5cb53720889ca43fc36013a3e31d
MD5 d45a8474f7351c187aef8ec3a0319944
SHA1 a1d6f4c52548920e255961bd49cc463a9f761827
SHA512 4f7c0af1465306f57cedfc4c7fd71715ce91ed1fa321df71bfa23c0da20bdf03ac18d85ab7bec8e4248ce8a55fdac700ee972d62c04b59fc8104de60198f20f5
SSDEEP 384:qiF1tNn/s3n9S8zsNi8TUNTUlIl4ZDbp0g4VRNVOK+t9FP/Tmn15wbAjEJTyThu:hF1j+93Lwg2aguHVOKs9d/Tmn12bfJuo
TLSH
T1BCA25D335D188D7BAEA38A89F94B33178FB941B7D6856AA0D2DC4E0D02DB2DC130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00ba6100fe983669c066a1f9686cbb87ff7d696e984629a5a29615d68ba3db52
MD5 a5a4b295b2ec1737caa99398efb602bb
SHA1 2a55be33f683339717e5e0b2502fc42fb738ca8c
SHA512 e8c91882876a78a948e45665558b80d672a169a8e28fd95c8cddf911285adde426aff04599ff85c6716f0e539129faa61542d407729bdd2112591baa7ad5b368
TLSH
T13B411658BAED1148B7B77E599BF6A46E887BBC762E0AC05E00110E4F0627A40C871773
MD5 SHA1 SHA512 TLSH

Submit Download