2f352d9d73d7dcb6e2d958e5256f12032ff6236bc52fefb0f54c82aa5b7efc07

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swiss/index.html
Size 6KB
Sample260702-pellfags4q
SHA256 2f352d9d73d7dcb6e2d958e5256f12032ff6236bc52fefb0f54c82aa5b7efc07
MD5 5389c3aa2cef354f202566db6e9e56ab
SHA1 c81439f9d0b59046b59db094cbba0f503f8c4007
SHA512 b4ef80984cd1c8cbc201edcf1d3136ec60e6aeab879b684db4aa78997a8cacc53a767f04e5a9e17a7feeffb49ff9d11c42ce9281b3d36ebb1057d569406102f9
SSDEEP 96:9anqZXrexaEWBzO5X5JbaDVqiuDV+t7lM:aeXrexaEWxO5pJbkoV+t7lM
TLSH
T1E3D1428795B7045A3886A5BCBBF7AB592299D003C509DD783DDC61BC8FC9AE6483334C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274680850429001"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A2F721F9-4F93-4006-9C07-AFB653996E87}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5136	msedge.exe
5136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2900	364	msedge.exe	87
PID 364 wrote to memory of 5708	364	msedge.exe	88
PID 364 wrote to memory of 2364	364	msedge.exe	89
PID 364 wrote to memory of 2364	364	msedge.exe	89
PID 364 wrote to memory of 2364	364	msedge.exe	89
PID 364 wrote to memory of 5164	364	msedge.exe	90
PID 364 wrote to memory of 5164	364	msedge.exe	90
PID 364 wrote to memory of 5092	364	msedge.exe	91
PID 364 wrote to memory of 5092	364	msedge.exe	91
PID 364 wrote to memory of 5092	364	msedge.exe	91
PID 364 wrote to memory of 2440	364	msedge.exe	92
PID 364 wrote to memory of 2440	364	msedge.exe	92
PID 364 wrote to memory of 2440	364	msedge.exe	92
PID 364 wrote to memory of 3376	364	msedge.exe	95
PID 364 wrote to memory of 3376	364	msedge.exe	95
PID 364 wrote to memory of 880	364	msedge.exe	96
PID 364 wrote to memory of 880	364	msedge.exe	96
PID 364 wrote to memory of 2700	364	msedge.exe	98
PID 364 wrote to memory of 2340	364	msedge.exe	108
PID 364 wrote to memory of 4656	364	msedge.exe	109
PID 364 wrote to memory of 5180	364	msedge.exe	110
PID 364 wrote to memory of 1520	364	msedge.exe	114
PID 364 wrote to memory of 1520	364	msedge.exe	114
PID 364 wrote to memory of 5136	364	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\swiss\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb1fd0c188,0x7ffb1fd0c194,0x7ffb1fd0c1a0
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7018539051122551990,3447352804643769860,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,4787672313737749367,14805138651233664183,262144 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,14280619991666584440,5915667693407484636,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,14338401460459634921,10734474055245153668,2097152 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1549758223446181386,2339128455133757197,2097152 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,2198416857811394038,17531506322413920617,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,11600223638954547858,17414923613188925325,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,18011468235421693134,2044958868461338765,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,18011468235421693134,2044958868461338765,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,9146186416675065044,8251048032716070870,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,259978181288884691,3469931457638761474,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14533982800727890913,17420375732396450528,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,14937557840171466268,15151414513053418193,524288 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,2107857229606252451,1268472576571472560,262144 --field-trial-handle=2260,i,12260193336156400185,18137171192565066193,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf38dfce0730cf156f1a3e62b788d8b5cb88dde276d543af0bdaf35fe6033fca
MD5 ff691abea0f13468c93e8ed318d4278a
SHA1 086b3db49d05479014f137a2f4c90635f39b01b1
SHA512 f978dbf46648deedcf1d6fcce322a3869fa066f6e96845fd12d19c2c784597a5f032452939b6d0812ca929f5313cb85c11169045c9d8e5a0dffad6445a8d4d86
TLSH
T14DE02BB6C826FC3719FE071860494647E74013572B90994F3B3C83088FB063685C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 606b401d1b66aa6f665a25dee8cb3396a9e87f6e51c8c5f77cacbbc9cdce7ff5
MD5 f936c996d952b20ccb7ea348a147891e
SHA1 41a9781fbca6aadf4d787df51a8ab6b9315c8d62
SHA512 626bf47a7dee6bccadc201bdc6c01e386415b0ca338e3c31beae8edcda0bfc3c46e3933d100d097f9d4264ba78d0d539ae2b8ba92fdb058b469d7d03dd06ec67
TLSH
T18D617DB7C6E4876E891196F0AA247D2ACE5E051683283C5A89F4AF0B63E24B1E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 09d8eeeaf5fc23eb8d4cccb77371c5a0b7ab84fb490368670bcdb651b15316eb
MD5 3700af166bd710abef9b95062b43a273
SHA1 cedae1122d95631e63f6eae38dcdabd5a278b898
SHA512 e0be451376a8183c936b3ddf6a1f017bcf90a643831839e2b8c2a5aa6524b50533bec3086ff4fba930396d9a7c072213b0968a80fb94a01840acc4bfa669dece
SSDEEP 384:sxZQfjCvLq9JR/fpUsRdzDFIwJHbGqbWRHNAL+:s3O9T/fLdzZHbGHz
TLSH
T13C620916AA3459778DD7D209FA85BF53D6F91563A2905E44A9FC8B0C01E7BEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d12bf88919103696673f93781df0eafad599afd15470a70f771f41b4521ea808
MD5 1784b8a0b89e24cf58da7f6f70015953
SHA1 0cafc6cd06fa1e584939213f255ceb69889dcf77
SHA512 3a8f766e695d11ddc93d0937d706068aa22ef62bca6a6a4339c6baaf6b9b3ce2010877c5fb70f5cc198e26ce536a30d0df2a62dc38d22b7e7af15f76841b9d3f
SSDEEP 384:sxZQfjCvLMJR/fpUssrMazDFIwJHbGrbRRHNAj+:s34T/ferMazZHbGJF
TLSH
T1E862F8166A3459778DDBD209FA85BF53D6F91123A2905E44A9FCCA0C05E7BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 43402a2d1dcf0064e81506dc93ab8d7fabc7e409150e387e6a28e75d534b511d
MD5 76eb07f414ccdc037ee6eb6ae0560958
SHA1 ef8e8b3ed437fa9b3202c888bdfabf29a4ac3aa8
SHA512 8ef00ea0bfc1ee9bc612c5db12e8356d1977d5349a8c8dee74a1204294919a434bb460da679fdc220e9d16b32cc18e14e7761108df8777b6f317319c7bc7536b
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9xxN/AxEwCuH:0LppY93PBZJPtN53xv6
TLSH
T14AB2695A713B0211397E2988B39696364F4235A37058E4BF7FB814A14F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 087722a745ed40473afb992548636d1b96808d5bf8025d6cf56f31f3b2526bf8
MD5 e0247fea04e281d3b625f367cbc398ab
SHA1 b10b9cf4fc349705a414ff69dd9d575f1fe8396c
SHA512 bb7f84fa314c37f4f9e85b390b166a6c38a83fac2aad009930c7c87aa12dbe96e3e327be13bbe789e324731fefb0308c48c9e1292d40eb0af887aac8116aa56e
SSDEEP 768:XF1j+9o3ywgyk4QjbGCtD+qEip0MQPJZKl8BvTPa8w1:G9o3XQtD+qEiOjvKl0W8w1
TLSH
T1CDD24A72E854CEBBADE38BC9A75A3907EEE4426385C869D4DADC2E1D01C729C430BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fdc127981075545574e02a4b0e83a1c4638a8f9e3d3aa14b23d5903dda9cce4c
MD5 47763b07177f86a2dac8b6bc482cfda1
SHA1 4f96ac2bf6bb55d40909103d50f901fb585f4356
SHA512 4e62eb8a360689be285437bbf12bfbf1eb2934dc32a18021eb18df65816703b9ec15046360d2968500a14a617c151b52894a737e4cb6d64943b7f2efa5e49425
SSDEEP 768:p5Fccps3CwgbkUGgbGCtD+qEip0MHPJZI8p0TLY:Ls3EztD+qEiOWvI8p0TLY
TLSH
T1F8C24B32E864CDBBFDE28B99E75A3507DEE4526385CCA9E4DADC1D0D01971AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4b9bbcf906c823b15b50e4bb29f1f16edb63e411fcda835fca1d7b8b48d5f535
MD5 b011b76933ea8bb1cdbd165604eef0dd
SHA1 4fc77681a2295423109b1bf41404445c0f6c003f
SHA512 9ae5bd8d8721bafbf460c5dc211f57e862758535cb4049d62843e2e0948112043616b59e2251ec05448f4f7fc28b9b63b6237d1bc49aac174e5cd5620e7b0a21
SSDEEP 768:pcFccps3ywgbkUckbGCtD+qEidPFI8p0TLY:Ks3U1tD+qEiZFI8p0TLY
TLSH
T14BB25B36EC69CDBBEDE28F89B75A3A07DEE4526785D899E4CED85D0D008319C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5d0f348c41e965e06a1ea20019c69399bb2169c1ae0cbab50260e44452f4ea3f
MD5 9bd3e5cda592ea51cfff74030e2d5fe3
SHA1 467a13cff74ace5294fea136168f60b15267cc23
SHA512 98fed167ab180f6835c1ef5bdf054e0c0d91ead259a13a67b94551b9d51d85c2975cd7e0cc13a5d521139263e1c659004cedde00b1d38c690e9fd97c66a67756
SSDEEP 768:p7F1j+9o3ywgyk4mjbGCtD+qEip0MQPJZKl8BvTPa8w1:A9o3XytD+qEiOjvKl0W8w1
TLSH
T165D24B72E854CE7BADE38BC9A75A3947EEE4426385C869D4DADC2E1D00C729C430BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d356c8740eed0eee434678e1122c286e25a60b0952f715143b58d82a6618b07a
MD5 7a558c116307ce81863d893be0712da3
SHA1 270c041b8327c129494629ac328550d654eb7f4e
SHA512 b22b1e6a20aec66d2f8c86d8efe3491364624671023da3ebaae1ce643cb6fb065727e64c2935a9b87d7e2bc383d3292a87955c31f9f35d73cca4f54bfb6d3f7a
SSDEEP 768:8F1j+9q3ywgyk4QjbGCtD+qEip0MYPJZKl8BvTPa8w1:L9q3XQtD+qEiOBvKl0W8w1
TLSH
T1C9D24A72E854CE7BADE38BC9B75A3907EEE4426385C869D4DADC2E1D01C729C430BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c4814f78c1b2a5e63141b5110cf518cd3dfb2a5b83d37262dc3990c6537e868b
MD5 9772b616368ccf69cbd1b5f6d63e9a31
SHA1 98ffceb2c7fa18189e6215032c519310d62954cf
SHA512 dc69cd29ca4306bb92485fee180d29fd21b2c62e85ed87d38a36f092ea706b8fae0261ecdbbe3335740ddebbfc28192a56e5ad16e4160e960e36f3cf5a7094bb
TLSH
T1A8410958AAEA1148B7B77E1AAFF6A86E487E7C772E17D45D00000E4F0677A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download