1fc5b524da2bf03d7f8d97289b8684bb9a01bc8f2fcaf2d40d175943598f7551

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swiss/thank-you.html
Size 4KB
Sample260702-pellfags4q
SHA256 1fc5b524da2bf03d7f8d97289b8684bb9a01bc8f2fcaf2d40d175943598f7551
MD5 7334913270e29f679687a13ac9023515
SHA1 4a5964ff685204e6232e71f2f4e8f28d8a2c3051
SHA512 5f0bdfc1600fb346039e8ee8b5dc207e0dd47f3162e7d550fd924f6c6aa2ebd807a74648c89b1b525dd3389e5c7a8edfe39715a3a3414b5d77e041ff95bb9e03
SSDEEP 48:00Yc5nBsZ/j7IyqmHfL6meQmaZmXmCPPMeiwYoQ45ygd5JbaxVfgM:sanqZXrexaEWBzO5X5JbaxVYM
TLSH
T16A91E28BD6B7084A7446B4787BF727892399D003950ADD793D9C72B8DF886F5483264C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274680809535281"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{34C5B00E-0359-4F74-87C4-1BFAA263B6B7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2852	1996	msedge.exe	86
PID 1996 wrote to memory of 5108	1996	msedge.exe	87
PID 1996 wrote to memory of 3512	1996	msedge.exe	88
PID 1996 wrote to memory of 1880	1996	msedge.exe	89
PID 1996 wrote to memory of 3512	1996	msedge.exe	88
PID 1996 wrote to memory of 3512	1996	msedge.exe	88
PID 1996 wrote to memory of 1880	1996	msedge.exe	89
PID 1996 wrote to memory of 4468	1996	msedge.exe	91
PID 1996 wrote to memory of 4468	1996	msedge.exe	91
PID 1996 wrote to memory of 4468	1996	msedge.exe	91
PID 1996 wrote to memory of 4508	1996	msedge.exe	92
PID 1996 wrote to memory of 4508	1996	msedge.exe	92
PID 1996 wrote to memory of 4508	1996	msedge.exe	92
PID 1996 wrote to memory of 1256	1996	msedge.exe	93
PID 1996 wrote to memory of 1256	1996	msedge.exe	93
PID 1996 wrote to memory of 1256	1996	msedge.exe	93
PID 1996 wrote to memory of 4704	1996	msedge.exe	94
PID 1996 wrote to memory of 4704	1996	msedge.exe	94
PID 1996 wrote to memory of 4704	1996	msedge.exe	94
PID 1996 wrote to memory of 4152	1996	msedge.exe	98
PID 1996 wrote to memory of 1588	1996	msedge.exe	99
PID 1996 wrote to memory of 4152	1996	msedge.exe	98
PID 1996 wrote to memory of 1588	1996	msedge.exe	99
PID 1996 wrote to memory of 2244	1996	msedge.exe	101
PID 1996 wrote to memory of 2688	1996	msedge.exe	110
PID 1996 wrote to memory of 4712	1996	msedge.exe	111
PID 1996 wrote to memory of 2812	1996	msedge.exe	112
PID 1996 wrote to memory of 3876	1996	msedge.exe	113
PID 1996 wrote to memory of 3876	1996	msedge.exe	113
PID 1996 wrote to memory of 3496	1996	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\swiss\thank-you.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2537212004208723943,18071886182991484773,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,11093967343920380947,8911451192302554494,262144 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,9598677822171103181,12573691667601349899,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11771635712167251155,12174057358526789742,2097152 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9622016835610391397,4625102676186391301,2097152 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,17361780448030585182,4605214943292683632,2097152 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7809792990187062809,3856772306877214057,2097152 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16533085448874417554,17734848574966219417,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1270815616161546608,7597966730259740645,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10968033185287902251,6485790012356365200,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10968033185287902251,6485790012356365200,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,6697190665637399203,7457836636148884431,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4929761062075552778,6839925720007707958,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,9669565141230206487,4119134386535272637,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,7391368183980943020,4908602306562408295,524288 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,220539961887713327,17668458902055268291,262144 --field-trial-handle=2328,i,9165501056091596005,7278277824863475846,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3ab8dcc1da57251e19a77973efd95e565c1c0b7c55fc9182762508a669739e80
MD5 c9b74e6b28cffa3a343ffad98749a9dc
SHA1 b612b6b91d63f6a392a79a32bf2a46ed5ffae06d
SHA512 293c38228b5e0d93f9f91b343b4c9e3f6153949510b09a71561cd4cba0500f3ea70fefc23ca6dce09d18c7984f9f3b5c08d17756b82c6b74854e0f719acbbfe9
TLSH
T1F4615D1802C24972EFBE1072C0F195193EF3599F8EDB8E1247E4C4FE6039B5EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a7b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a7b5.TMP
Size 3KB
SHA256 f13e73fa8a06a6eefad8b38ff3bf2c2eb1d5022daea6d00315886e0f42702a20
MD5 8946b4ea8f5fbdb2b2d9d898513b979d
SHA1 626df0e01978a38877770f023df39d5817ca0bfe
SHA512 5b5c90763d7f177283ecd357956b298fb759612d8bffeb0a05d7157f1e0f55c1e75d11efa5417114a5fe32082b2e7095676cc20ecd92b86c1502e32e7feaacb3
TLSH
T17B614E1802C24972EF7E1072C1F195153EF3499F8EDB8E1247E4C4FD6039B1EA9E5004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5a7eff0154568132f23ac33221e326e4e3b7701ed40f6dab08f8eec83976b12b
MD5 641a1d595821cb53b542219c8137a349
SHA1 cdae8bd3f6ab24ad58691b74050e8fb07c12c618
SHA512 0e0798d5e0ea42964352158c8f7cd731aee4f2fa5366141cc229880d46229162754db518cf089db1698c53efff8e305e11d5caef2f5ef00f0c7c7664cf0d3f9e
TLSH
T14B31AFB7C7D587AEC85152F46A246E2ACD5D050A83283C6689E4FF5F63E3071E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a4d7697bddb4ebb7060f9ef118cf233bed0285905c89ef8267de5f96d948dbcd
MD5 8b17bd119ea0ac32dcd7c81a005cdb47
SHA1 67459eefe6832ece8b1f283e21fd18faec859221
SHA512 38eddaf37ed7a76d3a9780e5dea0cb9d062109456fc36790165ec441dd3261a26d092da55e0e1a54720b534d5d7eb1839e591c77eacd2659edeba0825ef02c3a
SSDEEP 192:sxZIRtyM/jK1Ml8Mku/fisNE9rIdpd7yHW6+WNGYwKQ2lch7pwIgrJ:sxZIlMu/fisNu0ByHbGBsYpM9
TLSH
T10342F802AA345977CCDBD209FA45BF53DAF9457392901E44A9FCCA0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d132479fecf1d18626bddc266b649683ab635129f7600a6aa690c3c7a4fcdea0
MD5 69f3cb96464b81c598963949bdba1eae
SHA1 a4a7910eeb2dbc1c3c2f04509bb354aee0f8158f
SHA512 42ef45c8f3dc186c84b54bbed6464631e240a5a08fca1f3a3133b05044ae06bcd6a9ec93a47633f321c5b52c90ea2b9361b646f116ad120269df09763e95b8e6
SSDEEP 192:sxZIRtyM/jK1Ml8UQkku/fisJyE8FIdpH7yHW6+WNGYwC3QDlPh7pwIg5wJ:sxZI3q/u/fisJy32byHbGAgx1pMa
TLSH
T19D52D612AA3459B7CCDBD209BA41BF53EAF9447392501E44A9FCCA0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d0598b88ebca6167641eaa788bd12b32dd0e58cd44c61206c7d9ac94026ec814
MD5 0323fbbbb2bb805a0e53b351134023ec
SHA1 a205e2d53606c3bd45cdf47c6f5ba49ee62bef54
SHA512 a8bfe950ea2756d45de4f6cf2b774d1f6a039be6fe5dffd839790b874b0cf8eb7074f186d0d52efea495b6d0065edba71ad8826a0d518348b058203645906fca
SSDEEP 192:sxZIRtyM/jK1Ml8Mku/fisJyE9FIdpd7yHW6+WNGYwKQ2lch7pwIg5aJ:sxZI3Mu/fisJyu2ByHbGBsYpMA
TLSH
T1F052E702AA3499B7CCCBD209FA45BF53DAF9457392541E44A9FCCA0C05E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 abf6b752b972c51bf2fc2525b9d18a5d787f96cdbafd87fdae639836dc498c0a
MD5 a890f244d00a85df8a8cd681b8df16f7
SHA1 b8d76f61dd8f20f598fadc179eabb78765cb0399
SHA512 7d162aee7cc3ad4e5c43e54efab97b51cfeacaea6608d46f2ca5c4acae14a43cdafb1d34ba2fef51757c0a93fe5a1069aa2071e6e5a1b945831e381e73d89629
SSDEEP 768:sZ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+drrohgcFau:sZ4jeXmWvmKLEu1jacPLZQdYRn
TLSH
T187D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f022710f9401933434eadd004bcca2f31294b013c93ebf8b39c3cc0c8b6f7d30
MD5 e2f2ce3249bb5906463e80a2f2497416
SHA1 808bb3df0e99486d58b1dd272702afb1337b8d4f
SHA512 33db42f1b07fdd1b105cded39060f49d13ee334617ac9ca0e845419929f78964eb9d965c28a14950aa298003a987899da540b69f602fb842cf2926387816e522
SSDEEP 96:Kce0KLKeOl2KGUuv4dZvtNhW528gBhK4Igvhc3f+BtiHv4dZvta:ibJdv4dZvtNs529BLIgvO3f+BtiHv4d+
TLSH
T1E2915686717B52017C3E250C92A4CA26CE96F1A37034B42B7FAC45B65E27E149EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2781f16e-07a2-40e2-b602-b9f95260e7f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2781f16e-07a2-40e2-b602-b9f95260e7f4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b1337ffe97509e9fe51cb3bda260bc0eb8b69633b5dac103926cd663a0c594c
MD5 f3ec8532f63ccc0ffdb02f49cd59263d
SHA1 f9bdf4b4e7f22eaaf9b6617a2c7d89c09860626e
SHA512 5f13ef5c18e9e04fc2eac78fe2fd2949067c8c369220b44383615ff7e98b46fa44bcf9bf526577fd831b99efb2483fc08825df5e8c370e7260712fb385536866
SSDEEP 192:ueLsNw7nQbDZE3dQmiU11L34H/+jVRjzorIMXTr+2d5cFTFqZj:xsNw7nlLzof+j8IMX/+2oF0j
TLSH
T1A4421A3668789C274DD7A685F08732239EF84167ABD97F84E5ED6F0C01DA6AC130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9cf5377fd066cdf88f2d0a28d19e4671cbb21fc91e8c3eca66163fe704b415ad
MD5 c062b6de9ec7a80674c5e7974c8a411d
SHA1 54219e3f94fe7e821cf406d7319df3ed93feebbe
SHA512 d84e952a5d811abd820bae5792c8114312409973901f101a167e3ca072581e4fa3581d5dd2658b3eaf6165379b0e5500c2de0f7bcac50c3bc5c4c7c07dabe03c
SSDEEP 384:xsNwUflLzof+j8IMX/+2oF0Kl8BhBTPLBlimaau:xOwj/lW0Kl8BvTPa+u
TLSH
T1F9724C36A8649C274DE6E645F08732139EF84177AAD97FD4D6EC6B0C04CA29C230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 cdd6bf76eb64e75ca51792854b52ec35f4befcdc1cd553f726627e8253fa8703
MD5 a911a4f0cb82301c5c5722d3744bba3b
SHA1 dab0d0e10344ff4c46bf109f95c14121c90fd0da
SHA512 a35ef684482aefcbc2c670ad9b042360cc093d00fbfa8addde360f639563963f6b01e7bd1ca9dcb6390ad29dee5d198fe585d2b9afbe1d84453b4ef05af7ddff
SSDEEP 384:6iF1tNn/s3n9SJzsNw8TUNTUlIlUblLzof+j8IMX/+2mF0Kl8BhBTPLBlimaax:xF1j+9SBwg4wj/lY0Kl8BvTPa+x
TLSH
T11AA25B3358548D6B9EE69B89F14B22178EF8017796D57F94E7EC6F0D008B29C230BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dbe26cb748a2f1315efd60c926713c512fb271c0dceeefa50f718d3b2b92055
MD5 a9282599e0ba5d124fd77ca57500295f
SHA1 63561a50f17cb21943cd26f6a67b7a7874765092
SHA512 fcc38776b5e48d4f93645669d862c7b2c664fa6742e3d7dfbe9b096290036ed46611a36757cb6cbaf2fa75679ee9dc8c09785a3490707c2045142fc3c612e1df
SSDEEP 192:EONJ6hZ0QmiUy0Cpc/+jVRjzorIz5wOZ5AhU6:EONJ6oWpu+j8IK2OhU6
TLSH
T1A302CA3568687CB78EE2AE45F48737235FE5116BA9956F84DAF81B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a14740ebf7ed08d74b26a52212ea996d9084e89142ce649e1ed0cf03f730e33
MD5 b1c6f43fea6ed0833af48951331debfa
SHA1 0508b131c99683ddf4d89e795ac8113436071a61
SHA512 8f5004af854974fa3bbd80857896715b9b94a483bea4a20bb1b6f053b80a05d30a1564d66203f469ecc4c1187deb203cfcc2ec6b41c3557087832b463b64067b
SSDEEP 192:hONJ6hZ/QmiUykCYc/+jVRjzorIMXTr+275cOqFqZU6:hONJ69MYu+j8IMX/+2m90U6
TLSH
T1CE12FC366868AC674DD2E595F08732139EE55127EAD6BFC4D5EC2F1C00DB6AC234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 22683738607fc7a1dd0889b74cf3246f66da53b953d9aa54aa2af1bd1840e6c5
MD5 e1917ac4c157dead4d11a787532762f8
SHA1 d007e01c52168b8a228a78af714169aec082e962
SHA512 a0ffba376abd3e80d8144e58c316cadea5852d123f34833e812af48875960bd755b99c29fe824680650010a2c24570f2b2c2fe1decd132f10f9107c663af335c
SSDEEP 384:ptNn/s3n9SfsNwUblLzof+j8IMX/+2oF0Kl8BhBTPLBlimaax:pj+9Uywj/lW0Kl8BvTPa+x
TLSH
T19B927E3668645D6B4DE29689F04726278EF84577A6C53FD4D6EC6F0D00CA3AC230BD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb5d5e4c-87a0-4e2b-98e6-2c9f99389c48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb5d5e4c-87a0-4e2b-98e6-2c9f99389c48.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1d14993fd5d237cc6cc4ea540d943af83f0fb359b79b5bd9eb11577094321b8d
MD5 6692f8c858272ab15230d2d91fdfdde8
SHA1 68cd30c78b729d0f9e062643156e77844867c1c9
SHA512 b6cf9ba1baacbaeaf032b671b571f1dc6186ed0bd51f7f9eb85360639088192741e2a2e0253891375d3d40909c1ebe6944da92bb23f435063ad10d833fe7a624
TLSH
T1DF411748A7FE1148B3776E5AAFF7946D447E78772F06D49E00000E4F0662E40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download