8f5e01e77ab42a469bb965f7b470b270e0851202d7659b40e415ce3ff210d7a5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testimonial.html
Size 13KB
Sample260703-alezxagy7s
SHA256 8f5e01e77ab42a469bb965f7b470b270e0851202d7659b40e415ce3ff210d7a5
MD5 6ea724714c7a6761f32029b03791c15c
SHA1 d7c23734a5d8e9924ef58b32037bd314039c7e93
SHA512 59ada02b53b8256b966911cd402d80d08b6b85a0808765450b5ed865596dbfceabaa4c86bbf921a56fb90ac43215759f252f30368bb0b69d9c0fe7bf548bfc44
SSDEEP 192:W6Lz/7znjLy4edFDxIucZA9QwXZRfo2VN8ygvVVF+ZbzNup:3LDDAWBqDA+svV7+ZbzNup
TLSH
T1CB5283256CF2117B014790E43AB17B1BAEE3D807EA1B681871FC97C95FD3D42986399C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275114915948366"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{5C8C2675-E247-49CA-94EF-0FA02155BBDC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4780	4812	msedge.exe	84
PID 4812 wrote to memory of 3732	4812	msedge.exe	85
PID 4812 wrote to memory of 4712	4812	msedge.exe	86
PID 4812 wrote to memory of 4712	4812	msedge.exe	86
PID 4812 wrote to memory of 4712	4812	msedge.exe	86
PID 4812 wrote to memory of 4972	4812	msedge.exe	87
PID 4812 wrote to memory of 4972	4812	msedge.exe	87
PID 4812 wrote to memory of 1572	4812	msedge.exe	89
PID 4812 wrote to memory of 1572	4812	msedge.exe	89
PID 4812 wrote to memory of 632	4812	msedge.exe	90
PID 4812 wrote to memory of 1572	4812	msedge.exe	89
PID 4812 wrote to memory of 632	4812	msedge.exe	90
PID 4812 wrote to memory of 632	4812	msedge.exe	90
PID 4812 wrote to memory of 4272	4812	msedge.exe	91
PID 4812 wrote to memory of 4272	4812	msedge.exe	91
PID 4812 wrote to memory of 4272	4812	msedge.exe	91
PID 4812 wrote to memory of 4284	4812	msedge.exe	92
PID 4812 wrote to memory of 4284	4812	msedge.exe	92
PID 4812 wrote to memory of 4284	4812	msedge.exe	92
PID 4812 wrote to memory of 3892	4812	msedge.exe	101
PID 4812 wrote to memory of 988	4812	msedge.exe	102
PID 4812 wrote to memory of 3892	4812	msedge.exe	101
PID 4812 wrote to memory of 988	4812	msedge.exe	102
PID 4812 wrote to memory of 3744	4812	msedge.exe	104
PID 4812 wrote to memory of 1864	4812	msedge.exe	119
PID 4812 wrote to memory of 4204	4812	msedge.exe	120
PID 4812 wrote to memory of 1772	4812	msedge.exe	121
PID 4812 wrote to memory of 2328	4812	msedge.exe	124
PID 4812 wrote to memory of 2328	4812	msedge.exe	124
PID 4812 wrote to memory of 1608	4812	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\testimonial.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffd397cc188,0x7ffd397cc194,0x7ffd397cc1a0
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7271021305700230939,17410003190004745265,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,13485522896374186781,18412210967557931547,262144 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,3681896242774343080,2062097850208092435,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8667842057107904960,2632180385995583313,2097152 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16992831749919424748,7386158094475297264,2097152 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,16198597173608723291,9468826092904301758,2097152 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4338305107117558929,12559478627204473184,2097152 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9935624376408622787,14895324188037584538,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8212738051894304991,12146100581074230556,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12920948341905457025,2468346718125509366,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12920948341905457025,2468346718125509366,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1955172718019828771,11865735073401672693,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16986404407052236627,7832181402477670444,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,10096261941474181448,14334684063684969400,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,9006168859175948149,16872008459923253056,524288 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,7883052890944815856,14201887940130650355,262144 --field-trial-handle=2360,i,16533708848776546406,8365656436511776151,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0db65f0ed907872558a999cec4d9e71146d432cd356bc4e4a7a3108095ed21d8
MD5 ae41eb080625a8baf32dd759f0eb1cbc
SHA1 59edd800225cafc80f697fcb69860ce521cff3a9
SHA512 f6da2ea5fee9d3f4e1741e549fd15bad5c989f7a893dfe89bbaf17347fd298a791bbcac9a986ba1840e1e4a77ec524e4021e3e2775baa11b6a6bdee034e26b0b
TLSH
T163516C2883720881E37C1571A3E2133DF07E809A3AE7EE1646940DFD691EB36743F159
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dabb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dabb.TMP
Size 2KB
SHA256 6d67e6ddee90a9cb8c094153aa55b67c17866f8b06356a3be1647e68c482867a
MD5 78e9a1ac4a1d7c04f9291593045ca03c
SHA1 4a4f4458c50325888eb3eb151ea97acff8c7d71c
SHA512 9c9480f77621f15e9e960e7520b56347d96834561cf7ad21a131f5c651ce488339741a71610d40b00b3b35448b1ecf079a212655757ec00140a6458c0739f789
TLSH
T17351592883B20881E37C2571A3E1133DF07E809A3AE7EE1646900DFD691EB36783F159
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f8450d811eb168fd66d956ce0001892f757354d061bc8e02b471718733e1cef
MD5 7b1cdc7b6dca624da3d675e88428b919
SHA1 b188cf496a9d54d7fe1e00027ffe407f29695c9d
SHA512 781354898c90091f30e0eee452b0b1f9c2e0ad62024d3a91017e33a90f2bfd5b4c587f4388f01109e83878712a90b92bd7be91550eb77a4c6a424b40211af73f
TLSH
T17D518DB6C3D487AD981152F4AB25BD2ACD2D151642383C6A8DF4EF4F63E24B0E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 254a83455ea7fc375cfc976c266d15e2352f9c4ee4db3567fbeda3ed10881840
MD5 34d1f3e4c2168137e1cd5288fd4081c1
SHA1 e4093beb819d34b01a8f2f1a667e103253722c60
SHA512 4f56e201d9c903df7cf1dc6f49b48eac9c9c33f780fa58898372019c7f201b6d68ae13dff1e75cde45d153cc80dcdda364d26dc07f034b7e9f07ad940c7a2328
SSDEEP 192:sxZ5R6yM/jK1Ml8UQtk6/fks3WNs3cIdpHCHW6+WNGY9IWe0H0+MIg5hJ:sxZ54qG6/fks3P1iHbG3XR
TLSH
T16B52D716AA34597BCCDBD20DFA41BF53D6F4147292900E48AAFCDA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b0fd31f9459b262b78e986017b8f0b83cdd956f23f8575e929d0483f02e73c3
MD5 43ed4db8775f6b8e8c958d696a37f10a
SHA1 0086e458eb5995eed9aa431fb9683651e8782c0b
SHA512 24d00117f5d4be6ddd762f617365ca528785b420534bfc036450ba7bf2d42661c4af787c7d33e5e4b8746ff87b3cf1d52d074ed4f6cc9b0352fd7341c2cc8680
SSDEEP 192:sxZ5R6yM/jK1Ml8Mk6/fksWWNk3cIdpdCHW6+WNGY9IK0c0+MIgrJ:sxZ5YM6/fksWb1YHbGxX9
TLSH
T17D42E806AA34597BCCCBD209FA45BF53D6F5047293900E48AAFCDA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 983d7d3fb49731f2b77da75aa5160a14e784b7b5637f22cfec37b5f137b978a7
MD5 464d5f7ff400cdaf09075efcdd87d1a4
SHA1 03dfda5c6eec1fe2ddda4f70955c7ad726122969
SHA512 da8edcfea439c1cebe49abeedf3c390eb2523eb19c1a83753c286adeaedd5fa6c5787e61731a5a92a7071574668d27e1120bc99962358319111c459a87cc1570
SSDEEP 192:sxZ5R6yM/jK1Ml8Mk6/fks3WNs3cIdpdCHW6+WNGY9Iue0I0+MIg5hJ:sxZ54M6/fks3P1YHbGQXR
TLSH
T1B952E706AA34597BCCDBD209FA45BF53D6F4047293900E48AAFCDA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9b91030afd9def3114fb78671763be11fa66e13b4ac65f5389a21fc28d45f47a
MD5 026e365de4f06a65562364a3c8f88b56
SHA1 b5b6a53877267360d7b2b68bee8a6fbe3482ff83
SHA512 71bad4a9cced876f5e34f3238c2f9adc277cf9e02655c0b54782c9eb57329357417671495739775dbb86f87659abc85a372beeaee930d18f0dcd28e2f1928404
SSDEEP 768:uXcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproFg6o:uXcv21wWvu+Z+u1jaeFLeRNCFY
TLSH
T14CD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f93480f3bb7aa14adb36f387d86fbaed26f56662390ad74a0eb38a7ec0929ace
MD5 8506519a703f01cbdb38c5cf2b410ec3
SHA1 e7d118c49470be713194e43d7dc1cc140da5a50e
SHA512 ab804f60822c138d64c3ee78d99229600569730ae71a4f4a5c86fb1a6fee3ee44fbe73385e7ffb21a2ba8fcf14b778b9352749b1fd4028c1f3d5a4a9a4b7f570
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1eKe0CfVCbvlfjHWLQeg3HK4GgJHcNVIA:mTJlfVCbvlfj2LQ/3dGgJ8NVIbk
TLSH
T19D912F01703A06413C7E785DA7A29D268E8671A37518F4AFBBB801A14E2BE125DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597584.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 aee93cee43bbc3edaaf142f04723b4299b9cf9a21daec7faceb3d6413e849c29
MD5 084d7665aa782c9ca5cf204039c34de2
SHA1 8f4133058a2e4b571db4bcc6e3bbf99466593e9d
SHA512 bdf7f804a7da2974c10afdf1f99d12469d9566d212b0f1241f256e18f7b37054396bb41fe2ad315651f3facf6b2c71ed0d27e0a7d38b22eec013f7f0825d1777
SSDEEP 384:miF1tNn/s3n9S+zsNP8TUNTUlIlwBtSX9zi3bWue+CTdIe9Jrd2+OObjI9G6w7Ol:NF1j+9dKwgavSXNqarV9hd2+29MA
TLSH
T155A26C339C648E7B9EE29B94F54B35178EF841BBCA857E84E6D89F0C02DB5EC4316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4294e5155578ebf242127cdea9b382ac1f9f416b72a680aaa05fc3fa587e0afe
MD5 e90c8bb3ea1a433392833b6cbb3452d0
SHA1 0e15a24c8ae46a25b97589ceed208341483b18b9
SHA512 bbd241e8555db16bc68dd8ce6e0753fd471811c670552a6097b54c762b771bd797cc5e1df569973f8d866b612f579cd8f11ba330e54154d5095235227f57b54a
SSDEEP 384:AtNn/s3n9SfsNqUlBtSX9zi3bWue+CTdIe9JrC2+OObjI9G6w7OcUf:Aj+9UUvSXNqarV9hC2+29MA
TLSH
T1DA928D32AC355D7B4ED39595F48739178EF881BB9B892E88D5DC9F0C02DF6AC4311816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 212f341793e242256cf1acccf6bc22f944ad8392b334c4b00fc26e790af5021d
MD5 5e42108e09d94298c7b84c0aac09c54e
SHA1 ab8363f05396ea646130285a2239c83b8b818eec
SHA512 2017b8fe18cda8308c521afc7389fd4bfec88c14c675767ba74a43c0bb0331e6d3768d638dfc4c13731e26f02721d4a1ccd07e9c3e3fa7c6b33dbafa4bd54b42
SSDEEP 192:JONr6v+YLNQmiUye3Zh+CGN+FdeX9oEus2tiU6:JONr6vz/HZh+CTdIe62YU6
TLSH
T16202E935AD381CBB9FF2AE45F48736175FA82177EA922F84D9E81F1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a033f706d59d74d06e15ec76628cacce449cdf5c25b211510b717a4499d1130
MD5 9e7c948c677974beb722b372d3c1fd88
SHA1 3b5c90ae7bd3ca94fa915643714e0310199c760a
SHA512 589c8a227e246fe2c50c13fef8a4f3f05dcbf047147d9427f49150b31862d1a0a9cbd2e16b7c4cacabc14cc83a22a77d1455bc880a4d847b6d8e83bc2148e8c3
SSDEEP 192:vONw6v+YLgQmiUyW3Jh+CGN+FdeX9oIHSJrZxPCH2GqKU6:vONw6vzEZJh+CTdIe9Jr42+U6
TLSH
T139121A36AC745C6B5EE2A580F48735139EA85177EF8A3F81E5DC5F0C02EF6AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f962b870329bbfb984f6d24f771bc1f72ed12b374f5aa6e4c40e528e75f0d2d4
MD5 225cece1f7da8fb67270be7d16811b76
SHA1 95b89af72ef8b4fc9d2112a9f0490d8d9df5e943
SHA512 2d51e6c81bc6eb0715dd70a82471c259203bb9eb3d9ad0d82f0cee09997477a9b34f2b1eb3dc70b7d28927d32e0092ce9953590b3d9813b1fc00f82c1eaf0e27
SSDEEP 384:2tNn/s3n9SfsNqUwBtSX9zi3bWue+CTdIe9JrC2+OObjI9G6w7OcUf:2j+9UHvSXNqarV9hC2+29MA
TLSH
T1E5928D32AC355D7B4ED39595F48739178EF881BB9B892E88D5EC9F0C02DFAAC4311816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f6ac2d4-534b-43cf-ab39-9e39a1beb8f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f6ac2d4-534b-43cf-ab39-9e39a1beb8f7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 58ef1a08bc435809913f440580d42204639093264b36499f5c487f9e92b79e8e
MD5 06f0a148702343d34002becce80d22b3
SHA1 9a84960a4ce3c859ac22918e48b8ea760c18ffdb
SHA512 1ceb2edd6a1a62f935c724b0dfa09813e84ef551919a9c5b830c81e72107375bac4b0c0dcc76cdd07576b8e9d5a5752334c6a33df8035b3350be2e585593094f
TLSH
T1C041174CA6E90148B3B67F5A9BF7A86D487FBC772E16949E10110D4F0A62B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download