149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mbox/assets/CheckConnection(2).html
Size 34KB
Sample260705-aj61lsft2t
SHA256 149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc
MD5 4b8229537dd39dc6a4a2e1d750899c03
SHA1 f8319f0a3c503ae58c2b6396bf4a0b648a1dbb6f
SHA512 a4836bfe87d7d1b2581345afdbd6f5baed95a76874bcc17690d64d826225487846c728b8e81e87781fea7d9c446821996fcebd568ac2e5ba868c1bef60bbf8d2
SSDEEP 768:BiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSQ:QIUlVN8KYEsvZSJ4HX
TLSH
T1BFF2D7C8B7E2742683A3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276841503249271"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{202918AF-11DE-4887-9EC9-DA9B2BEDD11C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1100	4316	msedge.exe	86
PID 4316 wrote to memory of 2912	4316	msedge.exe	88
PID 4316 wrote to memory of 2108	4316	msedge.exe	89
PID 4316 wrote to memory of 2912	4316	msedge.exe	88
PID 4316 wrote to memory of 2912	4316	msedge.exe	88
PID 4316 wrote to memory of 4360	4316	msedge.exe	90
PID 4316 wrote to memory of 4360	4316	msedge.exe	90
PID 4316 wrote to memory of 2456	4316	msedge.exe	91
PID 4316 wrote to memory of 4520	4316	msedge.exe	92
PID 4316 wrote to memory of 2456	4316	msedge.exe	91
PID 4316 wrote to memory of 2456	4316	msedge.exe	91
PID 4316 wrote to memory of 4520	4316	msedge.exe	92
PID 4316 wrote to memory of 4520	4316	msedge.exe	92
PID 4316 wrote to memory of 1664	4316	msedge.exe	93
PID 4316 wrote to memory of 4192	4316	msedge.exe	94
PID 4316 wrote to memory of 1664	4316	msedge.exe	93
PID 4316 wrote to memory of 1664	4316	msedge.exe	93
PID 4316 wrote to memory of 4192	4316	msedge.exe	94
PID 4316 wrote to memory of 4192	4316	msedge.exe	94
PID 4316 wrote to memory of 1728	4316	msedge.exe	100
PID 4316 wrote to memory of 3660	4316	msedge.exe	101
PID 4316 wrote to memory of 1728	4316	msedge.exe	100
PID 4316 wrote to memory of 3660	4316	msedge.exe	101
PID 4316 wrote to memory of 676	4316	msedge.exe	103
PID 4316 wrote to memory of 1856	4316	msedge.exe	112
PID 4316 wrote to memory of 700	4316	msedge.exe	113
PID 4316 wrote to memory of 5012	4316	msedge.exe	114
PID 4316 wrote to memory of 4196	4316	msedge.exe	120
PID 4316 wrote to memory of 4196	4316	msedge.exe	120
PID 4316 wrote to memory of 5040	4316	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mbox\assets\CheckConnection(2).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa61dcc188,0x7ffa61dcc194,0x7ffa61dcc1a0
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,13155612772702304797,4929519919787687615,262144 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3153555541469285653,4841423131009153430,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,3334655483910305247,5798924526363388613,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7875021204458746387,6346665352223488668,2097152 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,6022738293766023138,14912692836341495163,2097152 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,9851315298759116475,5189432729362759355,2097152 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,636349720140372950,7008896786579107997,2097152 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,13190425844769364468,10951479740899142087,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,4323969238377379344,5196305552476442697,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5677215303076905866,18229807836566419499,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5677215303076905866,18229807836566419499,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,3225547811773613199,13003602568470660790,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,1049503061807387255,9757940830798929368,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16508296769599541481,3131466901583828567,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11729615179764601921,1143407127765810298,524288 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5744,i,14993959260594890418,14195818098926092137,262144 --field-trial-handle=2288,i,14120870233517367694,5896972455161853988,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 237a2a725f3d5d20b58a84f5c89c50360b5398c77f7fab72f44ddba96629dee2
MD5 512d36aa07cca3739ecd5c5b9c2a9711
SHA1 39fb18172752ff365307c6d51e6ecbdd3bcc97b3
SHA512 fa8a6311f5274d2b403061af991ddb5bc16a0f04407970884086b6206d9d3fe6eecc8a8ba85e2c26a6ef596cce3162688c08cfe0f615c8a9076007011af01988
TLSH
T195716FB0140EB899E35E01389CD25E0C7F3140E9F417BF7D1A508FB1551D72881FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b35d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b35d.TMP
Size 3KB
SHA256 d4c1bca20eb5b22d24e298ff7d0672fbe6768aac1c69fffaf017faa713448de1
MD5 4ba6e82b3d3b2fb02f4fc38a24dfbc09
SHA1 10437196a9d905c330887f0f54d896ce89da96e0
SHA512 808c7e1600de9a52ad6a03a8f9007cf86cb02c783bb86f5e1046134d2b085609ddc7bfc0ce22f74567fe513fd0cb53cf66d5758cbbcc027c4f0464988b09af3e
TLSH
T12C715FB0150EB899E35E01389CD25E0D7F3140E9F4177F7D1A508F75551D72982FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5bdd9b3048f3bc3e120e9a4180c8af07973c1c06b8dbd0a031a7cfb1b007d7d0
MD5 bed17483a084432dfc61970133eb75cf
SHA1 d4259e10bf87b81c04363bdb0cc241c282bcba14
SHA512 da455d95c81a905bc3fed8e587b7b4a00d7847dfd02fb471f45dbefb9bbc3fc27fe6d93ee904ddb427fef9d471d719814c751b2af6e39aa692426a60e200d1aa
TLSH
T1D411BDB3C3D5856E890157F06A24AE1BCE2D0902431C7C1A85D4EF27C3E3076E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0284d9c9c63c3a47b2c1a0c080165fdaad1014ff8f80ca679aa3469d537553a4
MD5 c2eca58883a62aa0905b2ed74a42a023
SHA1 1acba91383fbf6ab9d3cfacfff2c0635599237cb
SHA512 2ec63f973f3e8934578e37adb7fc949bf2e8120c93918992beec567a667aa9c73ce1139e75352f1c7ad1bd3285a8fd719373adac1754e8385183579c6147bee9
SSDEEP 192:sxZVRRyM/jK1Ml8MkiW/fBst1KNjeyIdpdTHW6+WNGYzQXSTiIgrJ:sxZVDMiW/fBst10i5HbGDx9
TLSH
T13F42E8126A34997BCCDBD209FA45BF53D6F51472E6940E44AAFCDA0C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f9e4a9a2a6c740af9c31560a7d1778019c6f75a9316650688ebe551910b78f92
MD5 e49fcd0979320d9e6d5aa9c63eb822a3
SHA1 9e7085822e9296d799f2cff36eaf5fa9520db83d
SHA512 aebe15836fb98bd48374ed0478d2f97e134215d6eb4c11d2f1e7a6b9d3c1394a9fae82c776a080284772227c9a22254b693b5b8551448465200ebb21044d525a
SSDEEP 192:sxZVRRyM/jK1Ml8UQ0kiW/fBse1KNQeyIdpHTHW6+WNGYzdXBTiIg5FJ:sxZVDqPiW/fBse1jizHbG6c9
TLSH
T1AC52E712AA345977CCDBD609FA41BF53D6F55473A6940E44AAFCCA0C01E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c9da81931d85087d4db637517d5741b890b0632918f4e2cbdea204d2d1625910
MD5 ae90d6b9804a49753f986ea0003f736b
SHA1 759606e89dd07c724e8bf6e337c9a88449b7e6a8
SHA512 d72b4abd171c1e41e7aa219b56947bef5d2bc49dd5b2491391d40970cc49ada92e0a01c7acf135e45b2e6a53490537276dc235289e66d19d288fa75b4e732372
SSDEEP 768:Q7W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjHroI6i3Yi:Q7W7kf0Wvqidau1jaa5LA3jUli
TLSH
T1ABD20B3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7f551c42f99061fdae4c5caf238cfcd7b8e35346d3e9bd9bf67274be442b46ae
MD5 92ccb9814c0b50087a4d6ec15846d239
SHA1 8d398898c38d5cb99db98e1f66a97109a7bb1fab
SHA512 ab0a5c9f08db81280abaf8db9915cfb31d9707eced6b59fef113587ca0d03499e8156c6902ebaae1f1b35a3e712280b16a410f234dfcc73a631e8f4e1d20bbd4
SSDEEP 96:KIbCKcrUAKdamuj6KIwwJGXThDXzWnUCgbzK4qgy:sM7NzJGXThDXinUDbpqgy
TLSH
T15E91F916323F095238BD2849B3998A274F4131A33018B4AF7F7914795E5AD225EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff601c05-71ca-454c-b792-73931ca87e33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff601c05-71ca-454c-b792-73931ca87e33.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 060eb411b17c24de308630cb8163b16059c69806ae756f80708dbeaa54ac5a91
MD5 306e22b55a565f9ed572da0a9a2fa80b
SHA1 478bc77076b36beda4c4b85d803a45dbddf47318
SHA512 eb2c581a9b7494cc92261f7d6a5644a9878028ce41ee6149a3ade3a86021e561725dc9216e0359ac3dfc8cec127ffc2dc5a9aeba56fdb923594df6a7a49611aa
SSDEEP 192:u7LsNFSTQThgk1tBbXYZQmiU161jd4aGBPKb++FdG24RFC1SJro/dNUCqoU8:SsNFSTGhgkhbo32ySd3UCEJroUoU8
TLSH
T1743208356C749C374EA3B144F4473A13AEB5412BEA892F84E6ED9B1C05DB7AC131AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa434f9389d1550f77039cd265b3df5304e8ef4747418ef5ba61729f2ab92ce8
MD5 ab6d5eb1c1820c40a214262a1ff98a27
SHA1 9b6afc10a794a4cbbe4e03a2558d9a71bd3dde1d
SHA512 7bed914d4dad92b252f4ae5342271f6efce80f0b5934b3f8be4d675143d0004b7852f78ac6c69e2a8174f6a1ea4701ff1616b394ac9e0417bd0166ac3b79b1ee
SSDEEP 192:MONi64BAQmiUyV10W5GBPKb++FdG2MaDUntWU6:MONi6eAuqWNd39UtWU6
TLSH
T18702E934AC786C7B9EB3AE45F48637175FE8113BEAC55B44EAE85B1C009764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c06cecea90cd6f70072c5c5eebfb6effa2dbfccfa4c9c8a2f0c4ba1bd1371a51
MD5 0027c71d6bedd1451afd0b57d1fc46b0
SHA1 49931b2913864f3b7e48c35858e67458653c8e79
SHA512 a42e9dc4918da3bad9bb9fea1fc1443172d88046eb2a5ebc39b2d7f60d6ed3aff73a2f0d7e097896505c4358de1af8e79a9ea08246232dc72035f8d392b0ae15
SSDEEP 384:jtNn/s3n9SfsNF7XGhgkhbo32ySd3UCEJroUoOObjI9G6w7gUL:jj+9UIePh0mBYhoUo29M1
TLSH
T122929D315C659D374DA3A155F4873B179FF8417BABC92F84E6ECAB0C02DB6AC4312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1d366e249c861c33675adb38f29443c6cb8dbb69ac52ea5a2aa03f13300b97c3
MD5 48407b5cce3cee1c3665fd155f0a2f01
SHA1 94684b13eda288d327aafc84c3b90bc17d9229ee
SHA512 066c69a46f1a33da80653a8fc1d0bfb9019e21ed9f42760c2ce6a46c242504d9ac18efc6935f33b9dbab10f2ce70a1092dab2c66e7a1320203efb872f39032b5
SSDEEP 384:hiF1tNn/s3n9SfzsNf8TUNTUlIl7XGhgkhbo32ySd3UCEJrlUoOObjI9G6w7gUL:IF1j+9sawgZePh0mBYhlUo29M1
TLSH
T114A26B335CA48E3B9EA29A95F54A3617DFF441BBEAC56E84F6D89B0C01DB2DC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8146483ec91873862d0f7184469d4906ded70e6f2a25ce34aa90614eef9d8bba
MD5 e0b9b5b2d2681303ee842cba7094598f
SHA1 d2a7c94ae0f24003164ade5023fb928a80902867
SHA512 1faf407677e684242612ed7a366ff28500f3dabbc683dd3c3448db467cdd97b052e4cc52aeb43a032164164d60936208365c4df01ea6d99e099956839ed499d6
SSDEEP 192:hONo64B9QmiUy0S0u5GBPKb++FdG24RFC1SJroiWwUCqoU6:hONo6e7NuNd3UCEJr3UoU6
TLSH
T10412F835AC646C3B5EA2B541F48736179EA4412BEFC96F84F6EC6B1C01EB69C2306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a73cb7ba-ef78-44d9-a05d-f0a23b77c30b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a73cb7ba-ef78-44d9-a05d-f0a23b77c30b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff40d46348416d0bcfa13014bd90ea8ada3082e3bb44b081ff1e546c3ed61105
MD5 626592eec0fb5487948084e3664f02c0
SHA1 a379cbd9051110937ead3670751dd992770b0506
SHA512 c0159d474a3bb09c52d04f83b0c7ea5473fed8c50efbe18eaf6fea1d3137e430b89fecf7d5d5cab2a887500108a0a48e3655e5fdbad7d7b34ce6f957f1dbaaef
TLSH
T17941289CA7F91148B3B76E5AABF6A86D44BABD772E06C05D10110D4F0A32A00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download