27109b2380d8103de9b7cee5fdcf53cc1c1829fb372586a9cbc36fb5d534e58a

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mbox/assets/CheckConnection(1).html
Size 34KB
Sample260705-gz5aaaes7r
SHA256 27109b2380d8103de9b7cee5fdcf53cc1c1829fb372586a9cbc36fb5d534e58a
MD5 2584a75eb4dcad04785e159e9b083ccb
SHA1 03a0273cfccbf8471b4e5dd42246a342dffe980e
SHA512 94573051930e1041c4afb813de3d8b2a1c6cda0bf9b56fb552af72ea2f64193d399414aaa545e4e36b27bd3f455f53de7ee748ca4f50336373b3202e898a71ae
SSDEEP 768:ZiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSl:4IUlVN8KYEsvZSJ4H+
TLSH
T16CF2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C453BF79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277059562753788"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{8D5BE8B0-9D28-4004-AA17-3F3A439116D9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2064	2552	msedge.exe	86
PID 2552 wrote to memory of 4912	2552	msedge.exe	88
PID 2552 wrote to memory of 856	2552	msedge.exe	89
PID 2552 wrote to memory of 4912	2552	msedge.exe	88
PID 2552 wrote to memory of 4912	2552	msedge.exe	88
PID 2552 wrote to memory of 1224	2552	msedge.exe	90
PID 2552 wrote to memory of 1224	2552	msedge.exe	90
PID 2552 wrote to memory of 4476	2552	msedge.exe	91
PID 2552 wrote to memory of 5036	2552	msedge.exe	92
PID 2552 wrote to memory of 4476	2552	msedge.exe	91
PID 2552 wrote to memory of 4476	2552	msedge.exe	91
PID 2552 wrote to memory of 5036	2552	msedge.exe	92
PID 2552 wrote to memory of 5036	2552	msedge.exe	92
PID 2552 wrote to memory of 5004	2552	msedge.exe	93
PID 2552 wrote to memory of 5004	2552	msedge.exe	93
PID 2552 wrote to memory of 5004	2552	msedge.exe	93
PID 2552 wrote to memory of 1676	2552	msedge.exe	94
PID 2552 wrote to memory of 1676	2552	msedge.exe	94
PID 2552 wrote to memory of 1676	2552	msedge.exe	94
PID 2552 wrote to memory of 4284	2552	msedge.exe	97
PID 2552 wrote to memory of 1164	2552	msedge.exe	98
PID 2552 wrote to memory of 4284	2552	msedge.exe	97
PID 2552 wrote to memory of 1164	2552	msedge.exe	98
PID 2552 wrote to memory of 2572	2552	msedge.exe	100
PID 2552 wrote to memory of 4500	2552	msedge.exe	112
PID 2552 wrote to memory of 3836	2552	msedge.exe	113
PID 2552 wrote to memory of 4780	2552	msedge.exe	114
PID 2552 wrote to memory of 3848	2552	msedge.exe	115
PID 2552 wrote to memory of 3848	2552	msedge.exe	115
PID 2552 wrote to memory of 3304	2552	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mbox\assets\CheckConnection(1).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,15272029926083814759,4335165384229219689,262144 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,8358064005078072355,7349499908693834700,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,9719450677040163773,7764153860350806205,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2076429783976601619,677005721250602392,2097152 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16858802695862840209,17482238795009470008,2097152 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,12540718634564867355,17955754590920104555,2097152 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,6886339749539274101,55599339183410712,2097152 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11715736885830132634,3403807318727362362,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,522793566171473530,11632730614861585220,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,928374322469929684,15443551607451887751,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,928374322469929684,15443551607451887751,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,17093206452851276932,142754416740061165,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2542841336116736014,16087670537484491897,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13109242018305804056,10121225367656704227,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3080770186202328400,10860717619118775810,524288 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,13360389651299864528,14966445609380182480,262144 --field-trial-handle=2804,i,13938241465239418360,3511415759998924821,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a0ec263b64ee9fb8e473fe768019637cd328a1b8b145147bccc1e5fdc9af18e
MD5 9b8d484e61d2ba37506d43ac28a4dc05
SHA1 be405a4e722afd439ae02575c78604f70b45b347
SHA512 ba4b1bb62615a49e490ead8b5ba697393d416806678e3d84225e9244d7bd0cec59b1d3957d60a6177c55f906199105b5055257fd1d618ab51d3d2f045ef5aab6
TLSH
T11961C7BD0596EDF6E3D13A3190C03A9738F191E8FD63FD5D01E348B5640AB514A6A8CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588dd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588dd4.TMP
Size 3KB
SHA256 9a0439035d977a687fcb56326098e8f56d980dc2fb21295e7db0ba2b13d2d610
MD5 23715e5488a339949e30cbc12ba903ca
SHA1 bfcc144f59d6f715a98edb8663be1cb95879e8a1
SHA512 00efaf8caca14a2330558e46ee93ffb21952bf405a88bcdc4c54edebaeecd6978ab306cbb6e1d948b9e25d036ec65153971ef0737ae94d8b629da7b5f887ad36
TLSH
T11C61C3BE0582EDF6E3D13A3190C03A8738F191E8FD23BD5D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d504be1ca1adcce9ac224faf5fb49faddd65c2a5be4c5ef66acbdf0c202aeadc
MD5 3f6a1dd22550e961801f38d5c0c6f49e
SHA1 6339e01c4f2d95b32b8c32b5ac0cd6ce087012c2
SHA512 a2db55b12b89ff9c8dbc530ee06d96910b717d62d3a2e29f7ba3cf10d29a181a8c0d09f6f7bee9efcbaa08d5ec50c2a3ce316597f5cc0603aa9cf3e7fa663ff1
TLSH
T1A5218EF383E585AEDA1156F0AA18AE2BCE1D0901422C3C5585E4EF1793E3465E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fbab3a1d28da955d352ee62c507c02ab62ebd998924f1a70b8b2a36c794808ab
MD5 358ca439cd4937d015ce316698762291
SHA1 f6f3d91b324f64973fd1df9b9cd9764f8ebc68db
SHA512 3b20fdc855cbd33111d84c6d86a382ba594503117772c461f595afe956d5e40adf2abaf0c88dc56e44d28ce249b339c8d3590a1cee47eadb45a859e3e9cb9ca3
SSDEEP 192:sxZyRVyM/jK1Ml8MkH/fnsEd7phVIdpd0HW6+WNGY9IKlteIgrJ:sxZynMH/fns6FQmHbG39
TLSH
T1AF42D7066B38A977CCCBD209FA55BF53D6F50572A2940E44A9FCCA0C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72e3dd05e20de2ceece16caabb9c57f051ca0b12774a0e9df6a51691383714db
MD5 c3cf5fe657e341a60baada91831d51a0
SHA1 2b0a1a3a2b213e2dcd964d635f286e21ee0eaab1
SHA512 5aaaa9d1dc0d49d59a8d97fb3119ce00a77829eff6cf4322861d404dc718858117c5d9ef65bb82e372bd7f0f67de2a59c66ca28b3db75d6de20dc8d27188d700
SSDEEP 192:sxZyRVyM/jK1Ml8UQrkH/fnswd7qhVIdpH0HW6+WNGY9I9IteIg51J:sxZynqAH/fns2OQUHbG/d
TLSH
T10152D6166A389977CCDBD309FA51BF53D6F5447292940E44AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 906c9d05b95b0d814b1320561c88e7600b640f83dcdece862d57013e6ac6d001
MD5 fbad6a42a489085b840dc0dc03db108a
SHA1 e7a37cf6054e9ae17705bb6fe97df99b3f0a2729
SHA512 cb60f9c60a907246da4d026a2215fcfc64427c006a87c7d4efcee8b6014ad2b5a9fc6415736e512f58956c7b990ab872d65221359ac19118bcbea73628c777d1
SSDEEP 768:KPcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNBro3g66:KPcv21wWvu+Z+u1jaeFLeRN63K
TLSH
T1AAD20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae7c7229d73dd7e1d592d41c9637fa55280e3e2273495f837267d6c65a27b46d
MD5 d7be301e4e25dd39208a76dfe6822965
SHA1 d45f85ff2575a16ea393d9a722ba93e917c06d31
SHA512 005c744668221925133c3b831003055d985e0b495bfefe33faaa316d2f43144871d6b365e387a9f144884f1f97117a5976391e8ada0905a7fec7f5a236c81543
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaH+zC+4AwmWgFNg+mK4jg8mc2edt:mTfHH+zC+4AwRgFe+ujg8V2edse3HFSO
TLSH
T1C2919702313F0682387E294C927685764E8275A37464A57F7FB900D60F27E226EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c46.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c46.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6c690cb40ee80b8255b077b7d057eec0dd38eb84092f82c9f5bf0874d2ac6343
MD5 139aff4ed38c8a23c227b86091b48c69
SHA1 faba529d6543140f46d378dd2974b13a2fbcc27d
SHA512 3a42e6dcae4232fde2a4a7499d75a372d69f7a02150ddfd963291655f7c27afc3230eba10176aa1ce169be0b048b41d42ff7c8d2381f17559d4e9b282a4296fc
SSDEEP 384:4GniF1tNn/s3n9SwzsNb8TUNTUlIl8/ziVRce+CXOmep3JrdxYOObjI9G6w7cv:47F1j+9LSwgiy3vO9p3hdxY29Mk
TLSH
T121A27C335D688D7B9EA28A95F54B3627DEF441B7C6C66A84E6CCAF0C02DB2DC0306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f03f4e5fb46cacc16c1b28343a1c1623fc0abbec6aceecdbbec94d1ac720b221
MD5 1e24a027adeaafbc39ea0887479584f9
SHA1 06af4ecfee72daaee6ff849582142f6f82d6210d
SHA512 ee4e107d956f77ebaadd8e30cbb40c34bb5ef564a71d003c081dd8a3500e5cc54d6226408b10163e81b79232ddb871ba5e9c1cc53fee0e91304594c5a71b8fd4
SSDEEP 192:JONO6v+YLNQmiUyzeZh+CG6Om9oEus6lU6:JONO6vz/TZh+CXOme6qU6
TLSH
T11F02D935BD281C6B9FB2AE45F5873B275FA8217BE9952F80D9E81F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd05efd1a757e95f438fed16a2dbc1795bbbca36657bf5cc7ba3a152e2b74a17
MD5 57cd6892c947743d86f6062be4961362
SHA1 08f7edc0365c5a7027b3909facbf1464234bc287
SHA512 265a62e4fa18e50fb2695304b20348322d94570f754af006858a6e92c1acac30377275bd16da70947a4b4966fbda55d1f4f47f61e7c6952876a21e37b7a81ab8
SSDEEP 384:EtNn/s3n9SfsN58/ziVRce+CXOmep3JrKxYOObjI9G6w7cv:Ej+9Uny3vO9p3hKxY29Mk
TLSH
T1BA92AD366D381D734DA285A5F54B3A279EF851BBD2CA2F84D5DCBF0C02DB69C0306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f37a421191bd8cdb3bec45f4eca27c4efcd29968fa14e141d815ae84d16c1969
MD5 2cc51f31c31d2ded87465446e1aea6eb
SHA1 018425fc49256f171757162e2b2f48822bc233d5
SHA512 a780d0dcc88abff03f1142b296a83b8ce88aabacbd3c73b94f9747bc883b92e4691e560abe5801e58cf722b233af026c726d738ba998dc48b8c43fcf55b25404
SSDEEP 192:eONE6v+YLjQmiUy5eMh+CG6Om9opwSJrHZCHxbq7U6:eONE6vzh3Mh+CXOmep3Jr+xYU6
TLSH
T184123C36B9785C7B5EE3A590F48736139EA85167DA8A3F80D5DC3E0C02DF69C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 830eb87df9846f886c6cda136d8af2e49ddd61f853d5b11a15b8d19a294a2b62
MD5 0ca5267ea39b4b6b130b66d6ece0c0ab
SHA1 c8d38b311d79b144a0055a5af6365fadc1be9564
SHA512 fbe5ed521ea31bb2990f350fc038f66ac20de5974e1ef99c3609e5bf351802357b4f3d29e48e141a93fcabf92fa95cf63def74661ecc5a11f900c3c70c045fba
SSDEEP 384:dtNn/s3n9SfsN5R/ziVRce+CXOmep3JrKxYOObjI9G6w7cv:dj+9UUy3vO9p3hKxY29Mk
TLSH
T1DF92AD366D381D724DA285A5F54B3A279EF851BBD2CA2F84D5DCBF0C06DB2AC0306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f008f3b-76af-42b2-8963-c874f27052d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f008f3b-76af-42b2-8963-c874f27052d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 336ea44dd6dd21399c1b8815774c4f7766d9827a648f7b2010f2f5c52ffb373b
MD5 87a82a0aee9e80467f66e089d83f0002
SHA1 72faee617cd3bca0a1a3fbd69ef3da01c0606a46
SHA512 0a36f7ce8327956b5d44198588180313995ca8b5612c99a0659fb273426f5a3c1d812984ca6c26fbc88e125619e21604e50b13773631bcc9d0eb2bffb932f5d3
TLSH
T10641E698A6F91148B3B76F56ABF6686D447EBC772F06D05E10110D8E0B22A04C8A1777
MD5 SHA1 SHA512 TLSH

Submit Download