41f8af66cc86eb215d9841eda4f195494fda55ee92f795f8b543cf6986cea3df

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
option.html
Size 1016B
Sample260706-ajabmsgw4v
SHA256 41f8af66cc86eb215d9841eda4f195494fda55ee92f795f8b543cf6986cea3df
MD5 0cccbf4cb188291e0dfd42e88487ec3f
SHA1 c98e09e95558660b6d5f536011176becbbe0c1de
SHA512 a871afbd711289105862e9a086337b36ca1c138849b5eba1be0109e77c5bec35558a465420809277e31d3bfd13d3dc905ebe277d38fa3c31e3583de6f8422e61
TLSH
T1A4110C10F4F0B56A2623045E9ED299215F5D010FC9667880789DA5A8EFF8D8BFB171BC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277704509640965"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{97742D63-5409-4525-A341-43FDB3F8B236}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4244	4620	msedge.exe	87
PID 4620 wrote to memory of 3792	4620	msedge.exe	89
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 3876	4620	msedge.exe	90
PID 4620 wrote to memory of 1464	4620	msedge.exe	91
PID 4620 wrote to memory of 1464	4620	msedge.exe	91
PID 4620 wrote to memory of 684	4620	msedge.exe	92
PID 4620 wrote to memory of 684	4620	msedge.exe	92
PID 4620 wrote to memory of 684	4620	msedge.exe	92
PID 4620 wrote to memory of 3432	4620	msedge.exe	93
PID 4620 wrote to memory of 3432	4620	msedge.exe	93
PID 4620 wrote to memory of 3432	4620	msedge.exe	93
PID 4620 wrote to memory of 380	4620	msedge.exe	94
PID 4620 wrote to memory of 380	4620	msedge.exe	94
PID 4620 wrote to memory of 380	4620	msedge.exe	94
PID 4620 wrote to memory of 4344	4620	msedge.exe	95
PID 4620 wrote to memory of 4344	4620	msedge.exe	95
PID 4620 wrote to memory of 4344	4620	msedge.exe	95
PID 4620 wrote to memory of 3368	4620	msedge.exe	98
PID 4620 wrote to memory of 4904	4620	msedge.exe	99
PID 4620 wrote to memory of 3368	4620	msedge.exe	98
PID 4620 wrote to memory of 4904	4620	msedge.exe	99
PID 4620 wrote to memory of 4060	4620	msedge.exe	101
PID 4620 wrote to memory of 960	4620	msedge.exe	104
PID 4620 wrote to memory of 2868	4620	msedge.exe	105
PID 4620 wrote to memory of 3828	4620	msedge.exe	106
PID 4620 wrote to memory of 3588	4620	msedge.exe	113
PID 4620 wrote to memory of 3588	4620	msedge.exe	113
PID 4620 wrote to memory of 4216	4620	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\option.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,2816369792545699231,15163714932921903561,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,18343682332291647735,17556746289585838334,262144 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,10168296088781629438,12329606397337283250,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1245854445678084298,5319870023337590489,2097152 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6305117134202136970,2309809694737885644,2097152 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,6426702185503989034,1342439391078900832,2097152 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12168774616535768973,12139520839151444192,2097152 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6028413304998673054,18263460878683564579,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7907737944999926131,17061408836857989893,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13627587085319883404,18119085842630498817,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13627587085319883404,18119085842630498817,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,7445382319355474912,16374693308037688710,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12438575935144867968,15992714565646648944,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5065712362727299426,6241038308501842138,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1503855479660644803,4964132992881308128,524288 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,11876009346492585203,5858545752779795674,262144 --field-trial-handle=2440,i,13899701568822853751,2193205142296738249,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec5204a6ab9694308a577a836b363217bb40554c8d87df547ff3eee86a17e7a8
MD5 c7d9d760424168a5d6fe35a0d625f5d9
SHA1 f762bce80b39b147eb875c52e27c65322adfdb85
SHA512 925f647735b20143554c90ae7a3858092ec50ad9157e4487b23951949b4c547765f6417dd46871c5e4beb012217730eb1222204d3bdd40d72c3e839b614cacd8
TLSH
T19061930CD902D941F36E273CFCD122D836B285D85EF39E1932B068BC7617BA191FA448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 359ef71bff134dfae6a0dfe7b977788250e41732f237a78ba0483a275f0dad7e
MD5 28fafbbeb26609b2508f3835389bb5c2
SHA1 67c3951b880b4874ca58462b54c1675b7c7fcd34
SHA512 59563aa9083fa5b3d0f0f174bf1d606d39f4e29409f3b24784c8f1356c68a54a2433b8473610ed5e1d337d942b0f102652a01b86cdd5042751f680f9d78add11
TLSH
T15521A0F7C3D585AECA1156F06A28BE2BCE1D0506831C3C5A89E4EF5793E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 058c9ba9162b2d6ea18300b4e89e9384416d0e56bee526463cb2756a380caa82
MD5 7f684b046da87c95b71798f4db8ecc6b
SHA1 a334a2d333269cafd8d859b5c4a23adcc95babd0
SHA512 e9080e6ca06ce83e75cbb259c6c06b709247382a611d857ed048e6be797c69cabe528c8bacc404665c4ab9802ab27c7cc852a57c5c39b0ebb04e8cf16b98fa0b
SSDEEP 192:sxZWRpyM/jK1Ml8Mkw/fisEcgLIdpdWHW6+WNGYLztgOIgrJ:sxZW1Mw/fisEXUIHbGo9
TLSH
T11142E9126A385977CCCBD309FA55BF53D6F91472A2900D48AAFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 095b62754be0582178b5996ec77d5a4247788efebcb6224040cc0441841120f1
MD5 eefcf0ab6f2a4cf05a0644b59a6a3123
SHA1 c1a6a1204948e923a4794e4ca03f69e0b51ad644
SHA512 6ef02dcee5a5c8caaee7867cb1122c8d80ab6b14884d1cf32fc12836b80f83945065142c6d9de76393d5303107a0249f4eb31a8cb38fddf360fa3a3b9daeffc1
SSDEEP 192:sxZWRpyM/jK1Ml8UQekw/fisDcwLIdpHWHW6+WNGYLx0JOIg5MJ:sxZW1q1w/fisDTU2HbGqW
TLSH
T1CE52E9526A385977CCDBD30DBA41BF53D6F51472A2900E48AAFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d357e9e7c83a1f71d4f166bf99c194795e02e950fb17f3a9ae7e23cac8df6d53
MD5 2523192103cf761f9f31fb743e2a9ad4
SHA1 842a600a2cf484688f727e4ce418912ade209603
SHA512 3cf1741aa1009de6d5b9e74864b27482979435a03ca42f5909c5343f0fed97ae09401f364851c32008a1c2b388c7233af17d5885e3170a2023c1c45f055a8f9c
SSDEEP 768:SMs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNUro6F:SMs6pD1WvxzWju1jahILIsN/6F
TLSH
T116D2F93B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0968d0fc3b2e4f30111704995f80f56ea41e4b9c04ea47312291c8e6faace709
MD5 b07e8b02fa78fbf282ae175728515f86
SHA1 bdd82f31b625d327f961f84f452f2d4f89d2b92e
SHA512 37eebd2cce305b27bd7a5be1c66b73b2976a80d3a42e2a963088fc8359573b57efd4bcc729170e1734104f0f437bf0059abd959d36042c88ff74c1b638264b01
SSDEEP 96:KUAAKtePGbGKYcaG5CKSMt5iKqgS+VWKGkmbEBVju:iiJt5DpBFbEBVju
TLSH
T1C7E1021271BF06073DBE2A08A39487274742B163702EA52B3BE950714E6BE354DBDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ef26c31-b2f7-4bce-a500-6984b3432512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6ef26c31-b2f7-4bce-a500-6984b3432512.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 41aa3976b5b37fa48e177e93d78165518a6bcd7d08a61dfa6e43fe7b010bf1ac
MD5 7b8b6fa52324af160c8464307b5e79ed
SHA1 cffb963bf06e046364e605d3b5fd835c2f8677c4
SHA512 869105f2f314f175fe5e9551a279ee96d051477ba1c3e39439d458f6a195ad834d8e6db6e4e84f1e34b048e83dbc4d6ae2948907071cb1a16744bdbe48f9c8f5
SSDEEP 384:htNn/s3n9SfsNuvsqmGcpmja9LOdlzCSOObjI9G6w7sUa:hj+9ULm4G9O3zCS29Ms
TLSH
T17C929E326C6C9D775DA39255F6472A279FF8017B978A2F84C5DCAF0C02DF6AC130A906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a127ab0f30b0e074fedeb1f35d7a670120964bdbaaafa39331fdf9def0bc749f
MD5 30fb8f26cadea5a637e1063ad0ee6df7
SHA1 17e1e68f91cc5d59b95931ad808f7e6dbda81c3a
SHA512 784112da3dc3d1ff8b795adddf2f4fbb2df1f41fb7240bb52d30657c9e0d907c03cab773d3a9d57817e6a4f11e8ae89d3c4700f526d2c3cbe6654499011a5afd
SSDEEP 384:ViF1tNn/s3n9SdzsN+8TUNTUlIlssqmGcpmja9LOdlzXSOObjI9G6w7sUa:cF1j+96vwgGm4G9O3zXS29Ms
TLSH
T1B0A27D335C58CD7B9EA29B54FA4B26179FF501BBC6866E84E2CC9E0C01DB5EC134AC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e63b34710475778599f0b23db45de8d1d9b1b3499137fa2cdb9c05090b1fa53f
MD5 d79b709248d06ac9a87c92d23859cfd2
SHA1 f3ee3ac28e65f11dad07507dae919df9f3e96773
SHA512 2c6bdac945af3d9d8cebd123b1d0234d3b64a68e630d2101087144929b5fc4b045363a79988fdda26b2cfab7c21e8374518c1b9dfda6019a33c96d2c8ba2516b
SSDEEP 192:qONC6O7+3hQmiUy57Gttb0CO2bCygGEuU6:qONC61WGt9LOdknU6
TLSH
T1A402F8357C6C6CB79EB2AE45F68727235FA5113BE9962F80D6E81E0C00D765C2347823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 60a533a3771dff4e6816405edddd4d85f4c9c59ac032a08d45c630a1a64998a8
MD5 10484b54a3cfb691514cb179d7962e29
SHA1 59a9abdf30c28590512cd93514d87fd238a3323b
SHA512 1944cf916bdec3ff753c080c87b5dfdf888f40601a663db8111d7b37a7d9e49119a7215248a522fe9a8135f26925161f0955481f20aa17c996c2a207457690db
SSDEEP 384:NtNn/s3n9SfsNussqmGcpmja9LOdlzCSOObjI9G6w7sUa:Nj+9UWm4G9O3zCS29Ms
TLSH
T1D6929E326C6C9D734DA39255F6472A279FF8017B978A2F84D5DC9F0C02DF6AC130A906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16cad5a9dcde21f24881cf043d00148e5d064f5e3e4ccfee2ae023887a1dac7b
MD5 70aec97aaa2028191da7b61803627dbb
SHA1 20f58a1c58d9f17c10725a2507ceee349e4c286e
SHA512 2f3097b8be429b46f7e355d6a0d52456f930630caff04c86ef3feb22f906d291fe70d36f135f794d1b07eebb2a30f6a4974d5a068d0946f6f046b45f7efb53ce
SSDEEP 192:8ON/6O7+3UQmiUyo7xttb0CO2bClwEvcN4rqe7U6:8ON/6+lxt9LOdlzsSU6
TLSH
T12D120932786C9C775DA2A584F98736179F69112BEA8A7F80D6DC1E0C01DF6AC234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f26355-d9b1-4e91-9c82-f3497b131a9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\93f26355-d9b1-4e91-9c82-f3497b131a9c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 96089af463ea0a1ed5a6111d326615751f6f359b19e280aaa96ca69e93fe0b5b
MD5 91ce9c27ad45de379fe29255fe32869c
SHA1 fd526a7fa836266853a1fbb041f9b04dc96c7616
SHA512 89bb5491b620b22772bb17255ca55ea5863bb3cc8bd2f640d4f428e5d51fc98405f8f3cbe1a9794c035a03034f98849fde8ac44d9ef6f3a54ed780da12bd48b5
TLSH
T16C411958B6FA1149B3B36E569FF6A86E447B7D772E06D45E10010E4E0627640C871B37
MD5 SHA1 SHA512 TLSH

Submit Download