7675173754ee16d10ce9d7145b37d23e22e1ac56434ecc7f54375f9448ff2578

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe/Windows/down.html
Size 2KB
Sample260708-pgdzdaft9x
SHA256 7675173754ee16d10ce9d7145b37d23e22e1ac56434ecc7f54375f9448ff2578
MD5 eca411f623cc231005f589e86a4c2454
SHA1 ab9593ab2a755fa1a1746e610e48af6591537793
SHA512 49a07533915599e56767a0a68dfbf6f7e9b1f62f98775d2e603e25bd2d50da4304467bbfde650e4dd94f6d245d23ef3bfd179145a1643b84a7838a2fe4aefa78
TLSH
T10641DB6E52D3500658B282B59FABB288FF860047970785217FDE510F9FF4A4186D3BCD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279866838892624"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{1E5FAE8D-565F-49C8-A94D-AD80BE8A1D5B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 680	3980	msedge.exe	83
PID 3980 wrote to memory of 2196	3980	msedge.exe	84
PID 3980 wrote to memory of 2480	3980	msedge.exe	85
PID 3980 wrote to memory of 2480	3980	msedge.exe	85
PID 3980 wrote to memory of 2480	3980	msedge.exe	85
PID 3980 wrote to memory of 564	3980	msedge.exe	87
PID 3980 wrote to memory of 564	3980	msedge.exe	87
PID 3980 wrote to memory of 1164	3980	msedge.exe	88
PID 3980 wrote to memory of 1164	3980	msedge.exe	88
PID 3980 wrote to memory of 1164	3980	msedge.exe	88
PID 3980 wrote to memory of 4100	3980	msedge.exe	89
PID 3980 wrote to memory of 4100	3980	msedge.exe	89
PID 3980 wrote to memory of 4100	3980	msedge.exe	89
PID 3980 wrote to memory of 2956	3980	msedge.exe	90
PID 3980 wrote to memory of 1692	3980	msedge.exe	91
PID 3980 wrote to memory of 2956	3980	msedge.exe	90
PID 3980 wrote to memory of 2956	3980	msedge.exe	90
PID 3980 wrote to memory of 1692	3980	msedge.exe	91
PID 3980 wrote to memory of 1692	3980	msedge.exe	91
PID 3980 wrote to memory of 2404	3980	msedge.exe	95
PID 3980 wrote to memory of 4740	3980	msedge.exe	96
PID 3980 wrote to memory of 2404	3980	msedge.exe	95
PID 3980 wrote to memory of 4740	3980	msedge.exe	96
PID 3980 wrote to memory of 960	3980	msedge.exe	98
PID 3980 wrote to memory of 4852	3980	msedge.exe	106
PID 3980 wrote to memory of 3580	3980	msedge.exe	107
PID 3980 wrote to memory of 1844	3980	msedge.exe	108
PID 3980 wrote to memory of 4588	3980	msedge.exe	109
PID 3980 wrote to memory of 4588	3980	msedge.exe	109
PID 3980 wrote to memory of 4984	3980	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\adobe\Windows\down.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,6433829275273331645,2868945098143131336,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8222440978189605632,15471837315731647039,262144 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,3332205091880511694,3529355179554385228,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17359363251076987852,5403020712038236268,2097152 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1105340937465222228,2526118704049176776,2097152 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,16371426501866183093,9898674161464397786,2097152 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15545803366506257666,8723809813150939434,2097152 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,13494638423889860915,1823083425224146129,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15735005562651466192,1106137967983230614,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17297229095986343819,8190203182428701600,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17297229095986343819,8190203182428701600,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,17866481205710228815,10202800847606920943,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,9687141928369761893,5487772822553184376,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,686856357862184438,16202258058909271404,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5796624313472471181,15704957473571596775,524288 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,11881933418882550759,17012274469249809211,262144 --field-trial-handle=2172,i,12481107557349913443,11792445299592194909,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9938a4e777cdd15a23471fdfb98dffe8dc31cb3d292832a01881531cbc388fd4
MD5 3f753a0d28e8e66dd062bf2a945ad537
SHA1 d907215b22ed7ab48f20f592fb2939ca996c416c
SHA512 059da3597e9f92eee5f1764ed91671d03338ae489103e088b7ac8a0ccd3a2003b2233eb649a12acd019dbbd0f938824af413281c1dd404976325a348eeb87054
TLSH
T1AE71513D192609A1D3A1893278CD12847DB5C9EEFE336DAE0179FA74E50D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589bce.TMP
Size 3KB
SHA256 b7c031d35afee0702c8fb7ed06f53a28fd4b0e54231177984b074113b31aa21e
MD5 adbfbb6b49288ab9b3392d00fbc3b567
SHA1 6ec0726b96e12077e41fd320a5c4cb072a49e79d
SHA512 c53aa0bd9a1db5434870e20efd6342fb656e783ea9e74c82c5072552aa5cde128708ceefc9f5c175215110f1df2da9cae8e0b5997918a78ed632c63bfb7c2d58
TLSH
T18B71523D192609A1D3A1883278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fb3da7e91ca32c80fb337b18bf4fd8fc7d178322274c7cc38fe33baa7594901a
MD5 420eaea138cde065c1b7ff48b4176195
SHA1 160b77a39a9b3898c90cc211a91e791c8d6febf6
SHA512 0121846d08191ffc79f943c67c72a305807091bd0f6cac59dd4a3da9cefefba94c78639597833ef028f0cb7ea5271f6265ef6d57eaf24eca8843d7044814d87b
TLSH
T1B3218EF7C3D585AED91156F06A28AE2BCE1D0501431C7C1A96E4EF1793E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ecce5fa03e6c4f48362b08575a69f9f1386b647c237ee0077573df69c6459738
MD5 3a52828842f2b4d79ae60fcd1b205761
SHA1 62694dc7eb67e2371af72f0fbd13f35545898801
SHA512 ead547d6240ea759cf4cb3e03fa24b180bba2a951ec4f00bf840ee00d9965f6d5a8d48f4d234ef5354bfc85b7793b14662b89a38ca32d0d940c336368882db72
SSDEEP 192:sxZQRUyM/jK1Ml8Mk0/fUsrsZoKJTIdpd/HW6+WNGYIkeY+tHIgrJ:sxZQeM0/fUsAZbMtHbGSq9
TLSH
T1F442D7126A38997BCCCBD209B945BF53D6F9447292900E449AFCDA0C05E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cdc5e1774d0dff9dfdcc7d947c67fc94e4976ab7f645bc6e6a6ce27d4583aed4
MD5 dabd6f5d9f39ae1b6f40fed6486f3275
SHA1 b032f9eb73933b9238603a4e79b1daac3f255373
SHA512 7a200cedc835e268b9a9cc1b6d7e5773beb50c6ba7ec5ad5817012589df225687ac473a2685f9aaf6fcfc22c4f09b9ab1d0553e9ae918dbe629b23387be21e82
SSDEEP 192:sxZQRUyM/jK1Ml8UQ7k0/fUs0sZoKXTIdpH/HW6+WNGYIbtY+tHIg5zJ:sxZQeqQ0/fUspZxMfHbGkqr
TLSH
T13252D7126A389977CCDBD219F945BF93D6F5547292900E44AAFCCA0C05E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f0262f55b40627dc70d94f887a656c83eb9c13ea2c4c01dc12ab73d20e9ac165
MD5 d78c47382f60206e7cec22dcee4f59ca
SHA1 c0bd9ace7428b96faadbe099b68bef46bac9af81
SHA512 97bd077fad239f79b5f36ea0ee85cd0d4eaede695759870ffebfb039e06b08bb97d7208a17cfa8fe76f0ab1ef93a288f27334162e453bff4758b79e7f606b63a
SSDEEP 768:oGsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9DroMfD:oGsqxXlWvJD6Tu1ja54LAs9wMb
TLSH
T1EDD21B3B694CC77D4F840E6DEC266FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0062e6f51b28fdd4c02ed51ccebdfd2362f93a185fc250cbcb695c5dabb79c7b
MD5 2a6c2472ba0581c01ba0c171b0823a95
SHA1 bc25d6a0d8047a1790e8b1795b3bc2c0991e4c59
SHA512 03824de19d3e21aecf0aafbb21e216952f68c1e024dae69028d4d7c6de8d3b84da374b0941891ccd3753d1f7261aa9b823baa9cc8d32a0086aff6796bc284a41
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLik1:KYbaKYIKOfuKQY+S2gKnKRgRkQiOn
TLSH
T115913526757E0342783D2858B3A699374F4532A37018A4EF3FB850A24E66E124DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 395939bd499c7580ab7062ed11089b3dbe208a6732c456f62c1b8d1f64dd07b5
MD5 b8f49467c7d884f3f2322b17f749c8bb
SHA1 73c1ccf08418a64f127ffebf70bc8139b27455eb
SHA512 fda635c8a2531775f8792f920c6a158ccf745477e3461314ef16fc40d6d2f6a6ee79c38fb662c327706417f3c038e9f1f38cd87ad4f220b13b806c4efc0f9990
SSDEEP 384:GtNn/s3n9SfsNeUzobbE2QVRNT6bjroYJEJ:Gj+9U1mHTuroYM
TLSH
T1A2727C326C385D3B9DE29569F54B36135FF8816BA6C52E8095EC1F0D02DB6DC1306E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67e326fce0f8427f93927ce7fa34b044083fee949b83797f7d664e729c2f47b2
MD5 a9c34e83f04b52936eb626ffa1ea7702
SHA1 0faa479bf66772223eb9c92a1b2fed0bbf4283fd
SHA512 e22a79f1ff01a7c2fb4fb68902bf08192967443e4d6628f1b1d673d7ac467e7038a44f025f0e1a3969dd25ae7087d2a7ac3511429b7e787c1889e4fa7472e64c
SSDEEP 384:LF1tNn/s3n9SfzsNj8TUNTUlIlzobbE2QVRNT6bOroYJEJ:LF1j+9s+wgWmHT1roYM
TLSH
T135924A3358688D3BADE69A55F54B32138FB441ABDAC56E80E6DC5E0D02DB2DC1307E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3940cdba283d9229abb1ae9414e956cc14684e09331ff05deda7cd03c62a2f9d
MD5 f537d3cb4daa6c30b93bb4d9081288b9
SHA1 ad73ce7e19c7f828eeddc2f00246e0f3cb138582
SHA512 63b6bc1c96928af651de764203f6f6e98b344d74dd27cb68f46177a31e3874c0aa0fef4e5241c3116a111c0f6f51cddf4214343d9d36ead88206d0c28d4abb26
SSDEEP 192:uwLsNeUbQ/IkRbn0QmiU1rwf4VRNKFCk5dZc0vYSR0q0nKZZIYdPEQ:1sNeUbobbE2QVRNT6bjroYJEQ
TLSH
T1AC422B326C385C7B9DE6A525B44732135FB8916BDB892F80D6ED1B0C02DB6DC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b009da16cdae883f1303873fa8560078bc8e42b4112e09407d4c52deb2ef5847
MD5 f4f2a242f660f35eb8e9aa0dd247bb0a
SHA1 47d4c6d4558bef1572998746f92545c71b334796
SHA512 b5a4e0ec2058a613d9934211784c16078230ecb837fcd00a36c562abd961b3829149d5d575c9f20fa1b3c2a3660ed469def282354b91186ee7189298cef993dc
SSDEEP 192:tONb6JkRtQmiUypPW+RNKFCk5dZDh3TREU6:tONb6UrWW+RNT6bVOU6
TLSH
T17A02FA35AC386C7B9EF3AD06B48737275FA4117BAA952F80D6E81A1C01D769C130793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a8bd805c80f36f76edc5ad0fd9a3b3994530bedf6f32aefa32f3c63b82e6371
MD5 0cb48ed687198712a0d40154e0d3663f
SHA1 4b6be6e8304914f7bc772d02f58836b60ebe4ca9
SHA512 6616575350849685747f413a47e544b06ec26e8f8d7f5c528f3b67c5d56f4ef360b3f93d89bad4ce9649647c75c0855b1ce940d3b2509a895dc824a5d3f4b53a
SSDEEP 192:gONs6JkRRQmiUyFPQ+RNKFCk5dZc0vJVc0q0nKU6:gONs6Uv4Q+RNT6b4rU6
TLSH
T1E8120B36A8385C7F9DE2A811B4C732135FA5526BEE897F80D5DC1A1C01EF59C134A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc718625-6d37-4bc5-a8f6-583eec0cc2e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc718625-6d37-4bc5-a8f6-583eec0cc2e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9ceacfff721acb7fecce500f7fac2e79b0ce7365796a81e362fdc41d3225ed3d
MD5 9f5bf3e4dc35c4e1b18433ec4b812a7f
SHA1 edcbc465c0b5326b76b878173de85163790a568a
SHA512 8fef93e02ece214cca59381b6b6e0b4c248bac5ebd5282a6c22aea4492323945170f39c6f99ebc75946875a7a5ed81e9cb8a68d3dbe0ea7b081ba3ebdb4d579a
TLSH
T107412DA8B6E91148B3B77F599BF7696D487B78372F06949E00110D4F0A26B41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download