149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/CheckConnection(2).html
Size 34KB
Sample260709-pfjs8sa13v
SHA256 149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc
MD5 4b8229537dd39dc6a4a2e1d750899c03
SHA1 f8319f0a3c503ae58c2b6396bf4a0b648a1dbb6f
SHA512 a4836bfe87d7d1b2581345afdbd6f5baed95a76874bcc17690d64d826225487846c728b8e81e87781fea7d9c446821996fcebd568ac2e5ba868c1bef60bbf8d2
SSDEEP 768:BiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSQ:QIUlVN8KYEsvZSJ4HX
TLSH
T1BFF2D7C8B7E2742683A3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4760	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280729986794996"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{45A80C85-8BBC-4C2C-997A-71F897ED10D2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1216	1192	msedge.exe	83
PID 1192 wrote to memory of 4760	1192	msedge.exe	84
PID 1192 wrote to memory of 4152	1192	msedge.exe	85
PID 1192 wrote to memory of 4152	1192	msedge.exe	85
PID 1192 wrote to memory of 4152	1192	msedge.exe	85
PID 1192 wrote to memory of 2992	1192	msedge.exe	86
PID 1192 wrote to memory of 2992	1192	msedge.exe	86
PID 1192 wrote to memory of 1488	1192	msedge.exe	89
PID 1192 wrote to memory of 1488	1192	msedge.exe	89
PID 1192 wrote to memory of 1488	1192	msedge.exe	89
PID 1192 wrote to memory of 1448	1192	msedge.exe	88
PID 1192 wrote to memory of 1448	1192	msedge.exe	88
PID 1192 wrote to memory of 1448	1192	msedge.exe	88
PID 1192 wrote to memory of 400	1192	msedge.exe	90
PID 1192 wrote to memory of 400	1192	msedge.exe	90
PID 1192 wrote to memory of 400	1192	msedge.exe	90
PID 1192 wrote to memory of 2956	1192	msedge.exe	91
PID 1192 wrote to memory of 2956	1192	msedge.exe	91
PID 1192 wrote to memory of 2956	1192	msedge.exe	91
PID 1192 wrote to memory of 4740	1192	msedge.exe	96
PID 1192 wrote to memory of 4184	1192	msedge.exe	97
PID 1192 wrote to memory of 4740	1192	msedge.exe	96
PID 1192 wrote to memory of 4184	1192	msedge.exe	97
PID 1192 wrote to memory of 4720	1192	msedge.exe	101
PID 1192 wrote to memory of 1204	1192	msedge.exe	111
PID 1192 wrote to memory of 1948	1192	msedge.exe	112
PID 1192 wrote to memory of 4520	1192	msedge.exe	113
PID 1192 wrote to memory of 4728	1192	msedge.exe	115
PID 1192 wrote to memory of 4728	1192	msedge.exe	115
PID 1192 wrote to memory of 1876	1192	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\assets\CheckConnection(2).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,13730807424687724996,18362019008101901205,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,4058211929034891888,14334753437080457845,262144 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,16857784497539084136,8539810538991784004,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,229118494282551321,12921858839602183930,2097152 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15827648714698353277,14446169673117173835,2097152 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13430168025970722564,9787381165043137096,2097152 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,786117659009123995,366939385398462086,2097152 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,7982666266734463878,10746573201786243667,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5147631577889202768,8570041327673198051,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11278664211855515553,6271245572906070320,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11278664211855515553,6271245572906070320,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,12654511422159134728,8920423418947743054,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,13205404804726836903,17123060043289049424,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16163531313217768755,2730003618778494409,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1096,i,17994546758502728457,11521853620453917881,524288 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,5034427595184679379,11687552424084235439,262144 --field-trial-handle=2296,i,6843084201796507945,3897438147383958991,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1a3f122992f86ac84c85d43b1e35b7569cf3656354e27aaa39dea6982a2dfa31
MD5 d2a26d91b39040bc309cbd2a1f0129a6
SHA1 ae0eba912ff1676b3ab5c1ba396976b6bbc35c4f
SHA512 aefb3bd6d5ef92d972bf2daaeff4e4a3f30019f1938b70c89a0c0731da39a348a01264006de4df3e5b944cd67b1201e671d106864524d23b94bdc71c5cdfddd5
TLSH
T15E71523D192609A1D3A1893278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589dc2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589dc2.TMP
Size 3KB
SHA256 aedd75f8982472cf0aefa14592d2b8ac2bb107f3662974c774feba567ecdf103
MD5 ad981a2fa4d7c1363d50e47aa190c779
SHA1 3b5b418febd8543dc3c32cbd276b4d8efdcaec8b
SHA512 dc2e92a5d4ed6e549d650f1863f07927a9115c4edb121e7a8097ec561e0fef44ce06b44e188b73ea81ee37b34031ee310261031bab9ce7853e730bb1aabc3247
TLSH
T12671523D192609A1D3A1883278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 39837d7c5f856fa8eaf87408771720ebe412d59e36e3932236c5cf9f3bcfd682
MD5 48331bfef31dd46ba11da8aafc55b33e
SHA1 68ce9799c2c1414a56c2fd0f965cd606abc18b8a
SHA512 52a771078572eb86b48c33a6fd48df79346b96a612dde27c8828f9a3575e6e6dfeb3efde744e2ad5acc318756f535eb347e1cc09a851acd275cb262488171fa8
TLSH
T11121A0F383E5856EDA1156F06A24BE2BCE1D0511431C3C558AE4EF17E3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8d8674b817f8f0b9ce3e4b63b1331c82ecea8e2a10b7019f69ab830ce969e963
MD5 f97b00ef68f8bf37fa369e6ba0026477
SHA1 899257c9c808313b88e268dae99cad37e7a8b170
SHA512 79b5c6a7f27b807810de5c4115bebd8a613670b9a8563a257e3ba761aa3b9f63a8a033c2a8b909ecf9bf924ecd9dfa495e2c5743f4c78e2bf10adce72d432a28
SSDEEP 192:sxZpR3yM/jK1Ml8UQAkpW/fesOswNhIdpHVHW6+WNGYIQhGWIg5YJ:sxZprqTpW/fesOsmK1HbGAe
TLSH
T143520A126A345977CCDBD20DFA817F93D6F51472A2941E48AAFCCB0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 087e81fefcb66dda4505b24e32a02e5b32726846f28446d754308b5d04b3fe2e
MD5 2684ebd6e0bfa3323ccc12df5d7e3117
SHA1 acaa278d89b08926c7cefb5f8931582ce40bc9a7
SHA512 4b64570563daf1deabaeb561e402a60a23189c80fe2f4a6143b6b6a7bbd1f56cbddac7013a4f84e556ba22b98b994c2efdc03f3dbba11cf14d47db665048c5f9
SSDEEP 192:sxZpR3yM/jK1Ml8MkpW/fesvswVhIdpdVHW6+WNGYIkqGWIgrJ:sxZprMpW/fesvs2KzHbGf9
TLSH
T1CC42F8126B34597BCCDBD209FA557F93D6F51472A2900E48AAFCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d5867851afc5a9cf9af2aa26c0844bbba852fc03f7cc2c7b1a98ffeafd6ffdf0
MD5 390b74e682736c97dd4df9f92004c7c9
SHA1 fd0439ed0160c56520cefb96e1533ef4883765db
SHA512 4768b031bc56dffd55cb3c7df2bbf16765f5b3d520ccf0ae905b55259c2b2f63d3aa19c53e27e20207c270b81104dd671f6b8394a1fd310c499d0a05e8835ad9
SSDEEP 768:20sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9kroWfC:20sqxXlWvJD6Tu1ja54LAs9vW6
TLSH
T142D20B3B694CC77E4F840E6CEC266FD76ED801CB66988D5447FA884C02CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec84753442c1e6d49a41c8a9eeb7144354551a261102e0538f956a855002bfa6
MD5 50d7e82f425b4c36144290cdcc1df62a
SHA1 cdc94515ec83edda0ffd01601248d7799835abde
SHA512 ffb55960149c56274c55f6f70cb4a4a093e4215109eac5719c683211730c74b1f763ab7f2ba6f22430b3e94ed5d29caa430144c2609110a7209283e88635f374
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikh:KYbaKYIKOfuKQY+S2gKnKRwBUAye3
TLSH
T18791691A757E0242783D2894B3A699374F4532A37008A4EF3FB950A24F66E124DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593a9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593a9e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6f96fceea3cb62cfa0c2d6a998446467927c15db3bd74ba9c7c5c7ac4059e08e
MD5 2b84a85013825a7ddc28e4de2c0af3a6
SHA1 739aa5166dab4c194743b3c92b2c41a2b6fca434
SHA512 5b4e10a6167e2be82f63512262506b6f2760b83bf679c47a2e86d0c6232c5fcfdbc206569be784fc85095eee84698c708b6efeab532b0f7fb8440f7f26d9e647
SSDEEP 384:2iF1tNn/s3n9SMzsNt8TUNTUlIleqRb2h6vVRNT6bDPOObjI9G6w7Wx:dF1j+97gwgHe6dHTwP29MWx
TLSH
T15FA26B339C648D7BAEE28E55F58B32239FF451AB96857E50E2DC6F0C01DB5DC030692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e6db28643c97575586b89402e3073575f7352d29795c431ce799c6f4c3b3d6c4
MD5 0fefe705f321ceb5b9273a0307e70040
SHA1 c305d32576d78a26c0373f96859114aab9eea6a8
SHA512 6ec874e6dd21708339c239bdb4c604d0bc8ce43aed0ca0d38adbd021b13c95e2160cc7334a952b8f76bb9f50f4c48b022224c0731dfd567fd72fa74244176820
SSDEEP 192:u0LsNTAQrqMekRbYjfQmiU1LHbOA4VRNKFCk5dZc0vxSRlqzKvW:hsNTAqRb2h6vVRNT6bMPvW
TLSH
T1C1522A72AC354C3B9DE3A801F48B32135EB4A1A7A7C93F40D6DC6B0C01DF59D130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05870383d0378a1e3ca4b45d0e47fb88870c1c823a01ea65903abb107561b68a
MD5 a9ba0dd0548913e5af087aaa1f6fc9a1
SHA1 cdcffe631b64795894af0a59b797ba707f013a72
SHA512 4a49eb50796b7e82983fb67dce0512be5a8fb4f138e663c38cf1a251a63f68503e690248756475b282c6ae6f3fbf9d4ec2e2db23de0880d4b7ce6957cf7a3c0e
SSDEEP 192:tONb6JkRtQmiUyoUW+RNKFCk5dZDh3GREU6:tONb6Ur8W+RNT6bVlU6
TLSH
T14202EA36AC386C7B9EF36D05B48737275FE4116BBA952F80D6E81A1C00D769C234693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 806e0e40845a2be5b1396e3c381c5cb5eef1f03f01065ec5b9ac4bd806910329
MD5 8865eac3ba441e78b363352394ac1da5
SHA1 41767b79c7298bb54441ac74a9bcc32fd6de9976
SHA512 f7d4cd2bde817fac5126ee8151f975bb993fb58c807fbe36b4a6b996246f9d77ca887a205678bff1d2c48963b7f34c65a00ef6411128fd22c1ceca2c9b7ffd16
SSDEEP 384:ZtNn/s3n9SfsNTeqRb2h6vVRNT6bMPOObjI9G6w7Wx:Zj+9Uae6dHTNP29MWx
TLSH
T156928D32AC354D7B9DD29811B48B36279FF461AB67C93F40E1DC6F0D01DB9AC431692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d979581e5c547cd8fb532bc4cb51a08b26329bc6360ce7c7a8224f11b94fa700
MD5 7de4307796aa09db27d8af2f57d9324c
SHA1 db91cb8d5e9f860e4c3fff46bb317718090e2e26
SHA512 bd770a5f4fc9adbfb3d7a5a05db0ab06ebbbdae25a9645f934b752ce5b0294d11a7c943a0293542ffdf7f48b53a0c3c5f3946a6c9b0c8ff79e49e9a291480da7
SSDEEP 192:u+LsNTVQrqMekRbYjfQmiU1LHbOA4VRNKFCk5dZc0vxSRlqzKU8:bsNTVqRb2h6vVRNT6bMPU8
TLSH
T1AD321A32AC345C7B9DE2A915B48B32135FF4616BABC97F80D5EC1B0C01DF69D130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a7f5c85a0300cc27100511ae24875c3fa1f11b9608f5bb059b599dec7393ac3
MD5 b9cbcdcb07846f64ea192f420cb9c303
SHA1 ae98c88ba52522d2c421471031ce9bbc7945c1ee
SHA512 27078ba3feecdb002b14db7bb8169de096326e629d4b27fba06019ba2d827a1a6ab059836a56d6e71b1e8605b990bc375d61ddf5b444985228b622b714d04b11
SSDEEP 192:1ON+6JkRaQmiUy/HjUt+RNKFCk5dZc0vGVclqzKU6:1ON+6UWSIt+RNT6bdPU6
TLSH
T12F120B32A8385C7F9DE2A811F4C732135FB5926BEB897F40D5DC2A1C01EF59C134A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d9b08fb93fd51560b97a03ef27fccca19456f4d815d7ce567535ad48dd2da79
MD5 4618aac42cef81181c88156901292fdf
SHA1 5466c4d37adbecaf68aa9cc6ac991df99827ebbf
SHA512 3785330905f05b6889bd114b4e602b3072fba8fb80d115b6e70db5d72b881033fbf4ded48981cc7f2472df900cb756ab40605d0b3bb17dd794c8f7a99dcb902a
TLSH
T117412F5DBBEA0148B3737E46ABF6A86E847FB8732E56949D00010D4F0623A01C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download