0d39dfcf34df7c24ceb9fa263364bcb7463b5a6aff7abfa565d58ff10fc878df

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Manual/create_referral__new_client__print.htm
Size 26KB
Sample260714-pn13gsft21
SHA256 0d39dfcf34df7c24ceb9fa263364bcb7463b5a6aff7abfa565d58ff10fc878df
MD5 6d1a5d34222d194adf0f0ef4253f20b1
SHA1 90c1dc4b7e469a7db39baaafabd8b94cbf7fd3e1
SHA512 4d2261f811440a58eb6d7df2ef7fdf258d9c4c7933b2a36adb36085162a585ebde9d8970a199d657f135bd6d718a9b85891182d332387576c73d3f131c26b78e
SSDEEP 96:1AiGTXd98QMLQiMuBRqQ/QtLQGQiMuBRqQ/Q+LQfQiMuBRqQ/QHLQ8QiMuBRqQ/h:Sf9LT9/+qp
TLSH
T1D4C2DD23B555152A91C392E4E4219FE43687A30AFB2B5074BBF15378D68DEC02D3A4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285058810875822"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{79C381FF-1FFD-4A35-A7E7-23500CD64A40}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3564	4920	msedge.exe	83
PID 4920 wrote to memory of 3464	4920	msedge.exe	84
PID 4920 wrote to memory of 1696	4920	msedge.exe	85
PID 4920 wrote to memory of 1696	4920	msedge.exe	85
PID 4920 wrote to memory of 1696	4920	msedge.exe	85
PID 4920 wrote to memory of 3988	4920	msedge.exe	86
PID 4920 wrote to memory of 3988	4920	msedge.exe	86
PID 4920 wrote to memory of 2804	4920	msedge.exe	89
PID 4920 wrote to memory of 1768	4920	msedge.exe	88
PID 4920 wrote to memory of 2804	4920	msedge.exe	89
PID 4920 wrote to memory of 2804	4920	msedge.exe	89
PID 4920 wrote to memory of 1768	4920	msedge.exe	88
PID 4920 wrote to memory of 1768	4920	msedge.exe	88
PID 4920 wrote to memory of 1760	4920	msedge.exe	90
PID 4920 wrote to memory of 3308	4920	msedge.exe	91
PID 4920 wrote to memory of 1760	4920	msedge.exe	90
PID 4920 wrote to memory of 1760	4920	msedge.exe	90
PID 4920 wrote to memory of 3308	4920	msedge.exe	91
PID 4920 wrote to memory of 3308	4920	msedge.exe	91
PID 4920 wrote to memory of 4476	4920	msedge.exe	96
PID 4920 wrote to memory of 4476	4920	msedge.exe	96
PID 4920 wrote to memory of 3236	4920	msedge.exe	97
PID 4920 wrote to memory of 3236	4920	msedge.exe	97
PID 4920 wrote to memory of 3036	4920	msedge.exe	99
PID 4920 wrote to memory of 2940	4920	msedge.exe	105
PID 4920 wrote to memory of 2408	4920	msedge.exe	106
PID 4920 wrote to memory of 1768	4920	msedge.exe	107
PID 4920 wrote to memory of 3036	4920	msedge.exe	111
PID 4920 wrote to memory of 3036	4920	msedge.exe	111
PID 4920 wrote to memory of 4420	4920	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Manual\create_referral__new_client__print.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbcfb4c188,0x7ffbcfb4c194,0x7ffbcfb4c1a0
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16635135887503530628,17982062129775114671,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,16920898999918726403,10873666446487008458,262144 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,16952672387215480368,11684987582137665580,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3108402899085930490,9372471579563210720,2097152 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,17845933508048070906,3875803419410665523,2097152 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,687007568081624605,9807986588402693173,2097152 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7358568588439885286,916327687846949783,2097152 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,17490330730721078021,13858270994179911,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7513900255916280269,15848435211773430679,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12830687792535333455,15442125113262975245,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12830687792535333455,15442125113262975245,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,1960516012896011287,16133190982606393639,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14130097056773153408,5574401211225299290,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,5693477385489930619,13921986235665455120,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5210631685868403645,1481837870897983060,524288 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,868132415602095846,18204140513316022143,262144 --field-trial-handle=2292,i,7859909593307670009,320803037346459272,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 165d2f84e1d787a8165f88e62921bf78cb60b8d108be1d3d6beda97fa7bd0dbb
MD5 95aedeba87e792dab2adeb9cebbefaa6
SHA1 68a6bcd00478f8d9dd95d69b26a7b81008897222
SHA512 a1dd2db877b44b936a284fd1fda7d8191ba99efa30c60c03288fc94de6812d805000e77f3d4d6f2e465a601658cb94bc41685c84601d42ef43cf58c1dfdffdb0
TLSH
T1AF6170A9216244D3E3633670F0D2C28278B0BBB60B53DF9AC160A87EF5097118FA1C17
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 710f6d23fda3f301c689e982678faa4552fbd4a1e13cc06678442b99fec1dc81
MD5 013ba2e5758f56c624b8ac0c1e82fa13
SHA1 7e20aaf88f6a736eeb4144e8cde4248be60c46e1
SHA512 9716f34ca0ea12fcaa16aa440553027cdf32986e963a44c64522fd9c6ac4f0b1254216a6e79181eb3499ef0dad855c51335a4fa29e2b8f928d5c3506bd500ae7
TLSH
T18D21BEF383D0856EDA1156F0AA14BE2BCE2D0501432C3C1A8AE0EF1793E3465E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f7f5b73bb054a8fcb4095dbe66c7307eeccbc187b22ebf6fe8a82080c993b24
MD5 f353c0bdc9112c7b1adfddb3aac5243f
SHA1 e5a320b4ba572a8e5e94038b4ed4efe5b367d2b6
SHA512 9de9b9a62292d29b2fc816f33a1fb347f668412462bc5cdca445db5ecd7f38624932beb0702e8d3c52bb82b1fc0baa5cbb0b7b377114d80f0c5f4adac275404a
SSDEEP 192:sxZ3RSyM/jK1Ml8Mkh/fQsI/wIdpdxHW6+WNGY4wdnzIgrJ:sxZ3oMh/fQsI/RrHbGK9
TLSH
T1D442E9126A34597BCCDBD209FA55BF53D6F94473A2900D44AAFCDA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dc4088a72910981c485f0b796b2eba3080414b40769dba231230427b1f8c418a
MD5 93ada152867c34e06ec3bbcbc5768b70
SHA1 68f281da99e18f19ed8d159ef77d516d055bedde
SHA512 a9e7f9d295652af0c49ae4acebcdae0e8e594d01896b0fb2218e6e14820d3dbf05d08291d32609090cad40f5f38237e3b8d0a5b565638f94a9e1765585fb8120
SSDEEP 192:sxZ3RSyM/jK1Ml8UQokh/fQskLwIdpHxHW6+WNGY4rimzIg5dJ:sxZ3oqLh/fQskLRRHbGDd
TLSH
T16452D7126A34597BCCDBD619FA55BF93D6F8447292900E44AAFCCB0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a6278d37356eaf44689f5de9d3db9fbcb43e2db226c2b6aad7ecf3f6f08c3548
MD5 f52a5aa3a0b351edd56d97e491a6d844
SHA1 b9eb9d064c67bfff1341e235eac0d49f94975f88
SHA512 00bb0324aa825d01ca3d7761ec2e839f1e9104ee8977e5bee2a4b7e5aa06e733d8e680fd64d872e9119b0fa9fb5eb0665b4f2e0807d8008c31efca8bdff2a050
SSDEEP 768:vj8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd4roKkKUn1:vj8iJPNWvx76ru1jahALocdDMU1
TLSH
T15AD20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA890C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b5efb7fc0cf0b81e29600a6ae68d8921ef4f574ab784e7deb6b12f8cf49e5a7
MD5 8a9e4fd234869a088fc0354c59bb8008
SHA1 07e9557c47ea4b6aacbaaf70481b62bc7d4549a3
SHA512 ff2e389f04f2270b20e74af60a738456bb61e09e98112c6b7113b22b9eed6bc52c096cc56ab0a30a5cecafdc0219e7106b63d427c707498a34544d2216bd6e3e
SSDEEP 48:K0WoIbKxiMPyvdGxNHzvk/zQPIQVkKpBRPkFt0WwHHuInK7qgD:K0Wo4Kxi2qCUKbCcusK7qu
TLSH
T1B391244771BF02622C7F250C95A19B275B81B667B118E82B3BA840B50F27E251DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60855253-0c70-4c62-93f0-5e9ba70dc23a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\60855253-0c70-4c62-93f0-5e9ba70dc23a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 941c4a883a9cc4f195c4310a785939dbd8850fb3d8584794a44101a1fc3665a1
MD5 c9152d401ed8d3aa04f315b425d445d9
SHA1 c05841e8cf5b69729f25b91a56b6e895da7dca24
SHA512 5068c62a85dea56645ef03f8b5b0de17b26966e5ef522a521c73a6c5b79b8b33886ccd2e037cf493cfd10fa768f9ba1011e52c67d2c716e1301819cd62413e24
SSDEEP 192:uWLsNITQ8n5m1/QmiU19ADX4k03lKygF6LIVtrqGrqdZ1:DsNIT3YDfOIkIKyEnZqd/
TLSH
T1DA423A36A8785C7A9DE3A585F50732139FB880ABD7C82FA4D6DDAB0C05DE29C0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5199ea2ee83075f890b81a5db70401dd291ff2147284d761c1e8014bd0d56775
MD5 7bda201c2f88e7f87b000bb4b2e533db
SHA1 8f2dfd4978810d3b635d64818e5efe8f55f47533
SHA512 fb7a159c4de88eff4a5dd7b1d5c765f90f895276efa2b34c48b25ce9a35aac3921ccaa9d47f9c48dd27691736c49ccf6cb5eb78aabd086803f66793fb5d42802
SSDEEP 384:StNn/s3n9SfsNIS3YDfOIkIKyEnZOObjI9G6w7wu:Sj+9UYOOBTZ29Mt
TLSH
T1E1928D3558285D3B8DE359A5F54B361B9FB481BBD3C82F88D6ECAF0C05DB5AC4302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4b0a3bbefa5ab51c8e8261f60cd6834019965a9565f65d91a4dc587c36df203b
MD5 d3a0dddc53c6ddf1a66c06939da3503a
SHA1 dc747b34e40b6c367333ba6db4e3b1e1bc70e8fa
SHA512 242b075eaa8c9b5f69328b7346d676461b913c89e4594a18bcc5a29f76eb0f54b7f30231aa549e3c7fbbd92a64704c81289e4f18a427e16ba5c3486f56882e39
SSDEEP 384:OiF1tNn/s3n9SSzsN48TUNTUlIlS3YDfOIkIKyEGZOObjI9G6w7wu:lF1j+9V5wgiOOB6Z29Mt
TLSH
T17CA26B3398688A7B9EE34E95F54A32179EB581BBC6C56FD4E7DCAF0C01DB19C0302915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f02906155d38cd1e1bc0ce34057d7c4da877e904b07826fc0dcba98a7efc3cc
MD5 0c12760b9739a93efaf574d3ae35d042
SHA1 abd7a8b7ab8fbfc92aafc2878a9873ce71df23b4
SHA512 70e9699efc19bd1352da9bbea9720c254d60ca217678ffecdabe0e3a6c97a13bbfe6373f881beb33f7636d0b07fa0e5b2c583bb6b0edd1aaa69b9d68001700bc
SSDEEP 96:ZqONkfQsjpfmUTmDK5ih/cIPURHl8h4otop5A5D6BhPwivh50xy0SFYKcAxZYDMk:gONf6kDfQmiUyiqZ903lKvQiVGRxU6
TLSH
T13302F835A8786C7B8EE3AE45F48637275FA5216BEAC42F80DAE41B1C04D764C1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4da839e17f0113a97d84a205196a2a1fc80c5b1c7c4b7ee4377ceb5795d8d069
MD5 52d065ddbb727334fe1bb27170a1fdfa
SHA1 e33433242d0064fdfe9c03ae215ec4551560f55e
SHA512 40678bfe13eefb54899b151bd60119d3e31255c9a47eb8804b7f69a5c8d4e34d11a63a2137f7eceaa9078d8810245cdd82f3283727e9a5e22a6c14ae3b6f312c
SSDEEP 192:0ONR6kgQmiUyZZq4903lKygFvcRVtrqGrU6:0ONR6RCk49IKyEwZU6
TLSH
T14B123932A8686C7F5DE3A951F48332179EA58127DBC86FD4D5DC2B1C05EF59C0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 547dbbc7ef3a2c353393f1f3a1cb96e3a6860e75e912d8ba6b8ec9b76257d6a9
MD5 eabcce720f41b308021ff45bf689550f
SHA1 ed1e02a56c74f27914dd21d6b21ff6a0092ebc55
SHA512 c85a05511d28c77fadd26b49ca0e5dd6cc3d15b7621156fdaf55fe39859e392b33826902c8502b41f3bfd8645b718e1b3fb758696bafc4a54423f814e680da6d
TLSH
T1CE412959BAF91148B3B77F5A9BB6A86E447ABD372E07C45D00010D4E0677B00D9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download