hxxps://msftexperience[.]qualtrics[.]com/CP/Graphic[.]php?IM=IM_kZSGAGY46JAAKA1

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://msftexperience.qualtrics.com/CP/Graphic.php?IM=IM_kZSGAGY46JAAKA1
Sample260722-lacaessdkf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291855695183749"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E05EF26D-CCF1-4F61-A825-0CDE969455AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4464	2072	msedge.exe	86
PID 2072 wrote to memory of 1508	2072	msedge.exe	88
PID 2072 wrote to memory of 408	2072	msedge.exe	89
PID 2072 wrote to memory of 1736	2072	msedge.exe	90
PID 2072 wrote to memory of 1508	2072	msedge.exe	88
PID 2072 wrote to memory of 1508	2072	msedge.exe	88
PID 2072 wrote to memory of 1736	2072	msedge.exe	90
PID 2072 wrote to memory of 4676	2072	msedge.exe	91
PID 2072 wrote to memory of 2112	2072	msedge.exe	92
PID 2072 wrote to memory of 4676	2072	msedge.exe	91
PID 2072 wrote to memory of 4676	2072	msedge.exe	91
PID 2072 wrote to memory of 2112	2072	msedge.exe	92
PID 2072 wrote to memory of 2112	2072	msedge.exe	92
PID 2072 wrote to memory of 456	2072	msedge.exe	93
PID 2072 wrote to memory of 5068	2072	msedge.exe	94
PID 2072 wrote to memory of 456	2072	msedge.exe	93
PID 2072 wrote to memory of 456	2072	msedge.exe	93
PID 2072 wrote to memory of 5068	2072	msedge.exe	94
PID 2072 wrote to memory of 5068	2072	msedge.exe	94
PID 2072 wrote to memory of 1716	2072	msedge.exe	98
PID 2072 wrote to memory of 2692	2072	msedge.exe	99
PID 2072 wrote to memory of 1716	2072	msedge.exe	98
PID 2072 wrote to memory of 2692	2072	msedge.exe	99
PID 2072 wrote to memory of 2520	2072	msedge.exe	101
PID 2072 wrote to memory of 1044	2072	msedge.exe	115
PID 2072 wrote to memory of 1428	2072	msedge.exe	116
PID 2072 wrote to memory of 1700	2072	msedge.exe	117
PID 2072 wrote to memory of 2848	2072	msedge.exe	118
PID 2072 wrote to memory of 2848	2072	msedge.exe	118
PID 2072 wrote to memory of 3320	2072	msedge.exe	119
PID 2072 wrote to memory of 3320	2072	msedge.exe	119
PID 2072 wrote to memory of 1704	2072	msedge.exe	122
PID 2072 wrote to memory of 1704	2072	msedge.exe	122
PID 2072 wrote to memory of 224	2072	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://msftexperience.qualtrics.com/CP/Graphic.php?IM=IM_kZSGAGY46JAAKA1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2b4,0x7ffaa992c188,0x7ffaa992c194,0x7ffaa992c1a0
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10980275973866646742,14484094704668969941,262144 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,7755552334499681720,18180419123259154656,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:3
  2⤵
  - System Time Discovery
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,10972752627263792633,15949711985372232081,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12910324456969038750,5611510649148536824,2097152 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,13034255054283551494,4884573562747475896,2097152 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7380477271308462032,15719434750788844950,2097152 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,12471102438242846633,11235175119159736515,2097152 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,918811811475746132,18267692621654346674,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13093092253923121996,11757623663434423257,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16026944486979394152,14232345372082252940,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16026944486979394152,14232345372082252940,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,5311176995968801932,6489516794690637446,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6832970357441563626,17201122696114241349,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16688014976162618164,2799771132890242422,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1375096811551265226,11182115370262722377,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3701423845575582434,17196262655428128829,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=992,i,2081378454381138204,5950534412368842875,524288 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6332,i,7091753904986914494,11290867895620298298,262144 --field-trial-handle=2456,i,172767448867754519,3076278997732042442,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 740af58a73a70d2f0081140a13c3f445ff0867273394a8447b920a50e9f9cd83
MD5 847eaa3f40b2ad60757ef2f64a7f9437
SHA1 7ec42ed36dbfaf1196c2187d21716f07c5fdcd3f
SHA512 5875e1f2736305443bb9a83c2332ed64e9d4b77f2142f52688434c38297fb81d88b486618304babf64022f48c047a4bbc66f995e487266ad20e7ce7a82210c37
TLSH
T18CE07DE444CCC2AFB3406467836DD31CC681364BD2C8790A170C85CD7041240B3E37D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 092eed6f571ce7f11c953e25b95d4ac73338a440147272fbc3142b15bc88fd0c
MD5 c29c68f710b1746380470bf4934b1638
SHA1 a0ea28dbaac058b4354b3edff4e9bb6977323d2c
SHA512 4e6a7de3177ea138fdf71e5951640ad443baf887f7525db3c4085778f1124173355a24b49318faf3069c2b8cbd1a075acea49a5e34b191cd0ef6359129ebde12
TLSH
T10B619138C78309A1D7A174B290FD0F24787687E8FAF32D85D8A829346F1B351C3682C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5912a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5912a4.TMP
Size 3KB
SHA256 94ede5d4f8d5e806b3896d64a889ea8fbcfd93ed0bcbfac6006bfdfa222b2b99
MD5 58e3dac1d5a0959b637782f0c62d6542
SHA1 7dc0f06b6c2ced184484c60ec8e6e6d8b7d98a09
SHA512 0ba8b7b93a12d03e91d6fa64c54291ac803f9c6ab10c6d2743cb063e3a6369792c68a106833349d8ac3939943f3142526e031a084e5e67e55aa51b833da32bec
TLSH
T118618138C78309A5D76174B294FD0F24797687E8FAF32D85D8A829346F1B751C3682D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e9a1dd7181ddece7161893d341a94f50542ddfd845b21cacb3ef3e7f8a343035
MD5 f7c80ab62db791d5eab57fcac76c8ad0
SHA1 fa5cdfdaabf1c401bf05a478fe35ec17df0e3d21
SHA512 10adb5abb263c8faf9d9245bc3ebf9611774051f704a0db170712cc7de9ea081b18f97ea8f2c02b8ba0f6e151cf62b4ec07fa9fca81895d6be96de47e9ae6737
TLSH
T16411ADF7C3E5856E890556F0AA24AE1BCE2C0606831C7C5989D4FF2783E3465E102AAB
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a99d24f682f5fcfc410363db18ce218a02ae62c5240e7a4b6bfbc651ae6ec383
MD5 7ea09961926ee97b29f81cf74456c093
SHA1 885ddd961482c3b1337d2dcb379bb892ac7823d4
SHA512 777dcbad9738dd859eed1872d2c7f5a5c85373edeebe045dfba05a035cd3203ef7eb24b3130e60387645e0cd7b4e31fc8e873a925db5f5bb89db655992740d9e
SSDEEP 192:sxZeRmkH/fps33j7GIdpqXyHW6+WNhLx/YzvxSttZIgrJ:sxZeDH/fps33fRHb//Ic9
TLSH
T15B22C7566E28993B8CC7D219BB15BF13E6FA503295D41E48A6FC960C04E7BCD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8bcc3be851854bda6c75f39667aa9fe3ffd9e2da0fca4a13e116a2ba8b2da1fc
MD5 71234e24089c2ee035e81f602fac9fd4
SHA1 a39f6f3185b227f0911dfa1d52e56a2d7d9b312d
SHA512 414f2f3c57631a8efe2803147f2c19b2721aac855822145df3139b390cce7f1d17801ca1e034679e51e3fc8afd010b4dc8880e7a38d4e4e272bedca82872e497
SSDEEP 192:sxZeRmkH/fpsM3j7GIdpqXyHW6+WNhLx/YzvxSttZIg5mJ:sxZeDH/fpsM3fRHb//Ics
TLSH
T17422C7566E28993B9CC7D21ABB15BB13E6FA503291D41E48A6FC960C04E6BCD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4071ff4f6f4258c99b79e9192c15e7536851ab88f053a0ab116440c16e92cc53
MD5 f2c1996414a9458d148fe68fb41a9445
SHA1 5c6c638b2cbf1128cd511dc9ab9b2ee6d5d201af
SHA512 fe8ca1305b712a9fe68eb527ac297b8467b737c81fe31acc05ebbc97bb7289f76eeeb18aa75fe7d1320b3f930237234cedd534f495c7ed04e16480f31c026882
SSDEEP 192:sxZeRmkH/fpsMkj7GIdpqXyHW6+WNhLx/Yzyx2ttZIg5MJ:sxZeDH/fpsMkfRHb//5Ym
TLSH
T11632C656AE28997B9CC6D209BB15BF13E6FA503291951E48A6FC870C05E7BCD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c92516f55db1572fa6f5f9f0ba393360afc0cec503c6747ab7480acd56ce8b48
MD5 4ef008b7a6cd3634a2fb5dc9a2468eff
SHA1 4f2329b5aa57f16ef461bbae39ec5c620e8c23ae
SHA512 17395c5d4ce3767851fdb166ea7ae632050ee4fa6d25952c5877b721a3d24d15439fd63ae8d74081931271b53b3fc02e5b3a2b1f73dedb2e973aef40cedb407f
SSDEEP 768:oik7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBiroy4Y8:oik7u70WvqiEau1jai5LA3B5u8
TLSH
T1DFC2E93B740CCB7E4F801E9DAD566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 336fb28bce1a236cabe05ab52a1f3897edc7722f92eed76b9cab5e5805faf7f8
MD5 cccc3c8c56b9047ca982e373d74b4d60
SHA1 a58d11edb5081522005096be884062d1c6f93a89
SHA512 426a943cb176165f049666daefae74d37fb88c519713e1510cbded8ee99fa4171ae354855d032caeed00cba8c7d280ccd359e828d7d46409362ababdd2def496
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTTIIjK1Kc7y5CI/KT60qonMIeWG2gWd9IjI2KuTGV:KIbCKcTIwK1K6aCgKT68pWKq6
TLSH
T1DF91AE16353A0E55387E294DB6A795365F8272633024746F3FB800A11E2BE224FFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7e322cfb8daee8772bf37e62a127a05fab5a8fb20d77aa7fcf8bbcdafb274d41
MD5 e206fc15742beb54d46e49dc879be3f8
SHA1 dd057bd9692b59793a7ec5083d01c64db6612fa4
SHA512 3c94a4d96e03c1ef240fa735a13bab1c3f23f5ffb230ce6991965e475b6e09f56001cdb000215733f6dfa1e0d0d01896bf5826ce0eae0cbc9f7b34c34cdb819d
SSDEEP 384:ztNn/s3n9SfsNiAa2N2S0baQ/Mdtp5CEJrQgScjmw/V:zj+9U1Pn0phQg1jjV
TLSH
T188928C365C759D66AEA2A185F54737079FBC41B39AC42F84E6ECBF0C01DA7AC0313926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 aae6262b13199efb217ed58cc82f815254b8b1eeb1ab6aa2309ce8e246e79d05
MD5 e4b9b2d805c774ab918c2412d7d7c9fa
SHA1 07f4ea8faedec0d445c68fe2ccd5440178dc693e
SHA512 a3b65cc20b52feb549c6fd559ab22d8535d86c9e8c10dbe008eeaa2fc6f3023e722aeac7c6bd78ebb0257bfd2689d2132389623b85180f8249fc13275d4142f8
SSDEEP 384:htNn/s3n9S6zsNita2N2S0baI/Mdtp5CEJrhgScjmw/V:hj+9JOP70phhg1jjV
TLSH
T198B228F658E35936E99D5347B73E2E029EBCC163B6841A44B7D86A0CCCC62BFC312915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c32a88296815c56ddd39f788d2fbe043c53e3c311413030b2b50c5dbd4079a5e
MD5 1ade9f983d17588988e7757c4c6812cb
SHA1 4ced52b6be4d9e5d9366d10235d607f472a82f7c
SHA512 e5da5ec4471c3c514a7627ab262f9bf50444bd34fdf52d9cd247a215fddce56c468f8dc601e9b70b698e44574795364d4a77e7fce6539724a18b0c5283b8aa39
SSDEEP 384:ltNn/s3n9SfsNita2N2S0baQ/Mdtp5CEJrQgScjmw/V:lj+9UOPn0phQg1jjV
TLSH
T118928D365C759D66AE92A185F54737079FBC41B79AC82F84E6ECBF0C00DA7AC0313926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14dc1fcedd110e5a2bae25912e71dd3b12fcaa762fa6fb5cb7c912ab3e55f54b
MD5 9ae4d3477a9518bdfb2b701e58505c4a
SHA1 5dfe1e2bb7bc33a77a0d463cff055c8088f07dd7
SHA512 37537b56f9c4f02c2a351c1a89d73d1181f1947cd53b77571783c43b6e215aba70fbb031abc154a884b6ade6ef432ca10447c38d37869ebe39ee0e08b9fac9e7
SSDEEP 192:MONY64BAQmiUyX1qW5GBPKK7+FdG29poaDBUxU6:MONY6eAo4WLdtpR0U6
TLSH
T114021A396C786C7B9EB2AE45F58637176FE8103BE6841B44E6E86B1C01D775C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff1d3f2d1bf0123e97ea361d65a83fc09489a1c5ebdb3b299edbca45d9e49144
MD5 b7595c730f5d95ac97966f3f68856c7a
SHA1 ccd5f0f7e21024633230308166c3e91cdb3645f1
SHA512 9291c0a6dafee1e78598033eec865ddf6d6819bd2f409be2807b0a44dd9c5d57f3bdc87737b8ecc9302a7913d5a888abb3cb23a466e029b3c59a616e15ee1e50
SSDEEP 192:SONNJ64BSQmiUyQqd5GBPKK7+FdG29p9hFC1SJrCWw2qcU6:SONL6eOYdLdtp5CEJrggU6
TLSH
T129120A35AC74AC2B6D92B581F48736035FE84127EA896F54F6DC7B1C01EB7AC1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3904897-3c2f-4bcd-a9e2-93b3cf7df08a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f3904897-3c2f-4bcd-a9e2-93b3cf7df08a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 67ded0d88213c247095f49f3c29c916177377866df5600b5c95737ddf20643a0
MD5 5a72c9f06a54d1231c8627c94fa9a975
SHA1 f9da73bf3fa79f96c5fd452c3b4806b65f6b18e5
SHA512 87eb2f5b648ca12e9ca6e87aeab83b7896ce93204bf40a4e9a204c11753caeb4fd1d7d1ce612a7e7a1f72bbc394bbf023f5767c26895eb117981dfa6852aaa16
TLSH
T1BE411898B6FA1108B3B77E179BF7A86D487AB9773E0AD45D10010E4F0A62B00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download