5dadaaf70eeb3acf8f599b0fb3f8e4829099b5658c3cbbded391dad5d0c92a74

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NewDoc.html
Size 1KB
Sample260722-pgwt7avara
SHA256 5dadaaf70eeb3acf8f599b0fb3f8e4829099b5658c3cbbded391dad5d0c92a74
MD5 8e5eb5de86dbb2b920833e56b01fcfa7
SHA1 5d7dba057d0276e6ca37d603bd5b808dda7695bd
SHA512 307be647cae6546248a5bd9e52b7951a3c9c150d48f0e9e542acb1329142276c2ec0b51d01e43867ba919b9ca06ee239f3c5fc2a2cc7b43ee391ea1dcde416c1
TLSH
T13D313EDB92F22005E90758A92B9237081E349147A287CCFE35ED4744CF8C8A0CBA779D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291963218466340"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2C8D1708-C162-4BC6-BE27-684F4BE7C8BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2172	1700	msedge.exe	85
PID 1700 wrote to memory of 2164	1700	msedge.exe	86
PID 1700 wrote to memory of 4168	1700	msedge.exe	87
PID 1700 wrote to memory of 4168	1700	msedge.exe	87
PID 1700 wrote to memory of 4168	1700	msedge.exe	87
PID 1700 wrote to memory of 1568	1700	msedge.exe	88
PID 1700 wrote to memory of 1568	1700	msedge.exe	88
PID 1700 wrote to memory of 2200	1700	msedge.exe	90
PID 1700 wrote to memory of 2200	1700	msedge.exe	90
PID 1700 wrote to memory of 4396	1700	msedge.exe	91
PID 1700 wrote to memory of 2200	1700	msedge.exe	90
PID 1700 wrote to memory of 4396	1700	msedge.exe	91
PID 1700 wrote to memory of 4396	1700	msedge.exe	91
PID 1700 wrote to memory of 2528	1700	msedge.exe	92
PID 1700 wrote to memory of 2528	1700	msedge.exe	92
PID 1700 wrote to memory of 2528	1700	msedge.exe	92
PID 1700 wrote to memory of 4736	1700	msedge.exe	93
PID 1700 wrote to memory of 4736	1700	msedge.exe	93
PID 1700 wrote to memory of 4736	1700	msedge.exe	93
PID 1700 wrote to memory of 5032	1700	msedge.exe	99
PID 1700 wrote to memory of 4556	1700	msedge.exe	100
PID 1700 wrote to memory of 5032	1700	msedge.exe	99
PID 1700 wrote to memory of 4556	1700	msedge.exe	100
PID 1700 wrote to memory of 2276	1700	msedge.exe	102
PID 1700 wrote to memory of 4644	1700	msedge.exe	114
PID 1700 wrote to memory of 4896	1700	msedge.exe	115
PID 1700 wrote to memory of 3532	1700	msedge.exe	116
PID 1700 wrote to memory of 4736	1700	msedge.exe	122
PID 1700 wrote to memory of 4736	1700	msedge.exe	122
PID 1700 wrote to memory of 2148	1700	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NewDoc.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9f3dcc188,0x7ff9f3dcc194,0x7ff9f3dcc1a0
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,11113571304560719041,15652958398199893114,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6370961842872147544,1621803203271340260,262144 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,6002598214992809840,11514974120167760644,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11771672203790158181,1183110928754132285,2097152 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,16183414167761371961,1304768654622945414,2097152 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15563670834875445628,12330757861265364601,2097152 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14127990563466061820,12111937574471430477,2097152 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,3685033056801765717,1017593087533360969,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7242174811020060666,14162431619514990725,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,178329069816385840,5475803508504801898,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,178329069816385840,5475803508504801898,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,4412095578818685109,954319723507479632,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,1984823701185662971,2530921193953781096,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,1284212914110750816,7451941415972146591,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,723673086123638123,12779819298934164200,524288 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,2152637557049712247,12624828192711067298,262144 --field-trial-handle=2220,i,3165968209916943215,13065283630652091911,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5184baf78a9c394b1b69ab4a07ed43f03ac66c6089e06c2b4e935e0339a182ad
MD5 cf1a5b7bf2fd537c4e8fa27ef76a154e
SHA1 de8e296be1d2d26c12f8a5a44fda0af16f266be4
SHA512 2542c7988b1057a3d26a827c7ec8fb4f8ad813162d6ddcd514c1ef39bd2d1249033b5e7fc49d45c540818f4d22c14be2715b1346e046e2820477cd545083b1aa
TLSH
T1D8515D24C3520D81EB911233C0D02764367AD6E83BD76F94F28868F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f289.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f289.TMP
Size 2KB
SHA256 1afcc839a17a9018219b359c99c3b266f40d6069dcc4c09d9839971e6ea26f57
MD5 a0da1556ce8016f2a3a0b1b4c90bc2d6
SHA1 b5da86d9b03765e20b1a164e7e79ec342e4918c2
SHA512 4e4a0e6e7337286c88c4a855362d2fa12d5ce3a86d2eb1259e3de376ff3044afd29cf1982b39d6117d27d3fb915e0d9b4c55af6aeb0eb5610545747ebe9efbe9
TLSH
T102514C24C3520D81EB911233D0D02754367AD6983BC76F94F29858F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 874eeec9af0a745c29295db67d4d83b98ed9ff68694fc2d1868dfe13da7338d0
MD5 bfdad05a3471b8ee9c120d8ab95eec4f
SHA1 03ec48952977d7113cca452cc540270fbebee3df
SHA512 5d7663e673b6e60376898d87cbaa5339f5ebeda4c8b39f39c8e24aacaa474b01f22e957138f95bef4df7009e154dfc4a57f87f0328264bf67dd2a21d16b1d8c9
TLSH
T1FD11BAF7C3D5856E891116F06A28AE2BCE2D0602832C3C5999D4FF2B83E3075E10256B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2c316f504e2488e455ceef4daaba8841c241f1d355ee4f4653ee5586102d45ad
MD5 905057a7126c4b36097e1ce34bb011c4
SHA1 41597829d1e6bb6919e2313f2f22a9edde2f8337
SHA512 3e0aad4d7587be6f5ad12f95f08b9c34b1f2110e155f09a3f8a99b4ebbd268ca202eddc19d313386a66e0c82c568166349019c219308213d84e9d7e641863f68
SSDEEP 192:sxZRRQyM/jK1Ml8UQpkU/fus2eSECGIdpHuHW6+WNGY9IsfarrIg5WJ:sxZRyqqU/fus6E0OHbGTw
TLSH
T1B952E716AA349977DCDBD20ABA41BF53D6F54472D2901E44A9FCCA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1e8196c1964055a262eea2b987beed95360aa63280806aeca9031b7f84cc2e07
MD5 fdfab850eb8fb663a3a265ca300dcc12
SHA1 81893b525cc7f0459f9c03ab002280e8e423595a
SHA512 76f5dcd8688e31d0f5885104e779fd781f33d97e55b765f5197739b281ac5bf67b5ee2f7aaa01d749bfec1aeb4b905787f8a3c966f0616d2158e2d5717545aa9
SSDEEP 192:sxZRRQyM/jK1Ml8MkU/fusHS8CGIdpduHW6+WNGY9IKj2rIgrJ:sxZRyMU/fusy80AHbGn9
TLSH
T11042F8166A34997BDCCBD209FA55BF53D6F90472D2901E44A9FCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 15d1e83da360fa4d3104c3b4f11d983d277639f8c79d1b9ca57960adabd7cdf2
MD5 7024873e019cf67012bf1dff4b457981
SHA1 c87691884b7e593de0b1a083f827baabb3702c57
SHA512 8f19ad2a75b954d798064bf7931a44908c04847cef223d045744bca374637b0669d56d25de03f6bb4eb30eb695e8c2324b00f56bb4e54a7a49057ed9899ac5a8
SSDEEP 768:Svcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNhrocg6n:Svcv21wWvu+Z+u1jaeFLeRNac3
TLSH
T189D21B2B280CCB7E4F841E9CED2A6F9A6DD801CB57988D5047FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 69e025badf7aa8f834398832d5217a8d4b11e1ae449e698e7c428dbb6f2a08c4
MD5 48ac4bc64ff3e5110e5d81efa7605372
SHA1 ffc9cab8420a8609ba439ebbe469245699aa9a9e
SHA512 58b3222924b6a5130fd70246bc5162a30ed4825fdd28bc6e16da3b365560aa78b6e7637456779fcd2875cac5a99c1eb328008dd952d34ca5edea4d65cbc60e1c
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFe9:mTfLRl7O
TLSH
T13BC15316B1374642287E7808A79285378F4631E7781CB4AF7FB800A68E6BE115DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e845c56869764a11be22ef331f21e38ef2dcf70d4a84eb94a72253edc8b41a7e
MD5 31d0fc2fbd2ca668cf85b14984f51941
SHA1 95c934ada50333abba8b26015457fc1c3857a4c8
SHA512 40ca722e4143a336ea35a88c6535313c412ef53c41ecf8b84d349b0a22e6dfebdfa6cb5d48aed21f972ceca49e5a0b734b629ed84e47bcbf7c0742ec8f05c902
SSDEEP 384:k9tNn/s3n9SWIzsNOwCPziCYoe+CzO4eyfwvScjmwbf:Sj+9J0Jc7rOXyfwv1j3f
TLSH
T1CB927C37B9249C676AE29596F94737178FA851A3D6C13F80C9DCBF0D01CB6AC1307929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5fbb6a486cac055a132ffc3ca3e5d261d0cbcaf636178987e7ee9a7e161c153f
MD5 c12e47c21806506077007908b53a3fc5
SHA1 ef2ee2cd61436060affb3ac8e52d87cc1ca4f2bd
SHA512 8ad1668fef70b3e01c27f4dc4c50e3da9f839ace9e73787ad63238a444236f848d1aa18b2773e1757d10c11b9ea83bc73e11aad765744d0988409473119035d8
SSDEEP 192:JONW6v+YLNQmiUyzpZh+CGSO49oQusvtU6:JONW6vz/YZh+CzO4eG1U6
TLSH
T18E02D9357D285CBB9FE2AE45F58737175FA82177E9912F40D9E82F1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5fb81082871c3d1e9634e4a164312ca70829826b5d06527d347c15b8a1f503b6
MD5 27dab75c504219710ab2790ef8b6a4bd
SHA1 bc07c2efbac9a665111b211a503fac03814ee58f
SHA512 f6df55f7b30ac4183d1121c1443d7d84e7bd4ab477b3c507ab4ed63d90de49ca429b480884b12e9df8be35581b326e208c2e542d5b9b272870c1ad4880392e11
SSDEEP 192:KONFV6v+YLAQmiUyspYh+CGSO49oyflCHlq+U6:KONH6vz8tYh+CzO4eyfyvU6
TLSH
T1A6122C36B9385C7B5EE2A585F48736138FA95167EA857F80D5DC3F0C02DF69C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8f4c4981a2483cf4d7d5ed86455afa715bb7964aaf5ecf425b3bcde820e86b23
MD5 1f3d2017bfe2465b62e506ebe51a7d06
SHA1 e9f7272d743b36ac93fdd59847db7f271fd522f8
SHA512 956837a810d95b44188f981d8d7060881431ac166e45f6e26d3b52bd5cecb71982f0400a1f59208a6ee0d3807b6d593bb850139f4ec95613b61a5746968452ae
SSDEEP 384:9tNn/s3n9SfsNOFCPziCYoe+CzO4eyfRvScjmwbf:9j+9U4c7rOXyfRv1j3f
TLSH
T139928D37B9345CA66EA2919AF94737178FA851A3D5C13F80C9ECBF0D01CB6AC1307929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7eff90cd94f2825da33c91468b7c98007930c8fb6b4ef8ba915be31143140da8
MD5 dcc1730c75675bdca1a3a2099856ef2e
SHA1 2c44a8d0ea5d0e19c77f5f6e7e8c168f98addd7b
SHA512 f5339b8015f5402857d2d89f27343f0a373f49362bd399b27305f3d82a7be743cb5d3e3b0b2252d07565a5b35d614909a270a2fad5b2e0b3bdc9708300e5035a
SSDEEP 384:stNn/s3n9SfsNOwCPziCYoe+CzO4eyfRvScjmwbf:sj+9UJc7rOXyfRv1j3f
TLSH
T1AC928D37B9345C666EA2959AF94737178FA850A3D6C13F80C9ECBF0D01CB6AC1307929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7eff4c8-1e27-4b64-bd81-1aa3511387bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7eff4c8-1e27-4b64-bd81-1aa3511387bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea8b0a6792c7d8535727cbbd1248f068c3bf2ec192a49138c46dd66fabb4b0ce
MD5 a883cb6c2bdb5a8145e0d25087d2c6ef
SHA1 f013dac29014f38170571ece4cec060a17d46fd7
SHA512 0dcbe198f19671036e4600f0b6f01c5dac702f2a8599b93d98843d37f9ca055d7d7765f014da5634ea1f37d6f97e07f9c244b3f859b1687886137fec2707c055
TLSH
T1E3412A58AAED1048B3B76F5A9BF6A86E447F78772F06D45E10110E4F0B62B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download