b81666e7a1bae1561ea08c1ac77dbc87b9b21a1707fc264a9ef9c6efa45c7351

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
constellationart.html
Size 831B
Sample260723-anyvssec87
SHA256 b81666e7a1bae1561ea08c1ac77dbc87b9b21a1707fc264a9ef9c6efa45c7351
MD5 f602c7d0686797709ab345ac24a1dc92
SHA1 d95ad36c5225b763a68b1c1df0d2f8cc435d14b1
SHA512 b1050b3eec382a04989626c79e18724bd5fc6d9c284fbee17abeb236d801060ec82393765fabe916deb8e3050298c8a471a695495f0631052303b027336497dd
TLSH
T1D101461F076301060137F1242FBBE31450A2D5078449D7CC39AFA60BEFAAA07D8E12DD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292399931244678"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{471F5538-6189-48BD-A2EF-B6FFEFCFB920}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2356	1504	msedge.exe	84
PID 1504 wrote to memory of 4380	1504	msedge.exe	86
PID 1504 wrote to memory of 2116	1504	msedge.exe	87
PID 1504 wrote to memory of 2116	1504	msedge.exe	87
PID 1504 wrote to memory of 2116	1504	msedge.exe	87
PID 1504 wrote to memory of 2552	1504	msedge.exe	88
PID 1504 wrote to memory of 2552	1504	msedge.exe	88
PID 1504 wrote to memory of 768	1504	msedge.exe	89
PID 1504 wrote to memory of 768	1504	msedge.exe	89
PID 1504 wrote to memory of 768	1504	msedge.exe	89
PID 1504 wrote to memory of 4536	1504	msedge.exe	90
PID 1504 wrote to memory of 4536	1504	msedge.exe	90
PID 1504 wrote to memory of 4536	1504	msedge.exe	90
PID 1504 wrote to memory of 228	1504	msedge.exe	91
PID 1504 wrote to memory of 228	1504	msedge.exe	91
PID 1504 wrote to memory of 228	1504	msedge.exe	91
PID 1504 wrote to memory of 260	1504	msedge.exe	92
PID 1504 wrote to memory of 260	1504	msedge.exe	92
PID 1504 wrote to memory of 260	1504	msedge.exe	92
PID 1504 wrote to memory of 5068	1504	msedge.exe	93
PID 1504 wrote to memory of 5068	1504	msedge.exe	93
PID 1504 wrote to memory of 5068	1504	msedge.exe	93
PID 1504 wrote to memory of 4440	1504	msedge.exe	98
PID 1504 wrote to memory of 4440	1504	msedge.exe	98
PID 1504 wrote to memory of 3312	1504	msedge.exe	99
PID 1504 wrote to memory of 3312	1504	msedge.exe	99
PID 1504 wrote to memory of 3324	1504	msedge.exe	101
PID 1504 wrote to memory of 2644	1504	msedge.exe	104
PID 1504 wrote to memory of 4132	1504	msedge.exe	105
PID 1504 wrote to memory of 1556	1504	msedge.exe	106
PID 1504 wrote to memory of 4944	1504	msedge.exe	113
PID 1504 wrote to memory of 4944	1504	msedge.exe	113
PID 1504 wrote to memory of 2824	1504	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\constellationart.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8ab63c188,0x7ff8ab63c194,0x7ff8ab63c1a0
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,1617372028302629312,2157054764898675480,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,1690044604796674123,245389051385507663,262144 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,10531543717032177834,14146401246620849169,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,2029553328119131567,15971127319562303588,2097152 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12638567945634436370,16604957442911266081,2097152 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6738675841802125601,9812272001172672961,2097152 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12281478088691019625,14351646813377523032,2097152 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,11271004069514526966,10193178210731860558,2097152 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,12991625650504085893,11665112225958294060,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14946097420462523449,18006204724775347773,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12082017677589008160,15181988250162327023,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12082017677589008160,15181988250162327023,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7394016051445436112,14914204426903118100,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,5675073048115653275,6449013447756555422,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,16377376035002447644,5291855211699573789,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9042162200461592574,1460132031450404198,524288 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5916,i,859673475641134432,9737286495323399687,262144 --field-trial-handle=2344,i,3520787680589820271,10947268440582690447,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3a1bb535f4f31d959ac1e61bdf8181adbd8af6b3eb1b5c1655eb3d1be73ced4
MD5 62ff32c3d8ca7bf0d6687a313cb407a0
SHA1 f0953d7276be3e95d2354b463920ce02750562c7
SHA512 b0be190ce3370ff51300de3d6b6718247475ff43348b83adf00f1bdbee32c02355c9fe2abb11d0091738c1c5381893dcf116d11d7ab9227434c35c3ffbdf144a
TLSH
T11171301C222A7593F3131134DDD1E6DFB8B2819E45776F1D0088D7FEAA1A715816F40E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59405b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59405b.TMP
Size 3KB
SHA256 254fb5e537cb94c4662added51b520de44d0cde5c0d75f02ca304bf3e0706e38
MD5 c0c358d50e240a4842ccdf35c27a515d
SHA1 ced3839e6d2cf84c30225eedc8a697544b7ac6a2
SHA512 37ba8fe702a3c902c095152dc69de1a0637c64e5a62542f02fcfdfc3c8824d966141791de8f166cb35c924ab9539e5e508e788ce1e758d4d6d17df913d825b8d
TLSH
T1A971301C222A7593F3131134DDD1E6DFB8B2809E44776F1D0488D7FEAA1AB15816F50E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3974c484e129427a265d83bf6a8278ee5890e62432819aa873a9277c1eae11e0
MD5 fe902006fc899508b6c6530e6680670c
SHA1 cd880c19fb8ea0cfb55548286e5e4eab4fa0426a
SHA512 a8755ea73b6e8d73a28a4efd3dcd454990b28a535df032b5885fc9590283955e32528906369bf3035501555829cd8476535a02d6982d810670feae63c94bfbfc
TLSH
T19B115BF7C3D5856E891156F06A24EE2BDE2D0606822C7C2985D4EF1B93E3465D10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 abe21b70489203eeaffc2c712c82f2a0b6d54a0e21ec926c87601b689f5f76f6
MD5 c5ce2eb8289d5e65ff2a4ce5efa0410c
SHA1 d4947e9d34d4ccf6838cad6a2d1ab9ea26a48a98
SHA512 768f108c78794ae64a282f22ea10ee0f21aea687defed8fc26d1dc8775bc34ab28c0a55b4c13d19b81e5d31963fa7df16d9f8f2e8fa17b559a6a5a6a6a1e1737
SSDEEP 192:sxZrPRHyM/jK1Ml8Mkf/fms4GfIdpdaHW6+WNGY4w6PeVIgrJ:sxZrPdMf/fms4GQgHbGk9
TLSH
T1EA42D7166A3459B7CCDBD309FA557F53D6F90472E2900E84A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d96798d017197c94d679ab89e32ca9507a47932f1785cbdc47f055f9fcb578c2
MD5 b4f6a849ee2d521dac0b55ff87021538
SHA1 64d4e85f7bff3a04ab2bd23897665be9e6b9ac9c
SHA512 5bcf87583c458a80e4d4c20f892bc3232a7bf357824b13a02cccf2a92aab3d302ccf9457dc7a0d315f6fb2c0851c17441269d9d97dcb1da667c6dcbc696b959d
SSDEEP 192:sxZrPRHyM/jK1Ml8UQOkf/fmsnhfIdpHaHW6+WNGY4ubPEVIg5KJ:sxZrPdqlf/fmsnhQ6HbGv8
TLSH
T15D52C616AA3459B7CCDBD309F9517F53E6F9147292500E84A9FCDB0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5b7242105cfc6cea515279f3e393a8fbcb20373b174b136336a15ca08859594f
MD5 ef05538ab2c63fb206ed6f04ebda5a8b
SHA1 2fa0d427a02c0bd576097f9698327d355afa3be1
SHA512 eb957a0ee3e32c3ff152293b03959d8bd2123ee08dee04c1a90ac5f1bea5201931794d88903811fb5aff7c002a740a91f57a1c8562e047d84ca950e4319a4ee4
SSDEEP 768:pB8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdyroFkBUn8:pB8iJPNWvx76ru1jahALocdp0U8
TLSH
T1B1D20A3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e536ada4a84f2c061551dcb9539a83b2ea88b9e1da99ee3e9876f800feb9dcc3
MD5 b286752a13afe9fb7e7ee746b892a699
SHA1 e713608e7bd607965ee921e951151a99e361f4ac
SHA512 c06becde539794af1574e6295dd8b6986a7ae347e472872f9497b3aa06e0288321a2610c9702fc6e9f40aba6aad58b51f191ecd9e78703eed860cf77a7b78bb8
SSDEEP 48:KSVFVAVRVlVDVbVrV2dVbVeV9IUVlV2KzVTrV/V2vVNVmOVmVPVFVnyJcIPKFGc5:KMEQKV6uKcAKFG2UYK5CyGz
TLSH
T17A913A3171BB22013C3E6908AAA1AA57578371677014E4AF7FD90072CE66E6B0DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91851bfa-2b27-474d-844f-6207ec387433.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\91851bfa-2b27-474d-844f-6207ec387433.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 707f736124917afa676f529d169db7ccf0797d84ffba01bbd62b2db94b2c1032
MD5 68b5a2d6d62ee1f6217b63f2a5ef9ec5
SHA1 971fbc76f3c8cbb671ba3515db364bd9fa4399d1
SHA512 2cccae885de7d82d6e55a1a27e39b38903c374d0fa976abddd67cd628745f336f464671ce475b227874442b3829ba567fcfdaf61bd15034f6764644e574adb40
SSDEEP 192:ugLsNZuQi6jm+YQmiU1131lY4k03ajzorh/XHN0CLIQqcU8:vsNZuH66H3nkD8h/Xt0vCU8
TLSH
T10D32193668786C7A5EE3A545B08637136FE5402BDBC82FD4D6ED1B0C05CF69C131E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 03e5d629b346ef819093830599e864de7a1e5967361d7b56ea8da50c66906822
MD5 d22ac35927eb6e9aa50d27d49bd7d39f
SHA1 9d6726a66ba4c9a4bbdf88bd5f4a3faaf89d591d
SHA512 6b6ddcde1754f422c3c9648861de0d84c926e6ad1bcac7404a8a03ddadf671da335d55a89b6b665d856f32ac6e6158cbfa889b2e01066f5a9d2f39ef7330993c
SSDEEP 384:qiFHzsNU8TUNTUlIljH66H3nkD8h/Xt0aCOObjI9G6w7meF:hFTjwgF6S3BC29Mr
TLSH
T162825C3758688D7A9EB39E45F08A32179FF1416BCBD86BD4E7D95B0C01CB19C030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8f0255eaa09f9d537edb03dde3c16a69f6b331490853b861582f8e60b1da3fcf
MD5 03b8c1c541a51f9d1831e86fcd8a2d57
SHA1 32d33a9c504c1d1552c77199091c4d1b62b52297
SHA512 74fa9fa5aae1848b8207a56382581662874aa4b166d076df365fbf67a8f37ccd18c28ffb75e73b3abf407ac830209a48cb483545b0039844328567eab93027a4
SSDEEP 384:xsNZjH66H3nkD8h/Xt0vCOObjI9G6w7meF:x06S3UC29Mr
TLSH
T13A727D3AA8785D764EA3E555F08A36176FE4802BDBCC1FC4E5ED5B0C05CB5AC430A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef0ca75f9aa937377e681d0ccb67ac41be239405cd4aed24ed68f0b9bc0fac01
MD5 6fc2a57bd1b2b29d874b05991f18e758
SHA1 4f709bd56cfdf38c6df52f3c761c4822df2f79cb
SHA512 3127ae22f4bf8c081ed4769549408e74e5ce76913dc6d574284b2f2fde4a244ce5ea8d81646792cb79109ce90ab1c6e8f6c3da64440660acd169af6b6f27b1ae
SSDEEP 192:gONl6kDfQmiUy1u1eZ903ajzorhfQillVVU6:gONl6gh6Z9D8hnfXU6
TLSH
T17C02D83968782CAB9EF3AE49F48637175FA5112BEAD52FC4DAE81B1C00D764C1346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0efca1219416bba6b46ee13fd95e32c71042d9c5a5deb1de250387e6fd4bc54f
MD5 b0d01b0c6934bfd19774efd7ec4e1b40
SHA1 7b4975648c2d91c9ae797302395ec3e8010b7e05
SHA512 7f549a004d5b7d16abd47d40a5952acf2bbd36aec7d10d1fdb8ad04ae9d50d2fae490c4f5eedf1f28db9af5bf0b389679ccb0b57e6d2d52125d20389833e6100
SSDEEP 192:iONM6kpQmiUy1q1eV903ajzorh/XHN0dcRQqcU6:iONM6C8V9D8h/Xt0yCU6
TLSH
T1A3122936A4B86CAB5EE3A945B08732176FA54127EBC92FD5D9EC1B0C04DF25C030A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5a25baed1d5206a0ea05d9d9bdaf997d45719a0248ba301e442c6afa69045773
MD5 85c54b7669a4a0e9d63d42db32ec4003
SHA1 0eed5cd6bc60ce9c585776907539e3cdd00d75fe
SHA512 fada598bd31bcfe681969d3043b9ed15c6f6eb73940fa9c70555dc105f66b34725526792802a6bf4d1fd3a0d6deebbbc8ad95f235b2b34481b04599b3cc75429
SSDEEP 384:qiFHzsN78TUNTUlIljH66H3nkD8h/Xt0OCOObjI9G6w7meF:hFTewgF6S3/C29Mr
TLSH
T129825C3758A88D7A9EB39E45F08A32179FF1406BCB986FD4E7D95B0C01CB19C030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2336cd32409111b3a6edfcc8573591982f7fc29c0763065680adf2f5c409e172
MD5 3d33e69a6b48aa1e4a54376d52e6ade9
SHA1 580c31d38bfcd38d590da4dd708bcc7868b1b5de
SHA512 5e6d5c28f1b2a668640c9e642a428b19c63e15274b627929ccc8d01e9826e7372d5f50946dd1964cfd65f85f6a9330a5751dfcfb3854b8e2fdb29619dbe857b7
TLSH
T1F541D658B6E91148B3B76F5A9BF6A86D887EBC362E06D45D00110D4F0A62A40D972733
MD5 SHA1 SHA512 TLSH

Submit Download