3b48c89ce71fe52b3dd20f511a490331f6c7d1dced9ff33acb1d0a4bbc7b72bf

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
open-sans-regular.html
Size 316B
Sample260724-g1k8sstdja
SHA256 3b48c89ce71fe52b3dd20f511a490331f6c7d1dced9ff33acb1d0a4bbc7b72bf
MD5 5d62bcc50e29b03a11ee15fcf3a4e50f
SHA1 574732a5b77a07bf231b9678aed1fc9ae1cf2dcd
SHA512 1b8186300c328d8255e164e68930b4b82f84bb612cbdd29e60f2fd56a90a8d2ed0dace5f31cd31a4de883b142905d2f46675b75f5c398820cbc4734dc28a7352
TLSH
T15AE07D8F506663874851696039C053C2738C13FB647543D87AC7E447A14857DC8991C9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293473902307434"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{C9183559-81B7-47F3-90B9-3FB0F1A6AC4F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4504	1600	msedge.exe	85
PID 1600 wrote to memory of 1584	1600	msedge.exe	86
PID 1600 wrote to memory of 552	1600	msedge.exe	87
PID 1600 wrote to memory of 552	1600	msedge.exe	87
PID 1600 wrote to memory of 552	1600	msedge.exe	87
PID 1600 wrote to memory of 4712	1600	msedge.exe	88
PID 1600 wrote to memory of 4712	1600	msedge.exe	88
PID 1600 wrote to memory of 548	1600	msedge.exe	90
PID 1600 wrote to memory of 4464	1600	msedge.exe	91
PID 1600 wrote to memory of 548	1600	msedge.exe	90
PID 1600 wrote to memory of 548	1600	msedge.exe	90
PID 1600 wrote to memory of 4464	1600	msedge.exe	91
PID 1600 wrote to memory of 4464	1600	msedge.exe	91
PID 1600 wrote to memory of 2692	1600	msedge.exe	92
PID 1600 wrote to memory of 4264	1600	msedge.exe	93
PID 1600 wrote to memory of 2692	1600	msedge.exe	92
PID 1600 wrote to memory of 2692	1600	msedge.exe	92
PID 1600 wrote to memory of 4264	1600	msedge.exe	93
PID 1600 wrote to memory of 4264	1600	msedge.exe	93
PID 1600 wrote to memory of 5016	1600	msedge.exe	96
PID 1600 wrote to memory of 532	1600	msedge.exe	97
PID 1600 wrote to memory of 5016	1600	msedge.exe	96
PID 1600 wrote to memory of 532	1600	msedge.exe	97
PID 1600 wrote to memory of 2900	1600	msedge.exe	100
PID 1600 wrote to memory of 5040	1600	msedge.exe	112
PID 1600 wrote to memory of 4872	1600	msedge.exe	113
PID 1600 wrote to memory of 4472	1600	msedge.exe	114
PID 1600 wrote to memory of 3744	1600	msedge.exe	116
PID 1600 wrote to memory of 3744	1600	msedge.exe	116
PID 1600 wrote to memory of 1120	1600	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open-sans-regular.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,5749870665781515293,13487325461972012954,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6906479900165901095,9106456190646075143,262144 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,14586828998932070121,9142814164049227415,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,453626259850927512,17798013209189056997,2097152 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,7798777444147077310,16509892085464605647,2097152 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7318264139443794076,2230404436162568104,2097152 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,12459296146035388723,18027660725651029955,2097152 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11990272483843291349,16241711450771159721,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6190408359871548264,17761935732945761823,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10711773776846989673,15940019857490590806,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10711773776846989673,15940019857490590806,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,8733561353269385235,7979366564872561891,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,3918765736795088249,6327555830677206510,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,17556416780965896997,502916313930348325,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16586095271712456705,1976409504281778227,524288 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,10771450132379876864,7980313376808269738,262144 --field-trial-handle=2384,i,15783472413778641982,9873725111106483208,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6fc4ce4e7ef25d5e949d31832a71006dd72655ce09c20722cbe992892e018b9
MD5 9a1b8532ce8e5464deaff207f02874b8
SHA1 0be63baf7bc4a39c280b4a9190a69a5cd4b319e8
SHA512 242b5ceb2034b62f83e1f279330efead6472839486f823f25590fc7ab183e064df5cfdc507f00fcd143028e00284367e802f56a7c30e3b25e9b8479ca139528f
TLSH
T16E71533933508158E3220872DFD916EB763685E7FCAB3E8111F2BC749521F728666B4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58968e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58968e.TMP
Size 3KB
SHA256 951b06baf175ece188dc8d5b7e4f05761e6a901381a665903101554f0f7db3a3
MD5 ab390d0511262f12150a4d0dbc35e8d3
SHA1 0ab1459be8a2052f15de042e445237413dfbb8b1
SHA512 76db7643441dfe59c7dc24d29de56683879c9e1b864f3aac6a0113cbe8f3b9050f138433478e4aba1d1cf624023b4da477be2d51182124264ee45624d110ded8
TLSH
T17271533937108058E3220872DFD916EB763685E7FCAB3E8151F2BC74A521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ab0d646ee2d76946f8258d584d1daf2a365db362659ce3852e0923bd8a25c10c
MD5 20934d9f9091e532131bb5e7dd591541
SHA1 2852f2f99f3d2bd40886be23aba42531375f73ac
SHA512 f7fd54353e62a53e310fa2ce4cf18153360e1ed2f392b3102efa42d77381934cb4423c6219b280d976abe1454bf2fe002bf3f18c371671f2a63292e0b5896fd1
TLSH
T144115BB3C3D5856E890116F06A24AE1BDE1E0606832C7C19C9D4EF5793E3475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8dbd7f4cf32aee764622fced379c7062f1149eb6348f4d3dc129d7761f9a2fe4
MD5 9e015a226b0754239ac03c64bb98ca4a
SHA1 a6b723f13a91a402df74c81b6009533da9e792bc
SHA512 8d8088f173e24fefbdd64dc65af91fb61f1b5917db02073fc475d7ef4fa8ce395c4b5d4eeca7c3e45f7f5392fbaa2b42877b910a45ff350940e2e170a4fba959
SSDEEP 192:sxZ6RrkU/fusg7EVqIdpdwHW6+WNGYvrtjAxZxIgrJ:sxZ6SU/fusg74GHbGOs9
TLSH
T15522B7166E28A93B8CC7E21EBB15BF53D6F9503291D52E48E6FC960C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1ba3a9a58e45ca7e034ca794e32dca042d4d9e8e57710e4e1bb03e1592e8d3a8
MD5 be31be10893ed582cceef80f01c466b3
SHA1 eb776d293907a2c39ce54c77f66c75f548846109
SHA512 84776c0c5e604387257a11fc9203dcdd5b64cd4be6e222dd1072e2c8618a581ac448b7eec5aeb7f116fbdb76c6048cc299c7fed67da8bde85e341c6253303592
SSDEEP 192:sxZ6RrkU/fusynEVqIdpdwHW6+WNGYvQ3jAxZxIg5+J:sxZ6SU/fusyn4GHbGbsA
TLSH
T16A22C7166E28997B8CC7E25DBB15BF53E6F9507291911E48A6FCD60C04E7ACD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5659aec1f0a8df7f29c59db53ec9c5fbf801b7813a4ac99f6a56aaa093b268cb
MD5 283c91d82c4d04c81376e920c3bede8e
SHA1 94ea5d4a372d296b06cb66386e90e753e4ac132f
SHA512 7e3f5b6e985f57c6086056a5ef879e93e44e1d7bc00761665f6a09ccd3d1513aca1531654b585fec073d74021c5d8490d4560ea71dcc9118f30464a3cfc85c49
SSDEEP 192:sxZ6RrkU/fusy7EVqIdpdwHW6+WNGYvrtjAxZxIg5MJ:sxZ6SU/fusy74GHbGOsC
TLSH
T1F322C7166E28993B8CCAD21EFB15BF53D6F9507291D42E48EAFC960C04E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 17662e70a67122b00840be46d46dd126d627072ff36f72eff07fb2cd9debf402
MD5 3db47e8a2d3e2b07daaf8cd3e1b6f641
SHA1 06157a209e7dab125e006b7874b65d619b4eca03
SHA512 be9f1970d5f793c57c8517590cbaacbb2ca681c41fe309cd7db0f07d22a9bcc6a32bbfbe500382a9bab3a37ddec7340d3f179ded6c6c95212503443da0218da7
SSDEEP 768:cXee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbjroP:cXee3rxWvhffnu1jatcL88bQP
TLSH
T15BC2FA3B640CCB7E4F800AADDC5A6F977FA802C7A7549D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a81c559-32a9-499f-848a-3ed96fdb5a0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3a81c559-32a9-499f-848a-3ed96fdb5a0b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bef6063c3724126737a5b2ea2a16ada1d36a10a17acbb8b58e43cb99f9503e84
MD5 610b5d0aa99dfeee051f12573ab0ac23
SHA1 d886722b80ec1d8ada2960eccc4cb2ba69d41035
SHA512 5023211e3805beb30ba2a2635eab960473d10f1e66e3a7bf4f293f0ec71275d5d2cd9eae1ae06fae81b65b6d2d950679ca8eafa1776ae108d861b29336212305
SSDEEP 192:u1zm+xasuheOwQxMGsN85iQl4I2OX2M7ffkQmiU1A+54MTbt+FdLjv3mhN8z1UqH:7ZcIhsN85iN4Xr7X0hmDd/rcmx
TLSH
T1A1625B716C789C7799B3B185F48636030FF88067D7C47F94A6EC6B1D01DA668130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83c8d354b6bf98a9f16454c030decc8192599e3ed74c79f57c9f80d94f5d17c3
MD5 9689636bdc29ed8ae91c47d4a6a38d91
SHA1 8e11a5ebec56fca8d6f26384916b9aa5fe028d79
SHA512 b7916ba2f4def8e97017c2ff9ccbee116410b7d11281e2a61550b0ee86eed38d5d6644308d3a2fc12e3a26fb262e3c17e6b4f91811f3c9e6bdfaedb44b4d1163
SSDEEP 384:liFiZcIIzsN08TUNTUlIl0iN4Xr7X0hmDd/3Ccmx:sFQ0lwgiGSkql3Ccmx
TLSH
T16B823B735CA4897BADB6AA85F98A32034EF441A7D6C4BB50F7DCAF0D01DA19C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c3bbd55a4614fc8898d5f89b8f2de51d2819268c366a178e0bc9395ed2ed8811
MD5 f35ed3d3fec4b56caca3a949114fa498
SHA1 5744e1429cb5f07819db6a86cea1409b87bcb974
SHA512 65ef4e51fdeea47254b9d512b326897a3a813758f404c0036c3e3f7a78007e514950bfca86aa5a51d82976ef3c4d7b40b79f1b0769b7638665828dd571c3ccd5
SSDEEP 192:lONe6vMtPQmiUy6/ThTbt+FdLjv3mR847eajU/u:lONe6UtRBTMd/+RU/u
TLSH
T14202F935AC786C67AAB3BD49F58A27171FE4117FA9906B54EAE82F1C00D774C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d4e30e9264cbfca80452d5c2f95fcdd40e6172f01ed1f4b190186b49488a3b78
MD5 c5b2b3acb59af8a4c981dc252e93e37f
SHA1 4ef3cb49af303997d2d6674aa05855fb978eb7ae
SHA512 a796831629a7e6da25a448d8fa29140c2ae6b30c2caa10e31bf26d525c05268b4d8c6fe7a067be3118a2d1f988edeef26c019cbc096eb77b501944b1a080770e
SSDEEP 192:uWzm+xasuheOwQxMGsN80iQl4I2OX2M7ffkQmiU1A+54MTbt+FdLjv3mhN8z1UqH:MZcIhsN80iN4Xr7X0hmDd/rcmx
TLSH
T149626B726C789C7799B3B185F48636031FF8806BD7C47F54A6ECAB1D01DA668130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e953e697bf5ffb460cf5fbb83040d215a763d2d4ad7200a62920c2d5827706fb
MD5 05fa0458f1e63f42dba6d2710a522bf3
SHA1 d6653bd9dba2667c79c227ad9abae5937016633d
SHA512 dbd94adf93378e66ebc60244a8ace94e795aea0417d6c2c88ba2cc57bb8dd78444bd2471568ca3f4c155cde328bc2804795eb48c7449091754a8822e9d4f9262
SSDEEP 192:GJONF6vM1PQmiUyx/yhTbt+FdLjv3mh080IUqyU/u:cONF6U1R0yMd/AcU/u
TLSH
T1AD120931AC64A86BAEA3B595F48B36171FA4816BDBC47F90E6DC3F1C01DA66C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a634e14bffceff8cc948c74f5fb155fcab07c94c1806843f6069ceb7d947be71
MD5 73b99980158eaf25d1aeed37866dc3ec
SHA1 2338c9b207212a94ea3e30418dc20d3df2d7e484
SHA512 0d2f70379ddff91a92157f2d906745109ae1b765486f9ea1149d116bccc30fef7ba1cbbd08c36e996624fbddab8936a2c733223c3c8a679d82a7c542c7f924af
TLSH
T1E9412859B6FA1148F3776E56ABF6A86E487FB8772F0AD45D10110D4E0A33B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download