58c3c98ec791aa82323a286669f799016dab72a93df0db8a6ef4034421c92282

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v3/2017/08/20/home-services/index.html
Size 50KB
Sample260727-ppg11asxev
SHA256 58c3c98ec791aa82323a286669f799016dab72a93df0db8a6ef4034421c92282
MD5 4913f3010b2c0c50b346fd9aeafc6b48
SHA1 a0acb2eff455339f40d56225af238906c4896378
SHA512 2c9e0d9d1599b8159daf5b9ba04f022f129cd5b5c43480753da4b7c08d16fa004924d26834af6789cc903d4d702934f61cbef3bd0a8024d2e6324d689601d219
SSDEEP 1536:C1xfjI7OiB6cvy61zAmbDD7Wy0PRe2lmd/D:Oxftx+DD7Wy0PRe2lmdD
TLSH
T16F331BF61895D43A00A3B294B864FB05BBA35027CA65DD5173FD5BA81F82DC3A5B331C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296290907987651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{802C4FC0-DEB3-4AC3-ADE3-E19B34B2648D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4120	2396	msedge.exe	84
PID 2396 wrote to memory of 2888	2396	msedge.exe	85
PID 2396 wrote to memory of 3344	2396	msedge.exe	86
PID 2396 wrote to memory of 3344	2396	msedge.exe	86
PID 2396 wrote to memory of 3344	2396	msedge.exe	86
PID 2396 wrote to memory of 4884	2396	msedge.exe	87
PID 2396 wrote to memory of 4884	2396	msedge.exe	87
PID 2396 wrote to memory of 404	2396	msedge.exe	89
PID 2396 wrote to memory of 1240	2396	msedge.exe	90
PID 2396 wrote to memory of 404	2396	msedge.exe	89
PID 2396 wrote to memory of 404	2396	msedge.exe	89
PID 2396 wrote to memory of 1240	2396	msedge.exe	90
PID 2396 wrote to memory of 1240	2396	msedge.exe	90
PID 2396 wrote to memory of 3736	2396	msedge.exe	91
PID 2396 wrote to memory of 3736	2396	msedge.exe	91
PID 2396 wrote to memory of 3736	2396	msedge.exe	91
PID 2396 wrote to memory of 4808	2396	msedge.exe	92
PID 2396 wrote to memory of 4808	2396	msedge.exe	92
PID 2396 wrote to memory of 4808	2396	msedge.exe	92
PID 2396 wrote to memory of 3800	2396	msedge.exe	96
PID 2396 wrote to memory of 3800	2396	msedge.exe	96
PID 2396 wrote to memory of 736	2396	msedge.exe	97
PID 2396 wrote to memory of 736	2396	msedge.exe	97
PID 2396 wrote to memory of 464	2396	msedge.exe	99
PID 2396 wrote to memory of 1040	2396	msedge.exe	101
PID 2396 wrote to memory of 1040	2396	msedge.exe	101
PID 2396 wrote to memory of 1040	2396	msedge.exe	101
PID 2396 wrote to memory of 3816	2396	msedge.exe	105
PID 2396 wrote to memory of 4848	2396	msedge.exe	106
PID 2396 wrote to memory of 3596	2396	msedge.exe	107
PID 2396 wrote to memory of 3696	2396	msedge.exe	108
PID 2396 wrote to memory of 3696	2396	msedge.exe	108
PID 2396 wrote to memory of 260	2396	msedge.exe	110
PID 2396 wrote to memory of 260	2396	msedge.exe	110
PID 2396 wrote to memory of 1808	2396	msedge.exe	111
PID 2396 wrote to memory of 1808	2396	msedge.exe	111
PID 2396 wrote to memory of 2756	2396	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\v3\2017\08\20\home-services\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc2c00c188,0x7ffc2c00c194,0x7ffc2c00c1a0
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,6869018550736792320,723157486069435948,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6791587788023678845,16527632572956714709,262144 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,8464939674052228932,18068412763584178606,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12930782678215804370,390444933031052109,2097152 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10471679093519992573,5109403387316004163,2097152 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4916279650534870783,4215357759106108898,2097152 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4293031285660771542,5853016059813738585,2097152 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,5237796406697548913,4467160517815415246,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,4420126563821130554,8477934701207700678,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,11472600375257001929,1392988637872391857,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,11472600375257001929,1392988637872391857,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4544,i,6460029071836815635,1534099647714304184,2097152 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,12873409604944067242,15565668472458655947,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,3309733186910260921,670119685170332462,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14414662935877865215,7115329339359920677,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,9399969973867046766,1555369904101671256,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,99794639747187230,4871060732512014904,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,6004000109599010009,2197834646798225793,524288 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5772,i,12785244965003193563,2919969936105616134,262144 --field-trial-handle=2240,i,7026772386802921681,12452351745212608330,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 072bc37ead9a113791f0f966c98ad1837b99fb57c05ad46da390e13df91b55f1
MD5 61f0dc1c6625b03ba58fe68f18d4a19c
SHA1 d86710c668b458bfeb27a6ad1605cb81e25b8070
SHA512 2f6ef31c988c1cfc5a7ed101c7ae476fa39c646fa117dbb19e51daba1c6e796cc6d02c0218942f51f335cd4c8778a690514db5accfb4e9be989771393e18b563
TLSH
T151E026A505C9C22EAA04B98F4278630C83813B1F9AC8AB8E6F1C98983283554B7E6595
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 1166f65bafb06cf97b4a8467a9bf8a87dc85aafd8a76b3170ed0deb51518ed52
MD5 446b801e25d0a3798dacc56c2efdcd4f
SHA1 f16cdb6588e361ce1bfb62b6d9dbe821fd506466
SHA512 b24a519644a1e92910586299843b2a5bbaec15b8a34f40e6b00103075cbee2c2fd52eb8786f906937200f5fd7cf2e952054280cf0b9b9cea919ce0df4fb11a7d
TLSH
T1AE4109D1022040D8FF100972D4DE83763778BEBD781FAE5D9CD2A6B69A00321866E17F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 73aa4eacd804608580512dc7d4e3b7ee26ec25386bffca01aaeb03f1a16478d6
MD5 f75fc55e59ee1ff424451e2c1f400baa
SHA1 d3e6daf289b15c5546abc342c747f731ab338f19
SHA512 9b9f2bb0871a352711a1c59e9cc480b74d8cbc9aa9cd65c32c7a70a8d8aeade2da91087635c586063e0b22afc24a647ee856b727cde6305fed38135279104bd0
TLSH
T17E4118D1062040D8FF100972D4DD83763778BEBD781FAE5E98D366769A14321862E17F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1d58f0276215e9443d8251c3a1a46a542a4a9f9da3ad31356a90a56ef2588be1
MD5 6575d723b98aa85d01ec5b1a26963075
SHA1 82a82e9cd047ad7d7daa9eb4551cca305f26feb5
SHA512 957c678650f796ae348d9afb41a434cca72b19b6b3b292444d9a76c2d12a732d0fd5603f43db348b9301109750f11ba073fcf60f1145c777893f9efa9bde5fa3
SSDEEP 96:DyLOkghWLhfeJZpz/jsxy/Td2StIJQ1uwOI:DZtGFeJZpDjsuTdfGK1uzI
TLSH
T1F2919CB6C2C887AE885156F09B35AE1BCD1E065F42383C568DE8AF4F63E1571D20229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c1c4c2dd-2fd4-4030-8298-c0dec21a4448.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c1c4c2dd-2fd4-4030-8298-c0dec21a4448.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 970e21caf87163af203637a4d44ce36a3e53607f8e31f1a0b8a4a8a314d7eabb
MD5 923942e8ded7716f3ecf1b9feefdfdd1
SHA1 dd5d79b4469d4b66e377edd58873d5e0a33a8d24
SHA512 d23858508a8c9067b1a9f98e2a7873b80d39cf4b9e4f034a3b70e6860fc142d548c5e10789fb719db9caba8ba18c670b691dbcd46816f445cbf67dc463fe02fc
SSDEEP 192:sxZVCTRAOyM/jK1Ml8MkQO/fw1sIWViVAkIdpdV3HW6+WNGYvreiACLIgrJ:sxZVCTGeMQO/fw1sIWVX9j3HbGiAc9
TLSH
T1A942D616AA349977CCCFD309FA45BF53D6F95462E2900E44A9FCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 00872ebebc339fa7b82b0767c2f41a49b0713245ee2ef1e91068553afb95bda9
MD5 f012908da51be8df197f98906cb67cb6
SHA1 30a6d2dea98338b611d30383d3e3267449176ddf
SHA512 2547a659743321ed33d8e02956b364b503b7dbbc9860bbf53a893a8fa6c3146d842f74ea6201b1deef0434901efabf07b415fd51550cec967954da4c95631d1a
SSDEEP 192:sxZVRTRAOyM/jK1Ml8MkQO/fw1sMexVAVAkIdpdV3HW6+WNGYvF6iACLIg5tJ:sxZVRTGmMQO/fw1sMexVp9j3HbGyAcV
TLSH
T1A352D716AA349977CCCFD309FA41BF53D6F55462D2900E44AAFC9A0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f37880f8d1b7625be9e098c3cd9829264af5d58fad895a25bbcd317ef8e81559
MD5 5f19b18e503333f50ee67ac755c5aa84
SHA1 8b0245d4b589d73065afc12d2e6a659ca959717f
SHA512 01b27aeb05d540eab9e1f42a8ba4eabc0fd2b4b3c283c8c5dc1df786eb36fccd54037b390809f0790034a5cecfa95ae25253cbd74a864247e84313461a8d4ec2
SSDEEP 192:sxZVRTRAOyM/jK1Ml8UQakQO/fw1sMexVAVAkIdpHV3HW6+WNGYvuBMACLIg5tJ:sxZVRTGmqpQO/fw1sMexVp913HbGaAcV
TLSH
T1B352D616AA349977CCDFD209FA41BF53D6F55472D2900E44A9FC8A0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 26d6bf1d670fdf978f7b173073fcea4e4cfb2d92e8aa0eb7607851eec66cd2b4
MD5 2dbaa1a77d97a0e76c83ad1cac81698e
SHA1 76bbd1658cc17999400073e4bb06ce4168c9f85f
SHA512 8a4280b5f415aa137be52bda49ebbb97a684e9ec2baab0ac166b6bdd28d22a7a586dbdee35d6e990f6d2789c42f263a067e31680ad0c82acfcda2d47d4c51b50
SSDEEP 768:CwseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp9robP:CwseJ3xWvhfynu1jaVcL88p27
TLSH
T136D20B2B680CCB7E4F844E5CEC266F966EE801CB97984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 757c4325ab93ab7784e0e0d834c32c4ed44472cdc05975ad12b39bfc4d8395c3
MD5 ad86c6e13a5a482b3be1fe80153d413b
SHA1 cbaa6876e5e150119432b0e2c9afc19bd8d6ec09
SHA512 aaef7b21b9efecaf05248d0fc59049f38f0fd7c4934fd86712aa7ba76f35eeff4a9fcf590280d009e0a60dc73723944529507e03c0f290f19ab3a8865c69528f
SSDEEP 96:KYH+Kggm2lyKuUaGlyKWQx0gKNuO6sQKF+Z:49ZtFV3r+
TLSH
T10FE1571A343A06122C7E298CB3A695360F4135B77054E46FBFB820954E2FE162DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c1091d0bfcf65e102dcd78a8701f65db4ebd218a8df47e9b125a7f062197c78a
MD5 2cd5920704f898c57c18f80b5f5f62a5
SHA1 afc986d91b9d16b8d114c07318e6dadb1f048f14
SHA512 4ac25d9e9aa716377e650edc15c3ee7bd93fe56d5cdfbb1e52b08295036757ab6ad654d51ba0e0334cd4061496a22dfb2c009a41792dfdf0fd359c258e729b85
SSDEEP 384:ADZcIhsNH3NMG6v7TBE0jbCjXaLdLx0aLhtFx:ehJDsuwcTn
TLSH
T1EB625C72AC749C37A9B7B245F58A36031FF8D127D7C46B54E6EDAF0D00DA2A8030AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9da730eedf92090d5d9b68adaea11319d6223a6d55f7b3382f715a86a63d429d
MD5 38921b8edddd6a24bd9ee0c3dcb74005
SHA1 cad3d571e7ea98b8dd76c5a1b3bb40b047a5dc0b
SHA512 a7d3cdf9e80668a8d5bdea606f9754837e80e069f2cfc209f6da13e94c6ba84221e3fa53bca8a6f61ce9f74c8b18986320fa9f8c16b984cece0d1455cfcbf52f
SSDEEP 384:xDZcIhsNH3qMG6v7TBE0jbCjXaLdLx0aLhtFx:phyDsuwcTn
TLSH
T198625C72AC749C37A9B7B246F58A36035FF4D127D7C46B54E6EDAF0D00DA2A8030AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 164c789437320c82914c849fb59dd11533ec2ec613e0a09e6fd828f5f7c06c30
MD5 2140b6f2158276cb5dfc7000096aca20
SHA1 04097e53e4a036584ad07d85449a4ca7192d7b8c
SHA512 9f9b7488746a9c30c45aefae839b96f422f47a88f250c76dde1f4de2c33d50cb93c5f821c1877e4a4e5e299f8de17133b5a79d75acb564d9cec72d651140dee3
SSDEEP 384:59SZcIyzsNH3qMG6v7TBE0jbCjXaLdLxEaLhtFx:jgayDsuwcTn
TLSH
T1CD725C72AC749C3799A7A246F54A36031FF8D127D7C46B54E6EDAF0D00DA2AC130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bcc89e589edb3081a16c5781bdb82cf57d55e652201d0433f5db51d5170c243b
MD5 0bf15fa050ccdb160bc77c62b6940b2a
SHA1 622ebd6c8e1a409db85492fdf4ec179dc9bc49c7
SHA512 df290921dff19793748f3e89696eb06abc0ffcd597972c99e7f5a01745441fdd2e7a26b2481ab944b457c4a2b325c1622134e5ca98c8d46a5ab59c3cc2e2fc29
SSDEEP 192:lONQ6vMtPQmiUyVGVzThTlr+FdLPxuaU847ayxU/u:lONQ6UtRC+zT4dLxIaGU/u
TLSH
T1DD02E835AC786C7BAA73AE46F48A37171FA4616FE6D05B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 69dd6d4c7dfe676cda0255a54c5f6c8166322fc88865837beeb2b1774eb14ddc
MD5 7899ba7eaf7e708c7b8e8ff0ba803a99
SHA1 0954251f0fbe1464ed9a53cdea0617940c41f0fe
SHA512 b1412d4fee610829680a48f134f61bb5a395145db142a178b14e1a15ce5e7543ed43609b832ca3d9a48e3919c8eed446ab87f9e31d64eb80ebf3e3e39dd96c72
SSDEEP 192:XSONz26vMsEPQmiUyVIVzXGhTlr+FdLPxuauQd380IaQqBU/u:XSONz26UsERCwzXG4dLxcaLU/u
TLSH
T100120B76BC649C6B9DA3A542F08B32071EB4926BDBC46B94F6DD3F1C01DE66C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcf48de6-213b-4e47-b201-6329e04547f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fcf48de6-213b-4e47-b201-6329e04547f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4873f361bd7eb5f9e18db13618fd8d7ac2e542cf1d157c98c3f170a2200c4bf9
MD5 c51cd83c5c69447299e228fe0f42d609
SHA1 3187c8582ddde31e3e88471b1b1a1c02160a6926
SHA512 23cde608a3dccc6c3078dc1ba2f70cf8e65d82a6635ed98acbef4a3dd9886afdf18f47c2e573ec0255f78f8825624a096155c097a15823b3363fdd3c2a24b287
TLSH
T1C741D358A6F91048B3B76F5A9BF6A86D487EBC772F06949D10110E4F0A27A40CCB1B77
MD5 SHA1 SHA512 TLSH

Submit Download