570506b4a013d9284529ee963fa1aea98199d9996c82fd42e290304367481973

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
content/vpn-notification/index.html
Size 160B
Sample260727-vtflmaxemg
SHA256 570506b4a013d9284529ee963fa1aea98199d9996c82fd42e290304367481973
MD5 e3984780fadba26c16c73904cf1d5530
SHA1 6da79c6e5bd7529bee36999f42143b43240cd57b
SHA512 abc9d2c2407524e58ed475f24ccd8e982f94bebbb6e55d3c6d4303bec4321d5852609d2039be507b9856861c45d0036c5b82d32240ac0192989326b8138de084
TLSH
T1EAC08C8B7802404189505A882CE2B31C8453BB9CB4838C0006E2E0A119C93B9DC47198
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296462164281428"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{65D5EFCD-0513-45EA-A5D4-DBE75A1CD6A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4440	1528	msedge.exe	85
PID 1528 wrote to memory of 4532	1528	msedge.exe	86
PID 1528 wrote to memory of 4296	1528	msedge.exe	87
PID 1528 wrote to memory of 4532	1528	msedge.exe	86
PID 1528 wrote to memory of 4532	1528	msedge.exe	86
PID 1528 wrote to memory of 4696	1528	msedge.exe	88
PID 1528 wrote to memory of 4696	1528	msedge.exe	88
PID 1528 wrote to memory of 1552	1528	msedge.exe	90
PID 1528 wrote to memory of 2784	1528	msedge.exe	91
PID 1528 wrote to memory of 1552	1528	msedge.exe	90
PID 1528 wrote to memory of 1552	1528	msedge.exe	90
PID 1528 wrote to memory of 2784	1528	msedge.exe	91
PID 1528 wrote to memory of 2784	1528	msedge.exe	91
PID 1528 wrote to memory of 4080	1528	msedge.exe	92
PID 1528 wrote to memory of 516	1528	msedge.exe	93
PID 1528 wrote to memory of 4080	1528	msedge.exe	92
PID 1528 wrote to memory of 4080	1528	msedge.exe	92
PID 1528 wrote to memory of 516	1528	msedge.exe	93
PID 1528 wrote to memory of 516	1528	msedge.exe	93
PID 1528 wrote to memory of 1760	1528	msedge.exe	99
PID 1528 wrote to memory of 3612	1528	msedge.exe	100
PID 1528 wrote to memory of 3612	1528	msedge.exe	100
PID 1528 wrote to memory of 1760	1528	msedge.exe	99
PID 1528 wrote to memory of 3428	1528	msedge.exe	102
PID 1528 wrote to memory of 1088	1528	msedge.exe	109
PID 1528 wrote to memory of 4932	1528	msedge.exe	110
PID 1528 wrote to memory of 5008	1528	msedge.exe	111
PID 1528 wrote to memory of 1924	1528	msedge.exe	113
PID 1528 wrote to memory of 1924	1528	msedge.exe	113
PID 1528 wrote to memory of 2616	1528	msedge.exe	114
PID 1528 wrote to memory of 2616	1528	msedge.exe	114
PID 1528 wrote to memory of 3912	1528	msedge.exe	115
PID 1528 wrote to memory of 3912	1528	msedge.exe	115
PID 1528 wrote to memory of 3884	1528	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\content\vpn-notification\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,18352578479921503074,6363899286094176826,262144 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6107758780475626572,13015929503392657655,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,11671706048053622439,4468466308125500236,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2142918490039449966,4404439159601025133,2097152 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11567496309560460185,14488604529279028723,2097152 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17684132216568563097,12476423410747383788,2097152 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4213902007869394995,18007243736134075019,2097152 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7958936928536389951,16325436161585424268,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13926656253705454807,2668557932681751523,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11287425011902195891,16831845422018927991,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11287425011902195891,16831845422018927991,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,9975819739847304212,9705389072631493100,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,7156836935479794827,1997619505358283065,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17331329031764950946,17056429771181975414,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16428320052371109508,13383453445710523415,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,2167031784657026027,16734237520598218092,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7721469892915391432,15687436639874844684,524288 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1052,i,14668635742514763157,3024145916400946089,262144 --field-trial-handle=2292,i,8984578175054899305,14973340158863462242,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 e575f2e11accbf4bcccf07d51702c9ecf6d88f8d06f9cd68e3a6e715554bab77
MD5 c7bf2961dd8cdc0a968877f5ab8b7595
SHA1 3d5ede2ff29396931534975b4d81877dd3f79c00
SHA512 d12b743b36556cbd1cfbfa071070d1b70b0d28fe0165b18b04bb7949ed8a8b5109e8daf63204025d2c856d7170e05af241f1734352bdddb5d416d7b5c0854217
TLSH
T1B5E026461E90F1E5094AB6C7A04FA754405C7085FF8CEB6E327E60AC3E03A034775484
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f4c036e141abe2281de8daf69cf4294e1ee526e9c7b471290144619919778a50
MD5 28fcee4f5b69472fb0817becfd062027
SHA1 93154c48185f07523134c6042a6169e63434ee97
SHA512 ce523f551c9067d872b15ae282e3d3d9e6f141e8b7224f3d3c4be4a10c855be3fb3a32b43c33863f3bca8da25115da5017c0b5bac53b707da5f40faf1b4a4fd7
TLSH
T152615D1802C24972EFBE1072C0F196153EF7599F8EDB8E1247E4C4FE6039B5EA9E6404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abeb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58abeb.TMP
Size 3KB
SHA256 bb452c45c609edca6647bbede6fdd17474990609641b9e9eb26fc0a96687b4b5
MD5 eef89cff08a856b4f6cd3d381055b3f6
SHA1 44a15cecd4fc6479c9f3f56e1075140b4456b5f8
SHA512 beec80589620022849165774e69daf4f96c470b9433551fc2339b6dba4d75c436e4a0b97d9c2b3ab8c18fa9fe44d0ec9360c745a7b90345049d9caa228eeb8ff
TLSH
T187614C1802C24972EFBE1072C4F196193EF3499F8EDB8E1247E4C4FD603AB1EA9E5004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 36968bf1400363a270c6fbc6c186901e6ac02e4682f48d1205d156abd6c23e3b
MD5 3b09a73cbf5ffe0bab4e95c1ba77ca1a
SHA1 29c2903a2920ec86f08c486ba62f3ebe94a52eaf
SHA512 36b1893bf37d3fe36f4c1280c91ad4dddd378a1a2c71bad2984b2686cf7b0f74aefd53071bda656f08a0bf5097e4dace26a83dc4851a9b8cb94fb8fce1eeebca
TLSH
T17E117DB3C3D5D5AE89011AF06A24AE2BDE2D0A06831C7C16C5D4EF1B93E3475D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff652fa93810f82a9530d678e23fdb816fead4ebacda59c91d6011670470d824
MD5 40509bd66ca05ee84148a9d02e61e2e3
SHA1 dff1fe41e8d784e19078d7c16f500726e6c03ecd
SHA512 46192c370e552b57c4a1a4dd19b3824b68809b8aa1e5064a3efa0d52eb569e414d1546788b0199fe6a4c7857e34706dcf92de97d9684a4cb0c042aa399a765cd
SSDEEP 192:sxZ5bbRsyM/jK1Ml8MkdZ/fnsCF+MIdpdoHW6+WNGYwKX+KTMIgrJ:sxZ5bbuMdZ/fnsCF+VmHbG19
TLSH
T18642F8056A34997BCCDBD209FA517F63D6F95472D2900E44AAFCCA0C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 75775e13d355cff034cb5418f73dd8edf6db6ba5f285e1c6347e1a42328774f9
MD5 8b61ab7ab85f63513c9502a0eb82e87f
SHA1 808252eabffff077606f6ad4c85eb6dcb5724006
SHA512 77f8b1fddaa1576435d7b42fdf2fe00a67eb1f2a47d8fcd9741fb4154c907ba06ee7a7c5c1ba9ac0648b0c1d4e0eeccaf5ed86f256b674dd631f793e42cd870c
SSDEEP 192:sxZ5bbRsyM/jK1Ml8UQDskdZ/fnsp/+MIdpHoHW6+WNGYwEM7KTMIg5YJ:sxZ5bbuqD3dZ/fnsp/+VIHbG9i
TLSH
T12552F906AA349977CCDBD209FA517F63D6F55472D2900E44AAFCCA0C05E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 889fbb8f91330e4702e3f7a6b7421f4a04cf9b80d31f79981e4ef33340ae40ba
MD5 82e0a1834bf64da4409452d601d616bb
SHA1 d0e65c8eeb9d21406ba710b2736a8cd6ed2a1540
SHA512 e535df94dd55493dc9c20961b0de324e33f690634eae0769507e16b296063a4817090d27c88b81a610b134c82b7cd48991bf2fc3473757f094136332f58d3c75
SSDEEP 768:Hc4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dnrohMyc+aN:Hc4jeXmWvmKLEu1jacPLZQd0sr
TLSH
T154D20A3B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b345440fc583b35acd13a1d1f3420c809ef158327d96a80e312d2aa8c0f33a5
MD5 7920fc4b16ea248280dd0b5e6e2eb47b
SHA1 b844b6a70289650faccbac16c9605bf47902c46f
SHA512 72c4da7da53374a8cd845fc23216bbb139cb9540192a93ace3ad694d89403d70f8d71e00993ba8cd3395a032b2acb74e410fe8d6d710c35480a47b69f4fee6e1
SSDEEP 96:Kce0KLKeOl2KGUD54dpXz3oLrO7pRoKBtpfoFxx+fpl/:ibJZz/
TLSH
T10A919A4531BB43412C3E294D9290DA268A81B0A73474B93B7F6D04F65E2BE159EFC8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5948b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5948b7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2241cd6a1e4f1a8b3153e37bc3d8ba0ce22a7dbfd3232bb172da321a78445c5a
MD5 ffdddf21e452ab2145e4ce775d53167e
SHA1 6c89c6dedd5707f300a3b8c3b53e4088e99b8259
SHA512 1bc0aab62c7251e7cc56d29e746dc401dd11cbb5dfc15738ebc8239c8b1b086c12562dfdade19d7da4bf2d1e28ed275a36c11e5475bebf6abcb09e49b9092348
SSDEEP 384:LZcIhsN5kjWYue3f+j8IMX/+2hFyROObjI9G6w7Un:ThZPj/l7yR29MUn
TLSH
T19A928D36AC389C369AE3D655F08B36238FF85127D7D86F84E1EDAB0C05D65AC131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 89eaaff41566b6fb039678013e9e8af187bd5a0cc4e8869c17c494282e6cb1f8
MD5 e5e9432ce877aa38ace0f120b89635ef
SHA1 23351a97ac7e9a206e4afdfbfa9c7212af7350d2
SHA512 d0abcb11a9d20c1b07be4d7f2c108f96aab0f33275f4ee4f114be15ff831f0c9c8c7db9c0e56e4fb0909b3720df862b4b88ff30964d4c135f780c825cd2bc0d8
SSDEEP 384:ziFiZcIi+zsNb8TUNTUlIl5jWYue3f+j8IMX/+2lFyROObjI9G6w7Un:eFQPOwgHPj/lfyR29MUn
TLSH
T1D3A26C339C68893B9EB69B95F48B36238EF55167C6D5AB80F2DDAB0C00974AC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91a0169d146d41cf35fd4f3177550abf92efb819a96a8615eba4da97bd7bc9eb
MD5 d6982070c218fbfc64b648b5defa9c0a
SHA1 603279df9442a523701ddbc3cc5d12a834790a57
SHA512 0d93b67811a85cd31bf53a3689d675e673bdf67e230b2da17867d168f32bb34312af41a8ca5e99dfbf020e8667ad047d7db1c9db3257e222a08fc0786d8349d4
SSDEEP 192:EONJ6hZ0QmiUyvDpc/+jVRjzorIz5wOZy8AhU6:EONJ6oIpu+j8IK2yrhU6
TLSH
T16F02CA39A8787C778EE2AE45F48737235FE5116BE9956F84DAE81B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 db9ff84de83c840981510bb87eb429449139b49e2aee8307040e64c21817958e
MD5 1a2ea696a277e3ef42264c66f1a47aaa
SHA1 b22dd00de3dd52e738b68c1e63c4dc79ca54a894
SHA512 e6ff6921b5a2546ce424a7912e0974becc470b7a74b4383daac828a10506f36bca0d8468eea1c1f77ce08ec43a8db973617431874b289ffe762b811a582f0188
SSDEEP 192:sON06hZwQmiUywXDFc/+jVRjzorIMXTr+2k5cOqyMqqSU6:sON060tFu+j8IMX/+2X9yRU6
TLSH
T11512FC36A468AC674DE2A695F08732239EE55127DEC5BF80D6EC1F1C00DB6AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8e3b2c4b3b0d44bfffac4f3252ee18bebbfb6c2170d4779c8b83a6da8565d103
MD5 d4d76343fee4c8c7cb86376e3199cafb
SHA1 52400cb271e8e0b7551d541df73412f72c423a55
SHA512 6ff8d57d9582514678e158e2b7e1befdbe1e9d96bc3883314527859fbb4f6e3041a223ceeaf3e4e1a3b1ba0cfa2ae88d396ba2f7e9dc8c5d76b26972c9b060a4
SSDEEP 384:0ZcIhsN55jWYue3f+j8IMX/+2hFyROObjI9G6w7Un:yhyPj/l7yR29MUn
TLSH
T1CA928E36AC389C369AE3D655F08736238FF85127D7D96F84E1EDAB0C04D65AC131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cae9f017218d0c788bc5b21767162d057b7f894e17f9992694c38f4fe914a311
MD5 86bd186a88e5cb0b9fd5b333d1ca2d75
SHA1 0dee77a172f532fa1f0a988ff6f1d468e75214c3
SHA512 b8c690d2f8d91288a635b8f4efe82abe3cb09a6e3ad9cf770fb21d02a9e29a8c1e94fe0b72e543f9c0efe10176f096c84245705268e20daf95171250cb04c9be
TLSH
T1E5412A6CB6F9014CF3B6AE5AABF6A4AD447BB8372F16D45E10110D4F0A62A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download