29ac2fd05fa3ceb86ecb456ba440b6df44c488ed9450ae30acdaa1dff82153ba

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEGIC/index.html
Size 22KB
Sample260727-w58bfscf36
SHA256 29ac2fd05fa3ceb86ecb456ba440b6df44c488ed9450ae30acdaa1dff82153ba
MD5 80f1a3ff092d1faf592fa01894f54b8a
SHA1 99f569bea07a5cf71513ae02ef8f65044e3069a0
SHA512 7daa0e8e2e3f14d4a8a291575a3a2d97f6d72aed0c36f545b2d33322ac370fe50459d62a6cac9b697b0e59b07c2c542aaaeae2bcc3adb38547c674a058a36904
SSDEEP 192:69y94X8M0E6eIo8o8lGPqgm+Y2vZN5QT4j2aym4+W:69yWMho8onZm+Rf5QT43ym3W
TLSH
T1A4A2CB21A8C5107702B3E6CA19A6DB6BFDD2518BD75B4A0036FC27DB6FB7E049813057
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296509188205581"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{9EF7A527-2AF5-4EAE-9233-AC7281B3D13A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2852	2720	msedge.exe	86
PID 2720 wrote to memory of 3708	2720	msedge.exe	87
PID 2720 wrote to memory of 4808	2720	msedge.exe	88
PID 2720 wrote to memory of 856	2720	msedge.exe	89
PID 2720 wrote to memory of 4808	2720	msedge.exe	88
PID 2720 wrote to memory of 4808	2720	msedge.exe	88
PID 2720 wrote to memory of 856	2720	msedge.exe	89
PID 2720 wrote to memory of 1264	2720	msedge.exe	91
PID 2720 wrote to memory of 2296	2720	msedge.exe	92
PID 2720 wrote to memory of 1264	2720	msedge.exe	91
PID 2720 wrote to memory of 1264	2720	msedge.exe	91
PID 2720 wrote to memory of 2296	2720	msedge.exe	92
PID 2720 wrote to memory of 2296	2720	msedge.exe	92
PID 2720 wrote to memory of 3140	2720	msedge.exe	93
PID 2720 wrote to memory of 4672	2720	msedge.exe	94
PID 2720 wrote to memory of 3140	2720	msedge.exe	93
PID 2720 wrote to memory of 3140	2720	msedge.exe	93
PID 2720 wrote to memory of 4672	2720	msedge.exe	94
PID 2720 wrote to memory of 4672	2720	msedge.exe	94
PID 2720 wrote to memory of 2672	2720	msedge.exe	98
PID 2720 wrote to memory of 4192	2720	msedge.exe	99
PID 2720 wrote to memory of 2672	2720	msedge.exe	98
PID 2720 wrote to memory of 4192	2720	msedge.exe	99
PID 2720 wrote to memory of 3952	2720	msedge.exe	101
PID 2720 wrote to memory of 3612	2720	msedge.exe	105
PID 2720 wrote to memory of 5088	2720	msedge.exe	106
PID 2720 wrote to memory of 3616	2720	msedge.exe	107
PID 2720 wrote to memory of 4152	2720	msedge.exe	114
PID 2720 wrote to memory of 4152	2720	msedge.exe	114
PID 2720 wrote to memory of 3160	2720	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CEGIC\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9888018476570897848,18392710869571533666,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6073244110454010893,17197985094803886769,262144 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,16803616869533055135,12756398321518004085,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15481575464026080443,12477800318690219338,2097152 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,11934184924789512788,6975755582348242143,2097152 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,9176151697086029828,12445627650124589559,2097152 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,13694607620019643114,8340794139179737069,2097152 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5016730452579497501,17860773727150093976,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,9279470047408040903,16263392095943818393,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,9914616139848130250,1477613908882381766,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,9914616139848130250,1477613908882381766,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,1530453356214001403,6428403976814021658,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,15498032633956209777,4435851035108541164,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,10071404924393236661,1674960984934557413,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,13025660688914508724,8641234823418082235,524288 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,8194841958768932429,5451777945644860798,262144 --field-trial-handle=2348,i,17629365055687699046,3757439715095248979,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

32fc5258-2414-4764-b57a-cf834b531470.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32fc5258-2414-4764-b57a-cf834b531470.tmp
Size 12KB
SHA256 e424e280236583ae48e6937696654e55fda820f0af649bc63c4e1e7f8daafec8
MD5 31b77b21dde3b8c824bdb42181f53f12
SHA1 a5ab4aadf7be87bde8e08bb74d5f09043d7e6194
SHA512 6db3337bcf36fe49087dfce08de2d322461c3f16fc3a7dbd104de5c7c4d7955f8682a1eb219a9b8bd48549460773461d23fd9ba2cc189e45bdcbc3f9b320dd35
SSDEEP 192:sxZIRfyM/jK1Ml8Mk4/fisVUt9IdpdBHW6+WNGYwKS/wQIgrJ:sxZIlM4/fisVO+HHbGJ9
TLSH
T18C42E906AA349977CCCBD209BA457F53D6F95572D2900E44A9FCCA0C08E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 228f15cd8866e6b4f673c0630ef4d88d641cf749a82dc2ddfc21510eb106f875
MD5 81f01c80cd475f65c98afcb68808b3d4
SHA1 0ef1524c9683103a9ccbb05d546dfcfe2910dc5d
SHA512 de4418603a0c44fae8009abd0d0773456a2b97962c73d884d68fb676aaec83af2f6c1e0beb2a1c3ce636751f7305b632f32f4601195d3ded3f96de1b3c4e9876
TLSH
T1CC615D1802C24972EFBE1072C1F196153EF7599F8EDB8E1247E4C4FE6039B5EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a8ed.TMP
Size 3KB
SHA256 47e4a5abd10d3a53db99fcde4f184366a6ce2251d1ab3fe0132bdcc24f30b8eb
MD5 dc84bd620ea7d0cd920e7c620ff3d527
SHA1 498401eab2ad038590200f2f8debff417fa10e53
SHA512 40e8d6a7941a43f2cfeca0713f1e7770be5a0466aabca76c15197fd25333fed07d5b0a476854de27faa2dcc4f4b81a16aae41bdf77271a2314aa23b0d42597cf
TLSH
T1FC614C1802C25972EFBE1072C0F196193EF3499F8EDB8E1247E4C4FD603AB1EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95a63ccd52c71b8d9ebc9da23f4bdd3d9d184b33072fb6d2ab235db9e32e6da9
MD5 f1ee8a04e622c92b6a2bb8d860d613e1
SHA1 e77b6f74b78d2bc99061aa08a1590c9471a70f22
SHA512 1289c316342cb83104e1ddaee57bb6241c40b9b8dd3a24eff50c703f814dbf3841df67471932ce942212846454c0095298538a9e163985d667712da38b883c82
TLSH
T12E21B1B7C7E9C6AE881117F06A24BE1BDE1D090682283C1689E4FF1F93F20B5E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 30af1510d8ca2888be9ea43fd1844017b2d1cbb90090e8ccb107c066db8f64e9
MD5 2f4297d5d52351448edcc193b5bdcb15
SHA1 26f969166ad20b2f55142e3447f227ced922acb3
SHA512 68759f0ef97c99413b3e6370e8e6bcff3a558d96a1c007f2b5d2008d98cc34c407974ad7bfa97d049bf16808ad2c57fd74dfec5175905119bf1cce7529dd75c1
SSDEEP 192:sxZIRfyM/jK1Ml8UQ0k4/fis7RUtV9IdpHBHW6+WNGYw/bn/bQIg5TJ:sxZIlqP4/fis7RcV+hHbGmb
TLSH
T18C52F816AA349977CCCBD209BA417F53D6F55572D2900E44A9FCCA0C09E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 035b7673306b36133d934a5ff315f666ad5593d11ce06993e3e7425718aaed75
MD5 d6b75f45ac3d80735b226dc0968a94a5
SHA1 0a9ee4396794c6e47e6db21aca47c1f097608890
SHA512 f307128e3b473c9643c7e46cfa6b70570164eeb8ed8f4bfaebad30cc7aee203e254d535c7f05f2bf7d512429dd52788b5c5a84544870eb74eae56e6013ff14e5
SSDEEP 768:/84jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dcrohFceae:/84jeXmWvmKLEu1jacPLZQdHYk
TLSH
T125D20A3B284CCB7E4F844E5CED26AE976DD801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 cce2afbcab788b9c761e7d1172e3dbc174b344304cc27e3317062df468ff2803
MD5 887992343b6c14f4ed1c97675725bbaf
SHA1 fc9d03a52674f32d97393b98a25adcc80551c9df
SHA512 b748d54d0a5b375002b3427a742bc98514e76f42af2e2dfa401097bc16ef19978461ba160aa13a5d51a796a80372b6f4951bcca5c0cf2e112b420b4e754c8613
SSDEEP 48:KceI3KLKIjy9lI5KGUcOOIXKDaoTyJyIvKvKgZ:Kce0KLKeOl2KGUJO0KDa+qyEKvKK
TLSH
T121B1785532FB12113C7E2908D291DB279981B0A73164F42BBFAC14A74E67E119DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594414.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594414.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a400f09fbe3b22f8d8e969a963cf6bf18e2cf2f699db775488be2baea3bbc786
MD5 0984a6f66de28f992539b46626192c3f
SHA1 694c167e62aa6e680e5f62486fa64b06e170c0d0
SHA512 1681847178e6ed4235929fcb9623d37500b13c1308b1c7f41cd9506ca5a6b534caea6344cf7929a7e9dff05dedc5069fea62818ac7063118d6bfcd5ebb8e81e7
SSDEEP 384:OZcIhsNPYL0kKElFHf+j8IMX/+2CF6OObjI9G6w71S:sh4K/j/lU629M1S
TLSH
T15B929E32AC389D7699E2D655F08736235FF99137D7D46B84E1EDEB0C08DA9AC1306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98d537be058610c4a7d96a7f43ee63d76a1dbe0a176a629a6509beb451ca3f5e
MD5 871630fbf9c5e721149bae29e87135b4
SHA1 db7ac81836a5993f322dc931e1973994c2a18872
SHA512 a6e1bfc97382326cadfaa0a0bdc126de73907a0b7c4b29d6e5a4598562ef908c398d9fa0b267a36abaa1695f791e06fdb334d06a4ca3c6dd2824131445b7c0fb
SSDEEP 384:iZcIhsNPxL0kKElFHf+j8IMX/+2CF6OObjI9G6w71S:QhjK/j/lU629M1S
TLSH
T1CC928E36AC389D7699E2E655F08736235FF8A137D7D46B84E1EDEB0C08D69AC1306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a39de4211be15d707264ebcf994710afa4384c449b68463ca7f35d90d9bc0f0
MD5 f126c1a9deef04fd11c2df4dfdebf370
SHA1 9400358a4610783d38646f59b6fb305e1ab64191
SHA512 279e6cd668ece37d76f1d0615d60659d31e3666c9ed630050d1170019ed2e5c8d5bdc87ae63f958f128ec5369b8e606193dddf719fbc57f22464e0bad6a68446
SSDEEP 192:EONJ6hZ0QmiUy7vpc/+jVRjzorIz5wOZwAhU6:EONJ6o8pu+j8IK2nhU6
TLSH
T10502DA39A8687C7B8EE2AE45F48737135FE5116BE9956F84DAF81B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e61083effb36695ca0b5921fd5eda2f7cfdf8844c05146284c47b2572707f988
MD5 8f8def6ad5685feaa075393e5a36836a
SHA1 355368bc9d26d373654c866b1a631d65adcd4577
SHA512 69d4d3d0c1be8992a7ec8d6597d222bfeecdc51962b7b81539c38f1e677d3363f2114ba8024839ae7e47ef9828451a64769ddb66da19972ac08fe611e8d8512b
SSDEEP 192:DONi6hZGQmiUyUv1c/+jVRjzorIMXTr+245cOqIqUU6:DONi6GJ1u+j8IMX/+2j96U6
TLSH
T1BD12FB36A468AC274DD2A685F08732135EE55227DEC6BF84D5EC1F1C04DF6AC230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 70bce5a5b9bac8bf9a36bb675570727310b4a19e433a0d68800adb363ba96cb2
MD5 114f3ee4cfe5312fd4ec358c4e5b8be2
SHA1 b80b6bafa207401b76e420202acc8cab55127e7c
SHA512 60baa4ef8eab3e8dee53e4eecd3843ac3cc9eea89124e8f2540f7ee39f90e500df4c83fdd36afb4d283c46f65b05b9eabb44dbc934fbb4923d5984920545099e
SSDEEP 384:viFiZcIbzsNx8TUNTUlIlxL0kKElFHf+j8IMX/+2WF6OObjI9G6w71S:6FQPswgcK/j/lI629M1S
TLSH
T1A7A26C339C68C97B9EE69F55F48A32138FF55177C6D5AB84E2EDEB0C04965AC030AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b0458fb-4cfb-42d7-b1f1-2108f781e9d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5b0458fb-4cfb-42d7-b1f1-2108f781e9d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4975aa2e570d1d8768a0465b3f6093428eb68581854f7a9b5080c4b1570d36ae
MD5 a1ac8a00c52f558855a4c18013b3953f
SHA1 be44759ba58ec821eb3923236acf66bd4939e8de
SHA512 2a0014a410cb825a08e4fbb92858a88e1ed7ea15e072cd819c75c6e56089ce589b1396311aca7eab2315bcd8e9e8b3f4503369ec02d3c5d3dfc4283d29d83e31
TLSH
T161412A48BAF91148B3B36E66ABF7586E447FB8772F16805E10110D4E0A26B44C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download