13f167366a844b7844e2ce038ed4e9ec98f9bc60f640417cceace5b15c88e421

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oak-cliff.html
Size 90KB
Sample260727-wstyasbk6x
SHA256 13f167366a844b7844e2ce038ed4e9ec98f9bc60f640417cceace5b15c88e421
MD5 81e8b9dcbaaa1a1388be64ab534f3950
SHA1 6cacab975e2b3989451707c78df5eac1752e226c
SHA512 8b6f8e8a22fe5a72ca09ae5050a5728540fe024cf2e73c851690f8de21b962ef44115930837e7c60569cbf38ff245e9ca3f52b35b8f059443c99ecb8adf2bc62
SSDEEP 1536:tT133UsmYZ06M4lSvF0JH3TSRmxHIIgpcUt2rmWH:tt3UsmYZ06M4lSvFI9xZ5ms
TLSH
T1539301D24CD9303F819A75416918B129E3D3D24BCF085A42B3FD7299DF87F85AAE224D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3780	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296495008060812"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{8F374998-2207-4B20-8494-E5E48E70752A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1796	3340	msedge.exe	85
PID 3340 wrote to memory of 3780	3340	msedge.exe	86
PID 3340 wrote to memory of 3008	3340	msedge.exe	87
PID 3340 wrote to memory of 1880	3340	msedge.exe	88
PID 3340 wrote to memory of 3008	3340	msedge.exe	87
PID 3340 wrote to memory of 3008	3340	msedge.exe	87
PID 3340 wrote to memory of 1880	3340	msedge.exe	88
PID 3340 wrote to memory of 4024	3340	msedge.exe	89
PID 3340 wrote to memory of 4024	3340	msedge.exe	89
PID 3340 wrote to memory of 1264	3340	msedge.exe	90
PID 3340 wrote to memory of 4024	3340	msedge.exe	89
PID 3340 wrote to memory of 1264	3340	msedge.exe	90
PID 3340 wrote to memory of 1264	3340	msedge.exe	90
PID 3340 wrote to memory of 924	3340	msedge.exe	92
PID 3340 wrote to memory of 5104	3340	msedge.exe	93
PID 3340 wrote to memory of 924	3340	msedge.exe	92
PID 3340 wrote to memory of 924	3340	msedge.exe	92
PID 3340 wrote to memory of 5104	3340	msedge.exe	93
PID 3340 wrote to memory of 5104	3340	msedge.exe	93
PID 3340 wrote to memory of 1048	3340	msedge.exe	97
PID 3340 wrote to memory of 4016	3340	msedge.exe	98
PID 3340 wrote to memory of 1048	3340	msedge.exe	97
PID 3340 wrote to memory of 4016	3340	msedge.exe	98
PID 3340 wrote to memory of 1152	3340	msedge.exe	100
PID 3340 wrote to memory of 2272	3340	msedge.exe	104
PID 3340 wrote to memory of 2408	3340	msedge.exe	105
PID 3340 wrote to memory of 2380	3340	msedge.exe	106
PID 3340 wrote to memory of 312	3340	msedge.exe	110
PID 3340 wrote to memory of 312	3340	msedge.exe	110
PID 3340 wrote to memory of 3088	3340	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\oak-cliff.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb2700c188,0x7ffb2700c194,0x7ffb2700c1a0
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14940290976067679475,13192229931554963171,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,18169890993261107265,17449287889261560873,262144 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,10344245929767087170,6914753876701401835,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,14779665925038606398,1690205611047886538,2097152 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14140172558693871679,4477906217591574471,2097152 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,1405919035847362175,11386612728851104009,2097152 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17754306432795244957,15785000539118716025,2097152 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,1396434966407709790,2293976922669868112,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,4742143966227056734,5748310469523463886,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,1272123823304721478,9950148096749467568,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,1272123823304721478,9950148096749467568,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,7222249660569227262,5232396733544238327,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,6833648289745660507,6682669139509037870,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,2086674294668847775,2007429266446640346,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,8935083184257197603,17500863854584705788,524288 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,10894473287735862227,16800119649606733957,262144 --field-trial-handle=2324,i,2866219078982235081,9747288322699258625,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

287d2b55-ac75-4e1c-acef-96778be2b7d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\287d2b55-ac75-4e1c-acef-96778be2b7d1.tmp
Size 8KB
SHA256 1cbbfd91433736a2349652441a6095f5c4e56e89376f3db07f4b0b14f7247e7a
MD5 8f07288a1ddb69511c74393851f92b4c
SHA1 b62b7f2d497e933b40b04a3bb10c844174f429f0
SHA512 19d58415ca326ff118154153cc4a08b0b53912af44f5e0bc7347ad59ee63c76852236e2308d890d28cc9aa141ffe9d36de6789a80ed9579c8a8d2d1e8e8addc4
SSDEEP 192:qONa6O7+3hQmiUyBTGttb0aO2eh2dqgGbvcU6:qONa61WGt97ORMab0U6
TLSH
T1D202E8356D286CB74EF2AD45FA873B235FA5103BE9952F84D6D81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba436ae00a2db908f9bd7590250cb77baca1dbfce8892cd556aeb22ee9ceef09
MD5 ca65a1a26a39997e4eabc88160a9ed43
SHA1 936b1ed587a32cab47423c2417e858fc00120c2b
SHA512 3b285012d815e4cab02e8e3e43fa95fd1ff207382ff4261fd265367d19f30154bc3da6c32b254f8801b5dc50b21376a8b566ed40c248bedb31524eb43629209c
TLSH
T1997194193A564B9FE7514E39E0E00237317AC7990E030F6AF2735CFC9396F76A662418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a11d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a11d.TMP
Size 3KB
SHA256 726b45fae36139a9a1f1aca8cfa70aa6fe34b0e094f9529c5bf72bbf6f0a0911
MD5 5e3ef975512439e28793d2e6d724fa22
SHA1 142c3aea95dbe9ea5110ece2fe47e97406d4626b
SHA512 1a606468d51c000873091465db770e778c4efc0397bc2a13120b0785ed8a7c67e8240bc96377e1e2367576ce3fe9df56e48266b4a7cad50789af21b81b1ec525
TLSH
T1057183193A564B9FE7514E39E4E00237317AC6A90E030F6AF2735CFC9396F76A662418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f225bdb4aed94f0a22ce1265a4084592f2d58a7a8c669a1ecc6f727a6b687b00
MD5 e863829ae4b8816e0862fd8b27e01514
SHA1 e0aaa9c2ced247270d16e798c4bde39901acc0b5
SHA512 40d3fb046cf06b24a0ebaf6b1b04e43c11d02e2b1b7de149dd09f1cd8e00720c7b47f14d4cf74d18fd8a43be0f1f3f2f6cc1143e1503bfe43b6702166305bfb2
TLSH
T1964159F783E4477E891252F09B25AE1BCE5D0117436C7C5689F4AE2B63B24B1E10279F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 818647b545f16e0ed50dda693dbfd157aec7ecdaab02dfa984997b3528912e7f
MD5 6158ff7382b6419977ed31fabb1dc0d8
SHA1 d2b621099a06be58f046876629093842e7fce5fa
SHA512 cc4528d1c13699f5409f2bc61e7f50b2102f02afb0d05a7a6594e7f9f90182fdab724b76b83a2f4ad5e8711ffc3b6c6d34241f004b7b76fa221ead19e3204df4
SSDEEP 192:sxZGRiyM/jK1Ml8Mk1/fEsxwLVIdpd3HW6+WNGYLzMu7IgrJ:sxZGsM1/fEsaLmxHbGS9
TLSH
T16542E9156A345977CCDBD20DFA55BF53D5F91472E2900E48AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d43d9e99b7ecacafb2906548d4d32605aaeeafbd687239a57f79f973803ebc4e
MD5 92d0e242aa78b4584591473d7d948567
SHA1 944d638344895635f9930a9f47bdb113cd5cc9ba
SHA512 b81bc4f2d4a3388cd1d9c50533dcd973d3df57a4e205cbfe0c1cba537a6340e3e6704ca9b01c1b30096018c66cc50e1d142adec52e08a0b4f5cd8b709140ea35
SSDEEP 192:sxZGRiyM/jK1Ml8UQYk1/fEsDw8VIdpH3HW6+WNGYLkXu7Ig5pJ:sxZGsq71/fEsE8mXHbGIR
TLSH
T1E552EA166A345977CCDBD20DFA51BF53E6F95872D2900E44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 76511e3095b400e530ee3a663539b0899dcea665a3a020f402c6142fb3782b49
MD5 b800efbafa8b4c3883cf1725adbcbf08
SHA1 ec65a7af52c62481616a701f5d03ea1922bd559f
SHA512 f2066c1acae31131d02bd9c6384e1d820b0a6aaa24845dd00303e2d761c56b197ac5c3aafa0859ca8381ed0d5d8e03f8fc510f395223196d251ae9054397cd9e
SSDEEP 192:sxZGRiyM/jK1Ml8Mk1/fEsDw8VIdpd3HW6+WNGYLu0u7Ig5pJ:sxZGsM1/fEsE8mxHbGPR
TLSH
T1EE52D9156A345977CCDBD20DFA51BF53D6F95472D2900E44AAFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 72b3a673066e6ab08d78a0f2e2b310a62b1be4db2c01ff503f83c6b14ed65f23
MD5 bca440f92f4b1b0fb33e4bb496447e25
SHA1 5b003af3a0245bb8ef8925df315d10e8e94930da
SHA512 8ae6f7803b98969da03d1a1a4051fb3ada4688c402a7761334333299387b9e2449b3b4943d47176ff11ce319bc355b4bd70d125f3493045f79c6f03598660d75
SSDEEP 768:xxs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNCrohe:xxs6pD1WvxzWju1jahILIsNZhe
TLSH
T1B8D2EA3B680CCB7E4F841E5CEC2AAE967DD801CBAB94895447FA844C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aa0c782d6461bc0875b4a266b391321ad9ac6ad33f5de0679d7795a8adb768c8
MD5 71d3d76810150b66e4d3d14ecdcc6273
SHA1 3d659347e4bb5c2288cf754d7211a7db5f5597f1
SHA512 89abd639392b0d8cd39f36e45b9bdc1e7aff295cb9cfa08381ef24f3abd6e1348f1e62408044fcf54a2d9b267d160c3ce3cd612d3c691ab0ade82dc84a178bdb
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFlIFKe4gfytVIZKGE8+:KUAAKtePulWKe4iuV2KGEd
TLSH
T11891585331BA13022C3E2E0CD35487668A4275A7316DA43B7BAC40B21E6BE215EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2be4565ae3f4ad98792f5dc130f6ab9a7cad8517792497eb39dbb9e6cecd6593
MD5 7ff43555f5e4345d057a7ab9223de12d
SHA1 c07abfba844918bf196da0f120e9caf65c9d16ef
SHA512 bcd2ef62a2b63518203228bf9fdb975e2a1b040a8f9c52b44294595089b2abb779d5ed468138789426a183c180bb332cec4d0ebbd537359a3bd0046bdc3fe000
SSDEEP 384:3ZcIhsNDkIR1WFD6a97ORMKoHbJOObjI9G6w7R7:/hg/I7JOpoHbJ29Mx
TLSH
T119928D326C389D734AF2A556F9873A135FF9907BD6C92B84E1DCAF0C05EB5AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 398b2b2ad7349fa36b19ffa5fd149b77c3fcc2d32a01149511925fe84357d387
MD5 1a1254448151d4521490c5c64c5f1736
SHA1 2bc986b72c97e12d8b55928cb64836c95415a309
SHA512 9ccb58b4809d5a639fa9a462c931f78fec320284f7998ad6806cd1c2a0101eddc868e52dd176fb3e9a2d53d9a5c161bdbc00868f35fcc8b96f201b848c9bd52d
SSDEEP 384:cZcIhsNDpIR1WFD6a97ORMKoHbJOObjI9G6w7R7:KhH/I7JOpoHbJ29Mx
TLSH
T1CC928D326C285D7349F2A556F9873A135FF5907BD6C91F84E1EC9F0C05EB5AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e9c8552626a8e8b8b18d455626de4107813f27a6c0683237710c076c1fb2de27
MD5 1599be3e0a149052bdd3ffa01a9b30d2
SHA1 106d306e5298475d5a5eaa7c08777736d45f44c6
SHA512 e7ef0d508400ff2563480f57cf1c7081bd2e818729c35952d22833835275f73b76cba88f9e6bb91d6f26e5216f99b7525809e649b9931419a616a042661e95b5
SSDEEP 384:1ZcIizsNDpIR1WFD6a97ORMKoMbJOObjI9G6w7R7:NqH/I7JOpoMbJ29Mx
TLSH
T19A928D366C289D7389F2A556F9873A135FF9503BD6C92F84E1EC9F0C05EB5AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be4a012057052bb6c324bbc5a250806785e6e26656576e78650e61a7fc7cd3e5
MD5 96aa0519b47e4cf7b71abdab979970c1
SHA1 cdbfe0beecef97f71af6dc95e3bcb77fcd97fc15
SHA512 88ea431a246c67aa4c396e5ebb75e399b3a06d19d222ce6f102b906d2d70e6bf404b89987af1dec8f2556877e6acf2384f63499d24796e532b2a8383d0f8451e
SSDEEP 192:vONe6O7+3TQmiUyNITmttb0aO2eh2dsLELcNbtqsNU6:vONe6TPmt97ORMKowbJU6
TLSH
T1F7121B367C6CAC771EF2A545F98736134FA5412BDA8A6F80D5DC2E0C01EF6AC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1d2b9b1-c05c-4a3c-8f98-af99a74b4c28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f1d2b9b1-c05c-4a3c-8f98-af99a74b4c28.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 28dddf957236681e02ca55d4876f3a4b2607c3b3c87e51daaee5a5757e401218
MD5 6ee2e6912aceef7fcde8458d4e010486
SHA1 cfd0d2c54b4a02ecfd334e3244d3c316f66e4921
SHA512 b3490d31d95f81a7ebc1d07841a6e3c766056d63160882218448bec69f51046ea8fa30d599aa2b2687f19a1959fe11d512f7e6c40f6af260bdbb212d1d102464
TLSH
T12D410B58B6EA1148B3B37F5AAFF664AD487EB9772E07D49D00010E4F0A66B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download