34a7cb58a292a7e1073219d0d045525964326b383b868d80cdd8eda647b6fc1d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capture.html
Size 6KB
Sample260728-pg7lpawyet
SHA256 34a7cb58a292a7e1073219d0d045525964326b383b868d80cdd8eda647b6fc1d
MD5 49d36e0c315299d657a39adfce0dc85f
SHA1 50a3caa226d17ebd366ea81dec22e46fbf03e51e
SHA512 df9a69adcd5eb527b3c26b9687f7905d5a94664f8ced48377891ff6e17284ac5356378a82331621e717dc13639f8a64237d395df2dc5b63dd8f4967b081f25bc
SSDEEP 192:Bf22u8lFFXsvtupRUI7vxQgStHtQIcWVUZc0Ut+l:GCh/7vxfoHthcWmZc9tA
TLSH
T1D3D122D6F562A23B01B381C9B56EABAF76E2918ED690461402FC07F547ECF78FD06412
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297147570849252"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{13B5D7C2-5F85-4B9A-906E-E65FC4E329EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
396	msedge.exe
396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2188	3036	msedge.exe	87
PID 3036 wrote to memory of 536	3036	msedge.exe	88
PID 3036 wrote to memory of 3520	3036	msedge.exe	89
PID 3036 wrote to memory of 3520	3036	msedge.exe	89
PID 3036 wrote to memory of 3520	3036	msedge.exe	89
PID 3036 wrote to memory of 3844	3036	msedge.exe	90
PID 3036 wrote to memory of 3844	3036	msedge.exe	90
PID 3036 wrote to memory of 3460	3036	msedge.exe	92
PID 3036 wrote to memory of 3460	3036	msedge.exe	92
PID 3036 wrote to memory of 3460	3036	msedge.exe	92
PID 3036 wrote to memory of 2352	3036	msedge.exe	93
PID 3036 wrote to memory of 2352	3036	msedge.exe	93
PID 3036 wrote to memory of 2352	3036	msedge.exe	93
PID 3036 wrote to memory of 4892	3036	msedge.exe	94
PID 3036 wrote to memory of 4892	3036	msedge.exe	94
PID 3036 wrote to memory of 1448	3036	msedge.exe	95
PID 3036 wrote to memory of 4892	3036	msedge.exe	94
PID 3036 wrote to memory of 1448	3036	msedge.exe	95
PID 3036 wrote to memory of 1448	3036	msedge.exe	95
PID 3036 wrote to memory of 2628	3036	msedge.exe	98
PID 3036 wrote to memory of 2524	3036	msedge.exe	99
PID 3036 wrote to memory of 2628	3036	msedge.exe	98
PID 3036 wrote to memory of 2524	3036	msedge.exe	99
PID 3036 wrote to memory of 624	3036	msedge.exe	101
PID 3036 wrote to memory of 1612	3036	msedge.exe	104
PID 3036 wrote to memory of 3760	3036	msedge.exe	105
PID 3036 wrote to memory of 2568	3036	msedge.exe	106
PID 3036 wrote to memory of 4960	3036	msedge.exe	107
PID 3036 wrote to memory of 4960	3036	msedge.exe	107
PID 3036 wrote to memory of 4540	3036	msedge.exe	108
PID 3036 wrote to memory of 4540	3036	msedge.exe	108
PID 3036 wrote to memory of 396	3036	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\capture.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,2692358609980403582,13586357445692054737,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9364612192297955642,17015191084591126144,262144 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,15075804103416559414,12980476969616328010,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13228319532169484945,12269219649325584132,2097152 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2515221915630133945,5515189803014787571,2097152 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14045240070933475306,7606414272682504313,2097152 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4726671891392470878,12682811137487921413,2097152 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6221495149486671955,1457569547222805874,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,2015471585021498504,11269459927937696731,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,13081432661039414816,4820378240653964804,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,13081432661039414816,4820378240653964804,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12196528848214296031,1221000322207881713,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,3406580138721859579,1436562563806322666,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,1055529753884343581,7754528537746316166,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,4727898906234009385,16674754292788311802,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,10858172581254376467,2840544870535919707,524288 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,14601303417265720057,6596594280784929335,262144 --field-trial-handle=2248,i,9653300122825790778,773677927261703304,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c107d5cf33a714a068be0aded9bac4225385ecd3f59f1705fa681e4010125f6c
MD5 aa4214cdd355dd491d7e78f2dc15f214
SHA1 60b5b7a0e0c833918c018f11fa7354bbb8735685
SHA512 aaaa9dc5718e77344760f3ebe4d3dbfe1578d67071ac4752c2addfa29e2e562b6da4ab466d0cef8231f31f45568e99edbac8c445454402bcf9b5c4cbebeb232e
TLSH
T10BD02372BE91D3D0D019303D502002403B26023123CF832310A8480CDC7404082DEECB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f854a8e83dffd7aaa23413c4f9ce5e638de4bf77f92356f4d21d21b26828a09
MD5 b97729822e268f516fbb13d49ee8397e
SHA1 a08ad2007d1850daa9dfdddc26c5ec2a87007d33
SHA512 c5d02a1c9d376754cdb7c6cc508822e049e0475432af888ea88e051240e5bb2c5ca52a7471cf21a61a3a02bc41f6058e55fe4dacd5389187049542dc05b898fe
TLSH
T182712C1A01F9489DD721A330F1CA1D1E7CF3F19B0E139E49315CD8BDA53A734E4A5454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc08.TMP
Size 3KB
SHA256 318b64daa0028f02734906d4cf25836f923fb19811846c2276e3f5cf3dfbbc1f
MD5 f907d204bd968faf1b6bc4111881cc03
SHA1 020830429a01b92b2142882eb63fd94ad5e6db7b
SHA512 2eaf39667609066ab2c7f28e09bd559b2d2b3015ceecbaac70087bb16182c8556b15de3ef378ddbad6913c83cb3b3f8f01ee6f0a986ce58225045eff6091943d
TLSH
T137712C1A02F9489DD721A330F1DA1D1E7CF3E19A0E139E49315CC8BDA53A734E4A5454
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1f6a349bf62df5e3b0928de62220b43ea0eb01470d23ba2169191472f02335f7
MD5 112646ef14e42c05cfcf502551d308de
SHA1 08d730954fe7cf9e7b1eb07f7748cd4811d51757
SHA512 f3ec3442d1e989f1c9a201e1922e6d88785dc816e8b1321c6017dfd3d816cf83dfd10b9653aeb8c99ddc145db15bcbecbfeb0da2d5cf03ca64622117fe005e2d
TLSH
T1C411BAF7C3D585AECA0157F06A24AE2BDE2D0A02831C7C19C9D4EF2B83E3075E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f3c9a5a39df7a7fa60b5e56909927d47d2c6931650dc66acfb2fd6030c393fa1
MD5 d5d1235cc0a2b48768bbc1e8bab364e4
SHA1 5d787131fc698a3422f8137e8ca8fdd8694bf938
SHA512 30d928102c06393eaff13672767aa667e825d92d9c095dc840b8355f61fd34f422154c647695d829643d13bcc1e03068454f5a195ce6820e1e44d2520a59444a
SSDEEP 192:sxZlRhyM/jK1Ml8MkT/f6smg2zGIIdpdnHW6+WNGY4wemMSIgrJ:sxZlrMT/f6sn2y5JHbGU9
TLSH
T19D42E9166A3859B7CCDBD20DFA557F53D6F90872D2900E44A9FCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 259fe0666608c3b2e82dd17935cc6a0e31378ccbec4e50153da822871417a299
MD5 13a5b6b7d7252eb9d81abe9efc987817
SHA1 38bf298a0878835d2abd79d71fed02923f51893a
SHA512 0f711c117985fc29edb59e7ce648a86810cecb172b4ebcb17ee0169ecf7cd45ff75b3ce200189ff4569b2e3f8df170ddda0eeed081d3c56342ff391deb27fbba
SSDEEP 192:sxZlRhyM/jK1Ml8UQWkT/f6s0g2IGIIdpHnHW6+WNGY48nmMSIg5/J:sxZlrq9T/f6sx215HHbGdn
TLSH
T15652D816AA3859B7CCDBD20DFA557F53D6F54872D2900E44A9FCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb4ce0626c04ef1c75858a0d69c71cc80dfe4e6aeee6b6522fa98fee420e9431
MD5 5104181864feaaa7bcb5f09dd90328a4
SHA1 9141fcc2289ab78b385faaba39df3cb3f539bf01
SHA512 1266e9980c5335d50dcfa94ea800dd8c40a33bd3a628b99977224dac676b1a59f745d3442ed05e95d28609d74c677f764242ba22af7468d1958e8395bab841f1
SSDEEP 768:Kw8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdBro1kzUn+:Kw8iJPNWvx76ru1jahALocd6qU+
TLSH
T192D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f075d1f39dd86118b1b7fbe984b6939e79968ba4658c0db6c1b24dd08dc64cd
MD5 da80c33d1cc72e330be32e691b0a85bf
SHA1 b70ec0cb14b2fd2926212ec190d8e2c0e8524a06
SHA512 d355aa03e2af84649cefde1d896297293d17f60e78985dffdf012d140f019001f9c90873e79d3882d2802e22fe80809eec938e85f5d2dff4705a4c88e982c1f0
SSDEEP 48:KsgIvKBWMPyNPK7/1pNkdpgPIgXkKDBbtkHf0aA136IfKTyszym:Ksg4KBW2qEgKNCi64KTy6t
TLSH
T18E91311375BA17113C3D6908E2629616AA81B6E33154E46B3BE850F20F3BE250DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a17877195a2d074ce0d489e8aedbf6fcdbe53b2d5379c9b6f964a319b733b161
MD5 6f5e22c23cf4c9dc428a906acdf5b2e9
SHA1 0c6c3df94190b4ee39f150ac3a8995f2c2553881
SHA512 ff3477489ecb0fc1aea8ecbe252e3d12341f3c53a0f15a38a8eb8e942e4513f2f786f2fcb6a58cda0657e8b81b7acb73405ee891dde53244613bbd017fc1131e
SSDEEP 192:ufLsNW5Qd29ZwmfyQmiU1sYB4k03pTeF3rLIvqgOOZljYRHKKGn6w81zIWNJI:usNW5V7GLukkTioDOObjI9G6w7WNG
TLSH
T1B6726C36A8786C778EA39562F08B36235FB0847BCBD81F84D6EC9B1C09DF59C4306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4984eb32207449cc07e56c0f2dc812efd816cfa5acf5d8520cfb9949ab50ddfd
MD5 895481312a5184563d3426009700e771
SHA1 b0245281150e92373b4226c033ee43ad59848ea7
SHA512 f26d2d3e92e5bdee27b20f35729f7430383bac17cd510ec5c53154ad9920b7c31b9f3c5bec211c3ec2047c401105ba90bc76f9ff8de55207f1ce5591de098862
SSDEEP 384:FZcIfzsNWIV7GLukkTiJDOObjI9G6w7WNp:9brVD29MU
TLSH
T1B2928D72AC786D7B8AA3A522F48636275FF4943BD7D81F84D6ECDB1C09DB45C0306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c62cedb36c9d9c1197b7edb78269522c0b54cdf4df3371c92d5692ea815ba4cd
MD5 b3dc799cc2ad4f07d50c9916d4b3c08e
SHA1 a0aa921f98a0a918fae2c1771e94efc534b5b349
SHA512 5c43177b2db47255f46df897f09f26d716be13d24c2d9ca3e5b078699ff0ded48ab214f0b92fecc93287dc13572170171898932194f166aa68a0fc7bbf79471e
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5D5DvBhPwivh50xy0SFYKCAxTeYNU:gONl6kDfQmiUy1ZZ903plQiYctU6
TLSH
T1F702FA3568786CBB8EA3AE46F48737275FE5112BEAD42F85DAE81B1C04D724C1706837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 855c7446c0afe0f61d49eef247d766df0714b739d11bd3efd94d08f2c497f5b3
MD5 7839714047894c6d49c937c9b7d23622
SHA1 fc6ab0a40b4f5e396ee4b1ea3d2f2de2472138c2
SHA512 50b7384b139eff7faa0ecfb1443e1f2bd47e6152cc85fe171d9df6d20ff10cf5331a00f3d983885be7bc60225a3d0458d5287473bae138522b6b4fdca437edc7
SSDEEP 96:ceqONkqsQsjpfmUToXK5ih/cIPURHl8h4otop5D7DvB4Pwivh50xy0SFYKCAxTeq:CON36kNQmiUy7ZK903pTeF30cRvqgU6
TLSH
T1D6122A36A8B8AC7B4DE3A551F48736235FA54127DBC92F91D9EC2B1C05DF19C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 878f88b35470888dfb9ffa5b8d6705a6d123d1b450fc7d4c6d1e52e5089299f1
MD5 e22d94cc351858913414596fc133d8d1
SHA1 7dd173d440dfd46d39e1035705fe04e57e10b19f
SHA512 4b4398e29eadbfcab0707565be26a328745995ebb657c6ceb17f75c385eb1b2632f49ce2ae0c8e5335f1f2f62004874fe62b9ad60d9fd001e2e93f28b7fae683
SSDEEP 192:urLsNWoQd29ZwmfyQmiU1sYB4k03pTeF3rLIvqgOOZljYRHKKGn6w81zIWNJI:WsNWoV7GLukkTioDOObjI9G6w7WNG
TLSH
T1BD726C36A8786D778EA39562F08736235FB0847BCBD81F84D6EC9B1C05DF59C4306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dc0f4cfa64d92931815fc4600b36f029d7d3aaa5f6a9cb019359de0802122d27
MD5 7256353644c321c12e3b828d97e0a07c
SHA1 cac50878aba59331c44306e9b6c014af286df049
SHA512 02b100d00ff4c0ab54ddfffa4f47da4c82fc95145695f66912b7e1c3e1b8bf657c8a428c1f504d9f1beab2121949ded7d0ae9004132859040dbb216abd373944
SSDEEP 384:jZcIhsNWIV7GLukkTioDOObjI9G6w7WNp:7hrsD29MU
TLSH
T130928D72AC786D7B8AA3A522F48636275FF4943BD7D81F84D6ECDB1C05DB46C0306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

169299d0-7191-47a5-824e-8c70a8ba5cd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\169299d0-7191-47a5-824e-8c70a8ba5cd5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0094728063fd8fddd1af25a85170b60b0ff8d3dd5adb9c3b339e7539806fc173
MD5 2616cde515516ee8de9fb16582ea2834
SHA1 e116f3b225cdab51887bea38449985759ab88dd6
SHA512 151b7c33966703b280c9fdcedf25b7ca557631887c8fa8256930756207617ab1070379da6df2f25ce6f45a33760fd4b6848a4af6f1ee55325e2c43b3422a53b1
TLSH
T10241E958A6FA1148B3B76F5A5BF6A8AD487FB9372F0AD44D00110D4F0663B40D972B37
MD5 SHA1 SHA512 TLSH

Submit Download