4a8fcf1bb47231d0bd65d798cb8cd3204afc5b7e5e2a723d068d45f8ac422e61

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
privacy.html
Size 29KB
Sample260729-ap2cbadb26
SHA256 4a8fcf1bb47231d0bd65d798cb8cd3204afc5b7e5e2a723d068d45f8ac422e61
MD5 448f4893f81eb2c4efe4656984d3af55
SHA1 8dbee2a6fc37a4aa9574ec20ff1e83ed239f6d3d
SHA512 c1f67652e4ee9b60b44e9f5f3de2b1ba3a690438667e164252f3baa7976c08cacd02095ea405b51bb67be760a98bc1cc6ff32a56fe127cee8a68b0e2941578fd
SSDEEP 384:lN5tH0qoiFfYKBzbBS35ZMocZ82oUPS1/XyRaPycC3imffwd1YwOYRtYh0buAzC4:zQeSpiXZFPg/Ev4OaYh0uAGX4Q0+/o
TLSH
T169D2A51BF748236516D213913B52EAE6FB1AE02C3395CA221C38916C13D6B7997373DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297589141069652"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DDF24777-70A3-4D4B-9C66-925B2F6295FC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4368	2016	msedge.exe	86
PID 2016 wrote to memory of 1228	2016	msedge.exe	87
PID 2016 wrote to memory of 3944	2016	msedge.exe	88
PID 2016 wrote to memory of 3944	2016	msedge.exe	88
PID 2016 wrote to memory of 4836	2016	msedge.exe	89
PID 2016 wrote to memory of 3944	2016	msedge.exe	88
PID 2016 wrote to memory of 4836	2016	msedge.exe	89
PID 2016 wrote to memory of 4920	2016	msedge.exe	90
PID 2016 wrote to memory of 828	2016	msedge.exe	91
PID 2016 wrote to memory of 4920	2016	msedge.exe	90
PID 2016 wrote to memory of 4920	2016	msedge.exe	90
PID 2016 wrote to memory of 828	2016	msedge.exe	91
PID 2016 wrote to memory of 828	2016	msedge.exe	91
PID 2016 wrote to memory of 4988	2016	msedge.exe	93
PID 2016 wrote to memory of 4988	2016	msedge.exe	93
PID 2016 wrote to memory of 4988	2016	msedge.exe	93
PID 2016 wrote to memory of 4828	2016	msedge.exe	94
PID 2016 wrote to memory of 4828	2016	msedge.exe	94
PID 2016 wrote to memory of 4828	2016	msedge.exe	94
PID 2016 wrote to memory of 5012	2016	msedge.exe	98
PID 2016 wrote to memory of 4708	2016	msedge.exe	99
PID 2016 wrote to memory of 5012	2016	msedge.exe	98
PID 2016 wrote to memory of 4708	2016	msedge.exe	99
PID 2016 wrote to memory of 4600	2016	msedge.exe	101
PID 2016 wrote to memory of 2244	2016	msedge.exe	109
PID 2016 wrote to memory of 4316	2016	msedge.exe	110
PID 2016 wrote to memory of 1420	2016	msedge.exe	111
PID 2016 wrote to memory of 3272	2016	msedge.exe	119
PID 2016 wrote to memory of 3272	2016	msedge.exe	119
PID 2016 wrote to memory of 2220	2016	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\privacy.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe3c2dc188,0x7ffe3c2dc194,0x7ffe3c2dc1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,15468099131076341807,18054640497967940128,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,167040132201462246,8188183780452534511,262144 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,10591872084938367807,16253390044945237367,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,81877691629771996,7888989119185174772,2097152 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11144920869172565242,9843169632896050349,2097152 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,10844603796964179409,3876941376978996333,2097152 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,3269175985909632171,1128389145384704362,2097152 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,10493817638015585171,17969921696085070171,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4852237993093248966,7042665049328849580,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12290328261782975942,7830560729007449653,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12290328261782975942,7830560729007449653,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,13222525313122112916,13430639384780084140,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17191110570129621758,5133634614790800345,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17768663646328213184,1217192220955892384,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6190563973516151650,17605503948424548947,524288 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,4387533026863222815,6455903081252930012,262144 --field-trial-handle=2188,i,15897369344285129764,7120752550961576202,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 92dd4e3f203f5c25c97da2795d48ac318c9618e2a8f02b5a765b5046ab8d8e42
MD5 0c1816497189a4e5618f1a639a906b4e
SHA1 edcb6da454af7a17862dc8d1b81cedc687c76fbf
SHA512 ef387d4c3d19aeb020e21f09fbd359e7a8dede886c02f5ffcf60b7f0b31abf9218b01a1b567510b36daae5be3a9879c7fab2031f36a9956366aaacc1811a1297
TLSH
T15571B634013500ACE36042B1A4ED65457DF481E8FD375F02A1CC7AB7AE0EFE4A76AC49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af65.TMP
Size 3KB
SHA256 0dcb36b5813470b94ad550bee3ca9639a50fd70b39fca284bc1bd13bf0aadd3f
MD5 81e6c66b1d285f37725d7c1e3ff0a652
SHA1 c96fec0d8a600a4f8c60653d29f06fa95a78fd45
SHA512 4df65de93f1c720ad384edbc7719716b57a56a348c79428cae1f4ab65d189d92da0dec9a23fe0ef7c034a5bc87420c5ca6b75dca2127cb31ef1d6b307e0fe462
TLSH
T1C271B734013500ACE36041B1A4ED65457DF481E8FD375F02A1CC79B76E0EFE4A769C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e396626722fd7d2e8077a96025ae074451a0cf180a49373968a604ed0524c5ce
MD5 aed95b99435c43e710c7f28f289d0923
SHA1 ccf2de7f4dadb9955d5d85a4d3b15247741442f9
SHA512 2fa8f356de1921ac47d02a6da358975576bad4918840d922aad84bd4457f075040728e02d0ce4e99040eb07cf31aba516ee56b476ca75d8e2135eb40909d39e9
TLSH
T129116AB7C3E586AE890116F05B24AE1BDE2D0506422C7C1589E4FF2B93F3075E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3b7fa359305e8ae69f79573d9052e3ac31ce7ca0053a47293d3c274cbfd5e2e7
MD5 a4ae22ed97a06ba4e2550db651a31fc0
SHA1 6c7644c5a05b9a0d469fcbaf06288bb862a43b64
SHA512 cb6e59c6fe2b3d16b1b8958c8d2f6c353f0b5fd164754eb11853401d5d82a2d25a993cb607a545219e025ab1d443099b05aca2d3bdac5031b32235ecc3dc3036
SSDEEP 192:sxZ6RxyM/jK1Ml8Mkgd/ftsZ59X/IdpdMHW6+WNGYzQfuXIgrJ:sxZ6HMm/ftsZ5iWHbGU9
TLSH
T18C42E8166A3899B7CCDBD209BA557F53D6F90473D2900E44AAFCCA0C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 48851295da3501003b7834de1150959924ac9fd190eef909bab45d4c077d257f
MD5 b88f736b07e4524fe224382417193ecf
SHA1 1ee37410d222ce5794403cc8324a2f5e96949563
SHA512 a74c6a3af844302d32183a6cafc1f76ef06682fdfab4085964f09d4ebea73e37ed9fdfd1528fe682574d0c63d9fc5d1e1fc8cc73c8fb98461f5cf7ced59ef280
SSDEEP 192:sxZ6RxyM/jK1Ml8UQfkgd/ftskN9X/IdpHMHW6+WNGYzKGuXIg5BJ:sxZ6HqMm/ftskNisHbGhd
TLSH
T10452D7566A3859B7CCDBD209FA45BF53D6F54872D2900E44AAFCCA0C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb6b7ccbb2e3be8f4043539a7d4b880db092f1eb97919977f470b08b667a4966
MD5 43935c3915e320a339e167add2a46f83
SHA1 a1d4fa86b686e8c09d2e24be393c69069f255892
SHA512 3e8cccb6687b993ed8a205af14329b9c77625b10df5db75dcc2bcc0f507441bdd5424267d04f407fcad61f7d0565872457825e298c4d1a76e98de3452a57a57a
SSDEEP 768:54W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjGroIUibYBy:54W7kf0Wvqidau1jaa5LA3j9TI
TLSH
T1AFD2FA3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1057a9e5ac41ffefbd77152a67f0d799685f1d721ab22e7fccecf7c4cce3d821
MD5 48fdef021c85b8d498ab84e35374d7b8
SHA1 ecfb146d4decca51b24b5de7071a24a68606038c
SHA512 b42710679bd93a9e93e9b36f33c1f1ddeca7af1fd597de48b89b80e6ab8cbf28f581351bc50c5e2a3db76b8ffd571642c70d3c57a57bc65c377c3c760692fdd7
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagbEIbKF/:KIbCKcT4wKVGKaCMKLaEEQKF/
TLSH
T1E1917652327B0A4139FD7808A26E8D378F9236533458A4AF3BB911750E6BE121DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5949e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5949e0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8970020838b7ea469c574fad01213f4728b16daa021c44ac2f6e40886c0b2b41
MD5 67fde0e8d81b8765270f76de17d1d6ab
SHA1 8b58579f7ca33b5d442a1fdb5e2964a87d50f32c
SHA512 fd4cdcaafad686d7aa39c00a221b05e2a3b030ca2334e4e8ce54a3c06898687183ed5e1ef8438863248e7d53b37fe1a83ac0031febdafb29fffcb976fb083e40
SSDEEP 384:MiFiZcISzsN88TUNTUlIlMub/jvJrdV5+24xScjmwE:3FQ65wgFrrVVl4x1j4
TLSH
T15DA26D379CA8897BAAF69645F54A3603CFF88073D6C49A50E7EDDB0C01AA1EC1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e4e06ac2f880d04322f9e20e07ce7c54facdd566bc47262f3674a27c63ae52de
MD5 f42201d73b1537e2e7e8303db9febb1c
SHA1 81ca608f852685a4b293130c5c3752e72776f5c0
SHA512 27f0ab8ad195c9d7411b03ef8001aa8fc5c7fbe81d1095ac688210d1c9e14c0854425cb052c7d98d20ac7b89bd2d7f3b9f78f9aee0dff6238712e05dde013d27
SSDEEP 192:MONM64BAQmiUyW1ZW5GBPKUq+FdGe5A0aDkxU6:MONM6eANTWUdVscU6
TLSH
T10A020B396C796C7B9EB27E45F4863B175FD8107BEA946B44EAE85B0C01D725C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f37228a0cec6f7c2c1c3bfc71659f766d47e232a8052e23bba29d93987882e4a
MD5 4151c7ea721ea188248ca28a013247e9
SHA1 973b2bc709933e0a5fecccb322f9a012141f75ae
SHA512 47404e44e37ff24334dadf1f8fda962eff7365a3077c6fd0550c260cd751752d3114be505c7e44bea3a3e8fac6696cdcf72327b43f31ed729d7ccd332acbfcee
SSDEEP 192:uXm+xasuheOwQxMGsN0VQlRBbxtFQmiU1lzG4aGBPKUq+FdGe5AMV+2vdNEqLScs:9ZcIhsN0Vub/jvJrdV5+2PxScjmwE
TLSH
T1C0928D36AC795C775AE6A146F48A3A038FF88073D7C45B44E6EDEB0D05EA6BC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e4496b280b967572d387a34c90ff22010f024ee1a969b3eb01b56f62f3a1d6a5
MD5 edb59134e07c618c88b325705daa2f4f
SHA1 400e38a0206a93651c8c4845617efcbae700e30d
SHA512 972c56cd6db51d585dcbce03d08e0fcb0e632e9be57c58564dd2eb3b7d7a373ff187c13d0bb29edffe3ffdbb41d2e1532c577b9d7251500fc5a4f77518f59d52
SSDEEP 192:uOm+xasuheOwQxMGsN0MQlRBbxtFQmiU1lzG4aGBPKUq+FdGe5AMV+2vdNEqLScs:cZcIhsN0Mub/jvJrdV5+2PxScjmwE
TLSH
T1EA928D36AC785C775AE6A146F48A3A038FF88073D7C45B44E6EDEB0D05EA6BC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b23c4736fa88577fd21122a6dd3469a4da5b34c94acf672fd0894c97125dc83
MD5 71e10f789f92670765d6c856ee8a1584
SHA1 a4dfd2fa23d15e09a5b6775cc87e6b57c101a2d8
SHA512 82452a7a69ee6e255fe95c7d6b94a5ec9cb677ca3fb5a4607f92ad3d15ef80747776c7f8bacaef04e90704a61fb743a66cbb42458936958ee093f6f5ec2e0539
SSDEEP 192:dONl64BKQmiUyuZr5GBPKUq+FdGe5AMV+26WwEqLU6:dONl6eGRrUdV5+24xU6
TLSH
T1FA121A3AAC795C7B5EE1B545F08736035FA8412BFBC46B40E6ED6B1C05EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 68b1e4426ea1b81f0f357afa143bec89c945eeed81aa1a43dd74bbd0e94a6e51
MD5 283628e9f3d6a76d8d12425fc5eb2f4e
SHA1 fe616f9dc4c84403b86e40890587ab977066afc4
SHA512 bcd03ea03a37536f16e1dd4222a53ee8ba635cb1ab9ad1b6e11e8a72bcf682e6a23b2a1510b66cf740fb1970cd7890a97b465a72e20342bfa3c70ece684b452c
TLSH
T10D41295CA7F91144B3B36E6AABF6786D447FB9773F06D45D00110E4F0A66A00D8A2B3B
MD5 SHA1 SHA512 TLSH

Submit Download