hxxps://www[.]ato[.]gov[.]au/onlinesecurity

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.ato.gov.au/onlinesecurity
Sample260729-cv7sdsdf49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297655087763411"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{363D8BE9-E49B-490B-8A83-08C812E7070D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2308	4604	msedge.exe	83
PID 4604 wrote to memory of 5060	4604	msedge.exe	84
PID 4604 wrote to memory of 2284	4604	msedge.exe	87
PID 4604 wrote to memory of 2284	4604	msedge.exe	87
PID 4604 wrote to memory of 2400	4604	msedge.exe	86
PID 4604 wrote to memory of 2400	4604	msedge.exe	86
PID 4604 wrote to memory of 2400	4604	msedge.exe	86
PID 4604 wrote to memory of 3800	4604	msedge.exe	89
PID 4604 wrote to memory of 3800	4604	msedge.exe	89
PID 4604 wrote to memory of 3800	4604	msedge.exe	89
PID 4604 wrote to memory of 3776	4604	msedge.exe	88
PID 4604 wrote to memory of 3776	4604	msedge.exe	88
PID 4604 wrote to memory of 3776	4604	msedge.exe	88
PID 4604 wrote to memory of 4460	4604	msedge.exe	90
PID 4604 wrote to memory of 4460	4604	msedge.exe	90
PID 4604 wrote to memory of 4460	4604	msedge.exe	90
PID 4604 wrote to memory of 3144	4604	msedge.exe	91
PID 4604 wrote to memory of 3144	4604	msedge.exe	91
PID 4604 wrote to memory of 3144	4604	msedge.exe	91
PID 4604 wrote to memory of 4628	4604	msedge.exe	96
PID 4604 wrote to memory of 5008	4604	msedge.exe	97
PID 4604 wrote to memory of 4628	4604	msedge.exe	96
PID 4604 wrote to memory of 5008	4604	msedge.exe	97
PID 4604 wrote to memory of 2380	4604	msedge.exe	101
PID 4604 wrote to memory of 4136	4604	msedge.exe	107
PID 4604 wrote to memory of 4136	4604	msedge.exe	107
PID 4604 wrote to memory of 4136	4604	msedge.exe	107
PID 4604 wrote to memory of 2228	4604	msedge.exe	113
PID 4604 wrote to memory of 1480	4604	msedge.exe	114
PID 4604 wrote to memory of 2164	4604	msedge.exe	115
PID 4604 wrote to memory of 1732	4604	msedge.exe	120
PID 4604 wrote to memory of 1732	4604	msedge.exe	120
PID 4604 wrote to memory of 4728	4604	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ato.gov.au/onlinesecurity
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2864977688372153520,15474977586641658777,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,5732897796843540311,11799226342455928987,262144 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,8239918872176470143,3414026926449197070,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,9300339151225343223,3385989753920616462,2097152 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15149773209298367684,16892771387176166978,2097152 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,3840260097292011536,1096283128766812652,2097152 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,8783033176387788118,5779351366662248886,2097152 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,109924236917972521,16991051140236937445,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15034738267202882274,6003174476523268318,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9311861298930526736,13152408011815696615,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9311861298930526736,13152408011815696615,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,12238201952065762952,17606318888502737180,2097152 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,14533046517476169956,6777237047080826089,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,8745096286435092285,9811989196384590884,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,638563676020533281,5135725436335691910,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,3851263178649553415,17150244029317915478,524288 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6596,i,6214978503897764184,10193433495972523839,262144 --field-trial-handle=2304,i,16156200183550911031,4654398157610593927,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3de9b3f32657ec86ead3f2a7b72413fe36e856e50f38b4c8ae7d41ea2bb7f97c
MD5 c2b5fa333c0a6c2c31d24b543787f6dd
SHA1 1647ca8b9f824ad011693d2481f1851e97cb67e7
SHA512 3bb3e0e54ad6a5d15e704f890cd21247f3674ec7a74aaf6e63a21af8d3f6c3f6d08c547edb64de2d539c21f66cc5344f44ca75ddc35363c117c5203b6d99964f
SSDEEP 48:OHq/U2mzqaZgLKUm+2iwItpNv8shhWG/Jovc/56N1ue08wblW7blpT37pbpYK7:OKWWv2Um+9HEg/WZuT8Ff37P7
TLSH
T1BF8180385951B9ACFB792273F3D12BF833F581A84F874EDA11608DBE144BFB25962408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e5c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e5c7.TMP
Size 3KB
SHA256 ceb20a04aadcd5656d1eb931bc34c726165986f1097005f3b16aa78ddfc6d428
MD5 84da412a89f7da3cc1658d4dcf82d2fa
SHA1 cda211ab2a7804559246c90b7cdb0579e3863b6e
SHA512 145f8e8cf4097edba0197607cf8dec0030bd10366c2493f89223a7cfb95b16722089b36f176af25816c19c26a99937cdc6645febab91b5a99ccf9f0c8f5a4fab
TLSH
T19161D7380A12B89DF7311373F6E03BFD37F251A94D5B5DD951A018BE158BF328666418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0be8bda29d8746aa9238039f24d49c0742dbb0c1f0be0063316c711a42bb7d2a
MD5 e440cca4cc6593c88586bb9c3e0aadcf
SHA1 bca5dc4192dae6a379735a6cff09a8c61fec0c74
SHA512 660a8bbcdddcce83df5d6b94f993a5c7e2bdef16db68e39fe8acc961d2cd3cb616611ba115af31e6910335797136ff6836e4e33af8ba7670611e4c05a733eb75
SSDEEP 96:DJOfgeKBrznhfbl/sOVuQADqBk28Np8EvwQ:DMfgeKBrrhfbl/sOVudD6k28Np8EvT
TLSH
T16CA199F7C3E8D62D8D125AF09B14EE1BCE1D25154738386A89D4AE2B97E2571E200B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 05ce5d2bbd56720e57f7db622b57cfffa0aebbb723c39ac941494a8b3f16f691
MD5 d076da80a1fb557609855acf17eb31c8
SHA1 ec3ce737e7a4f8f2958f157b55ddfbdbaf5eb7d5
SHA512 568e965534791d98bba77e8f1fb3aec31b9079c2a1c828daadd8c647c0f9ec25a7de99301ac87faddf918de2531712f73a3a2aefedcad4439fc331c18348e9b4
SSDEEP 192:sxZ+RlVyM/jK1Ml8UQ6kS/f2s1oiIdppOHW6+WN/SH/YLvJSaXIg5jJ:sxZ+PpqJS/f2s1oL0Hbk/ufH
TLSH
T1C852E8166A3859B7CCDBD209B945BB53E6F54872D2901E44AAFCCA0C01F6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 84992dc7fad8f5fc4640eca1e01d576aed68d609313862804b470350ca1abbe9
MD5 40d634b7238804a3c25e959f0762b0c6
SHA1 0341f224aed2d25301429aa19240a3f2ba2083af
SHA512 4b5ed6a5eaa762d53f672bdb6f2e43b77d1a43c2e15432f306c1a3f1a2f8993cc0d8cb60434e126486e4df954f3a6abd0ae2e1cbffbbc761cc3f48acc7393d07
SSDEEP 192:sxZ+RlVyM/jK1Ml8MkS/f2sCNiIdpvOHW6+WN/SH/YLT/UXIgrJ:sxZ+PpMS/f2sCNLmHbk/B9
TLSH
T12D5208156A3859B7CCDBD208B945BF53D6F50872D2901E449AFC8A0C05F2BED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f6f5eee3c339a638a6c81d03d0435cd7b3ed34bf9048a68d1243efd0224f089f
MD5 879eb844423075d42e83601a0b78397c
SHA1 197179f99e55ee8d49901eff3a2462d0cac56077
SHA512 0452bf66390e7f35f30f87d6c00a70905d86eb90f317ac9d17d7f687c777e649d6d51cc8604107e433f77a9fd176e25c20021874fec2ed7cb2057edd93329570
SSDEEP 768:dhs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN7rohpM:dhs6pD1WvxzWju1jahILIsNIhi
TLSH
T13ED2FA3B680CCB7E4F841E5CEC2A6F976DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0e612b05fdaa8194b6fe57fd617fc52e11017e5ec43b3b2c0fb06ceaf7a68ce0
MD5 5d5759cc5ad7d87d3a29078997a3d474
SHA1 2de959cc7548ccdade699f92c75a50b6167085e3
SHA512 c9584d41b4892829e55fbdb12dbfc52e22bbebc5ec0b9777c7d8496d729c5fc558ba12123f182ae8aec2bc996b9a0eab73baa2c5349f8f2a8b01a3bf585700f9
SSDEEP 192:iiJHohV/lR8hK19XCmbuHPCpxIJLsd57V9GXqW4UIdMpqui1ugF+uZAw:iWHohV/lR8hK19XCmbuHPCpxELsd57Pn
TLSH
T189D10F1331BB4B123C3E290C939497265B82F6A73018E92B3BA810714E67E794DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c4a3f12d783ac03b621f3466da98a955eed2fdabdb8e011a783ceab17d9b1924
MD5 32eb95d5d1f0cc88a2bc45a2a77e1efa
SHA1 cb92534805fd8b83ba98844177011a86cc903789
SHA512 900352213d75e73cfe829c191dfa18f604251babf9f2180ab23b11e97d521ad348ab70a25599eacfba673749f58e41ecf628445fe92bf50773758db1b78aa217
SSDEEP 192:uQsbzsNNVQSXs7+3vm+6dQmiU1H6D+4atb0mO2oazEnMM/q0B/C:8zsNNVVabBIha9nODawpn/C
TLSH
T13C82B5F658EB4C72C9AE6343A77D2E035E7CC067B5851A40B3D85A0CCD9A67FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6c26551923ff57833be6e7c104cf4392af950a36c84bc5ee14a5620bd7fa814b
MD5 cbfa93f2f667fd4648150d037a280f0e
SHA1 e9e1d3e892391f9021aa7fe1e9a97cf37d37c146
SHA512 3318b7c8b7e0dc368e61954e508cecf10dcb9455cb9f08edaff0c177cb2b71d699545fb260875427a8aa8d39ff67fb92034440f9783cb18bd7235e78bd757d01
SSDEEP 192:u7LsN8VQSXs7+3vm+6dQmiU1HWD+4atb0mO2oazE3LM/q0B/J:csN8VVabBsha9nODawIn/J
TLSH
T1EC4209366C7C5CB75DA2A585F54A36135FB84067DA892F80D1EC5F0C02DF6AC234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7acf9efaeb7ffdbe8c24bb35a43892bdc5206d9cc5aee2b8b479fac09685b323
MD5 4eb99691033604c81747df6813668aca
SHA1 2ef5fea148a2749c6f890b2330ee617b28280aa7
SHA512 7035295399d71d11e65fb10d955601736212a007e403d51a91a43cfa44413e930a04698b680b45614ee259e3faf7309905c37cfe4c26df60825c9d55c0ac060a
SSDEEP 192:qONp6O7+3hQmiUylHGttb0mO2opgGOfU6:qONp612Gt9nOD5IU6
TLSH
T14302F8396C7C6CB78EB2AE45F68737179FA5103BE9962F80D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8626c3ddd2b583a8a966a78c7e821f51ba55d3cc57329cf12ffccf0ce41ea6f0
MD5 36606757b54f3e42995ece1fc3ca9651
SHA1 8b6da9f6c1c94c1588b1aeabe00ef2959850b0a3
SHA512 4cd451b768a6d99a8c231d1749beca9fe6b2009d3164344d4a44c9aa32a4b788936e9e8f039a8590b52820791d129c8ac4097af50b11405aa9b2990f0daaa245
SSDEEP 192:rONd6O7+3DQmiUyJJHTttb0mO2oazEdcN/q0BU6:rONd6jg5Tt9nODaw6nU6
TLSH
T110120B36687C5CB75EA2A585F98736135F750167EA8A3F80D1EC2E1C02EF66C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0e956ae1cfa07f21cb2f1ea8c820bb055dfa5e45c1dbeb791ac5f8e010a2ed64
MD5 9c6e88364d476ac386e3a899fd7b9b9b
SHA1 4aa8204eb8bb140046993385a34f032900d7db85
SHA512 8ebd1380418b2c1a5f7274be5ffde2b19da54b47783a95f5dccf523dfefe2c7a35a85352602ae23d76f123394359fd4a0f4e70c5c5933f2f00b4767153f93e22
SSDEEP 192:uALsN8UQSXs7+3vm+6dQmiU1HWD+4atb0mO2oazE3LM/q0BU8:RsN8UVabBsha9nODawInU8
TLSH
T1853208366C7C5CB75DA2A184F58B36139FB51067DA8A2F90D2EC5E0C01EF6AC234B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a975ec81acf3d9c3674ef667840680fae9e1eeefc8c60e5139e8dadfd769dc22
MD5 e858826d3527230308e5c5ebb22492bf
SHA1 e0b8d4d34a7838ca844972a9c558797889b922df
SHA512 4110a9c0fd041a8a950fbc83ee3a7f60fc22534810332f0d4c4cefe7e43dc77f46483e36b602b8bca40a252f6e5ead768f01b5c33ee82c10fe58d2bb105faf11
SSDEEP 192:uQsbzsN8VQSXs7+3vm+6dQmiU1H6D+4atb0mO2oazEQHM/q0B/C:8zsN8VVabBIha9nODawZn/C
TLSH
T1F782B5F558EB4C72C9AE6347A77D2E035E7CC067B5851A40B3D85A0CCD9A27FD306406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64c132ad-a95b-4b6d-9348-9f5ca4543fcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64c132ad-a95b-4b6d-9348-9f5ca4543fcd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2fd85f6850a0d1608d83e345b00a2827fb8b909587c137047676e2417a8c93c7
MD5 6bd1b65b06cad7890fa34e7aed66ae79
SHA1 74bac45cd78cfa385f7f93029aab4bd5faee798c
SHA512 23c01f5b3d58bf50b862243cc6866384c5f7c98a079f1702f1f495088f46410581d7288e0e0a59b35473ea56858eee8b39bcdb938d38e43c43457d0a28c15989
TLSH
T179410B5CAAFA1148B3B36F5AABF6A97D447F7C331E1A949D10110E4F0662A40CD72737
MD5 SHA1 SHA512 TLSH

Submit Download