90841231ae7cb5280032b1b4910d9d66b71e45cee0fc4274e2a4b02d00956d5c

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forshellAttachBCC/FILE/PHPMailer/docs/extending.html
Size 3KB
Sample260730-fx5ycsdk4v
SHA256 90841231ae7cb5280032b1b4910d9d66b71e45cee0fc4274e2a4b02d00956d5c
MD5 8a93870d6204cdc793eaadcb9310d052
SHA1 83610d92094a41481162ed52102138faefe69544
SHA512 47a07e2bdfeeadd528fceaa51a2b6201eeab881eff91f5d5eaf5df88dbb3d89f613e469f53e4ccc7dee87c32f4e3387871a9f951fe1fcc9d5d5f320bf477d518
TLSH
T11B71B714A9935AE525A7A56AB38D70827C0541073A10F9B078DE43D8CF41C17FF796ED
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298621771293699"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{272BF9D3-B4D7-4CD9-B5A6-A8ADBDFA4D7C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 4772	784	msedge.exe	85
PID 784 wrote to memory of 3440	784	msedge.exe	86
PID 784 wrote to memory of 556	784	msedge.exe	87
PID 784 wrote to memory of 556	784	msedge.exe	87
PID 784 wrote to memory of 556	784	msedge.exe	87
PID 784 wrote to memory of 4560	784	msedge.exe	88
PID 784 wrote to memory of 4560	784	msedge.exe	88
PID 784 wrote to memory of 3696	784	msedge.exe	90
PID 784 wrote to memory of 3696	784	msedge.exe	90
PID 784 wrote to memory of 3696	784	msedge.exe	90
PID 784 wrote to memory of 2420	784	msedge.exe	91
PID 784 wrote to memory of 2420	784	msedge.exe	91
PID 784 wrote to memory of 2420	784	msedge.exe	91
PID 784 wrote to memory of 2496	784	msedge.exe	92
PID 784 wrote to memory of 2496	784	msedge.exe	92
PID 784 wrote to memory of 4864	784	msedge.exe	93
PID 784 wrote to memory of 2496	784	msedge.exe	92
PID 784 wrote to memory of 4864	784	msedge.exe	93
PID 784 wrote to memory of 4864	784	msedge.exe	93
PID 784 wrote to memory of 3528	784	msedge.exe	97
PID 784 wrote to memory of 2368	784	msedge.exe	98
PID 784 wrote to memory of 3528	784	msedge.exe	97
PID 784 wrote to memory of 2368	784	msedge.exe	98
PID 784 wrote to memory of 4636	784	msedge.exe	100
PID 784 wrote to memory of 3928	784	msedge.exe	103
PID 784 wrote to memory of 1844	784	msedge.exe	104
PID 784 wrote to memory of 1756	784	msedge.exe	105
PID 784 wrote to memory of 5056	784	msedge.exe	108
PID 784 wrote to memory of 5056	784	msedge.exe	108
PID 784 wrote to memory of 3020	784	msedge.exe	112
PID 784 wrote to memory of 3020	784	msedge.exe	112
PID 784 wrote to memory of 4896	784	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\forshellAttachBCC\FILE\PHPMailer\docs\extending.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa6ec8c188,0x7ffa6ec8c194,0x7ffa6ec8c1a0
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,9339390158105737430,16046855105754745662,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,917590397164160291,6883785619952650716,262144 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,17732070839737755016,1495489359254510135,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,15873976282315574625,15102939210214911624,2097152 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,6623208221174479683,2362482601962814928,2097152 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,14171831439991647581,2694893206587469171,2097152 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10154635189167137627,6289144499415522596,2097152 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12130227793965748353,2315742525409070300,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7628466879107920033,6717698797466934947,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14242830886335087635,4891455030905772671,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14242830886335087635,4891455030905772671,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,4236478606776065461,5291721321311691809,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10166045787876080944,3964789710757262167,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6675061471546587876,11048938632531158901,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15296533365778033252,13153181080634102401,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7584578638943511802,4199202326165565521,524288 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,5778449108674728139,10101798321851375322,262144 --field-trial-handle=2276,i,1192833553026601121,2766774560176358688,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 81acf9bde763ec5667cd71f1907ba5df78878e8a709e619110be121c092c4796
MD5 3aa814b547bfc81d6952c1826267c82f
SHA1 2a4101bf7aa55f8ea221a1e5d16d7007a5cbf277
SHA512 10df6ee201f981c54a50fa99a4df1e14072fa39f2a99d182349a322927bb22198ec666a31080abacfca9188395f129b25bec5ed1be13bbbce289628aa044ed50
TLSH
T128612828F5320C81E3B12370DAA15A5C38F0CF89DA5B9E5243D864BCC9DA37F85B6C59
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8bfe7be7881ca81c3407752fae39909694da8520e57d8f8cba9e18c6751f43a6
MD5 afd6880e9fb8c81e6c55ad73212dfc9d
SHA1 aab97c1513e26fb3566d2c712d889e38e94ad6ea
SHA512 6f2ee787287294aa7c3c21b2a7b5078c24242bce141693d64e2679a6be9b01b8fdecd5277ee2dd58939596c87db18c97c87eff2563846aff3430526ea80e92ff
TLSH
T11A117AB3C3D5856E891116F06A24AE2BCE2D0A06835C7D1989D4EF2B93E3479E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b139f6ef279d972249a6348b75d2d893196d5ae88681854f8ada9f583a88b838
MD5 caaae2bd7498afa80e95c11e2f85f593
SHA1 f71c75cb8d6beac17693198eb3578444ffd594f8
SHA512 0c6937ffaf72a16e9a123fd6929061844fb80798db2a625b26224840bdfaa88e4c3681a780cc5b93188b7f2a1fadd177534c79aa30179665d1aaa26782607d8e
SSDEEP 192:sxZsRAyM/jK1Ml8MkJ/fIsIg63VSIdpdtHW6+WNGYLztYFyIgrJ:sxZs+MJ/fIsR63VbvHbG/g9
TLSH
T14542D7156B349977CCDBD209BA45BF53D6F90433A2900E88A9FCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 462856245b005641bc3e10a41cc520ca12ed39810c844a1716aa880356406280
MD5 c62002bdc0f9bb2a7ca3438208f7d52f
SHA1 1b8aaf054f58ca1f39978ac7cfd6ed9d3d511e70
SHA512 e7dcdc128e51e5234b53fb8564679d19e32073b94f7abc4051e7151a63d2ba8ac5bf517eca23cfeabfe38d2437f659a2940c8ae1a92183e274d1b7fb7160816a
SSDEEP 192:sxZsRAyM/jK1Ml8UQwkJ/fIsqg6gVSIdpHtHW6+WNGYLrN0BFyIg5lJ:sxZs+qDJ/fIsX6gVbNHbGfgx
TLSH
T1B652D816AA345977CCDBD209BA41BF53D6F55473E2900E88A9FCDA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 55b7187ea2f3d12c2b4181e9fa61bd2bd377ff76bf90541fda78c749218c067e
MD5 74b222b74912758feb4db003bb42ecfc
SHA1 db006a28bf508dcef92e9d6718d991a0975ae588
SHA512 2a87ac4f396780fd7c083af1a1a8d1a5ec02f3a363dc6ccf97d752d6d48fc0f883674bec82bac123ba26d222a0c7c7ac91484ce99fee035ef7af633f81585a4e
SSDEEP 768:ess6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNlrokZ:ess6pD1WvxzWju1jahILIsNekZ
TLSH
T1FED2FB3B680CC77E4F841E5CEC2A6F967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 76eacb427577202611faaa95d3a85e2ab5ff6bedebdffaf0b1d0f02e35d3bb27
MD5 355140b07540c2a70f67ec227c1b9846
SHA1 b958b688603b54bbb3b74873aa452edd2ac5f4fa
SHA512 38cc7aea265969b94d0c5d4330044a480240c20a248b4e3a9c972646895f1bbc81bff8dee99b5767c515ddae94469aeebed74b6330271d660d74aec210cd63b6
SSDEEP 96:KUAAKtePtYhM46SS+4iDlqY+KyLqO+2QYr+ofuVKKOAJ+IKHKS6eUKry3:iitYhM46SSPiDIYYLqOzQYr+ofdxXvo
TLSH
T1FAE1C25771B742023C7E2A4C9794C7768E42B5633024A42B7FAC01765E67E208EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58c0f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58c0f9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 59c617ee6ec86afdcc98cd7ee0e395f693c44e94e5fccc229d1d69a1a294236a
MD5 aa3c4e758f33c4f00e949fd49b14028f
SHA1 ba5da002a4c825108ea7bc4d21cddc63e3027c48
SHA512 9ee35ad500380b575fa7c4c26ee674cb114055245c23b76f58a2cf45c790aacf4f5c82c7546b33ed9dabb2711fd73247b4b1558f9512b1dd73e443810eb1e215
SSDEEP 384:xZcIhsNzUlg0S45Ba9lOaaR3KD4FO6AV5XMux4:ZhG0zUvOaaR3KD4FTAV5XN6
TLSH
T1B8927C312D385C765DB2A545F9863A034FB8856BE7C66A88D0FD9F0C01EB6AC031BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2952198945179c9e44015644b85d1a182861fa4ed781fd41090076301b47347e
MD5 c8e6eb54a67c793430b345b84db9e62e
SHA1 13912449457ac19075a6be6541028a4565f55c14
SHA512 36ecc31529d639577f4be68ef5027263d2134a549a5341805e691058ab24aa6a0863a404de0da57cee69d6d61acf0fd79c10cf1bf15310d0101c430be084d8bf
SSDEEP 192:qONy6O7+3hQmiUyN/Gttb0cO2coGgGD426U6:qONy61GGt9lOa4DR6U6
TLSH
T19402E7356D686CB78EF2AE45F98727279FA8103BE9962F40D6E81E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3c5cc9b7c898e3b68f9561f64a4f6ecc7bf82bd13a2bfc20451693b60730e962
MD5 1c0dcf7efc4ebee59a8d7f560314146c
SHA1 79b526839a0310fe8c5a85029292f9a029bec404
SHA512 86c7bd7c9ad56128b989d21ad9c376428e47c3743f0ee81af42399ce4b70228d415662e56467916926f319866f50d7f6e7f917983907ff369fae0909971f5f78
SSDEEP 384:rZcIhsNzUQg0S45Ba9lOaaR3KD4FO6AV5XMux4:zh90zUvOaaR3KD4FTAV5XN6
TLSH
T194927C312D385C765DB2A545F9863A034FB8856BE7C66E88D0FD9F0D01EB6AC031BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f1db57d660dccaa2a9edf9ff38611f813f7ce35d7fb0f7e339f8fc4237b6a700
MD5 94680e863ff8a8dadb4ebbe193fa81f3
SHA1 c8d86be419cb086ca60fd5aee46009faadda010f
SHA512 df029d7c7f612bcc29ca047baa531583dbcc83f129126edd1ad9a2be033a5eae25dc5604c0700fa54ffc222930b8ee55a05fc2cc81f70c3912967ab4fef97348
SSDEEP 384:DiFiZcIezsNzc8TUNTUlIlQg0S45Ba9lOaaR35D4FO6AV5XMux4:uFQ+hwgb0zUvOaaR35D4FTAV5XN6
TLSH
T14AA28E335D649C7A9DB69E45F98A35038FF84177D6C5AA84E2EC9E0C01DB59C030BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c21e01936dfb7c9099e21a5cef75bc84a39f02db94a21e7092266d73162e5a6
MD5 0b8efa76e9a02365b167119a1530621e
SHA1 dded4b3abd73834ebdb26e0dea8079f710a86d7a
SHA512 a2645d533725c70a9459cee50fd06620fd31ec12d48ed76c5bba1dde59cf72f195bb52c9293366e8c6089279080c764fb455ddc6541a6758caea621ad8615453
SSDEEP 192:LONHh6O7+3gQmiUyE/zttb0cO2coaR0EucND2qqzU6:LONHh6ixzt9lOaaR3/D4U6
TLSH
T13E120B367968AC771EE2A545F9C735134FA9412BDA867F80D5EC2E0C01DF6AC234B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4210a666fef1d2c43c4b8b7621321353d310cce5342bbc54c7340f620f7391c2
MD5 be3e01e1e557a35fa14baf99df5e1439
SHA1 1cc0238ecbc211b42eae6a9e791bde84ad0bf2b9
SHA512 94745d9a9835422c299db468e18a81a20d59d890442da748941267149e49456d928208f28ee7cdf214694608c9d61ec24b065b1b41e243a0a7bf0014b39ffda8
TLSH
T1DE412758ABF91158B3B36E569FF7A56E487FB9372F07D45D00110E8F0662A00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download