bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
application/controllers/admin/index.html
Size 142B
Sample260730-pg1hdaxcjc
SHA256 bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635
MD5 d92311600f6632e0f98c0e5777acf431
SHA1 e799bd5ab234730a641b034fb62d5f7ca0461c50
SHA512 0f6c1d055daf7e1ddc565fd70c9a98f38fc3ee874141494cb2c4f3ed41f43b2d4304167592ae7e41ac95af257b92e2074f5ac82a8f4286624878ed402e1bd09f
TLSH
T1D3C08C66220C2C0C52F233B01AC02260219323C002032B255B8451233A1111DCDC218D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298875751325561"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{AC8EA5A2-5749-484B-8D80-79EC0DDD50E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3480	4964	msedge.exe	86
PID 4964 wrote to memory of 2436	4964	msedge.exe	88
PID 4964 wrote to memory of 3968	4964	msedge.exe	89
PID 4964 wrote to memory of 3968	4964	msedge.exe	89
PID 4964 wrote to memory of 3968	4964	msedge.exe	89
PID 4964 wrote to memory of 4900	4964	msedge.exe	90
PID 4964 wrote to memory of 4900	4964	msedge.exe	90
PID 4964 wrote to memory of 1792	4964	msedge.exe	91
PID 4964 wrote to memory of 1792	4964	msedge.exe	91
PID 4964 wrote to memory of 1792	4964	msedge.exe	91
PID 4964 wrote to memory of 4216	4964	msedge.exe	92
PID 4964 wrote to memory of 4216	4964	msedge.exe	92
PID 4964 wrote to memory of 4216	4964	msedge.exe	92
PID 4964 wrote to memory of 2996	4964	msedge.exe	93
PID 4964 wrote to memory of 2996	4964	msedge.exe	93
PID 4964 wrote to memory of 2996	4964	msedge.exe	93
PID 4964 wrote to memory of 4212	4964	msedge.exe	94
PID 4964 wrote to memory of 4212	4964	msedge.exe	94
PID 4964 wrote to memory of 4212	4964	msedge.exe	94
PID 4964 wrote to memory of 3376	4964	msedge.exe	97
PID 4964 wrote to memory of 3816	4964	msedge.exe	98
PID 4964 wrote to memory of 3376	4964	msedge.exe	97
PID 4964 wrote to memory of 3816	4964	msedge.exe	98
PID 4964 wrote to memory of 3996	4964	msedge.exe	100
PID 4964 wrote to memory of 3224	4964	msedge.exe	104
PID 4964 wrote to memory of 2536	4964	msedge.exe	105
PID 4964 wrote to memory of 2492	4964	msedge.exe	106
PID 4964 wrote to memory of 4784	4964	msedge.exe	113
PID 4964 wrote to memory of 4784	4964	msedge.exe	113
PID 4964 wrote to memory of 1764	4964	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\application\controllers\admin\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff94aecc188,0x7ff94aecc194,0x7ff94aecc1a0
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,13499817266892649905,1208131711035972918,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5923747866983100277,6613282023992484343,262144 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,6823593209769790427,18425324834409020375,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,8121360055512276529,7009423845497388153,2097152 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6899640132506366293,18075279129282472540,2097152 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,1867343623233723670,12654298816807318108,2097152 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,16988676186124529514,12710400423695166526,2097152 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,14160025309303117031,4476601979667920109,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,12158368260523678390,5361498273564232853,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,13482917117552226352,9619652516067012196,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,13482917117552226352,9619652516067012196,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,8511700841199689070,13201290923378242040,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6946517864872407753,8489583932820652294,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11289021555153093342,2787743552286421463,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13501570209461712902,17288692402382999370,524288 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5504,i,202892655006510894,11791763768462747461,262144 --field-trial-handle=2300,i,17998184063915508798,13413260507703481182,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5bf1700a42dba9194182a8cf89665c52ad4a79f3f231f858d89f36004fcf6bc9
MD5 87d2452191a35845e789a22993657913
SHA1 f1cb968e02168079d5e235956cd85812fe5c3b38
SHA512 6a5c97b7e4f95a92dd37b6e6a60955122fc718cd22cc1ddeb6f9808879d081dc66b032cd1f4e8ab7dca9d7e10f50097bffafae06a94143fd7a7a31a41101800b
TLSH
T19071513B126209BAD3AA8033D0F323413577AAEAF4235E5917708CB76634B52B15957D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 485db1093ec68276f688f6dff38a6574e6e45ff11fc19b11772b87af2da1afc1
MD5 e76fa7311287a4dfa092caa78d36870b
SHA1 e002d81c13d4952dd914336dae98e9c82173f307
SHA512 0805eb0ca9ff8657f3dc107760555d516846165c80bfdbcadf5c487e7b2b01c1080bd89003a593906f93b254c6726b4598a721afc014d07c6e45ae43273d91ca
TLSH
T12B11BDF3C3D585AE891116F06A24AE2BCE1D0A02831C3C19C5D4FF1BD3E3075E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8aa1e01631955709708a6f0683e1b72dd15117dc0405bb30c37e30692c58c08c
MD5 ebd1ec38c591244503793be45fdbc328
SHA1 1ecedd67e883ee2bf510a7c878f20b52074aa9a6
SHA512 1aacf0e2f6dab330c5bb977df4bf9b90fdf6d91112e566f4ba475b8f47e260ad4d5135c8b9607abfe59cf76bd9c1f562e795d977b1e0dbbbafbab878a02b5a72
SSDEEP 192:sxZAhR5yM/jK1Ml8Mkn/fHsU0FIdpdOHW6+WNGYIk0ud3IgrJ:sxZ4zMn/fHsU02YHbGK9
TLSH
T1D842C6166B349977CCDBD209FA55BF53D6F91472E2900E44A9FCDA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92dc214d6c368af59463560ef50fc2c95d6e514dd8cdbab7f0de5919dd898f5f
MD5 69b865e85003e9490713bd46ad195c23
SHA1 4c2cae32835fd054b939165b2d6da254573e6ec0
SHA512 18e13d25b8633823d8309e6d75183411f1e86b04282ea6fedbf772d1275479460945dc8397e3ecd5a305520355841166d8fca370c9c705286d5e3031d4d82a3b
SSDEEP 192:sxZAhR5yM/jK1Ml8UQSkn/fHsKrFIdpHOHW6+WNGYIv/Hd3Ig57J:sxZ4zqRn/fHsKr2uHbGnz
TLSH
T13052D616AA349977CCDBD21DB941BF53E6F55472D2900E44A9FCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f58b6a78bf8dffed4a5c645c5e14608f5197137bd3d3ded136cc9e7d243b90f0
MD5 1ef3a0372c26bb36da40fe67c33b51b2
SHA1 4af012077947edd6ec8f3772c83a46b747d7b194
SHA512 3e4414f2a7beb39dc6a92e12bd92d5b7b83cbaa992c0eb39512085deac20467862e0a31dcdb65a18004bbd0e83f111e437d7e2122b8756a702419d3651126f6f
SSDEEP 768:VxsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9qroFK6:VxsqxXlWvJD6Tu1ja54LAs9BFF
TLSH
T196D20B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a466cb0e6a5d11d6c1c2c16c9b051f6f18c4202d2a91c8b2b884064cde13f2d2
MD5 a0344abcfe94023262aabe409a905e16
SHA1 4bfac67689704a25664e750574452660feb19564
SHA512 1121189d8ae1b51f5415512af4f487f4d0e836e7f5ae5dd812e4c7c2e251b7a8313529fe000f4bebdc16bdedcdeb3f8e071d1f274fcccd645ee32b11e518fe47
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxC1:ExX/l9ZfK
TLSH
T176E10402713F02033ABD7908A3AA89378E4275A37418A4BF3B7955A14EB7E111DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 35ef31665fe8865da3443bb3a8a98e0863e67ed3b46b6eef9db8286ffa00a9d2
MD5 f1114dfa824dddba4249dfaf65db19f9
SHA1 114f327a5e7a10207427097dab18b958c4a65328
SHA512 9327f51f74da6c48a41087824de35ef47ff2dd26cb356e22d2db1623067a538777a80da6658ff919c23acf50c2fb8afc8b1870f1c0b1cc37b84214ca94eca6bf
SSDEEP 384:3ZcIhsNQWp1butzVRNwOWG9JerOObjI9G6w7aD:/hSgRHwOp9kr29MI
TLSH
T1EE928C326D385C379EB7A155F58B3A174EF4907BE78C2F84A0DDAB0C059B9AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5f801627bfa229671c9902de0512703e67a1a92fe64a218a52a591e8c4c827df
MD5 4634e0b4255f035c3c56f1699f44bb67
SHA1 ee01ff9ebaf2d891ad6af15f3d96e52acc917e9d
SHA512 abfd6a8e7b5853f2e6e2e4a4cdc021bc7657727ec2247a710e5fd23c33da368601832db3b95e6bc15b30c45379d8cb7ad8f017ec5fe12a05e558da09fe783222
SSDEEP 384:sZcIKzsNQHp1butzVRNwOWG9JnrOObjI9G6w7aD:6CJgRHwOp9Fr29MI
TLSH
T139928D316D344C379EE6A155F58B36174EF4903BE7CC1F84A1DDAF0C059BAAC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c3e8394c965cc1b39f0a0e47be8cade9a32226ead889b2adbb9ac1752b9c02b
MD5 bc58ec39269142b1c7689c191f195969
SHA1 5d1eb852438858b164aab67d7edc79b5f31049f8
SHA512 a670c39bb7f790f0a2c9e15921003df1256e8f6a1f6eac5435f0312154bc90dceae21a0673a0aac2182665c1d653b269255ba3950ee2e4e6b9eb72cd912d1ff1
SSDEEP 192:tONg6JkRtQmiUybXW+RNwOmhOmQh3XRQU6:tONg6UrkW+RNwOW02U6
TLSH
T17B02E935AD381C779EF2AE09F58B27135FA5103BEA852F80DAD81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dd5428d803612126c704c8bb90c8a31915a87fb07cf1b994069a27eb95cbe5e3
MD5 0924cbc1d4ace1b47140678b0e35ab02
SHA1 3c31d7f981e00b1c3a7fa19f973e43046de248fd
SHA512 93fed1625e780a9aadf6a58ff9f8d3dc306e3301efe84373d4dda153ae0c3822ac5b2fa3ff72f740b695a7211f5c0dab772886451b119b39fb295ff6a4a452ce
SSDEEP 384:cZcIhsNQHp1butzVRNwOWG9JerOObjI9G6w7aD:KhJgRHwOp9kr29MI
TLSH
T1CF928C316D384C379EA7A555F58B3A174EF4907BE78C1F84A0DDAF0C059BAAC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b615f0ac7bdf0af4d35968e68ea3dbe716d1404fc9ad0d587430dce4f85094e4
MD5 2d041622ceb34515e636491441616b20
SHA1 4b220a458feb0434d5055d83ae6f3c81500f5f07
SHA512 3d232ec97594c43df0cc544e6e409954b01ef8a5a6fd5a649a596beb134a39f312ac6cab3f2cbe902f789646fe0b307153c87550946f6c050e3ef87ac643e3d0
SSDEEP 192:dONB6JkReQmiUySXh+RNwOmhOmVU9DFmVcDqQvU6:dONB6Uanh+RNwOWG9JBrU6
TLSH
T15E1229356D385C7B5EE2A545F58B36034EB5512BEB896F80D5DC2E0C01EFA9C234AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defbd242-f623-4e99-80da-8fd6e5c8a151.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\defbd242-f623-4e99-80da-8fd6e5c8a151.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b157e1fc2459c1fa536312a4d7c9bfc4acb7f9e633f1ed1b6af35d67c74459ee
MD5 9dcaf4d338c5ee842fd89517e5ee3b35
SHA1 3e329b1877af79cdd0725319ed6bb50113ccf25a
SHA512 f2906654a454513bcf1bdd27731fcf933e8559b9e9825fe752109ee294fc9dc05755b83946e2e5f5b8e4e77a037b62ebd308b3dc82b2b44075871377f78b7668
TLSH
T112414798A6ED1158B3B73F5AABF6A86D887FBC372E0AD45D10010E4F0626E41C871777
MD5 SHA1 SHA512 TLSH

Submit Download