441bb98131a9e620e85d48c6b23b9d2521222b8e1a6ca11f07584d1785315a0e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
homexyz/terms.html
Size 28KB
Sample260730-pg8tra1vgx
SHA256 441bb98131a9e620e85d48c6b23b9d2521222b8e1a6ca11f07584d1785315a0e
MD5 987080a393907181f8724553ca76b1fa
SHA1 bbfa69781d5b91807e268f3a29df2099a3744c9b
SHA512 41641f0af02bbfbcb2676ac513577ef16f9da1e90d0302c03d53334d7916d67e0d3f89409e084ab2f093cbd6d1c6d5fc55c56225d442d597ba9816fd65c96891
SSDEEP 768:p1CEV6cEmJIzFCRfeSIwVOTHJ/+fZdgF91Y:p1CM6cEmqzFOfegQ7J/+fYY
TLSH
T1C0D2F76FE34C537206C2016237B3A9D9F36AE13C777994613869402E13E6F28867B5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298875607959316"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{EA7FE91F-4E06-4B72-BFF5-7E8D2B5D1601}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3756	4220	msedge.exe	84
PID 4220 wrote to memory of 4296	4220	msedge.exe	85
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 5012	4220	msedge.exe	86
PID 4220 wrote to memory of 4608	4220	msedge.exe	88
PID 4220 wrote to memory of 4608	4220	msedge.exe	88
PID 4220 wrote to memory of 3904	4220	msedge.exe	89
PID 4220 wrote to memory of 3904	4220	msedge.exe	89
PID 4220 wrote to memory of 3904	4220	msedge.exe	89
PID 4220 wrote to memory of 1112	4220	msedge.exe	90
PID 4220 wrote to memory of 1112	4220	msedge.exe	90
PID 4220 wrote to memory of 1112	4220	msedge.exe	90
PID 4220 wrote to memory of 3768	4220	msedge.exe	91
PID 4220 wrote to memory of 3768	4220	msedge.exe	91
PID 4220 wrote to memory of 3768	4220	msedge.exe	91
PID 4220 wrote to memory of 2472	4220	msedge.exe	92
PID 4220 wrote to memory of 2472	4220	msedge.exe	92
PID 4220 wrote to memory of 2472	4220	msedge.exe	92
PID 4220 wrote to memory of 824	4220	msedge.exe	97
PID 4220 wrote to memory of 824	4220	msedge.exe	97
PID 4220 wrote to memory of 2044	4220	msedge.exe	96
PID 4220 wrote to memory of 2044	4220	msedge.exe	96
PID 4220 wrote to memory of 4540	4220	msedge.exe	99
PID 4220 wrote to memory of 3092	4220	msedge.exe	103
PID 4220 wrote to memory of 4860	4220	msedge.exe	104
PID 4220 wrote to memory of 4780	4220	msedge.exe	105
PID 4220 wrote to memory of 3604	4220	msedge.exe	113
PID 4220 wrote to memory of 3604	4220	msedge.exe	113
PID 4220 wrote to memory of 5004	4220	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\homexyz\terms.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc5d11c188,0x7ffc5d11c194,0x7ffc5d11c1a0
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,11813413392032708039,17023047616479604193,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,7474736307740642646,8146926564347715799,262144 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,17255197939365639767,16274466293221744548,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1375715933670786295,9946277043058620173,2097152 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9615471962093789421,3531220154133777401,2097152 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11698707237525255837,16057788022759773336,2097152 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,12189324955749302658,7616813077083534986,2097152 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,17174292287084717151,8055780166732213067,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,13165677297497358708,15012214774796123519,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2263414197233489243,5954336963453866719,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2263414197233489243,5954336963453866719,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,9316959898559061016,9764047579148603034,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,9037754591679666840,9155900897242904377,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,4195293488696131890,4088841060765246429,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,12978227984247605701,11291131079197473899,524288 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2756,i,4700173145751652518,14877786038942203988,262144 --field-trial-handle=2300,i,13128827695930559320,2782073937784870740,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7d0133a9fe024dd2b230695be204b17846666eea82772e1be951a2f6fdc86e8
MD5 e874acde4d4ef5e73ed088cb98d6fce5
SHA1 0b6ddbc9f511ceeb54b7fbc659280e4b1dca6471
SHA512 f28e1cfab85fb0ce4759d9f4b9213ed47a2bc68c8c6386e737e0324647e363d0155443f5fb220e7d7fe809d97549c18714d9b6388613aca0dd8d0fd754b0b14c
TLSH
T195714CB7034D14E3EB631D32ACC20AC678BA90EDF6377E9A1070DB35C52633101E9669
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d49.TMP
Size 3KB
SHA256 ac94dadbcd7a41487f1c48194069dbaf926a606302f197b6f9901013ac000f87
MD5 9d1b7f80d97f32a95c7523c02991cde3
SHA1 fa5902b88030b9e563210c87a73f998f5c8bb3be
SHA512 e93ae491b9dda93ec80698f5fbc657f743cf4756f9c57f3ffdba11a7da2735eac74124399245dd4f60cd5ffbb9942a55981c7ec3019e4b5dab688707ba8d18dc
TLSH
T129714CB7034D18E3EB631C32ACC10AC678BA91EDFA377E9A1060CB35C62633141E9658
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 df935dca91d887ffbebd6d6dec3c045dc16d0c7c5e79ea922ce417938f44f9f8
MD5 a4c69a499aea15cd27022aae25771712
SHA1 1f1fc45e85f6dc0cef8f86fbfc144e6983cc8041
SHA512 e1a77f85590ea27a76f3ad4809279b95018e2f0b1c39377a0f2700e0df5f5c031d1e1390295f65ee0f821bd0cb5c732ffd18a58517ef183b7310c002bbaef9b5
TLSH
T1A161DDBBC2D8877E845152F4AB296A17CD1D154B82283C568DF9AF0F63E24B0E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7481d38eed43733f46857fed36046614ae618c4034a3c6a28558e2f52eaf888e
MD5 e054f0285d32ef0143adc3597a9e879a
SHA1 5c59c2b8eceea094865be8a17d298e3044123b5f
SHA512 af1423ebf51692fac4dfddeb9b8bbb70e621d176cb285199f0dff832059f29288fa4500202873e04925534ba6a350617f60d194f88bea394a5b06ad8c422a255
SSDEEP 192:sxZGs/yM/jK1Ml8MklH/fFHslq5aVVxIdpdLHW6+WNGYvrvjktQIgrJ:sxZGs5MlH/fFHslq5Y6BHbG4L9
TLSH
T10142C8156B389977CCDBD209F951BF53D6F91462D2900D44A9FCDA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 86c3774cfadd40561163dc26ffc70e3cbe7e344d2a76a14d9cb679b32da92500
MD5 d7f48005b7d888cc7304fceafa2753f7
SHA1 c0ec4f23f71bd2f1ce1c35d3f1397cce8870d7c7
SHA512 a89cc8c1896d51a27beb4d84f74c9fca919b434b8f7fc6e045f4e22da30298b8cf92fae979335005c9fdae928d6fd146e5830335058083a29ea4cdc54bd7fafe
SSDEEP 192:sxZGs/yM/jK1Ml8UQmklH/fFHsaqgaVVxIdpHLHW6+WNGYvtyjktQIg5MJ:sxZGs7qNlH/fFHsaqgY6rHbGbLu
TLSH
T1FC52C6166A389977CCDBD20DF951BF53D6F51462D2940E44AAFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44388b1e7ce60062e0d4a09c7ed18117b8585bca04d85447cce0406f5d742681
MD5 6f4e365b3df6107f4b292a8a6cf3d5d3
SHA1 3dd819474f2f31b9a18345941984bc668d53162b
SHA512 6e3425a17c732b5a41ba6d5fc02f691951a780d524eb80eb54e6e3ab34c5724c3ba9eb2979225a1da6121d067436f3098986b2959404997bac447076a1e01f58
SSDEEP 192:sxZGs/yM/jK1Ml8MklH/fFHsaqgaVVxIdpHLHW6+WNGYvtyjktQIg5MJ:sxZGs7MlH/fFHsaqgY6rHbGbLu
TLSH
T11952C7166A389977CDDBD20DFA51BF53D6F51462D2900E44AAFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 eeab3a0e48a2cdca44d7b67de749c4a24429e77037a0eb7eba6e474a7a8038f6
MD5 87724ad93dd2e3c45ef5082649b23b91
SHA1 1f3cbb12430b62f6f5f13bd5d75446d3604469bf
SHA512 7b37c38ef8f93ccc8974ea547843163776db159beb9fbee9af5d1f9933854a8956455ac0b01d1ef363a191d4ef64fdbb55e9a5f63d17fb066aea37838ce4d544
SSDEEP 768:/bseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkrofV:/bseJ3xWvhfynu1jaVcL88pvt
TLSH
T12DD20B2B680CCB7E4F844E6CEC266F966EE801CB57984D5487FA880C02C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d45e9cefb22a3257057f92aedaca731f69cd40809bec2f0447e4ce3118852f7e
MD5 276f83f30635f678020ba54f67c4518c
SHA1 d82603f3139c31051e8443fc845350299b364e14
SHA512 f412f93559fba52ce3e3c8683ca9d9f91ec414b9cabb09e2dffd830c838da48cbb833d6df62164daf45e576250185d75cea26f52713a9a67ce042c22d73d4755
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EC:KYHIhKggkXyVDIdKYMAPyJiI/KXq08
TLSH
T1AF911606747A12023C3D2988B2E2D5364F4539A3745964EFBF7844A68E67E210EFD8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591af1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591af1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e8838ae299aedcb68e53c302ee19ba82e5bd162556bb5fc281434aa308f9e179
MD5 099273d70516106b4f634978aac7e255
SHA1 c2daa912c7dea2a1e8cbf3fa3785af4c20de38de
SHA512 6a91b514610d065e211ad4720e2e1270b9261b85232734db4fd34e7f34c6fd9940f2ffb7daa795e046a28c1db9ef6a1bfecf4f2d2594bf28570e6068a770d0a4
SSDEEP 384:HUiFiZcI7zsNO8TUNTUlIl+r7ERAAO9d9xW+2mBbc:PFQvXwgkkUElmBbc
TLSH
T1D0824B735C68C83BEEB6EA45F54A32034FF59067C6D4AA94F7DDAF0C019669C130AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9957a06f1f3270253c3d8d0fd30c6320c512d60c001cc9ea0b75bca5f74bcd74
MD5 0dc84091af4bb366a8abe36a5a5322ad
SHA1 ca4164d2ba7943bda34b8fd89ac6e1a395733f01
SHA512 b879cac54a40e3d92a0b39250e08e5e54d3a544a114ad012ef9c243e91b8a515c73cf9d42f2908e5966c936b8eeee926c292c8e840767f88bdb4622f7f024311
SSDEEP 192:lONP6vMtPQmiUy6/ThTH7+FdLJxf847YLU/u:lONP6UtRFTmd9xHOU/u
TLSH
T18A020835AC786C7BEAB3BD4AF48A27171FE4116FE9905B54EAE82F0C00D765C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5dff1e51ce91845fed14b48221fc60179865ae7c1d4a7ab33f28223e50e59552
MD5 2f416bcc5d47539fd2d3a4cc75bd64fb
SHA1 8333be3ad52209e8d922085498d0e382ab2b483d
SHA512 5e3e8a88d537afb8e287481fb1cb26a8a2e7421a7d95a272ad88df29d6f09f2e689f78a88b0011ae8dfa21e2cd3924fca73c795153212930c4fda022cdab2fc5
SSDEEP 192:uq1LsN+IQ0xy/M7EvJAQmiU1/Gh4MTH7+FdLJxtQ+2X8z1HqKvi:vpsN+Ir7ERAAO9d9xW+2cBvi
TLSH
T14E424A76AC788C37AAA3A545F04B32035FF5916BDAC46F94E6ED6F0C01CA79C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f0526eb9ac7df58c5d2e1bb5b538847f3d3e83b0a8b7faac9b27de75489c4481
MD5 9aa280a66a0587d0bebce67d9a503de9
SHA1 7c16d094cb459632c040a9f71daa1cbdcf8e4989
SHA512 3ec3e7687e9dd6c18a9b0508b4284ac1cabe9ed7c41d30b0e62ee87f938ec4f69b3dea00651d59456f8a36a0b57fdce23f90b9056edb53b33101aeffa1ae2a29
SSDEEP 192:uq1m+xasuheOwQxMGsN++Q0xy/M7EvJAQmiU1/Gh4MTH7+FdLJxtQ+2X8z1HqKbc:vmZcIhsN++r7ERAAO9d9xW+2cBbc
TLSH
T16D626D725C789C3BA9A7F145F44636034FF99027D7C85F54B6EDAF0D01DA6A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 db562b9e072691e0f41e94d05a0d69acdf10f3c987bf88ba303d9717699e2e39
MD5 169ed07087d041d54c17457dcc9f465f
SHA1 4710d87e11ffb0f40c701f04759f91e1cee0ac3d
SHA512 638de82e4071b71376c0e69651b032cc78505a563519f5cf91a38b6a791c7e7c2091b70921ebc79163f20bb7001b3d6d03a45e4f2d8454898306882dbe1e9cfa
SSDEEP 192:mONv6vM/PQmiUyS/qhTH7+FdLJxtQ+2S80IHqKU/u:mONv6U/Rvqmd9xW+2bBU/u
TLSH
T1F0121B76AC68DC27AE53B545F08B32170FF5926BDAC49B51F6DC2F1C01DE65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 585B
SHA256 25780ebca69053389de75d59094ea0901029a80f6aeaad883e3cad31092955cf
MD5 75e63592fbaf84550290250de698b09d
SHA1 c93121b04fd6598bf6366e1705c8ca73bc9dd2c3
SHA512 f3b6810e0e1dece632ae682a4acb4a3a365c6389e995c4b7a445c580c43ade1bb332a73f13fcee8a61add1763a5fc152aa5eaa750d293edc376e8945cfc3abae
TLSH
T14DF0E733F024C679CE9983F255415A0A50E4128545C67357FC32531019B38DFCAD1A97
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 a47c5cc6152989e813d903a5e49ec4f5b4a2131253c15b1395150d1ee6c02012
MD5 c1ddc8942f99109bfeb089e97557e441
SHA1 ba3724c518048de3b65c43ff0960ec686670f7a7
SHA512 3135d2b0e9c27dbcdb1bfad1a1bbf2147d8c548d10c03fc6482735ab3b0798a3f14d40dc3c031d9474f7a7aaea4be40ffad7bbf1bfdc21efdc565ab1608ef0fc
TLSH
T1E9514C657A9247BA8D652E7A9F00CBA57D9CCDA41AB70080C32209A5858B0E71C033FE
MD5 SHA1 SHA512 TLSH

Submit Download

dd245915-f9bf-4301-9c69-3252df8608cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd245915-f9bf-4301-9c69-3252df8608cb.tmp
Size 11KB
SHA256 4170547503cb35d4bd51c742e0d881cd65823cb61e381469ffed55699c5b536c
MD5 d84488e3419ae8dc1f9784778c5e5654
SHA1 e0e6c30cab40be40821427bc816a891795586f8f
SHA512 0b326b67454c3620e7be0c07758a6318cc51b568368f7426ec0cdd8b81a539ee7c205072d986410ea1657af2b988da93dd239d141569abe380d382aabe722533
SSDEEP 192:u+1LsN+3Q0xy/M7EvJAQmiU1/Gh4MTH7+FdLJxtQ+2X8z1HqKUMZ:LpsN+3r7ERAAO9d9xW+2cBUMZ
TLSH
T1FD424B32AC789C37AAA3A145F44736035FF5912BDAC46F94F6ED6F0C01CA79C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f91bbd478f1cf162dd6a0f2fda8634c3b7387d900cb08525d0f3ccd0f387b1a3
MD5 a4ff1d8c5d5499c2b5c7745e76299943
SHA1 68c1c5eca8639bead4ef024e746ae386e8762f69
SHA512 7b06cc13d265ac23f1e75e46d0ca3987f839256691045364ffddd2fe26adf4c1af8aa30fe4c3190fd00319004959ab3305322d242c0f72f5e3aadbde194500c4
TLSH
T1E7411A5CB6FA1154B3777F5A9BF2A8AD487FB8772E06D45D10110D4E0A22A40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download