a513c43e5ffbf87fcba463d76eb477315a5d003e9654f66080eaaba585fbe743

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.html
Size 5KB
Sample260730-prbl1ahf72
SHA256 a513c43e5ffbf87fcba463d76eb477315a5d003e9654f66080eaaba585fbe743
MD5 c266e37fbf3e1d61e5339f8235ca4b56
SHA1 a4befd520fdaf161040457e104a660cb0be2a1c5
SHA512 5975048ad2c90a9cf71097692d40264186ed820bc52d71a2dd9135e1d7d85a8690a97fc574e6bf303b345767cc68d24c0d734ea7fa3c9678b324598848e2d66c
SSDEEP 48:8XizzH9EgsmvxwhZ1EuFkFGp1tJ9B5AZs9D05tEGmmyJWW8iKGUq3IxjX25o5sLW:LL6OxOZyuFkFGpFNF055mmyJbfJUKwNz
TLSH
T1E7B133561AF31016695390A92BF76B1539E4C203C34ACDB93ECC57A88FC6AC5AD9339C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298887462355548"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{D2AEAED8-9EE7-4563-B792-EE48CC0458EA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1104	4680	msedge.exe	87
PID 4680 wrote to memory of 3572	4680	msedge.exe	88
PID 4680 wrote to memory of 4516	4680	msedge.exe	89
PID 4680 wrote to memory of 4516	4680	msedge.exe	89
PID 4680 wrote to memory of 2040	4680	msedge.exe	90
PID 4680 wrote to memory of 2040	4680	msedge.exe	90
PID 4680 wrote to memory of 2040	4680	msedge.exe	90
PID 4680 wrote to memory of 2516	4680	msedge.exe	91
PID 4680 wrote to memory of 2516	4680	msedge.exe	91
PID 4680 wrote to memory of 2516	4680	msedge.exe	91
PID 4680 wrote to memory of 2576	4680	msedge.exe	92
PID 4680 wrote to memory of 2576	4680	msedge.exe	92
PID 4680 wrote to memory of 2576	4680	msedge.exe	92
PID 4680 wrote to memory of 4952	4680	msedge.exe	94
PID 4680 wrote to memory of 4952	4680	msedge.exe	94
PID 4680 wrote to memory of 4952	4680	msedge.exe	94
PID 4680 wrote to memory of 4444	4680	msedge.exe	95
PID 4680 wrote to memory of 4444	4680	msedge.exe	95
PID 4680 wrote to memory of 4444	4680	msedge.exe	95
PID 4680 wrote to memory of 628	4680	msedge.exe	100
PID 4680 wrote to memory of 2420	4680	msedge.exe	99
PID 4680 wrote to memory of 628	4680	msedge.exe	100
PID 4680 wrote to memory of 2420	4680	msedge.exe	99
PID 4680 wrote to memory of 4692	4680	msedge.exe	102
PID 4680 wrote to memory of 2392	4680	msedge.exe	106
PID 4680 wrote to memory of 4888	4680	msedge.exe	107
PID 4680 wrote to memory of 2464	4680	msedge.exe	108
PID 4680 wrote to memory of 2208	4680	msedge.exe	109
PID 4680 wrote to memory of 2208	4680	msedge.exe	109
PID 4680 wrote to memory of 2132	4680	msedge.exe	112
PID 4680 wrote to memory of 2132	4680	msedge.exe	112
PID 4680 wrote to memory of 3772	4680	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ok.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbf556c188,0x7ffbf556c194,0x7ffbf556c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,14773137642900141881,5178872265898072294,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,14955945952704256344,15646975841925846475,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,516137556655217238,7195191402973348821,262144 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12557422403837195426,3376383489935297057,2097152 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,16475223542335125291,7183056824954948642,2097152 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,16203512325228028575,5389357380733822514,2097152 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,17034390710961166738,7267458909039714464,2097152 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13171311132578227046,7554763955009921069,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10810124637990359095,6726798465181933101,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7405812525955339678,11567689270031975770,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7405812525955339678,11567689270031975770,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10965720215996402963,18276019743466135306,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,1524693639166159352,16849882335186413253,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2974839795317083184,5286445303838236724,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,16450255798267503534,12612062046818250402,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,15415554626674747141,5582992034853713473,524288 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,16905081660214735746,8093528335756968878,262144 --field-trial-handle=2308,i,15723509527483156231,663823772887358211,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 899b70b1c6e89ec59c02467d2d941d30391b79f815779aa5ec905d63bf29820f
MD5 4fee398a9cfeb6e719d755ef1f11ab98
SHA1 7be5561f9d63059b1a48e47d27fa7faee9d1ea34
SHA512 91df80267aacb9a29d32fa64a845147e9640f5b867008b62853a06f3e53a258a6c0cc1e27a3da5a14cc277683551edd4ff900c559452bb04a731e7e54304f68d
TLSH
T1AF61F7008E4A0501FF221237D4D21315F87042B93A936EEA426E8BBF440EB61FD3FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 08989ccb0868db9d99ac43832ba0692c6c2e8a26c76baa45cc0a18a932d0b68a
MD5 4d2a3c136f9c97e3d15a4ac20356ec0c
SHA1 224f306003e96a7350e902cb9d03eb647f4911b9
SHA512 cd9927c4d8ce52b0dcb8060652862249bb100a34108a471a4da2bce30d22df70c2726976385386c183ee75a319b2eff2729cf0e38cffca364675d6de23b37109
TLSH
T1D8117DF3C7D585AE890116F06A24EE1BCE1D0606831C7C19C5D4EF1793E3479E502D5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 397f50a39f87693ee620290a12802530b2ba1e89d675cee02d242d8c97eddef2
MD5 d73110772d2be5da49ee20f7d5bf3c58
SHA1 44569caabff7d44ee50a87c153b2c525ca24d9b8
SHA512 5486935a25bea54b59838f941b22503c59473d46137b47c9fd43bab1834415c77f6163ed2a622126155bbd582195da840a6da36254ef77f03e97b8573092e35f
SSDEEP 192:sxZbRlkU/fXsxFfIdpdHHW6+WNGYLzerkIgrJ:sxZbQU/fXsxFQJHbGg9
TLSH
T18022C7166F3869774CC7D20DBB15BF13E6FA5032A1915E48E6FC961C04E6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8f215e8c8f4ea2f5cca13cd6f83034898b72b1e5091d7611c3d20c878cbb49b3
MD5 fc34fdaf83c15af5b0871a7f4eb4bf9e
SHA1 38e0775f5f9be6fe9469a480c9df9d2c511e6c4f
SHA512 1239327948ee952c80e7c118301275be9b04187de00e9ac4b2f8be0e71ffa11c45fa789a38cddca3a3f6695d72d31b56351cef872934cf0ffd1522cc7506c729
SSDEEP 192:sxZbRlkU/fXscFfIdpdHHW6+WNGYLzerkIg5AJ:sxZbQU/fXscFQJHbGga
TLSH
T10022B7166F3869778CC7D20DBB15BF13E6FA503291915E48A6FC961C04E67DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3916de4b27a467e350d495bd8826e1847ba089cd6b32a8b4c4c8c7a38699ec75
MD5 c918703dfa15b2902458185bfd5c59d9
SHA1 addeb47f972e5d9e668e5f247779396724b28eb6
SHA512 33f03cb109b8399839c47963fe358fd40a2febabc6de237e364e492226d38c85aed9c910cb8e1c09699f751c959e6d3bee530bd41a8e28da28974ab97445d463
SSDEEP 192:sxZbRlkU/fXscnfIdpdHHW6+WNGYLLKrkIg5yJ:sxZbQU/fXscnQJHbGCo
TLSH
T11A22C6166E3869778CC7E20DBB15BF13E6FA503291915E48A6FC961C05E7BCE230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8340a11320068de7a57a24b67740b8024d2444e390749a535dec2ad64a5d25f0
MD5 f70b0af0a8f6d728dba8da32458b0b5b
SHA1 9c08bc1a4c4905d05d1009d5e59821354fa45e8d
SHA512 66f0e1a28a7be52481e8455816661a46caad123ebd51888d13f9189d857957e982efb6ec0984260ff1ec51c2ea34e9c344b91abde3b4a191be33c1b60141dfa6
SSDEEP 768:mhO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvxro38:mhO6fP1Wvxz3ju1jaZILIsvK38
TLSH
T183C2F93B640DCB7E4F801A9DAC5A6F973E9802C7AB588D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 82ffe70a4d9fb8b59bea3d9d800cda177e24350d327e6e21e419a0660db4d143
MD5 28b026c302f74fb6316998635b97e363
SHA1 d4feabdd244e7dd7d6717d65ef0193d331725ae1
SHA512 d52b1c5e78a01f88f2a873212ecf176e456aed6601170a04c693c9b6ebfe7f2397f187a06c42e304b3260631d1ddf4be1ca079d88995b1a33be86f17285efd61
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28kfuW:KUAAKtePKSsKL6C6GQKTyWSs4KZ2R
TLSH
T137C1151376B603026D3E29089655D7279E467963302DA42B7FEE40B21EA7E204EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c7b910a-ee31-4688-ac1f-0276ed29fd73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2c7b910a-ee31-4688-ac1f-0276ed29fd73.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8ad0d644f0517298eb7f441603688d62543fcce40182be88aa535821feb15e66
MD5 29560925aeb1c9a992b5c8187ea239b2
SHA1 0435ae214a2dac2aa58a103f4dfe5e7e5fd17a36
SHA512 63452d545aab206eb87e14848cdff91321a1d9ea90163765db470d50c9ec9190f1df634ad88e5390ed808e989e19657ff8a6d0862a0743b8b9761e5761005e64
SSDEEP 192:uGLsNM+Q/QeZgV57+3vAXQmiU1vxZ4atb0UO2rh2Wv8EsXLMbqR8U8:vsNM+hrVSwvGa95O0MWv/T9U8
TLSH
T1BF3208326C785C771DE3A584B5873A139FB54067DA8A2F80D5ED6F0C01EF6AC230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ff8925291f45b77571c309f07e6d167a0930d149af254a5f007bf1ed522a074
MD5 d22560169d94c0a654159f7f22ff9da9
SHA1 33844f00427bebf272faf6b8198046a1b18dfe9b
SHA512 73bac6717b9e6ff319f7cea4f28d4a4ed85c4193f74dcf71e90a2cee0ae96467d7a0e665ea4e88a31997cf10432d0e5b450779febe65feca54391b4adbc46219
SSDEEP 192:qONY6O7+3hQmiUyE2Gttb0UO2rh26gGSuSU6:qONY61GGt95O0M8sU6
TLSH
T14202E7356C386CB79EF3AE45BA872B235FA5112BE9952F40D6E81F0C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 688f5b7c3b1009f7a4d7ca9d41f32d33c704f8486bea065f2cae364119924db3
MD5 db6898e47024bac79d663d93a45be6e6
SHA1 63a621698a5a74a1522a8ba3c86f19868f96b1da
SHA512 686ef159c16c99ff55b00fd7ed378ecb5005edbe433e7cab907a1e0bfaafae358d6e1a66366b13dc55380571501ac205103488f336ae2439cdcfe07540bd4821
SSDEEP 384:7ZcIhsNMlhrVSwvGa95O0MWv/T9OObjI9G6w7FS:jhTn/OOv/T929MI
TLSH
T156927C31AC385D7659A3E545F58A2A174FF98077D7891F80D1EEEF0C05EBAAC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b6f9433455bab132bf12cfd2e6d03a0c6e03f69258a1a439584336dfb7df6bba
MD5 42b8b9236f03a311ecc777c652f3b1b9
SHA1 34c97bfd6b9be87c188fe0d4ea845993b73188b4
SHA512 d2da33b86136ef63da7e52ab6b706a475c34495493a68425dfada8e16ea6b9f363558aca3ac0c7a141529d347e4af824caa70135d5a45d2eeea459685808a5df
SSDEEP 192:JONF6O7+31QmiUy82Sttb0UO2rh2Wv8EslcNbqR8U6:JONF6RISt95O0MWv/b9U6
TLSH
T10B120A366C689C771DE3B585F98736135FA5412BDA8A6F80D5DC2E0C01EF6AC234AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 92a41e9d4af3a5184a5b5447cd44a352bb21eb05f8682fc3b2afeb10bb9b73ba
MD5 abf88ee839a859c3b6af62e463761146
SHA1 b4a6255899e6e6721152509159d457f02c2ea071
SHA512 94d83aab19f35080e10d4e6e71dadc98ca41058b35695c4f343b5c4a95d7c72b13aa08ea6f1897c49cd24631ad6ed4377d0ff2d29e92c51e20d1ef3ff151326b
SSDEEP 384:ViFiZcIRzsNE8TUNTUlIllhrVSwvGa95O0MWv/w9OObjI9G6w7FS:cFQhBwgRn/OOv/w929MI
TLSH
T1CFA28E339C648D7BADB3EA45F58A26178FF54077DAD56A80E2DDDF0C01AB59C030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f22b52eb45caba1796222a844356e3ac91e6aee83dcef525dea698bbaa637705
MD5 72c77cc5fe199180414ffce56767249f
SHA1 86d103018851e1c44cde2a1d532e0cb3f966ca32
SHA512 62c10b5e2128dbeb481afc586300e3f8df57c4c0f8c203d144df144eac448b32b0e756d691156391b950c1acc4fc46a008be26b114d3360b1ffc6aa22837a02f
TLSH
T1DB410BA8A6F9115CB3B36E5A9FF6A56E497FB9372E46C05D10110E4F0A63B00C971733
MD5 SHA1 SHA512 TLSH

Submit Download