25c82a37253bef97f3a28b53951766f4fc594723ce526a5f72baa373e28fb3c9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ywss/index2.html
Size 5KB
Sample260802-pl9lvaaa68
SHA256 25c82a37253bef97f3a28b53951766f4fc594723ce526a5f72baa373e28fb3c9
MD5 1e91cd6d7b86b99f2084908ffba3c54b
SHA1 91ca741624687e96550b814fccdaa359936a756b
SHA512 54d4adba61bdd9a0f6849bdea06d018a53018b39bcf3690c022de1303699c6bb53bfc2a236b79cfbe5ac44d648b8e8a5e82b89e3545db203e98f266126c772ad
SSDEEP 96:MRzEWi0UrlDetllvnyirejCqOtn2K4/DoUZx2i8C:7StllvnPqjCqOt2K40Ub21C
TLSH
T144C18213558C9E27031240E5E043392CD9FBC93BE820DDA079FF15A517E6FD9A26F62A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301472896370824"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{70432CBC-D6FF-405A-A826-0360F9CDCD40}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2516	4524	msedge.exe	85
PID 4524 wrote to memory of 3056	4524	msedge.exe	88
PID 4524 wrote to memory of 2260	4524	msedge.exe	87
PID 4524 wrote to memory of 3056	4524	msedge.exe	88
PID 4524 wrote to memory of 3056	4524	msedge.exe	88
PID 4524 wrote to memory of 3392	4524	msedge.exe	89
PID 4524 wrote to memory of 3392	4524	msedge.exe	89
PID 4524 wrote to memory of 2924	4524	msedge.exe	90
PID 4524 wrote to memory of 2924	4524	msedge.exe	90
PID 4524 wrote to memory of 2912	4524	msedge.exe	91
PID 4524 wrote to memory of 2924	4524	msedge.exe	90
PID 4524 wrote to memory of 2912	4524	msedge.exe	91
PID 4524 wrote to memory of 2912	4524	msedge.exe	91
PID 4524 wrote to memory of 2416	4524	msedge.exe	92
PID 4524 wrote to memory of 4668	4524	msedge.exe	93
PID 4524 wrote to memory of 2416	4524	msedge.exe	92
PID 4524 wrote to memory of 2416	4524	msedge.exe	92
PID 4524 wrote to memory of 4668	4524	msedge.exe	93
PID 4524 wrote to memory of 4668	4524	msedge.exe	93
PID 4524 wrote to memory of 4700	4524	msedge.exe	98
PID 4524 wrote to memory of 4700	4524	msedge.exe	98
PID 4524 wrote to memory of 1944	4524	msedge.exe	99
PID 4524 wrote to memory of 1944	4524	msedge.exe	99
PID 4524 wrote to memory of 3704	4524	msedge.exe	101
PID 4524 wrote to memory of 1808	4524	msedge.exe	110
PID 4524 wrote to memory of 1788	4524	msedge.exe	111
PID 4524 wrote to memory of 1060	4524	msedge.exe	112
PID 4524 wrote to memory of 3980	4524	msedge.exe	114
PID 4524 wrote to memory of 3980	4524	msedge.exe	114
PID 4524 wrote to memory of 4360	4524	msedge.exe	115
PID 4524 wrote to memory of 4360	4524	msedge.exe	115
PID 4524 wrote to memory of 3836	4524	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ywss\index2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa710cc188,0x7ffa710cc194,0x7ffa710cc1a0
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,3429048086789726907,17286371201127678807,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,14748031997579142782,15254707794141446498,262144 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,11701548827931942593,9581141419944379150,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2919714499671202312,2556907803676317724,2097152 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7967082006839267551,16417383741689478152,2097152 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,17184728559528362855,2060689163285567189,2097152 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,16421840382043909484,5493768373593296291,2097152 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,170404930293270317,822512107771607123,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12925685289337682633,5069600955628526458,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15541727179990088565,2355458943656715612,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15541727179990088565,2355458943656715612,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8494652372380988766,18233125909200174418,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,370586809297728870,146089443861802750,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,12321557688057264105,15841822317597427463,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11161836907893822807,9585910641328363451,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6858746275355823741,10198482778004860760,524288 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5144,i,266823808278265888,14863646126757262674,262144 --field-trial-handle=2264,i,6280953105974577319,3762580330546694769,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f9d30355ce9f49b34999ef140e608ea59ef151d4885526ca99fce7a53754b3d
MD5 43a005773cb86bb921ad7a4362fa9b98
SHA1 2f8cc6343d083a00533eb0182b1ad4b2f8e0fece
SHA512 3ace3525701414d548026fb7b8f4a2a30156e74f7ba8f77f090bdafe65f111d9017e1061e3692901165c7ef44c2823b48d8df1dfe72596c7910711a59eec36e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e90fc0921ee4e753a92fa4b97db4b414c3eae7efba5df615f3074c1026300196
MD5 8f1d0492416ae5bbb0cedf1cad8cb1ce
SHA1 ac3dfae51648d915cbb5f331265b6f356c675e9f
SHA512 6e594973e5536714e4acec2aba1aead04a2a044167aad70d2d829ea28bbd1aa4627e043919a6ab8902d6fe7fb8af3c62f00750d4ef224e512128d8f0c3723a52
TLSH
T1BC712DA641B34552F7ED2231D0F23646327EFAD50A0B8F6AF1ECE47F991E765D816008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b503.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b503.TMP
Size 3KB
SHA256 5a05aa53b1044ba23fe201dba4aabf4219f5038fa404113af403998a77e954d6
MD5 4331926c972e4f280a00482cd853d61b
SHA1 857447fec276b2d4fbec33de1f704e1b222e4415
SHA512 a9557f57bc4495edecdabdbc33602360ed1f7c253a7a7f235ec2326c2b5024ead57e0f6a4823e458e09498e445b652fc5294195e883c5ab344fb8a7615e0eb89
TLSH
T1B3714FA241B34651F7ED2231D4F13646327EFAD50A0B8F6AF0ECE47FA91E725C816008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 52fe20167dc71bfe003db345e017d123fb45d2d082bc7f40b5928bfc44d4203a
MD5 bab08dce9b72fed1f482b41b3738193e
SHA1 ae93bb60d3c8ae901e5703da95ce7708930fcc6f
SHA512 4d37559a31600b82623f41dd3aa8fd219c8837043e41a271e759459a46019954bf4d4f5903b5935ba57837e5e435bdacd02f9dc8df5b28d08842d73ced935b18
TLSH
T1C8117DF3C3D5856F890157F09A24AE2BCE1D0A06421C7C2985D4FF6793E3476E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 18f86a4928c5e72c47e581ea003bef8c37e87a4e8fe1e74440b7e8f2790dbee5
MD5 bebe13f31f2cf0961e368bff4368e318
SHA1 c13e4ee577b6ecb78737729b23af7dcd18c677fb
SHA512 4c5da8f4cad74ada7e36563b11b0080cf4a7b4b10c90bfc4e4b9fc0de4254fca71fbd0dea45c2710fa3a2588eb4f302bbd02f6ad18c8f3d7f03814e7d328d802
SSDEEP 192:sxZcRnyM/jK1Ml8MkU/fGs20LIdpdYHW6+WNGYLzhwQnUIgrJ:sxZc9MU/fGs20UyHbGT9
TLSH
T1D2420A116A346977CCDBD209F945BF63D6F90472A2901E54AAFCDA1C04E6EFD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b04db0533a709d7e6f03b57f305832970b44bce910a7f5a32332788a79aaf62d
MD5 3cf8de3b94c57c754475fda5875b9e30
SHA1 773582ccc6efb0ae84b7464b0f53892172e0834d
SHA512 e9892c117a3745107d382a949c80f0a1f3988a56623984aa3eebc271020453556c9f7b3b04e1e8c2442ee6404e835e8146a718e712e9b89c1c4ff56a3c827303
SSDEEP 192:sxZcRnyM/jK1Ml8UQXkU/fGsXBLIdpHYHW6+WNGYLNgw4QnUIg5+J:sxZc9qUU/fGsXBU4HbGFg
TLSH
T1C75209126A346977CCDBD60DB941BF63D6F90472A2501E54AAFCDA1C00E6EED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1d6acf80903c11865fd3b99af5365a10c2bf5d1bcd37ea05713d95e2afaf516e
MD5 ffdd4757aa59846961e968cf591536c9
SHA1 37a7e6c048b73a363ff1063b40ef510c9e6855c6
SHA512 f9fb7c324feda85ff1c5aff901850d1f10e8b3efcc3c353cb9f2646344ad6f68388fa05b459f41e039edfb797fdc0297911204b25f3ef11f3a886534aa805e43
SSDEEP 768:oes6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNProMn:oes6pD1WvxzWju1jahILIsNcMn
TLSH
T1A2D2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c6d537dd3f71ec58dfc0ccbe9dd89672fabed272d9700f7a6b07927870365d13
MD5 99e4ac444bd331b2ed755ca63149efb9
SHA1 912d3a2a3d4c42fa873ee28079f3a241ddba36bc
SHA512 c9f3cdf03fb16d33aa9bfeb3456848db92e323f4a3830abaf6401077b994af04b73106e08ad76357c968266c2b9553b1a502fd5f523abb4b02f1eaa805987de2
SSDEEP 96:KUAAKtePWNKKu0S+FeKWchsAK9aOy+YKT6MHUrXL:iiJFxhjni
TLSH
T16AE16B5673BA02033C7D3B0982D5976B8E82B1637018A46B7BED04738E66E218DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6fd82f90abf0754fae7c0066caa292b9cd9deda94178c00fbd36f2b2394c6536
MD5 c721142c3f2282bcc490fc18ef91bf92
SHA1 99cbdf4bedea256e7a4e4d2249662fb66ea3b1dd
SHA512 8d896ea5e6d5c8d1d30463a5e4aa0446e1946d62dfe1086306785cf6e89426b0b8b3b8222a4e347c4664755668ef9068fabdc3c85e358cc7a61b86a40e952916
SSDEEP 384:0ZcIhsNuOOCeO5Ka9OdsMBAJonTKwBODNZOCMWD:yh5urgkJonewBKZOxWD
TLSH
T174928D316C3C6C635EE2A545F94B71174FF88073EAD92F6496EDAF1C00EA668130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e220ac7e6ac96bf293b65d9121f37b46d8652cdacef8d0b20f424622da1a19a
MD5 1b583e51a241f25ccc0037eca381de65
SHA1 709718efcdc30d92067e9bfa0488019361dfba11
SHA512 1acf4aba9ff5705dc78b4e459ec3af29a5c42d45927386d618193c3f96e682c689712fdb3e23f09ccca82ad54950159d8952f1b76bb621e887c62671b691689a
SSDEEP 192:qONq6O7+3hQmiUyUcGttb0M+Fdsh2uPgGJ/FU6:qONq61wGt9OdsMUJNU6
TLSH
T18A02E835AC386CB78EF2AD46B58737235FA5113BA9A52F44D6E81E1C00D766C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ca4903c63a365a847353883592ae0275e377382d5ab03f9bc0a26dc67583c8ae
MD5 d162f707c47dfbc1cded1d4d438af031
SHA1 355cbaa2ee38c6a41401d0c215c1f51999cbca1d
SHA512 40dade516cf5a7ba81421c9f6756d4e81f460522e17e480d01166ba0b8d2390afa38106bf3c3e4952a4ab2904077503e96c2bbea1d0ff65a7f4db8987478ab62
SSDEEP 384:ZFiZcIYzsN+8TUNTUlIlBOCeO5Ka9OdsMBJJonTKwBODNZOCMWD:ZFQkzwguurgNJonewBKZOxWD
TLSH
T1ECA28E335C2898779EF6AE45F94A72178FF48077D9D57AA0E3DCDE0C00A65A8130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97c5746600c7f01051eb757f5d10493eaaafacc5ceb407089967b7387651fc64
MD5 f308bf2e9ecbe9ad6c0a8df7cf0f12be
SHA1 d4e81c42224e79822a82039bf924caae21b399a4
SHA512 060ab4c2caeb080ec9f2feebb2deac7cb1f7a8b634679b28ceb7fbdb712a7d75ffb8b54b28b9ef0c039dd385b45c1711c4d688823c2b35d3c9687f0dc533fd38
SSDEEP 192:5ONP6O7+3KQmiUyScWttb0M+Fdsh2ue7NTcNJKqpaU6:5ONP64oWt9OdsMBoJoU6
TLSH
T136120935A8786C671EB2A941F48736135FA5413BDE9A7F90E6EC5E0C00EF67C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0b8f06b3bf9ac1533ab9f73279aa85b83bce62aa259cc58e802caab6913db4c2
MD5 2f228902e812c1cc440f2df635831d70
SHA1 2b0c9799dd8443fcacd83a64b7182c93467ffa87
SHA512 d9e190e67a283b5e7d7ea012a815ef27208082caab0642a21a773b519126740c5752fb81c4262e3a17a4c38c2b9b312ef74946b193e2c507bf844ad574965f6d
SSDEEP 384:DZcIhsNuBOCeO5Ka9OdsMBAJonTKwBODNZOCMWD:bhyurgkJonewBKZOxWD
TLSH
T166927D716C386C635EE2A545F94771174FF88073EAD92F6496ECAF1C00AA668130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f032d36da80fca0162fa43565d767468e608b2903bb1b69f8ee4142e0378a1d
MD5 0fe1ae72d146c9ebff0d9f05adf2f79c
SHA1 13ea0d510aab9b269271e1abbfb66675a5e37d3e
SHA512 992d5b44fee19410ff2979c3b378b47c0bcededfb66b7dbb4c7cbd71bbf3fc1f70dc51574536f1055e35e1bb66fdd0e4b8c0e417d688da068941cf0dd1fcb646
TLSH
T14F415658B6F91148B3B76F5A9BF6A96E847FB8372E16D45E00110D8F0A66B00C972733
MD5 SHA1 SHA512 TLSH

Submit Download