d4a022003ec980cfaf9302264e87e6d9444912a8f922a19013a057a03e93df7b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
artist-kit-sites/drake-kit/faq.html
Size 24KB
Sample260802-plhhcszsfs
SHA256 d4a022003ec980cfaf9302264e87e6d9444912a8f922a19013a057a03e93df7b
MD5 49f91a56f1a930567829d72db50c2ec2
SHA1 4741bc9887fb7b50afc46e9f3fe676a4c3cf6632
SHA512 e730263632691958d079ff3ef8adddf399f2792fee1744437b25ba6a5cdcb6f47c4c4047a97af85c395b70cb306ce726105ba88994468de0b2bbb3183af6e29f
SSDEEP 192:QwvUeDrbDZUljixowSbnHhWhpvH2yKPFImcQfc34ueNmkakJdOuHPTIbUcQfUzk7:NxZZeYF5mPuhqTcbUXi4edPn1w
TLSH
T108B2F82BF250063E656722C1735A47EA30124305FA4671617CFEA32867EAF5AD7372DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301471161528002"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7221E4FE-8AC3-4FA9-8893-34B2ECE00DC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2452	3184	msedge.exe	86
PID 3184 wrote to memory of 4928	3184	msedge.exe	87
PID 3184 wrote to memory of 1760	3184	msedge.exe	88
PID 3184 wrote to memory of 1760	3184	msedge.exe	88
PID 3184 wrote to memory of 1760	3184	msedge.exe	88
PID 3184 wrote to memory of 940	3184	msedge.exe	89
PID 3184 wrote to memory of 940	3184	msedge.exe	89
PID 3184 wrote to memory of 4028	3184	msedge.exe	92
PID 3184 wrote to memory of 4028	3184	msedge.exe	92
PID 3184 wrote to memory of 4028	3184	msedge.exe	92
PID 3184 wrote to memory of 1340	3184	msedge.exe	91
PID 3184 wrote to memory of 1340	3184	msedge.exe	91
PID 3184 wrote to memory of 1340	3184	msedge.exe	91
PID 3184 wrote to memory of 2764	3184	msedge.exe	93
PID 3184 wrote to memory of 2764	3184	msedge.exe	93
PID 3184 wrote to memory of 2764	3184	msedge.exe	93
PID 3184 wrote to memory of 2084	3184	msedge.exe	94
PID 3184 wrote to memory of 2084	3184	msedge.exe	94
PID 3184 wrote to memory of 2084	3184	msedge.exe	94
PID 3184 wrote to memory of 2584	3184	msedge.exe	98
PID 3184 wrote to memory of 4832	3184	msedge.exe	99
PID 3184 wrote to memory of 2584	3184	msedge.exe	98
PID 3184 wrote to memory of 4832	3184	msedge.exe	99
PID 3184 wrote to memory of 4932	3184	msedge.exe	101
PID 3184 wrote to memory of 2664	3184	msedge.exe	113
PID 3184 wrote to memory of 4796	3184	msedge.exe	114
PID 3184 wrote to memory of 4036	3184	msedge.exe	115
PID 3184 wrote to memory of 772	3184	msedge.exe	116
PID 3184 wrote to memory of 772	3184	msedge.exe	116
PID 3184 wrote to memory of 4288	3184	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\artist-kit-sites\drake-kit\faq.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd51a5c188,0x7ffd51a5c194,0x7ffd51a5c1a0
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,12714510649302704576,8767887005788612090,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,6893573855124100571,4597581718604013613,262144 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,10322413916354052751,13076743395786964674,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5789671208844236670,8507443648376628104,2097152 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4251872895757444965,7944372532338302945,2097152 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,11682474324077967421,3824118573699550508,2097152 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,9327983713712234126,15548219854315292686,2097152 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,13019162925076317597,7476476145460389484,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6802967869647630715,5685543399137850340,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,3786005631087259248,14532897627362630606,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,3786005631087259248,14532897627362630606,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,4120914241556386388,9134775507408822703,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,7662246670472840775,6251995457392859591,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14701952431821739231,3265980540523705109,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17113209246700239345,11825532368736867845,524288 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,10920565320170886448,1703638775840952683,262144 --field-trial-handle=2608,i,15390745063066582246,16776764707560856753,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 170dba82c3c1d375809e04168f3ebcd24865503047beaae16ac5acd42a07e369
MD5 3c9aded40c22ce6c2d048535ace0e977
SHA1 c74250e15a13c5f5ac83039050878df1298c44c9
SHA512 2e57432b8359c45e46f3d05d9c6a57eae6ada11c95810c76be1c532993d0a00b71e958c5a942913acd811290e76a78a313f0d89e6f1b2d2cfed07734a97e03a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1E6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 31512982670df4549444d62275b4dd510467a9164642a2e88d97969eded6c40b
MD5 bafb5ddc18cc9a3b378e578acae69f1c
SHA1 da227ba485a619a2bf1beca0c3b9c33cde3eeb23
SHA512 93a84f56a41295f858c5d8907c16c6cce6571eeb0d479944c853b4f0d40591e0a4fd86744d4a88b6e9b61b0caca7c04436bbf078ea82a9b20b579feeabc0b2dc
TLSH
T165812F35028E0091C75DA2B9FFC10700F772A2EBFF97AD76C492A97C980375C850AC45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585908.TMP
Size 3KB
SHA256 176fcd4646a622862198035cbb140f5a8052769d63262d30e1b53dc976c84606
MD5 0030fd96760c4dc834ad5b5c3f0e4ed1
SHA1 38a35705df6873e25399c27016032b0e87da1313
SHA512 d60b4a02f6148d935aa226b16c9c865cc21dbf0df74b9ac652292e58a79a554ba5ebaac6f94d372a1e19bb6e7859012459bdedebd39f767c2503b5660c6e3510
TLSH
T1A1812D35028E0091C75EA2BAFFC10300F772A2EBFF97AD76C4A2997C980375C891AC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 befbf67b99ec69bd66141789239646829ed5460a06d52203c95c426ea07ff32f
MD5 a11b5a82c6c6213647d539fb2209e909
SHA1 21ea74ee75e2988f7d9c3cb09e13a2188b4fb5ba
SHA512 5f9a35a2b409e1af3ab16e2dcaa38b8aaef2743c1713d2d4b34d42ea29c8c254b2628b60a6b2ec74d40a6b3e68aa8a3cee1ee2e6514745c7758d91cb8ea28b4e
TLSH
T1E80168B3C3E499AE8A0152F46A18AE1BCE2D0546831C7D2A85D4AE2BD3E2465E50199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8e77590e491f01d24ddab8d1038ff3c4e5cbccdd97740f5b1bfb0f9ee8c431fe
MD5 90ae3e8ef89643fc777f6bc0b71c8ff0
SHA1 fca6ad4c8812e448bd6c0c7006f8f87f49604fe1
SHA512 3be0fc4f45ebeb474a7b09cc5d76bf220c9275f1726518b35179ec676f7f135f8c30c9864ab3b15178de180df2da98787905a3b7897f8bbda297626ae6e37393
SSDEEP 192:sxZERsyM/jK1Ml8MkY/fys5aj5IdpdOHW6+WNGYzQywMQIgrJ:sxZE2MY/fys5aGkHbG79
TLSH
T17842F9126A349977CCDBD209FA517F53D6F9047392A00E54AAFCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aad3a8e37a693ae902a23d1919437171d1191d2ac560af09afe745b56cd8070d
MD5 ec8246bfa6e9150e188cf000942888bb
SHA1 2fa0a5d127aea4a495147eedd567ec855833434e
SHA512 e69334383ad779e12507785c85e075c65281a1546406bc42cb5c0dd2eaa616ffaa4bb4968ba54dc10fba021d166c64b1eaa64c07098efdcfbc92bdcf46f361a4
SSDEEP 192:sxZERsyM/jK1Ml8UQMkY/fysmdj5IdpHOHW6+WNGYzhhwMQIg5hJ:sxZE2qXY/fysmdGuHbG1Z
TLSH
T1BE52E8126A349977CCDBD209FA41BF53E6F5147292A00E54AAFCDA1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fa22dce1e85219a95f15e10b23b88f347078c17aaf79e59ab28a9fd5ecf45b72
MD5 df85e713130f1a049e45a6917e315856
SHA1 b082de9019ac9d0e373f94524b616876333af4cc
SHA512 940f0d2220236b0633d7ee825ca47ecb3d4e88ceae4eaed6284b4e99548d0981dd9a87cc550f38e198d15b073ead2ac4310f409418139ad98e131267963c3050
SSDEEP 768:KB7lW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj7droI4iDJRYL:K5W7kf0Wvqidau1jaa5LA3jSIEL
TLSH
T188D20B3B684CCB7E4F840E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bbe92694c5e8beac98dd4c95295a50398cb541fe015b56bae550a467409bc54e
MD5 cc933dc991a4e2881b07126100b2a1f3
SHA1 baf8cc17efbb111d2db380e91163820e9370d2eb
SHA512 2c443e3873999c4151ee3e6337d0f298859964e4aba30041d033cdcd735d285bc4e01b991066820bf14ebc1d9df0af5a45e45db953aa609ab9dd4557e563968e
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBaD1Iw:KIbCKcba0K/qmOVGKmct16KOEl
TLSH
T1A6912F03757F461238BE2808A67585668E8272933468A8EF7BB810651F77E110DFFDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f46d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f46d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d07bab14ede9879e99bc7842cacb16996c0bed61132521c22f8c6f2b3655560c
MD5 e0846ad29a99a9a16836f53cebca902e
SHA1 ac821c8d4b72dd0f99da6df0cbbe19c1a5282aac
SHA512 00ed16c93ae0fa1d5632d388ee7de4274feda29961a337cd69af58a91d8a0ba0cef746d6b58ca84161f05bd6c41b5a51047219e5ba992620607459e05cdcb34f
SSDEEP 384:18sNKzfEd1pLbsSCsM3dMjCEJrysnTKwBODNZOCNWz:qFe1lyX6hysnewBKZO8Wz
TLSH
T19A726C366C385C775E92B545F40A3207AFF841A7E6C52E64E6EDFB1C01EA6A81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ebed18205b887fe9490d3dfc275711c06834d2884713ae2aa95bf82f0ce5a890
MD5 0f521e7afb9cc44b3bc3d7147d8ff4a1
SHA1 0476efbc6da3d484c2ad66b99763c155a95364ea
SHA512 00a75bcd9488ae3a495862881b6c7e1ae7749acc750a2b9a1fc5d96e9bfe370794f44eef74188ef7ff2fd85406fb3c381ac135738df69a89cf1761190abb20f2
SSDEEP 384:IiiFiZcInzsNS8TUNTUlIlGUfEd1pLbsSCsM3dMjCEJrpsnTKwBODNZOCNWY:8FQzXwgZe1lyX6hpsnewBKZO8WY
TLSH
T10CA28E735C68987BAEE6AB44F94A32079FF44177E6D56AA4F3DDEB0C00A71A81307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 315d24f2f4608224d3c61f5e1bf2b971861b539e716763418f586874657c5fd3
MD5 9ae092c767234803a19a898f61ae6e35
SHA1 37320ccd31c8875650939ec50c0686f062276a09
SHA512 902c52163ccfa2cf73ee3dfa7245bad536f3e6341256e73aa8caa793825bcd1288f3c412db9f0dbfcb8c76d7040c8ebb0443f44f4252926fd0e5e719bc1c760a
SSDEEP 384:wFZcIhsNKGUfEd1pLbsSCsM3dMjCEJrysnTKwBODNZOCNWY:KhBe1lyX6hysnewBKZO8WY
TLSH
T124929D726C386C779EE6B545F44632075FF88177F6D42EA4A6EDFB1C00AA6681307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07b37c0d1ffa7662bdb6133a73f43e91b3343ee072f41205274bfc7bcde5ce7f
MD5 9e7d9e44d9bb336486ec7a9eed4f9fef
SHA1 794d6ae57e2ffa7259318e2c14e390f944d07556
SHA512 d18ef124b3be383dc0a5af0078e30b374c4df48d41883e2786e89ef20a9f4b89f069f6d4e7cfdb4ee4eee72b75aeb8bcef40be61ea62e88a0d3753f5dd875ddb
SSDEEP 192:MONt64BAQmiUy31KW5GBPKnn+FdGN9Q1aDmT8U6:MONt6eAE8WMdMR68U6
TLSH
T17D020935AC792C7B9EB2AE45F48637176FD8103BE6D55B54E6E82B0C00D765C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dffcd516808bae2fcf1b35ffe69786cc0613e2312f1d751e8de69f789a587c68
MD5 d2ccc30f69123cec189bb0615bca9e66
SHA1 e03f2951c5f47c66bce112345ffeb02ae6060070
SHA512 e53fd61f99348d8849d681af9f48d78330e27cd6cb9f5ce51510fa25938715c67869d5040a904a5430c421604dd6551f5ed13984dd804220dd24552fa33ea946
SSDEEP 192:skONT64B5YQmiUy+Ksc5GBPKnn+FdGN9Q8XFC1SJrKWwJqpU6:skONT6e54GscMdMjCEJrIsU6
TLSH
T1AE121B32AC746C7B5DA2B551F48736136FE4413BEA896F90F6EC6A1C01EB66C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dadccd9-052a-4019-a994-ecc04b202ea5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7dadccd9-052a-4019-a994-ecc04b202ea5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6fb8e2f5536b8a9d6fbfe834d9464404c0e6ed6921184f768ef2a95a6f5e3416
MD5 3c4534e98aa56559191898f565abfcc4
SHA1 9540d2c67e783a7eaa1b2b998762358a297c7795
SHA512 306d4f3212a5404a24a22c6a38d69d9c1b4945fc9175b388653fc9e1a0a1f7bf6cff64c4dd08ec1c8b55be534be0c3c99b717961308856137993f82bf057aedb
TLSH
T1BA41EB58A6ED1144F3B76F1AABF6A46D487FBD772E46945E00050D4F0B22B40C962737
MD5 SHA1 SHA512 TLSH

Submit Download