15f46a6da981ef9b867f1a1a37e0d818562b345e30561d2330152158d11dece7

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
artist-kit-sites/don-toliver/privacy.html
Size 5KB
Sample260802-plhhcszsfs
SHA256 15f46a6da981ef9b867f1a1a37e0d818562b345e30561d2330152158d11dece7
MD5 bbd92d75bbead5d8a5a69427945026a0
SHA1 0386d76e9d21948130b45fdafc60a963bf5ba515
SHA512 a1b08a2eccc36687575df6db42d8df8dce8c014ed5f64f94a81fbad44780e5df18798b4ade062e76f5f17cbcdf4dc34b52adaa0b4c570838440611294b0e2487
SSDEEP 96:2t29oeSFW0xH7XWH0LMk11t4F6Qrj8xGAv4+fNJHxushNA+tNVi7Mywk/sTOlQ+:2tjePGNLMk1rpQvmg6Rh77VDywkkTS/
TLSH
T13AC11A16F285113B91CF11513B89ABE5BF54E094632909127D7A82888393BB2E6B73CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301471204188097"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{93277DF2-689C-4CE1-BF4A-E4499F3D333B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1772	2372	msedge.exe	83
PID 2372 wrote to memory of 960	2372	msedge.exe	84
PID 2372 wrote to memory of 3060	2372	msedge.exe	85
PID 2372 wrote to memory of 3060	2372	msedge.exe	85
PID 2372 wrote to memory of 3060	2372	msedge.exe	85
PID 2372 wrote to memory of 4452	2372	msedge.exe	87
PID 2372 wrote to memory of 4452	2372	msedge.exe	87
PID 2372 wrote to memory of 2428	2372	msedge.exe	88
PID 2372 wrote to memory of 2428	2372	msedge.exe	88
PID 2372 wrote to memory of 2428	2372	msedge.exe	88
PID 2372 wrote to memory of 4800	2372	msedge.exe	89
PID 2372 wrote to memory of 4800	2372	msedge.exe	89
PID 2372 wrote to memory of 4800	2372	msedge.exe	89
PID 2372 wrote to memory of 3752	2372	msedge.exe	90
PID 2372 wrote to memory of 3752	2372	msedge.exe	90
PID 2372 wrote to memory of 3752	2372	msedge.exe	90
PID 2372 wrote to memory of 1888	2372	msedge.exe	91
PID 2372 wrote to memory of 1888	2372	msedge.exe	91
PID 2372 wrote to memory of 1888	2372	msedge.exe	91
PID 2372 wrote to memory of 3404	2372	msedge.exe	95
PID 2372 wrote to memory of 1964	2372	msedge.exe	96
PID 2372 wrote to memory of 3404	2372	msedge.exe	95
PID 2372 wrote to memory of 1964	2372	msedge.exe	96
PID 2372 wrote to memory of 2848	2372	msedge.exe	98
PID 2372 wrote to memory of 1172	2372	msedge.exe	114
PID 2372 wrote to memory of 1884	2372	msedge.exe	115
PID 2372 wrote to memory of 4152	2372	msedge.exe	116
PID 2372 wrote to memory of 3540	2372	msedge.exe	118
PID 2372 wrote to memory of 3540	2372	msedge.exe	118
PID 2372 wrote to memory of 3304	2372	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\artist-kit-sites\don-toliver\privacy.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,2795590263960612426,17440416223867747098,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,15470505177072425537,12699122706616679734,262144 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,14257305359683276945,526135138344405387,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,18029488790257658577,18336011404889766644,2097152 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16979544827175916387,4915438728852921267,2097152 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4595120911282981608,15224414602594329148,2097152 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,18111689731554084500,12576783465096955557,2097152 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17799504171438664468,9756446146188868283,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,11864141388838831255,14591393519735659735,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,17534351584449327933,14857206692771781807,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,17534351584449327933,14857206692771781807,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,17504785820668230287,10509453466985244041,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,13241969318021853037,16358283484798608307,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,8306868538043475513,14216364443630582739,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,4607037475681993140,9933185322977926573,524288 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,13487009555575319738,9779095030674680395,262144 --field-trial-handle=2320,i,10158455373649703713,10414331789119172599,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 48259ec4105c3b9f4087c6b4382a4b958de0c227970e8c38a8ef418cd9c62d05
MD5 6237ca49791bd763052913ec70e56fd3
SHA1 ebd81c2bd6eabfd4125e19eb8f95d9ff96146a4b
SHA512 9335d93c3c687fa67b4e9f01755595db5d6679e567af13f836b2d8ca1d20eb2e246c9683e989b2fc47114102411d7714887eb2ac612b2198bdbe8c2930ff7dc1
TLSH
T16871F755334248B6EFD6013DCCE206C17AB1B299495B0EAA15B09F7E37CC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c01f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c01f.TMP
Size 3KB
SHA256 1649aa80e9c8fbe1511eb5c4442b3d9a009d5b2dd41705d0b8f8d135d83a33ff
MD5 0f68b006c086791ed9ec86789f4cdcfa
SHA1 128b45711a7167fd7b75047a97f19d0e48dfbaa8
SHA512 76b198a6fdacac6af53fe85a45f6330d6eabf86ba138b732b550da973889107dc1bdf090d865cd290b8c8069aeecf3f88991f73f9a3c23c9f18f54f15ce3fdda
TLSH
T1F571F755334248B5EFD6013DCCE216C57AB1B299491B0E6A15B05F7E37CC72F0D2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 dc06c6155b6dc21522fbad0e3919294170037bdeb0d8e063a671682fb5967303
MD5 eb98caa37dfa5f8c032802b4fb40a64d
SHA1 f8e488ee7add9ce734739ff0c31a96094c7521c8
SHA512 0458e6b84711517c19663b109b3ef6ac5d83bcf69c364b763859bbb1c274a4bf75d4df5ebd403c520250bcc5387114ba329cba553d04517b886bed935ba88244
TLSH
T166F09EB383E0957E8A0052F05A18AE1BCE2D0442431C7D69C5E4BE2B93E2065D40099B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a25b38c8a3015fd4d2a1a4682323218f4f566e979f9508f2682d804499cba44
MD5 bb213b4d46aea542461302c6e3dc4c00
SHA1 daa47b22d3d72aca2a5d253e92b47d40ce584438
SHA512 cbfbcf782ef90b06813bbf36592fee6bf4b14eb180a921644a760f586a3d747d5fa896a3d00343a8a464ed7135f968f2bf5cb23791d6bdbf89294d5784521f4a
SSDEEP 192:sxZIV/yM/jK1Ml8Mkr/f4sIQIIdpd5HW6+WNGY4wDOdIgrJ:sxZIV7Mr/f4sIQ5THbGj9
TLSH
T18942E812AA346977CCDBD20DFA557F53D6F94473A2900E44A9FCDA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2ea0e8b9f85b756168e4547987b1ad26caa0c06abcafc527c46aefad47458b30
MD5 2903efd9dd34e02fb9852f930a56bc39
SHA1 b402b5a0cb3260f4f4eab2f447142a71e0a38f6a
SHA512 ecf7f802aa11502c475c19ae0196c2bef653da4ee0f8faf9b0e79996fe7cf23bed5d6b610c8974df57c496a2c8f7b33ddd2fc0ed9862b908299bc738e8b0a882
SSDEEP 192:sxZIV/yM/jK1Ml8UQwkr/f4sK9IIdpH5HW6+WNGY4RUOdIg5pJ:sxZIV7qDr/f4sK95ZHbGvJ
TLSH
T17052E912AA345977CCDBD60DFA557F63D6F8447392900E44AAFCDA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b0cc63ce3888e0246f04d10ac69ff5cc83e67f9e527599365923626aec1e3aba
MD5 41ddce047f42f99cdd2084d7fff63312
SHA1 06bc95d90e0d671516e0623669b14894f525cbce
SHA512 82a4ff57a688318c4dd18868efa28dabe5eb67e27244bb6ef16ad65f78052b184b2f8393df9d8b3d02ee482aac43e63d2f863ace7028ef52979949772bbc68c1
SSDEEP 768:hZ8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdaroPkZUnS:hZ8iJPNWvx76ru1jahALocdRSUS
TLSH
T157D2FA3B680CCB7E4F844E9CEC266F966ED801CB5A984D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc24834e-6eb2-446a-b9a9-92d9d4e5f42a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cc24834e-6eb2-446a-b9a9-92d9d4e5f42a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f381f081f2a44dda4712b6bcf144a1e5a4bd162be2d64313522dfb4d4e24b3a1
MD5 76f84749f7ef64d71ffa034708b795d4
SHA1 99f72065abafbc4f7e696fd8e9d76fce156d3ec8
SHA512 c5faaed3324296c86ee3356d04d3774e433e75c65781cd8a7fe307472d22402dfc7f9b5cb29926ed7a64d1058cf8db13475f54d534e79e8db1600bbe46ef3b08
SSDEEP 192:uObLsNe9QlZVm/fQmiU1Hog4k03tjzorYbraEXH6FBLIJqkmU8:dsNe9MMZCPkM8YyEXWmLmU8
TLSH
T1E8321C3268786C7B5DE3A555B44B3623AFE4402BDBC93F94D6EC171C04DB6AC130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3f34e96c72c4c3f701eaec8f749c6dea6f44660bcebc4cae18fc10fbb82205fa
MD5 e427979118dcab5da7527a9dd78765ea
SHA1 b14dc43f3f5ca8cd1537386ce0c46b3aa6671b9f
SHA512 6a33d3829f7d032b4e44bafad4958c1ad4f82075311af5376378497027c9dcc72d3e844b59ddf49f3968564df00fc639bf61b600304508fe4dad15b8bb971d46
SSDEEP 384:9iFiZcI7zsNu8TUNTUlIlfMMZCPkM8YyEXWmLmnTKwBODNZOCU5s:0FQvfwgW0MFLmnewBKZO/s
TLSH
T1ADA28D739C68983B9EE3AE45F90A32139FF48067D6D57FA4E7DC6A1C0097198130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9192149881c17f86259c888a264c8a29e44ea18ae1a1969926ad3395031b965e
MD5 9a0b872e9546efb4a238e95b2ecdade7
SHA1 22783fdb3ba169169c264c7095c3b5e5c36b001b
SHA512 e88827a87e6c8296df6a2e249a818026e1b9051920fea742842199f09af7c527dbc9b08e0c6a6b1752f2fd7594f7e1a06f9d63a97886991e3099c6af096e7c75
SSDEEP 384:YqZcI7zsNefMMZCPkM8YyEXWBLmnTKwBODNZOCU5s:7vW0MgLmnewBKZO/s
TLSH
T111928E72AC786C3B9EE3B505F44A32175FF8806BE6D82F64D6EC671C00D6698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cbefc5602988cd8345668d1c128bf34ffb22e04a97498130668b9175c30474e4
MD5 b004620c09f9e5740c07286b97268270
SHA1 a46b82e94cfd3a716718d49aacc036b90de6d26e
SHA512 95b3498d2c958ba5aacf43cc9fb0bb258a3f8f6f6e8b0c02ebe584b8efb9ac83fec24971d196d7b91c0787e875da54dc7671f40d34b5461972a1ede94edc2060
SSDEEP 384:NZcIhsNefMMZCPkM8YyEXWmLmnTKwBODNZOCU5s:VhW0MVLmnewBKZO/s
TLSH
T129927E716C382C7B9EE3B505F44A32275FF8806BE7D82FA4D6ED671C00D6698130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7a3cebf91df389a52c2e8ee03e6cff5dd9fed1b90f3e93eeb756c1894df3f25
MD5 ef2708c7bdd8e0ae85b14962f8743146
SHA1 3d57a337602d9469b5d28622d9dcbb2ffde1cbae
SHA512 6ecab59608aa6e73cedefc823b0e88bd086183f4c0acd58ebdab041432de8998492495baf5d3697a0992f7833c5bb1680e15d13504da33c0a16bf99b10c48892
SSDEEP 192:gONS6kDfQmiUysoZ903tjzorYbracQiIzU6:gONS6ghmZ9M8YyKiU6
TLSH
T11602DA3568782C7B8EF3AE49B44B27275FE5112BEA952F84DAE8171C00D765C2346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92d7f4b8880fb473a0cb5ed3f0053035fb5966c70689498b96a5da2e1e4374bb
MD5 a364da6ff16e05deb539a31b5c10ed18
SHA1 b9887b062fe4e1e52a08553c9d0a43de0e97f94b
SHA512 afc39a917f96ef40f095c4f1770700c2bdd9b0f0f93fa8b44a415a9885ffa8783e035889027cdfc7e2c2a59ace4ef88b4e0aea2a0f73a55d003711ccb70dffea
SSDEEP 192:UONf6kUQmiUyqoN903tjzorYbraEXH6FNcRJqkmU6:UONf6JiN9M8YyEXWiLmU6
TLSH
T162122B3268786C7B9DE3A945B44736335FA5412BEB897F90D6EC271C04DF66C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a84ba6c-f38d-4cd6-9713-f692591f299b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9a84ba6c-f38d-4cd6-9713-f692591f299b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aff7c73cc9286134cd3c10ef51ce5eaacac1324584c0e2196d35c403cd13824d
MD5 01bd168760b0ea6fa9bd92d0f24b4cf9
SHA1 41ace8ae5a6744bb0903f673c06db099e07632c0
SHA512 87872f66ba6543aaf347b32e62b441fe718f10591cad2947f6fb0ecd670b9219ed458df91aa314239183e013968ac7d363cb548a4da615c9bc2345dbf77df60c
TLSH
T10141D358B6E91058B3B76F5AAFB2A86D443EB8762E06D45D10120D4F0A63B01C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download