hxxp://oneocsp[.]microsoft[.]com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE+VmfUqbVYAAAAAAAAs=

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE+VmfUqbVYAAAAAAAAs=
Sample260802-tsc9face85

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1580	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301611498187976"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{48211E6C-88D1-47AC-8647-430BE182F65C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 552	5000	msedge.exe	88
PID 5000 wrote to memory of 1392	5000	msedge.exe	89
PID 5000 wrote to memory of 1580	5000	msedge.exe	90
PID 5000 wrote to memory of 1392	5000	msedge.exe	89
PID 5000 wrote to memory of 1392	5000	msedge.exe	89
PID 5000 wrote to memory of 4664	5000	msedge.exe	91
PID 5000 wrote to memory of 4664	5000	msedge.exe	91
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 1064	5000	msedge.exe	93
PID 5000 wrote to memory of 1064	5000	msedge.exe	93
PID 5000 wrote to memory of 1064	5000	msedge.exe	93
PID 5000 wrote to memory of 3232	5000	msedge.exe	95
PID 5000 wrote to memory of 3232	5000	msedge.exe	95
PID 5000 wrote to memory of 3232	5000	msedge.exe	95
PID 5000 wrote to memory of 3428	5000	msedge.exe	96
PID 5000 wrote to memory of 3428	5000	msedge.exe	96
PID 5000 wrote to memory of 3428	5000	msedge.exe	96
PID 5000 wrote to memory of 3748	5000	msedge.exe	99
PID 5000 wrote to memory of 3748	5000	msedge.exe	99
PID 5000 wrote to memory of 3748	5000	msedge.exe	99
PID 5000 wrote to memory of 4420	5000	msedge.exe	101
PID 5000 wrote to memory of 3452	5000	msedge.exe	102
PID 5000 wrote to memory of 4420	5000	msedge.exe	101
PID 5000 wrote to memory of 3452	5000	msedge.exe	102
PID 5000 wrote to memory of 3328	5000	msedge.exe	105
PID 5000 wrote to memory of 3328	5000	msedge.exe	114
PID 5000 wrote to memory of 5092	5000	msedge.exe	115
PID 5000 wrote to memory of 2928	5000	msedge.exe	116
PID 5000 wrote to memory of 3824	5000	msedge.exe	120
PID 5000 wrote to memory of 3824	5000	msedge.exe	120
PID 5000 wrote to memory of 3280	5000	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE+VmfUqbVYAAAAAAAAs=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf523c188,0x7ffbf523c194,0x7ffbf523c1a0
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1185830897968676787,16330363595154015862,262144 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17243099949809154708,6788350245185654206,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=796,i,15059505048723848226,6694798988142285752,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,5179076130380663836,9298500748693960766,2097152 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5872293591145807712,183840162795242701,2097152 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,2480148856026829774,3652662157773650986,2097152 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,12192542850246557569,13194053353835720319,2097152 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4492,i,4710907098593079858,10868776669781922063,2097152 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,3894643091280882341,16063702529398291446,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,12143278703148137198,7432056443777758469,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9453535157022534150,1812168097640889392,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9453535157022534150,1812168097640889392,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,107214864185232709,12839994136625909787,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,806055459255550786,12102146349978442518,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,8122443846134361512,9814880993613194831,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,8629031846011446991,7521393654408431668,524288 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,11585963836797127784,18173573028235462740,262144 --field-trial-handle=2512,i,13766349894238141865,11425741876635498381,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5749be2ab4e330301b0b00502de1bde46d56309f37e3ab3b501efa6392f781e
MD5 ab4486aba47617d5f7f939b559e5bc2e
SHA1 f3291c2f3c060c3f4eeedb686fda8d15d5e447d8
SHA512 afff6803188ad93e9af66a330e5337d03eb9fb02867071a46880ae20f3db236cde3355713c1c55235aae1036eca53d9f87bceb67419825038c5773b619079596
TLSH
T13B61F7408E4A0901FF211237D5D21315F87042B93A976EEA426E8BBF440EB61FD3FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 831B
SHA256 c0cfbf26a705bba47d35b51b3f89f3dff21bad08627cdd8a967bdf6d2a5e29de
MD5 d7becd11d87f1cb8b08f91bac5edc1ee
SHA1 98141a433d2e59c5122133bc4b533434707e6ef7
SHA512 f620d64c6bb56602cf1cc56545d35829c386634b9707ff456f226732929f663c0724c10ed4182473b57cdaab45a142f3fde36b93a9dcff02504724d0137560a4
TLSH
T148016BF383E185AE8A1557F05A28EE1FCE2D0606421C7C2585D4FF27D3E3076E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a32533d3d526f92b0aa0e857d84747a4ad88c5f8c8c1f215220e3b77365c38a6
MD5 85e09a96672b963bc6fc8c78206a2cdf
SHA1 489b73f9ccd7acceaee6e589232f3bd029400334
SHA512 7e7c54facaa131aceaab83893d6835080b0e2d0f265f2a28146b57a01b3c10aed38ee7b411c11501c6b39a9f1e4bad7da9f50c3ce9c1448da5465aed8a74bec1
SSDEEP 192:sxZFlkX/fSsFxMIdpwFHW6+WNUR59YL/Iu7+IIg5xJ:sxZFuX/fSsFxVEHbc9b8x1
TLSH
T10B22E8126E38AD779CCBD21DBA15BF13E2F9403290955E58A6FC961C04E76DE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 93914447418446fb5a0e17f2c073cbe78017cd4778fc70e53a3a6ce3a94e98f4
MD5 9f815399db4653b63e4e4c501def5d28
SHA1 d6e564a9198678f26459a19f28eacb68fa60aae0
SHA512 6c385a629a32c95b80a72895956d70837478541b220ad2fd2e1843875225b2cec34f71d0dda0484e4f5b436e279acc53b4f968d663251a54b74a98f2ecb016ed
SSDEEP 192:sxZFlkX/fSsLMMIdpwwHW6+WNUx3fYLAIa7+IIgrJ:sxZFuX/fSsLMVJHbGfWYx9
TLSH
T1AA22D9116E38AD3B8CC7D21DBE15BF13E2F95032A5955E58E6FC961C04E66DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 288b03dded0f5d455e36985fd353b0d0e9dded28dc8940b432322f133e490fa8
MD5 55c128f8a5ec43385c3ed48bda384d87
SHA1 724ee529f93dacde2505bce581f9ca210309706b
SHA512 960b4052a642a08b9de10204ad0be8cb4ff728db5a02688c63bd7de15587bc605d58e315f3d09394170a55cbefcda1c6cadb38772ca793fce7d6e0fcc2947589
SSDEEP 192:sxZFlkX/fSsFMMIdpwwHW6+WNUx3fYLAIa7+IIg5jJ:sxZFuX/fSsFMVJHbGfWYxD
TLSH
T13022E9116E38AD3B8CCBD21DBE15BF13E6F9403291955E98A6FC961C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 602d5682af5b4f7b8a4f03ee566c7827e419b0ddf02e40ea5251721a41c28d91
MD5 5f709c4cfcca8f49e7a74a6adddbffc5
SHA1 268397f27d6003245f6970bbe96589735efcf242
SHA512 1c4ee6934aa23e579373d3af5193c9012aa61bdd3ec0ad4e8b3d9b1d174408804b29c409428c1983839a2ba24892958a6cc514574321e53b849ce09a9dcf0702
SSDEEP 768:EbO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvnroYA:EbO6fP1Wvxz3ju1jaZILIsv0YA
TLSH
T157C2E83B240DCB7E5F801A9DAC5A6F973E9802C7AB588D8047FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ba79308d3239bde385b6dcc8b39d564069522108499867edf7a047b532f26452
MD5 33a16336aff70ec344720894c1faf7a3
SHA1 b2068a72b147e38d736a3955abda1eef2584fdc9
SHA512 35a2db335c7abd8970d5b6f14813e6a4e2386fa37f97ba50ef250c9e73e10eef38c3f4a3457dea5da8c7ac3a1fe80e4557616c0b39693a7177e8de420b42e64b
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28G:KUAAKtePKSsKL6C6GQKTyWSs4KZ29
TLSH
T1C5C1251332BA03026D3E2948925597279E467963702DA42B7FEE40B25DA7E204EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a0e65dc-0395-4cec-ba99-3c6ba3639cbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3a0e65dc-0395-4cec-ba99-3c6ba3639cbc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5c9e58b91bbc57835ef4d1e66be0be10bb1eb272baa672e7d3b3f23debec27e6
MD5 0db8932eebe8ee4830eb71efe67c109f
SHA1 2ed9da06bc82c668b19ba674691b860add6806ac
SHA512 b07f2317a171dfb6d589d742e7935738ffaad78b63a511819cd8da8c01ce271dde07a3c7e773e9a482d141b988b9ff8c8335c5510ddc0abc385bebbc6fa8f507
SSDEEP 384:2iFiZcI8zsNG8TUNTUlIlkm6lOZqAa95O0MWv/1KnTKwBODNZOCAWP:dFQAHwgWp/OOv/1KnewBKZOJWP
TLSH
T165A27E735C689C7BADE6A649FD4A32138EF84077D9856A90E3DCAE1C009B1AC134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f829cb3556e4d46dba417cffa26379a8f1d4d3164b1b7ff577e53754f45dc46b
MD5 7b0b6f949c69a8bb1b8c5bc1b902b160
SHA1 96d689451fe03b58bd4eadd5f85d133d19ac6bb3
SHA512 d615000de1172df86d013ec13e8d93883dfa1b2c72409a1da349d0a8a809685362bb4bbecfbe15665483d595d84ea3d1fc941b1e9aaac502955ff55e8222a492
SSDEEP 192:qONY6O7+3hQmiUybNGttb0UO2rh26gGluSU6:qONY61CGt95O0M8hU6
TLSH
T10A02C7356C386CB75EF2AE45BA8727239FA5113BA9951F44D6E81F0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 52c0f5de2229c30c88dcaefcf6bcf4a08390b4b4ca14cc26fb9782abc44fb201
MD5 275c7f3e3e2210c93367a2b2b4bf2979
SHA1 5154f1040e6d71593a33a9b4d6c0ccf57648fd74
SHA512 b0dc38218d7c1ebd440e1e9764eaafb0324f9bf29c774c715e5960ee3b8299338d4099194873d21addba7ec120d2c022076f6c858282b8f80adc5ce0ea7a2e8d
SSDEEP 192:uILsNVULu5zQTTlN7+3vn3QmiU1TYv4atb0UO2rh2Wv8EsRLM4qVOU8:RsNVULG6lOZWAa95O0MWv/NKU8
TLSH
T1D432F9316C789C775DE2A245F98736139FB4007BDA892F90D6ED6A1C01DF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f55e97a268f046015395b3b9928de8ab8f090833cb300ca8876f28c06b04b6b
MD5 fadc3afe40f9bfbd678f12c598040611
SHA1 aa7be40440691be3b85eddfad2c0f85cc4ac5050
SHA512 c86e65dd7974f231f981885a23f6616af0813162ae81cab8316164f7ebb88b4adc09b6d2d4c1f24487b3963a0475989d433969d637ba7cbe0570cf015d90ee95
SSDEEP 192:QONv6O7+3wQmiUycNgttb0UO2rh2Wv8EsgcN4qVOU6:QONv6uDgt95O0MWv/MKU6
TLSH
T165120A316C78AC771EE2A545F98736139EA5412BDE8A6F80D5DC2E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c79acc7bbd44a605cafa2d6138bfa53187b5e7ec089dd8061f23f05547f22a5e
MD5 39c04613fe2301b31b8086986bb6cbef
SHA1 ed7fe683274e3e200d8c795f6b0937ba241abfb9
SHA512 4423191380ccf167d0fae608eaa70c07aa6ccd12cd5f63dd1a11a879a52a3534eceafb19e52d5e1e1ef6b3271245a57e876fc5ad7c27c581333288e7a2a70e21
SSDEEP 384:wZcIhsNVUkm6lOZNAa95O0MWv/NKnTKwBODNZOCAWP:OhBp/OOv/NKnewBKZOJWP
TLSH
T108928E716C3C6CB76DE2B149FD4732178EF84077EAC52A9495EDAF1C00EA668134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 57c74dd4ac605b7c370191fe89edc43de29013c9104717b989befaea3fb1f4e9
MD5 a331f49e785593e6eeb94985912085bc
SHA1 c8108bff8a580c8c5bd7c552bf942e47fccba588
SHA512 aed7ab95ff4940e5b90fcc95b02898ef8be5da3bcf4f154f1b9e8dcb3b491102a7d6bd32070c4df46aff7f4e564343b5616a21b42c4b3e2d07f6a1286d92b237
TLSH
T1E841E76DA6F90158B3B36E5A9BF6B86E447B79372E06D5AD10110E4E0A73A00C861737
MD5 SHA1 SHA512 TLSH

Submit Download