hxxp://vodafone-nz[.]wm-staging[.]com

Resubmissions

03/08/2026, 03:38

260803-d698bsbf273

03/08/2026, 03:30

260803-d2pe3abp2w3

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vodafone-nz.wm-staging.com
Sample260803-d698bsbf27

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302019233799188"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C99F9588-3EA8-4F27-BF81-8C4934F60700}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 5108	1704	msedge.exe	87
PID 1704 wrote to memory of 548	1704	msedge.exe	88
PID 1704 wrote to memory of 3768	1704	msedge.exe	90
PID 1704 wrote to memory of 3768	1704	msedge.exe	90
PID 1704 wrote to memory of 3220	1704	msedge.exe	89
PID 1704 wrote to memory of 3220	1704	msedge.exe	89
PID 1704 wrote to memory of 3220	1704	msedge.exe	89
PID 1704 wrote to memory of 2432	1704	msedge.exe	93
PID 1704 wrote to memory of 2432	1704	msedge.exe	93
PID 1704 wrote to memory of 2432	1704	msedge.exe	93
PID 1704 wrote to memory of 2532	1704	msedge.exe	92
PID 1704 wrote to memory of 2532	1704	msedge.exe	92
PID 1704 wrote to memory of 2532	1704	msedge.exe	92
PID 1704 wrote to memory of 3800	1704	msedge.exe	94
PID 1704 wrote to memory of 3800	1704	msedge.exe	94
PID 1704 wrote to memory of 3800	1704	msedge.exe	94
PID 1704 wrote to memory of 1096	1704	msedge.exe	95
PID 1704 wrote to memory of 1096	1704	msedge.exe	95
PID 1704 wrote to memory of 1096	1704	msedge.exe	95
PID 1704 wrote to memory of 3880	1704	msedge.exe	98
PID 1704 wrote to memory of 3880	1704	msedge.exe	98
PID 1704 wrote to memory of 3880	1704	msedge.exe	98
PID 1704 wrote to memory of 2296	1704	msedge.exe	99
PID 1704 wrote to memory of 2296	1704	msedge.exe	99
PID 1704 wrote to memory of 2296	1704	msedge.exe	99
PID 1704 wrote to memory of 2304	1704	msedge.exe	102
PID 1704 wrote to memory of 2304	1704	msedge.exe	102
PID 1704 wrote to memory of 1728	1704	msedge.exe	101
PID 1704 wrote to memory of 1728	1704	msedge.exe	101
PID 1704 wrote to memory of 2140	1704	msedge.exe	104
PID 1704 wrote to memory of 3772	1704	msedge.exe	113
PID 1704 wrote to memory of 4316	1704	msedge.exe	114
PID 1704 wrote to memory of 2012	1704	msedge.exe	115
PID 1704 wrote to memory of 432	1704	msedge.exe	117
PID 1704 wrote to memory of 432	1704	msedge.exe	117
PID 1704 wrote to memory of 4924	1704	msedge.exe	118
PID 1704 wrote to memory of 4924	1704	msedge.exe	118
PID 1704 wrote to memory of 4924	1704	msedge.exe	118
PID 1704 wrote to memory of 1012	1704	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vodafone-nz.wm-staging.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,16023635759623419997,17973646040126849095,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10968754405252998768,7358376921322552095,262144 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,5603053333982128945,16432668884847340887,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,4717741777582207960,1218726539579466114,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14000753177177457619,10281627855854179403,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,14920592402531034548,7203710733446222752,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12870117479406053696,6898860913834136869,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,10914107617765399432,3800979755082149747,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,6699554603638770627,1641158818316633428,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15737291465643496093,5161603491974586198,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,16543916514619111323,15554468097098857349,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14511422824976647650,12110807025545949494,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14511422824976647650,12110807025545949494,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,14012161616655933146,17030349956020529956,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,14995980277903597866,13944773021074073975,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,15145365765749188206,2918240286287519034,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,17801110538425788525,13735255002366675303,524288 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3532,i,15955592278212862934,16454348600899930570,2097152 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5804,i,13181975149794419061,18428435255920111059,262144 --field-trial-handle=2352,i,14523047984639799074,11103632007461637550,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e85b0ead13f780523006ec78ba1f44cba1401bc2d7d23b7891be113cfeb9b806
MD5 84399925537bf33809bfbe648a5f30cd
SHA1 3ef36da0379cc54303aa77ca9b9a75ada5a30a98
SHA512 4ef99f0287e57485571c21bbdc1b9791c36660ad06085389dc5eb1684207048b183691af54aaa9e7a0a61dc9d362b6d1e352ae41e7a2d3b2e9da8f568b26fdac
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T19DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f40adfd80ef3f53b9f94e5a880bf0234aa1aea4581bc64ca2ea4f062c6e460a
MD5 df8ae05c60902cdc3f762b7501814403
SHA1 1ca82749005e2c9eeb27019f59394c20efdb0360
SHA512 3f99c3382a2d07aa5cde59d187ee9de74f599b87632afb11433cd6f95756382b60c6be6c1457c746b60c6adf5478a3881bead126aaaf76ca421cd83ff1c5ea92
TLSH
T171618069934204B4CF6317BEF3E0521238F2B4E8350BCF62115079BEB11676C8D3B408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58941d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58941d.TMP
Size 3KB
SHA256 cc877e75dbb60c05153a6b2f6e89e0776f3f704595b932ef02cd9505962331d0
MD5 4505cbbfbae2cfd39fbcb5f2fb089b23
SHA1 c4c65205ca0dca791c43e7a563a8de71beb1b4a0
SHA512 cf679c80d8e21cf2adbf59ad95a9c22ed3e4a2405a99bfa0a107a8680659405303f812d3d96b577f99f8c38adab897d9316b619eefac059b22f1152b8f6434f9
TLSH
T1BC616F69974208B4CF6316BEF3E0531238F2B4E8391BCF62159079BEB11676C8D7B558
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 67b0009c892eff58e56d4cfd682c4f86e0f4d71bb56d0b8f1d2a12f0ce0f2694
MD5 e09a405ef93c4a9100a05ec4d356d9f6
SHA1 fe404a517f55a61df4d5310752729a4f8bd38bb1
SHA512 93be9d33ddbebeab89e46b9ce5fe9d46d12cbf73279edf026c1fedb024d048136f613150054dfb5335c0b6d205939758f4fa47c616164a97a71581ab751c202c
TLSH
T1D711A0F3C3E5956E8A0116F05B18AE1BCE1C0516431C7C1A85D4FF2793E3475D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1186e3c9e77751d744f1eaa62a0ccb128e61d67853e6e5d8cd70470ed3c96a59
MD5 7b7fad562a3b2b6f999493cc7f8248cb
SHA1 34b2a97a3f9b6529f70bba08211c65a2cf8b1efe
SHA512 6fe4c9b60b65683bf64280724251005ca644a10cea1f0f6e852076b5b3e52627ecbced13c9f8502c80156469f304c48d1f2af9a62967bce183dcc7194cd4b872
SSDEEP 192:sxZfRMyM/jK1Ml8Mk+/f/sLyFIdpYYHW6+WNGYwKBU8IgrJ:sxZfaM+/f/sLy25HbG69
TLSH
T197420911AB34A97BCCDBD20DFA557F53D6F9047292900E54A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9d94a3f4afb8475b38e8465ab6fbcc831906fa6613ff6ea45e72103ea6f59108
MD5 95dec476f5b6844a9a63cf06c86d34ea
SHA1 5193b69a02f844d9c0a792862d269f8c03c8855c
SHA512 c7f7b11aa2cb4ab6cf04c6b2548f8d1627048aa052f0ac5ece1c95111130df09ec7834bfed62540545b7e809f64813955d1f92b4d50d9cef6948251cde97900b
SSDEEP 192:sxZhRMyM/jK1Ml8UQ4k+/f/s+8FIdpSYHW6+WNGYwpiL8Ig5xyJ:sxZhaqb+/f/s+82vHbGTDO
TLSH
T12852E712AA34AD77CCDBD20DFA51BF53D6F9047291900E54A9FCDA0C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d7997be7642de822b286ba2c01815188a705bfcb8c8e05e316d57f3652e169c7
MD5 209052d5b2fbc8929ebe2f4f9486a7d0
SHA1 1ba5dd8e30413170203a36981d253815b25518a9
SHA512 1f234d9671977edccbcf096920d7ba6b60bb50ef3e3fb61a17ad08b97498795988f0b247c7c108b3e545219c372fb6c0435a81a30eb2ac37121ea2aaefbf8ee2
SSDEEP 192:sxZhRMyM/jK1Ml8Mk+/f/s+8FIdpSYHW6+WNGYwpiL8Ig5xyJ:sxZhaM+/f/s+82vHbGTDO
TLSH
T19052E811AA346D77CCDBD20DB955BF53D6F5047291500E54A9FCDA0C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 edbeeba6376ce420d3c51a677dc938c663de5ca7b2cabce300cc6c25951b8d66
MD5 0745ceb3c7e662b8080432ea0a38f589
SHA1 c50126002d0f47d2847511fb4e3dac5a4b3a85a4
SHA512 55eac9b92cfb53205346f50c1a7291f54b901b6d19a464b2c2674124862b73bc0da6f54f9202d9b6fd5f4a51fa7df3baab38fde60b67dc7d419f6869ee0db500
SSDEEP 768:EZ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+drroh5cMaM:EZ4jeXmWvmKLEu1jacPLZQdY4k
TLSH
T18DD20A3B284CCF7E4F844E5DEC2AAE976ED801CB5A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae6e0a06ea1cd62ccd74a1ad76236027df5f6140e327ab9a9906188b389b2ed3
MD5 01ba39710f7bd9138ebafa78c6914b14
SHA1 5e849e58f0e7d43913f0d6472860892d186d3c4c
SHA512 cec1273c22095fc6bb6b17e92806b8e47ec49c8b4058321e4adbcd6fbe8db11e129fa4fbe41f85d02937f78a3bfa8d6cb5ca11549ff09726162acb33964f0e7c
SSDEEP 48:KNOfCuD1IxKuEkDylrIBKsIMIaI/Kfa4byo:K41KKuE6mrmKsILa8KfaO1
TLSH
T16E91038A71BF02223C3F695DA5A186170A417A737059F42BBBA910620D6BE345CFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa0fd3fd-eab2-482b-88e6-055a5ffbb048.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa0fd3fd-eab2-482b-88e6-055a5ffbb048.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 67a4ccb896c255efa47eb60d65749c0f63a05968b965d3927d6e441c39e7bbe6
MD5 8fa4098dda1a03b19741278b6d095216
SHA1 e4688d4a2c1d56ce4058812fbcee0ae48102f9a8
SHA512 c7fd13a75196597d98922aa9c412998ee21c9b35d3d758bed36e10e407fcd6c6ff7584cfa9f192aea1dc0b98bbd7f26fe7152eea5b098f09a23bd13a70881ad1
SSDEEP 384:lsNoZPg4+bdHf+o8eHXowFv+/6HlytEDq1bKDi:l1o/x3oevGoy6Dq1z
TLSH
T170724C3595B89C274EA3B645F45B35139FB800679AD97FD4A6ED6F2C00CA2EC130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c2f209a470e3b60d6b251b1813dc3a56c8f8f2b9d8b8a11860332a1af8692025
MD5 d029ca962f127f07573602bc2dd4607f
SHA1 520d84cb37e81cb0f4003dfa1c40d7080ecefe21
SHA512 552ee13ded615995cba7d6d66477f571a78765eaa3138208bfacc64e0f1cc5ab72f7990c38b51184b29d217e1087b438109248c3f751fc97af801d6f555ba052
SSDEEP 384:2ZcIhsNoyg4+bdHf+o8eHXowFv+/6HlytEDq1bKDz:khJ/x3oevGoy6Dq1A
TLSH
T1A6928D3199B86C275EA6B544F49B35138EFC5027ABD86FD4A1FD6B2C008A6F8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ea8b04769e4a4a9ff8c9f3cb2e60cca2febfe4387830105cddc3299312a58069
MD5 02e4c16813dc3f7f2bc5037c78fe6949
SHA1 d9d937f0d881955df93f7298ffe178d18f1c6630
SHA512 017202334bfc9d15123828d9d5e94c5e9b15c6082e2aa9b113f5c087dfb9a53c903f33da3c9e299ca20115660672991ea450b2c623c5cc0a2a1f666922bc9301
SSDEEP 384:eiFiZcIl+isNY8TUNTUlIlyg49dHf+o8eHXoEFv+/6HlytEDq1bKDz:1FQplwgE/x3oivGoy6Dq1A
TLSH
T14AA27E3249B89D3B9EE6AA44F45A35138EF95067DAD5BFD4A3EC6F1C009A1EC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5d0f2b012d85b061549eef4831ae7dac83b39db966a07b375fcea7e7330dffe
MD5 01113fac9daf4aaf6115d2b4fe99fbf7
SHA1 e8860c5daeb05c04bfed5a60392d35f32cdfe01a
SHA512 ed123a729f47d0c3340ec50bc94188b6d80d4e3cefe6e5ff386f888177d7f118fded3f5acc4b31bbb37221d273250d27bda98498e0e26216a548964656889f74
SSDEEP 192:EONG6hZ0QmiUyp/pc/+jVSjzor9oZ5wOZmaU6:EONG6oipu+o8eg2VU6
TLSH
T1B602C835AD686C678EE2AE45F48727139FE8116BEA956F84D6F81B1C00D779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d5b138686d61c0294f0e030f4f62e853cc20dca0bed6436762643ca1cdcbeb80
MD5 7428689fcec62a96988d82ef024e2d71
SHA1 4f5859c90cbee7388fb5a6685b3038bb1d3328ae
SHA512 1250506d2be5541cf2221af695785a0e360b0cd3d0ee322df219cf230bae67f25260e909e974071a757e28967192922c69e48d3c1b289dbc48e9d56209d7a99f
SSDEEP 384:wZcIhsNoyg4+bdHf+o8eHXowFv+/6HlytEDq1bKDz:OhJ/x3oevGoy6Dq1A
TLSH
T123927D3199B86C275EE6B544F49B35138EFC5027ABD86FD4A5FD6B2C008A6F8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c0603fa88ee77f21ee698cce7835b3653d28d260c6e35cf33e2954368ca09704
MD5 2ca2cafc2b9c12439623201e08d0c926
SHA1 2507e736dcb0c5fa7590dde48bbbc87f2efef996
SHA512 55c599ee34678d1b47f889417c9bbb757545719ce63b7ac9d84c4e7517a84dffe2ad6059b27719284eabbb558cba72ea0f6616e81c9df9c6db00a7ae9e7b6e11
SSDEEP 192:pONR6hZ7QmiUyS/1c/+jVSjzor9oHXLEs5cOqKqH+/U6:pONR65j1u+o8eHXoP9v+/U6
TLSH
T1CB120B32A968BC674ED2A685F48731139EE9512BDE897F84D6FC2B1C00DF6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f991d43-04d4-48f9-9896-227b0ba5ca46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f991d43-04d4-48f9-9896-227b0ba5ca46.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed4da119a74581b605a804f60007bfb4b3c2d56e264373c242c228feb19de2e8
MD5 d970d10127aaf8d7742ef83ff7b93bfd
SHA1 dbfced969ad8bb7bbc83a35e00aac7d78ad059aa
SHA512 6be19e1a8adec116abeebe17f5c77f5c9d7d0e577b0b2e20f78406e02a293fbd5150aa36792c638e5ea5c335e92aaa10f1d937f820510fd520855596b2cb944d
TLSH
T1E7412798A6F9110CB3776F669BF6A46D447AB9372F06945D00120E8F0B73B00C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download