hxxp://s[.]cdn-fileserver[.]com

Resubmissions

03/08/2026, 09:05

260803-k2md2afb483

03/08/2026, 08:59

260803-kxs11sseke3

Analysis

user interaction
yes
max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://s.cdn-fileserver.com
Sample260803-k2md2afb48

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302215826657380"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{B564C783-CBA1-4010-8BAD-179C4F0E70A4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5673B148-5332-426A-85A9-BD917BBD542C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4328	4448	msedge.exe	86
PID 4448 wrote to memory of 3488	4448	msedge.exe	87
PID 4448 wrote to memory of 1328	4448	msedge.exe	88
PID 4448 wrote to memory of 1328	4448	msedge.exe	88
PID 4448 wrote to memory of 1328	4448	msedge.exe	88
PID 4448 wrote to memory of 2128	4448	msedge.exe	89
PID 4448 wrote to memory of 2128	4448	msedge.exe	89
PID 4448 wrote to memory of 4480	4448	msedge.exe	92
PID 4448 wrote to memory of 4456	4448	msedge.exe	91
PID 4448 wrote to memory of 4480	4448	msedge.exe	92
PID 4448 wrote to memory of 4480	4448	msedge.exe	92
PID 4448 wrote to memory of 4456	4448	msedge.exe	91
PID 4448 wrote to memory of 4456	4448	msedge.exe	91
PID 4448 wrote to memory of 4732	4448	msedge.exe	93
PID 4448 wrote to memory of 4732	4448	msedge.exe	93
PID 4448 wrote to memory of 4732	4448	msedge.exe	93
PID 4448 wrote to memory of 2636	4448	msedge.exe	94
PID 4448 wrote to memory of 2636	4448	msedge.exe	94
PID 4448 wrote to memory of 2636	4448	msedge.exe	94
PID 4448 wrote to memory of 1440	4448	msedge.exe	96
PID 4448 wrote to memory of 1440	4448	msedge.exe	96
PID 4448 wrote to memory of 1440	4448	msedge.exe	96
PID 4448 wrote to memory of 3264	4448	msedge.exe	99
PID 4448 wrote to memory of 3264	4448	msedge.exe	99
PID 4448 wrote to memory of 4532	4448	msedge.exe	100
PID 4448 wrote to memory of 4532	4448	msedge.exe	100
PID 4448 wrote to memory of 4284	4448	msedge.exe	101
PID 4448 wrote to memory of 4764	4448	msedge.exe	102
PID 4448 wrote to memory of 4284	4448	msedge.exe	101
PID 4448 wrote to memory of 4756	4448	msedge.exe	104
PID 4448 wrote to memory of 4936	4448	msedge.exe	110
PID 4448 wrote to memory of 4296	4448	msedge.exe	111
PID 4448 wrote to memory of 3508	4448	msedge.exe	112
PID 4448 wrote to memory of 752	4448	msedge.exe	117
PID 4448 wrote to memory of 752	4448	msedge.exe	117
PID 4448 wrote to memory of 4600	4448	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://s.cdn-fileserver.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbf900c188,0x7ffbf900c194,0x7ffbf900c1a0
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14379862648412570620,18104636851590733798,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11439164976865205169,12686387068806208475,262144 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,12410638405120340177,8072340524223308630,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7472887733589441943,7261306472658512657,2097152 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2997492787671978476,1535925623798122604,2097152 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,9156794084861596988,3662833372716812262,2097152 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,9826299015483472797,14484709526559967798,2097152 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4992,i,9323971488086371831,12900656621901611225,2097152 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7211106159093837801,4555883910160764212,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4961836326567358442,17332488520929970183,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,6979709744071334743,4699125833290644151,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,380400338639726356,10283412351096401625,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17127927607606044791,9600676789607198540,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17127927607606044791,9600676789607198540,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17693726489791722624,5580407016137895301,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15212089574071863487,569715174160951443,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7559486964340444806,8817418922352109152,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,3311253387231405286,1659884433054946908,524288 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,14216395937858164446,13915398044924300267,262144 --field-trial-handle=2296,i,13998909776237448808,18422518955840729014,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ef4e0e1bbcee0e96be8a679acc069777f85e225ffc19f0f22c02542837af679
MD5 9e22390221f7e7b478f218ddd3d38e74
SHA1 b204dc37d34241348e59a7f7faa05490987ea939
SHA512 d5daaf7ded3ab7eeeee3fdd9f77c0d0d24757b64ed687db8d18ee721766f1465113e31b359c28d3c92089f6fe6534b2c5055d83857fccd70298b60306c7d6f1f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T19FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e92ef1732209b09d82da2e4a4d2d55538c4d7f0a1a1fa30b6d2ef3acf569a29
MD5 8f3554b4cebf7a22719a544b2ca760df
SHA1 c3d8f095952628e7455c78240a781de4bb919430
SHA512 563bbde50e39aec47f583bbab48e42e0017fa5d1d8ec7354ff523a9291f3848bc8305cae64cef1c759589812c4ad0dda8ee0e0fac86015abf2557d7fefbc1c36
TLSH
T187718F472E930CE5F3748FB1DFDA0A383074A8A60F4F2F46115294BD25393649E1E52E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d78.TMP
Size 3KB
SHA256 9faac7ce9294034857073388c78a6d68055282fcc9c68bf361d4e796b122e71f
MD5 f37da63ef4b39b12c47c328f047d66c9
SHA1 fabddf4f6f50b2a6f907e94b5e6ae10c40f9e134
SHA512 4168ccc07dc711ed9f4178b7cb9153ba15b4652c332c7479045cd1325b19f515c3ae90b16985d5eaea4d0c8f523553dda396ebca8e1a170d6e4773d53d368d62
TLSH
T1A2616F472E930CE5F3748FB1DFDA1A383074A8A60F0F2F561052A4BD25397245E5E52E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c341cb0e4ae20ea804c7dcc3e55bc02a0cf1dcfc8581ff81afc7535062a4f1a
MD5 c63677e7e912a2e3e122bf409cb72b4f
SHA1 8326bba58c4d3fbe78f6412a14eea74c1db5b304
SHA512 cba8d4950ecfd293c07257606320c6cf9369242e486e47dcaffd9dbdd58abe29e1edc5fa01a528de7c863d95bff6662247f8c150a64ffc132dc53ae22eb5f1ce
TLSH
T13D41AEB3C2F4966DCB0553F0AA18AE2BCE1E0915437C3C5AC9D4AE1B93F34B1E15095B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f85fa45f2ef77cc2b4bb9397a5a9baa7adc8885fa7fc04ccc09ad82836a45bf9
MD5 8753a481081cef5940e59867f55f66d1
SHA1 690bf217e7409ab0d3489e04f4a9056e3e84ba89
SHA512 02cba777dfab624d3079a80adc972a581d1cc21dc42d92436e4b1ffab8f6534989236b97971876af1fde2a44acd80234e78dec46d8a6addb4dc83fc73d491938
SSDEEP 192:sxZVRXyM/jK1Ml8Mkm/fHskmZGIdprAHW6+WN9Yt4/YHVcJSIgrJ:sxZV9Mm/fHs5ZnsHbI4/q9
TLSH
T1265209126A346977CCDBD20DF946BF53D6F54572A2940E88A9FCDA1C00E6AED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 98fa40c472e263b26f167a76e4265617be439d2b4a9b27a9e6311a89a39d3324
MD5 e06c967a75602ce1ba0542058b3516a8
SHA1 b99b29392ec632c87bea6ce2e37769b88d0b1584
SHA512 ea4c9ebaf14bc2a5d60b1ef90824e75254d27e8f9df2306ecb2a977ea3348d0ff005892228017a66abee84d2133b5ff4b862c8747214b4297e2b0ca670cdf2db
SSDEEP 192:sxZVRXyM/jK1Ml8UQgkm/fHs+8mxGIdplAHW6+WN9Yt4/YHNrqSIg59J:sxZV9qzm/fHs+BxnOHbI4/cN
TLSH
T108521912AA345977CCDBD20DF946BF53D6F4457292940E88A9FCDA1C00E2AED631382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3570da0c12603bef068b3712c61f67b3e75d6fb6dc0036f1ce9fc5f637c9068
MD5 59d20da18a6dc4cccb9b9a4d95bb52fc
SHA1 a69fd8ee45a80635253b3afc697364a65de7cdcd
SHA512 f02aedff0a17e58dd1e10c4295f9330d3ed5712ac6dc3cc7da501ababa98fd41e38fb00d85eff116b01d4a54f0f084ffe86f285d6369135e686bed087cdbff57
SSDEEP 768:xAUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RiroVX0b:xAUZYTMWvg09ou1ja7eLZmR52b
TLSH
T189E20B2F280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 fc6762bb6791343e5795ef4d6be20c69749831e1c2ad5bd8a6b604506b4c13b8
MD5 a21b15ca28dc6043489322366f3fbb9b
SHA1 912b25cf25e8e76b5e172b7cd125c2c0c50c0346
SHA512 10dfe99e28a236e48ce638372ff97be52ffbb3bb215092dbaf8599b84b676b35e0b56018059972a79118c8d6ff87eb172eef7eb56a72128722dbb2d2039e1cb0
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMoo:EMXPoNDJ
TLSH
T183D1460231FB16423DFD3A19A2648B2B4742B5633018F52B7BE810B54E6AE345DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5350a66-213a-4e34-b8d5-eab5a54ef83f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5350a66-213a-4e34-b8d5-eab5a54ef83f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c946035-8d2c-434c-a125-13dcdc1ad251.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8c946035-8d2c-434c-a125-13dcdc1ad251.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c827cbaa388eeae6d9d07f802c655414ad3895488bf368b9fae8f3526cb77b85
MD5 40a3e966f7b7e817868935cc173b862c
SHA1 42cee7145b1a570c9834d1a4e0051a2fc9d5bcb9
SHA512 39db33d1383021812bacc5b0b2b870491f9d2aefdd463bc9ea72b703d1ec797ab511a60d0b745bacf3830cffd645cc26721b5d73d14903cd62f3edb4e6e21444
SSDEEP 384:dZcIhsNtWTTxCxpouzX5od+2OO+ustJrgf6HlytEDq1WCUR:Fhy5OTOOnWhgfoy6DqwR
TLSH
T117927D31557458339EF7B589F48B35139EF88063E7D86EC891EC6F2C04EA5AC131A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0012d66fae5c93443d4ca8b3dd36dd458b3be6c16e9c7d748180eb5cceb904a3
MD5 9edcba6bbf8dd44582685081cee3daa1
SHA1 fd2665448500b60e035c0e8cf25a36f8c7c4783d
SHA512 4381e243b4f4e7c8c74d331ce2f7612ae31d1f77e601584a24a7fd0205f324f2f345eda45fbf764d728f53de34dd71a28a06bcffed3d28175aab5bf3ebbea119
SSDEEP 192:yONC61VWQmiUyengGX5Obd+j6OuL+7/ao3BcU6:yONC6WfgGX5od+2OO+eucU6
TLSH
T19602E835A8286C77DEF2AE49F48737235FA5206BEA946F84D6E81B1C00D765C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3bed594c764aa1d3f572bd288ee7276cbab698165613538c7e2b908d8af3b39e
MD5 ac8e259ed6537a38391d03902d993574
SHA1 9279705e0526a0cd745904b6b821c0fd4cd9a098
SHA512 adae8f4f1d9448700ffc4b71432c92959a90642d94d5d4c87bdc2fbce874a604f094ecf16866481fe6dd112f4042246cfa8354a4c53563c2f4c7e99907567edc
SSDEEP 384:UiFiZcIMzsN38TUNTUlIljTTxCxyouzX5od+2OO+ustJryf6HlytEDq1WCUR:vFQwqwgf5OTOOnWhyfoy6DqwR
TLSH
T1E5D229F244E75836D9AE6747E77E2D038EBCC063B5846A94B3D85A1CCC961BFC30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d77cd0471ec7678334ef1e4c1c4790883f84c7191dca046aef92d02281eba3c9
MD5 aaa6a918ff67ac616bba5407d9e58638
SHA1 7cd9e986501ba0ac99dbdbe95dd22e9f3e63b6ad
SHA512 0e61f2cbc8b8559dea18f416a3e6b5b7a901208999c7c107486ac63c4cf6c7425e45d611e1214200605ce2a7c25c7f22950c0b28eb334f539fd0543125d249ed
SSDEEP 384:RZcIhsNtjTTxCxpouzX5od+2OO+ustJrgf6HlytEDq1WCUR:5hp5OTOOnWhgfoy6DqwR
TLSH
T10C928D31557468339DF7B589F48B35139EF88063E7D86EC891EC6F2C04EA5AC131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80658bbf6bc72c80dc023e5385e4235c5abff9126910786b11a9b3c7130407da
MD5 a3f52ec42306aa8e9802c38545c51927
SHA1 3cc3e1c378c56ac2d3f29d8fb0dc7e7471117c8a
SHA512 68b5b2296f423953ab29742871f9da3dc54524a1e98576a50aeb6478fbe73feffb2981a6f9826d26439b84c60ff568564df2581c905ab8a56181b6b93c3f1c8f
SSDEEP 192:oONA61NWQmiUyEnjGX5Obd+j6OuL+usySJr8jJvqkU6:oONA6mFjGX5od+2OO+ustJrUfU6
TLSH
T1D4123B326468AC379DE2A595F48B36139FE45167EA887FC4C1DC2F1C01EB6AC131AC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d8c0456-59dc-4387-90ce-22c994db0312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d8c0456-59dc-4387-90ce-22c994db0312.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44659b014c0128abec9c23fcd722473920634b35daadb3e5f15119afc636336e
MD5 f310c37be40fa8353a25141b9fbf2b8d
SHA1 63c957720d166f32586f302ad54ef8dcef50ecf8
SHA512 f29605ecccf4fa52c0730501760f3923fe6a6453abcf7a11eb2933dcfbe9c21d88a55d3e868433a9fdd43c01c50f1b6167297e99a7dd0229cda40cceaaf9dcb2
TLSH
T1DD41FC68BAF91148B3B36F569BF2A4AD48BBBD772E07D45E10110D4F0622B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download