hxxps://brightleaf[.]com/wp-content/uploads/Think%20migrating%20your%20contracts%20is%20a%20simple%20drag-and-drop%20job%20Think%20again[.][.]pdf

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://brightleaf.com/wp-content/uploads/Think%20migrating%20your%20contracts%20is%20a%20simple%20drag-and-drop%20job%20Think%20again..pdf
Sample260803-rx93vsdn2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302413426445562"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9C3B2775-064E-49DA-8E40-3DAD2B3D735A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4856	900	msedge.exe	86
PID 900 wrote to memory of 4944	900	msedge.exe	87
PID 900 wrote to memory of 2060	900	msedge.exe	88
PID 900 wrote to memory of 2060	900	msedge.exe	88
PID 900 wrote to memory of 2060	900	msedge.exe	88
PID 900 wrote to memory of 4940	900	msedge.exe	89
PID 900 wrote to memory of 4940	900	msedge.exe	89
PID 900 wrote to memory of 3692	900	msedge.exe	91
PID 900 wrote to memory of 3692	900	msedge.exe	91
PID 900 wrote to memory of 3692	900	msedge.exe	91
PID 900 wrote to memory of 3496	900	msedge.exe	92
PID 900 wrote to memory of 3496	900	msedge.exe	92
PID 900 wrote to memory of 3496	900	msedge.exe	92
PID 900 wrote to memory of 832	900	msedge.exe	93
PID 900 wrote to memory of 832	900	msedge.exe	93
PID 900 wrote to memory of 832	900	msedge.exe	93
PID 900 wrote to memory of 4476	900	msedge.exe	94
PID 900 wrote to memory of 4476	900	msedge.exe	94
PID 900 wrote to memory of 4476	900	msedge.exe	94
PID 900 wrote to memory of 4296	900	msedge.exe	97
PID 900 wrote to memory of 4296	900	msedge.exe	97
PID 900 wrote to memory of 4296	900	msedge.exe	97
PID 900 wrote to memory of 4048	900	msedge.exe	98
PID 900 wrote to memory of 4048	900	msedge.exe	98
PID 900 wrote to memory of 4048	900	msedge.exe	98
PID 900 wrote to memory of 2056	900	msedge.exe	100
PID 900 wrote to memory of 4808	900	msedge.exe	101
PID 900 wrote to memory of 2056	900	msedge.exe	100
PID 900 wrote to memory of 4808	900	msedge.exe	101
PID 900 wrote to memory of 2928	900	msedge.exe	103
PID 900 wrote to memory of 5032	900	msedge.exe	109
PID 900 wrote to memory of 2576	900	msedge.exe	110
PID 900 wrote to memory of 4372	900	msedge.exe	111
PID 900 wrote to memory of 5096	900	msedge.exe	121
PID 900 wrote to memory of 5096	900	msedge.exe	121
PID 900 wrote to memory of 2396	900	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://brightleaf.com/wp-content/uploads/Think%20migrating%20your%20contracts%20is%20a%20simple%20drag-and-drop%20job%20Think%20again..pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffd51ddc188,0x7ffd51ddc194,0x7ffd51ddc1a0
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3146354228334006130,11669390258663145080,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10303205614135725966,17329453337540696392,262144 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8744430293711151239,2516895172724676186,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,9623195510102783623,2738002657717304418,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14243942010279257620,14140462671279446383,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,9285401246269555657,4005607171992142048,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,113070696195098654,2830700669198920792,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,14153704564161703939,1988668902204726713,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5272,i,11180279383715387567,5979605251371220451,2097152 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4180626088573490019,3533577046398139813,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,4631951564296891971,4993104063401919638,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7109907047002204390,11590386935791220469,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7109907047002204390,11590386935791220469,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,14660708116259119748,786591191330844993,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,2189741967359982077,11283254077477665421,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,11446058039891378253,7235754986936748478,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,9964958401117804306,4211242211640283092,524288 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6440,i,7428829047910917043,13303199534376937884,262144 --field-trial-handle=2324,i,13136723405332041651,9889643028511609645,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ef4e0e1bbcee0e96be8a679acc069777f85e225ffc19f0f22c02542837af679
MD5 9e22390221f7e7b478f218ddd3d38e74
SHA1 b204dc37d34241348e59a7f7faa05490987ea939
SHA512 d5daaf7ded3ab7eeeee3fdd9f77c0d0d24757b64ed687db8d18ee721766f1465113e31b359c28d3c92089f6fe6534b2c5055d83857fccd70298b60306c7d6f1f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T19FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a3bbfed8694029297911e55e37dd3e8bb4757fa56f2014c421d66075a944efc9
MD5 1aaec51feb4b003620e069a1e39b51ce
SHA1 dc161db7eff34a76001602ac9c6156a03f1fe1a4
SHA512 6c76a39d494c77ae07748c4be13297d43f1787b769e66d3d60afe7fd55a7e5c541b263e5ce8ffa5e68f7ab22cc8ec8d2d4c87b3db2247b12fb44b749b710d0c0
SSDEEP 48:qa0lAwlu72XmPb9vWMXtKn0kDgXH41E3mWT4SiT3JyK5tclCS+Wj06DD+H7LNtq:50Rs9v9K0kDE41xSiUktlSBNk7Ly
TLSH
T153811E74028E00A1EB5EA2B9FFC10700F77292EBFF87AE76C552997C980778D8919C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586a0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586a0f.TMP
Size 3KB
SHA256 4ba76cea33d4da5c53e3951bb77ba5d2d3c8861eabb62bcec003ab076f7fa6c2
MD5 803f069d358f6301e32bcde86eba2be2
SHA1 026beb0c7753c47b9b9bd121e9430d861ac236ea
SHA512 06cf3d32fc7f0405738253b8c0fc1dec3070fde802f81e61967860ff96e1548317d14bd073438c024265748c6e54919c95dd3cf181659da0bdaf7472c5c4355d
TLSH
T1BF812D35028E0091C75EA2BAFFC10300F772A2EBFF97AD76C4A2997C980375C895AC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 50165bd5240e01aed60f78c48adc666e8231b3efb2f2d85e9c3558b15e7ba13c
MD5 5202b8796c57b2ce245363a8e83f8b8a
SHA1 89357eac107fe250e8b79923dbd44c3ef90bbfce
SHA512 5d593df6afd9c436aa90c807ca031a265e0680a445d4f21e10aa7647543129e64b9fb0f7e89a9968361aaba30aa0e7c6a4986832e3a0f2e0cc8e0507cf097d16
TLSH
T1C321A0F3D7E4895DCD0113F19A14AE1BCE2E091992283D2AC9E4EF5B93E2072D10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d8274c28d5c58611d92d5bc5352aa56c80d65795c27673bd61e32a94c35dfc3
MD5 cbdf41fc97262d41b230ecf958cc488f
SHA1 9f9a1154798a468e748a160684935d7d3880bd9c
SHA512 ac62ba745cf22998fc5b862d445fb9fd873311b79ec812f1dcba842295df9e8fdd951ac502a01458d62f0e5a9de8cb57846bcebee6ff3d8c999e1b03ca38bf47
SSDEEP 192:sxZnQUny/yM/jK1Ml8Mks/fWsfE8UZCodpgPHW6+WNf84/Yzs0DOwmH+sIgrJ:sxZrny7Ms/fWsfE8A+HbX/iDOTz9
TLSH
T1B252D712AA346977CCDBD61DFA067B53D6F8146396940E54A9FC9A0C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 16b63e438bdc7569a60386a0452a3fe67213db13e2a6e906a9d1bec3d1ed4c8d
MD5 9f9516f63523b227d76515fe49727ae5
SHA1 d4bfe6c389ba549ffe89462cbdd3d25cf45fdd57
SHA512 9743f4690391a6b356de9c673f5d67e72b042c1eff803f87b07356d2d46fceea556297666c5d46d78b1d273d08c1520cc048ec039d0de5c49bf5e7c95c6822a8
SSDEEP 192:sxZnQUny/yM/jK1Ml8UQbks/fWsXE0UZCodpePHW6+WNfjIXYzg0BOwRH+sIg50J:sxZrny7qws/fWsXE0AoHbEXeBO8z2
TLSH
T1DF62F852AA346977CCDBD61DFA427B53D6F8147392940E48E9FC9A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0a9b607c19898f69b4280696f77a8f3504e009ce06b8c373a42088fb994bd69a
MD5 bd393f5e0ef9446ec42b99a9adadeba3
SHA1 a138935c2f92bb7fef0035b20f25746ebfc21f7f
SHA512 35af2a2a1fb102f3759ff989079c2c5bb172291c5aa01f69b24bf2d4ea49a8db637588e0bb8d061c3506279cc52dd6f75047eefa6db9dcd31ef40a18c8c8cbb2
SSDEEP 768:xQW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj+roIMiNavYs:xQW7kf0Wvqidau1jaa5LA3jVcaws
TLSH
T1DCD20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2311550a0acb39276e024606920a2b3ab614cf2813f3003d5ed520d803b1fc0c
MD5 ad99281954b54a0a386c70a062b306d1
SHA1 58e6ad0188bcb4a1cfde550e93edc13aa519f6fd
SHA512 9bd21f14415faeec5b3bd53cd005a1867b4937050fe577e96b45a2aa74c9270214ecae8c675dc4dd560a14cb6bf3237d0b8b8ef2d675b8730870a74f5824a4f4
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBaLZIu:KIbCKcba0K/qmOVGKmc1ZqKiS
TLSH
T15C914F02753F4612387E2C09A26695268E4272A33569A4FF7BB804620F77E150DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ee91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ee91.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 891dbb777da4d1ac2df3a7e0b7298ae8391dee5412511f0a90259e4a96a7ed8b
MD5 9feb89ccd835a62fb78b81752f5eb277
SHA1 19e3e5d4671dc7f1ceaae1e488d968ab3df42dbd
SHA512 93cb424f79dbd5d37ea78a0b605ca40cc4a02730a81699c632fbb9c8d95d8c380b39a47180f27addb3789bd205c94eb5547a2ade035f333fd583f1ec22d1aff2
SSDEEP 384:iiFiZcIjzsNQ8TUNTUlIloH3obaDH3dMjCEJrIO6HlytEDq1OWXl:pFQnxwg2oYX6hIOoy6DqUWV
TLSH
T18AD218F248E7493ADAAE5707E77D2D038EBCC063B5805A64B3D89A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fb4b112dccef0c1aa97c2a71874a466b181e4e4564059811e5b2fc6fe8ddf9bd
MD5 1c4ce8a671d834f16fcd3c6ddd8091a7
SHA1 a710feef991ef0a2677812e0d2bfab602fba78fd
SHA512 58d306047b7c75204e7ebcc55aeec0207e79f348e1c8aeb239e2ed341d244f411973006651a5479933af2dfa3e72f248583bd95b088908fbaa535ff4bdfec98f
SSDEEP 192:MONt64BAQmiUyz1OW5GBPKnn+FdGN9Q1aDWT8U6:MONt6eAwcWMdMRq8U6
TLSH
T1BC020935AC782C7B9EB2AE45F48637176FD8103BE6D51B54E6E82B0C00E764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7226687eee527d8397eeddca80fb04fe912ae6827d7f0595a124db7466f4896e
MD5 dcd32489384f64374be7a55afa7990c3
SHA1 5ae1190e7049566050cd24fb29c9f4723673df1e
SHA512 b29be69d80c5997f442cfa6560caf85290b787cf8de5e4231d34f4b3aadd09c17c9d05169e3391b4311c443fffa86600d1b1278480c85fec48043d52fe40cf55
SSDEEP 384:eZcIhsN7UoH3obaSH3dMjCEJrNO6HlytEDq1OWXl:chMoVX6hNOoy6DqUWV
TLSH
T159929F319C745D3B5AA6B116F4863A039FF84437B7C41FA8B2EDEF1C01DA6A9131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ae656eef4a5909e84b65af40266367fd2f67b6da4d4c77b19f2167f50ba0dc8e
MD5 458c81f431cf3a8f53cf3f4a08b5d78d
SHA1 76a2846dbfaa587864e2ffafdc79746ad54ec38c
SHA512 d9244fe01c1b950108180397de9cc241d335675335f867b04ec17a4d3ef17b553a8a25124770aa9fd38abf09f460dc28cc30614d0787d07c6ba96716b9f050e9
SSDEEP 384:1ZcIhsN7UfH3obaSH3dMjCEJrNO6HlytEDq1OWXl:NhnoVX6hNOoy6DqUWV
TLSH
T1CB929F319C745D3B5AA6B116F4863A039FF84437B7C41FA8B2EDEF1C01DA6A9131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1192e1b-1e42-4012-a67c-1d10f3e70997.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1192e1b-1e42-4012-a67c-1d10f3e70997.tmp
Size 8KB
SHA256 0fe3ddf7f288e60697cf405572094dd9727e48474fd8c95590fc572c809e9136
MD5 68c79214e3a9f28f820ba5990abee776
SHA1 9c2006ddfae53dd17b8cf587a626131c214e5e3a
SHA512 ca0e8310787169138931a6eedd344cd328d3d9b1bc94a3bad29303f52a9029a9356f1eb99c843ba64568aca371d20e4abe7e013079dc82a82637acd6b6fbcf19
SSDEEP 192:FONJ64B+QmiUyhO15GBPKnn+FdGN9Q8XFC1SJrTWwZqnU6:FONJ6e6B1MdMjCEJrfOU6
TLSH
T17D121A31AC746C3B5DA2B555F08736039EE44137EA896F94F6EC7A1C01EB66C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f2f5418-92d0-4c2e-ad95-c1065ffab03b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7f2f5418-92d0-4c2e-ad95-c1065ffab03b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 88b87d2ae9a30238375609614ce070965ad22e4d0c0a7356c96306a9c850bf57
MD5 070ad0bd6abd9719b69fd085cbcfc415
SHA1 1fbadfb85c440aff4a2b435ecff3139834de9bd6
SHA512 6411e6b029b7ae6e8c11b996388d04eeeef3b41c23a94e90ff6a6265816dc541ba37016744bef907511a12bbb12ba9b57615739875c7c7b0827ad8187484c741
TLSH
T1FD412A59A6F91248B3B37F4AAFF6A82D447FBC372F06D15D00110E4E0A62B40C9A1773
MD5 SHA1 SHA512 TLSH

Submit Download