048909013fefdb6011debc148656970ae6959b6dbcc0796ff77d319bb6650053

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
redirect.html
Size 5KB
Sample260804-ajrwpaaa46
SHA256 048909013fefdb6011debc148656970ae6959b6dbcc0796ff77d319bb6650053
MD5 9be5078a10851635cb6d29ff7848f7cc
SHA1 683ef29fe19a7d1d36f5c1e828d938ca29204d06
SHA512 0ab0fd6ac6f8b9e79c5e70b9711bc66dd4d419ed130cb7c832518e3c98bc7a795f484a78fc37928897a58b97489290884eb04f6446d155c589f30142d8ca4b14
SSDEEP 96:PNyltoXZzIEb0EaW87H9V6UIW8I4LKJ4rOuEg+Kgs2uoUmYYYYzueh8iHmw:PN0tkCBjpIWr4qCHHPoU1Y5ykGw
TLSH
T1CEC13CD3DD3B200237B65B77D4B6B3588A23B198FE044458E940DB2DEADDF16011A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302764549603094"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{724E42EC-73B5-4E87-86A7-90EF2A744989}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4592	396	msedge.exe	85
PID 396 wrote to memory of 4636	396	msedge.exe	88
PID 396 wrote to memory of 4440	396	msedge.exe	87
PID 396 wrote to memory of 4636	396	msedge.exe	88
PID 396 wrote to memory of 4636	396	msedge.exe	88
PID 396 wrote to memory of 2612	396	msedge.exe	89
PID 396 wrote to memory of 2612	396	msedge.exe	89
PID 396 wrote to memory of 4264	396	msedge.exe	91
PID 396 wrote to memory of 4264	396	msedge.exe	91
PID 396 wrote to memory of 4264	396	msedge.exe	91
PID 396 wrote to memory of 1856	396	msedge.exe	90
PID 396 wrote to memory of 1856	396	msedge.exe	90
PID 396 wrote to memory of 1856	396	msedge.exe	90
PID 396 wrote to memory of 2388	396	msedge.exe	93
PID 396 wrote to memory of 2388	396	msedge.exe	93
PID 396 wrote to memory of 640	396	msedge.exe	92
PID 396 wrote to memory of 2388	396	msedge.exe	93
PID 396 wrote to memory of 640	396	msedge.exe	92
PID 396 wrote to memory of 640	396	msedge.exe	92
PID 396 wrote to memory of 3412	396	msedge.exe	99
PID 396 wrote to memory of 3412	396	msedge.exe	99
PID 396 wrote to memory of 3872	396	msedge.exe	100
PID 396 wrote to memory of 3872	396	msedge.exe	100
PID 396 wrote to memory of 3920	396	msedge.exe	102
PID 396 wrote to memory of 2996	396	msedge.exe	109
PID 396 wrote to memory of 2604	396	msedge.exe	110
PID 396 wrote to memory of 2016	396	msedge.exe	111
PID 396 wrote to memory of 4916	396	msedge.exe	113
PID 396 wrote to memory of 4916	396	msedge.exe	113
PID 396 wrote to memory of 8	396	msedge.exe	114
PID 396 wrote to memory of 8	396	msedge.exe	114
PID 396 wrote to memory of 2228	396	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,11000367027812529649,13433785979696182521,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13470924035714958260,9418282596575447765,262144 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,17806355301470823885,1787101661254209047,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,8962723950975611082,7497591210125442968,2097152 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,10564155399528545683,11510264784514248034,2097152 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,11809845959944624253,10865402310676281023,2097152 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,930100165079098727,7211212011684827468,2097152 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,16038207943878727117,16112586071310993521,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,16827978263045513282,2416058662469162009,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9063004296611960142,17732875716827625782,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9063004296611960142,17732875716827625782,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,15395385896361231716,12097936747877700666,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7555159029135046562,3154070685545175211,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,5021520562577088181,11917930044696131391,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17574318049125848798,7480354724724922048,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,10390315344932492036,6090661882089941917,524288 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5040,i,15530080297504039127,9022288661408812613,262144 --field-trial-handle=2608,i,4066508927536660494,7773150417701870091,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
MD5 855cd69f46ca80eb69346c8a580ca6b8
SHA1 edabd216a3773be95b50c047ece50793ca1b0403
SHA512 3eba5699e57eb3f6a05ab94cd60ae66b60f73621303363a5393ea34f2b8a556e243a128d41829e64f21b76f4c24cd5978cf832f4255309101adc2b7bbcb1babd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 94e6106bd46ff82ffdc0a919d1a6f5ff6ddc38788b3ef7d985dbd005ea45ca88
MD5 b99fac96cdc83b0c85f90788d90f8eb2
SHA1 b11940e6f566ac7a6822b483bd792c385eb48cdf
SHA512 096aa8d2631870f4bc2f494eec2804caadde1fdca9b80fdf228e6dae91be6c21c23f6ff8e0bece633b28f40aff38a5eb7a575d949bad97d9f5fee7ece0c52ed7
TLSH
T1BC61F9590E15549DEFD31631E5D123B97AB4B3878E8FBE55421CC8BD6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585416.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585416.TMP
Size 3KB
SHA256 36bb195887d29f1c60ee5d70d6278e8403945c9bcf48e791287f1c133b7c5578
MD5 b81f5ea8d5780884d28e255c0a1ea5d9
SHA1 084a8fb01f37465f060e2b24b9081e37c3b28d42
SHA512 5b0d45fc77aa6ef30e13005f3f04cf4f7a4bab25c7569383e1e9b3b8de62bfe7a37e3ee9678643451d948d601f04eaa9cdff6ef7403ff9a0ae018ca852d38058
TLSH
T14661F9190E05549DEFD31631E5D123B83AB4B3978A8FBE56421CC8BD6A35F3246C604C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 feff2c50cacb1905aae7e874a0ca554ba21f66e14f5d397b5df8fe06da5b8b2e
MD5 e4b62c56ae474319300b4b9915f6ecb4
SHA1 9106f3254f55fee0a8e4405033739b61232078a2
SHA512 c9ab6d14b72a6aba836d5cfb2f564d6a78d8e1a64d7898f93164cb9a2a00c11430dfd96239b1ce9fb5c427aa09072c05a00448b36b056e8d903b93c2777861c5
TLSH
T157115BF7C7D585AE894556F05A28AE2BCE2D050542187C1585D4FF2793E3465E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ab4159f066d7b84d62521bc39f19c41bd39f96261c235075475bd66e5401d773
MD5 430a49164865ba4db55d490b84b396a5
SHA1 a874291bf24253799cee0e8f2348b04369d9cbcc
SHA512 06aa41dbae5fcbbb0a3bf49a2c0184adba5ecc20ef0cef28330d2b5b1b42525110ca6c4c3a90672fe1f9dbef44e87b32e8c6b4dfc42778e4ab2f98244bf5118b
SSDEEP 192:sxZRRLyM/jK1Ml8Mkr/fCsB+vdIdpdSHW6+WNGYHjCCeIgrJ:sxZRRMr/fCsBEeAHbG59
TLSH
T1F74209116A34A977CCDFD20DFA55BF53D6F81472A2900E54A9FCDA1C05E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f1369610ba5e2f288e15cfeadc70d0a3eed7c099f50ecb5f8ac648e2c0d2860
MD5 511adfe77a8ff06cd1d3fe10542cb484
SHA1 a74c804c7e3950d718355981a0741e892577ed63
SHA512 01feae0661e4590d50420b4ab181a789ebc3273b247a6c454a360d9ff894b1d10a0930ef2bf65d5c5e9e9948856dfa0d13e4b38caf1696e067f6f4cb1b2abdcb
SSDEEP 192:sxZRRLyM/jK1Ml8UQTkr/fCs1+YdIdpHSHW6+WNGYHEFfeIg5pJ:sxZRRq4r/fCs1reyHbGE9
TLSH
T176520811AA34A977CCDBD20DFA55BF53D6F45472A2900E44A9FCDA1C01E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 77dc73fa39b95236c821dd7959a9f15a4b16bb176f374effca4f78304eb42f87
MD5 8fefda1b24ad99f1f9c7b4abfc29e3ee
SHA1 c873e2ffd81aa3c73cd853dfaa0d69f8a26cee1d
SHA512 25fc4550daf0338f25719d69e060603cc2654871686374525acd64fe76e4868a549c12a1daf8b69c4b9e5c772225b38a9f03afbe04bcec0084a6a63e366e415e
SSDEEP 768:p4UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RKroVF0G:p4UZYTMWvg0Pou1ja7eLZmRhoG
TLSH
T16BD20A2B680CCB7E4F844E9DEC2A6F963DD801CB5A584D5447EA884C03CB6EF512659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 afbb7237de59432969fe879ef9fe3170acf901816b896e865a218506f7015884
MD5 f538131f11cc62a3d69353653354692e
SHA1 840cd0eb710e6ce22ad8d46f7c5a06f3a57f93db
SHA512 cbeb7342bad4c0dcb82ab98d92eb78434cdf36d05a3ad03a8271eb7752095ef6d79c57420e0489cb7a8198c7928d60211c72f9948d580a213878cef8c59b75ab
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0k:ES3D2rZt
TLSH
T166D1140232BB02033C3D2918A2AA97774F45F1E33454E86B7B6854B64E66E741CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a83119c384c85c39af6a5e4ce8271b6b16744b1c44e6a075b71cf3fa9e0b3ddc
MD5 135377dba5d6dd67d129842724202c97
SHA1 ce65ab8ee040075c38b8c2b198ca8f48de067184
SHA512 567af2aa01218e7e840c44f2c44f2f40df556d86aeefdd13d626ffd771fd1d021fb0a9633eddc63b36392f13d9f25c16c30d3637b22731139bb8758a77400ffb
SSDEEP 384:wZcIhsNf6lNBxzX5od+2OU9vCNBeRs9JKgqijUVY:OhrZOTOUlCNTjKgqmUVY
TLSH
T162927D31583478779AF6F585F44B36174FF89067E7C0AFD091EC6B1C0196998231BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a59cacdfbf69605162e456f0077c5852644a8917e8c7db9993159016e8087484
MD5 4211aaee489b602b9268731f535121ac
SHA1 de400875c6ff8101b780f40a39ba30d6626c2554
SHA512 eef6ed7083b311c02882cf72fa22c9f47788038ff5b6755ef837056b2dd6548ac29c19830499e2e7b6ffeb23d3420fc3cbf1ce5040746a862f5bd2cf1a6ff3ce
SSDEEP 384:KZcIZzsNfjlNBxzX5od+2OU9TeNBeRs9JKgqijUVY:oZaZOTOUteNTjKgqmUVY
TLSH
T137927C315824B97799F6F589F44B36135FF8906BE7C0AFD091EC6B1C019A99C230BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34843bc9e82ac370d52984f90488f0002848a7441f94cab7cd939e5ed4d3718a
MD5 2f94d56a2e3ed55c26f4b3f96be2ac45
SHA1 364a7e49eeafead2096bbffd14d4ec1e8805271f
SHA512 6eaffba66ff4ff687ba4c4a28076249c0c0784a342d35f11e3eac4549c20737e55968e8743a5896034e143530626866e344397bdae5e12f5b6fdcfe443f4e6df
SSDEEP 192:yON061VWQmiUyfKgGX5Obd+jKOImm/an3GFU6:yON06WbgGX5od+2OT2FU6
TLSH
T11B02E83569687C678EB2BE49F58737135FA8207BEA546F80D6E81B1C01D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ee833806677c0703a1a30840a459b331b64dc6821491c4c51fe91e8e2cd22b97
MD5 1940a2f2c01ea50078ff572cf7338582
SHA1 65fe5d7fe04ab33735a7bfcb34d798bd84a26852
SHA512 66281255501f77fa375b3c552da5cbdcdfdcbd33c881d4c64e6f80f035261535842f64ae1098a6e93ea605684e2d298063e6f40a44e1cb2505084f01c7f4f436
SSDEEP 384:EZcIhsNfjlNBxzX5od+2OU9vCNBeRs9JKgqijUVY:ihaZOTOUlCNTjKgqmUVY
TLSH
T1B6928D315834B87799F6F585F44B36134FF8906BE7C0AFD091EC6B1C019699C230BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 811cc278839140d3c4b13042aaf3c765afaa244bf35d9cd5f29427e113e5170f
MD5 6e7b16d9ee90c56cc1a920411f454993
SHA1 bf73ace26e5f89d157a80340c50090d5816ac5fb
SHA512 82455e9a14dde30d40004c7a079712e925c9e2b9e466f4e97a34253c69433c491fa03be677f66ff47f2e1f5acb5cd3484f486e1ed2bb43ee1f10f96c1ded2bb7
SSDEEP 192:7ONy61yWQmiUygKDGX5Obd+jKOImy9HjJzqeU6:7ONy6n6DGX5od+2OU9lNU6
TLSH
T1B912F9366968BC675EE2B545F48B32135FA5516BEA847FC0C1DC3B2C02DA6AC230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9a9204b98e8fce69aba17f590b4bd206a28dddaf5db7ec632a79a901300c927a
MD5 cddf3adfc6c9109101188dee83e88d32
SHA1 2a97e0b79b4f29954de55d054af44b10630e4ea6
SHA512 70a9ac9b6c3df89f996df7ca72f41cadb20113ecf93d9450f01cc45f11580633328f2aaf8f8c75dde60e44b84abe6e730d7a60db0d1e05f9bd1225a753168433
TLSH
T150413A99B6FE1108B3B37E0B9BF7A46E447AB9772E07D45E10010E4F0A63A40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download