9ea66826c026591e8f10a905c6377e5851acac2f065de44d20a1bc768831e369

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ea66826c026591e8f10a905c6377e5851acac2f065de44d20a1bc768831e369.html
Size 79KB
Sample260804-gql3caea74
SHA256 9ea66826c026591e8f10a905c6377e5851acac2f065de44d20a1bc768831e369
MD5 a601b6ec5bf569fbd7ce796e027d8900
SHA1 02cd3d003fbaafd665817f12fae3f52f83dc3a71
SHA512 c92876037dec8bd85f8b791283e27019d809894ca5072afa177ff767dba85d00aee16096e9f1334ff13ff6d5d64682c8995004caaca95e7dab2fd7c313332371
SSDEEP 1536:ZQNo0l0q47N/MFIvXuROHpHXZ/vhql7uWV7qQOO3n93:wofvXuROHq7fVX
TLSH
T1D583F9B9F5A070325E13F970412F800FB93B646BE44C0EACF254D8F06EF599A8567B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302969248553200"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EC81B637-F341-4755-AFA6-2F993E89AA3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3128	2084	msedge.exe	86
PID 2084 wrote to memory of 2836	2084	msedge.exe	87
PID 2084 wrote to memory of 3032	2084	msedge.exe	88
PID 2084 wrote to memory of 2160	2084	msedge.exe	89
PID 2084 wrote to memory of 3032	2084	msedge.exe	88
PID 2084 wrote to memory of 3032	2084	msedge.exe	88
PID 2084 wrote to memory of 2160	2084	msedge.exe	89
PID 2084 wrote to memory of 3080	2084	msedge.exe	91
PID 2084 wrote to memory of 3080	2084	msedge.exe	91
PID 2084 wrote to memory of 3080	2084	msedge.exe	91
PID 2084 wrote to memory of 696	2084	msedge.exe	92
PID 2084 wrote to memory of 696	2084	msedge.exe	92
PID 2084 wrote to memory of 696	2084	msedge.exe	92
PID 2084 wrote to memory of 5028	2084	msedge.exe	93
PID 2084 wrote to memory of 5028	2084	msedge.exe	93
PID 2084 wrote to memory of 1360	2084	msedge.exe	94
PID 2084 wrote to memory of 5028	2084	msedge.exe	93
PID 2084 wrote to memory of 1360	2084	msedge.exe	94
PID 2084 wrote to memory of 1360	2084	msedge.exe	94
PID 2084 wrote to memory of 884	2084	msedge.exe	98
PID 2084 wrote to memory of 1528	2084	msedge.exe	99
PID 2084 wrote to memory of 884	2084	msedge.exe	98
PID 2084 wrote to memory of 1528	2084	msedge.exe	99
PID 2084 wrote to memory of 2688	2084	msedge.exe	101
PID 2084 wrote to memory of 4588	2084	msedge.exe	113
PID 2084 wrote to memory of 1336	2084	msedge.exe	114
PID 2084 wrote to memory of 1612	2084	msedge.exe	115
PID 2084 wrote to memory of 2152	2084	msedge.exe	116
PID 2084 wrote to memory of 2152	2084	msedge.exe	116
PID 2084 wrote to memory of 3208	2084	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\9ea66826c026591e8f10a905c6377e5851acac2f065de44d20a1bc768831e369.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffaa992c188,0x7ffaa992c194,0x7ffaa992c1a0
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,3536636310126194340,8620198467245940644,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3007441291709500136,9931672340362781647,262144 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,19003130255005697,330446226766780606,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,18271349224038872564,3205241222248005392,2097152 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9282359102914563173,13208718777582374206,2097152 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,8112138018192959009,12571751406010326055,2097152 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,7753645035416140815,13021952047609011535,2097152 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1375377395047587082,1685637427418821492,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13785595320662091756,17561155902541515373,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6575667271569438198,2002280880846961481,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6575667271569438198,2002280880846961481,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,114784285930324569,8097425879528891801,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,16914335070680844055,17675631840894230170,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,15755170113812224640,3448506173441453565,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,18275118607346784387,5122869045047561945,524288 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,6770996192163936672,5341173506795461841,262144 --field-trial-handle=2284,i,3752875217150585358,13421915530353206975,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b708c3cc65f6f7ca56359110e87cef298a3231503c66fbffc96d558f0df7e0e
MD5 e2478bcd7fd1456615c0b8bae0fe3ed4
SHA1 483393ff013a3e9d1f192a02ed9d85387bc32a9d
SHA512 ded89d0033b43a546e65bfad42eedc320020a749e4fa6c446e2f32abd1ac5fb03d83af7e649be45f4bbe533ef09e49d033a6bea5176c9b5aef9d2c5c07c25c30
TLSH
T183618138C78309A5D7A174B290FD0F24797687E8FAF32D85D8A829346F1B751C3682D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59137e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59137e.TMP
Size 3KB
SHA256 557e150a663f15361b66fe342cb18310a183fde26ea6079de379b8018350a7dc
MD5 ff9cc0d32573e00147c4fdc79f71e8c1
SHA1 056f2c777b4eb85ed45c9d2ebda904fffaa3c62c
SHA512 2876f629c42a1a4037e00827b6d2730c16e8a1a7dbeeff0017becb3f2693142a443e09f292d70ef0f1f680ca2a112efab16e6107ec03450b7c103192cecd0608
TLSH
T119618138C78309A5D76174B294FD0F24797687E8FAF32D85D8A829346F1B751C3682D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 85c4183029d3f6b7ee79ef772b4a33c8080b8d19dd8149259f3923d2df61747b
MD5 024b124f8e5ebf45fd9296bd325727d8
SHA1 bce75ad0663f6128f87bb256b271e5da8df5de50
SHA512 20596950144e00a4448cf8c037baeeaf43e3a7617464ecf034289a8cb52e1ab3ebd9929349c7e213728c9bf9b07ff8204030ea52d0ca0eac1830fedbb76fcbce
TLSH
T13631ACB3C3D4866E881157F09B28AE1BDE2D0606822C3C56C9E5FF6B93F2471D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4ae0a565ccc4811442d2dcc9c041405da70b3a6ff3155d963abfb8cfb90582a7
MD5 155f07f26c1daee5ae87471b1b1ade65
SHA1 686f9ac8d6dc4d453a6c202d8040e66878f424f2
SHA512 3d6a245a8ee58d1983768339cf8276cb5447c306cc9b623b6a640273a87a4a0ed5af0517de8cb07087ef403b6fee5d93292b3f91629c601befcfa97452dc6a59
SSDEEP 192:sxZ5Lp6RYZkoI/fIRsv9Dq5gPOIdpd5VHW6+WNGYzQ57UJx59lIgrJ:sxZCXf/fQsv9WeFHbGc9
TLSH
T10B22C7126E78A43B8CCBD219BB197F43E6F95032A1951E58B6FC961C04E6BDD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fdac103d0e7f32117194da6c6c7cec4b3c1ebd7909c2153557fef00f043d6489
MD5 eef80237e4bbc9f5b08d91d27d12a5e7
SHA1 c4e58a042b5708355dcb7f5d41d21dffe5d8d6d2
SHA512 42170da21e022978608d4e7343464d7baf24507cfd39b2e91d8d8a152c3ca26c893eb9d76f4e94ff448ab8c2ed8c049ac11159ad51dadf753bef3719c7b94e2d
SSDEEP 192:sxZ5Lp6RYZkoI/fIRsoj9wxq5gPOIdpd5VHW6+WNGYzJ55UJx59lIg5P/J:sxZCXf/fQsY91eFHbGnP
TLSH
T1AB22D8126E78A87B8CCBD209BB197F43E6F9503291950E58A6FC961C05E7BCD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b1a8ef4fd73d05d7d9a36f18fe52fe56a68447a058fbeea9a13432c5205c1fb
MD5 793268f225ef3e9d69fcbbbfdbb0f911
SHA1 ad9ea7a82ee7d7cd36ccfbabd73eec802536fd0e
SHA512 d08fcbf432d7e715e48ee77736c46bc52b1f1b88a230ba2d4af9d6fd5fcbb302c0e34102cb4f2afed4361d9d5ea3f102fb5979335ca4d84fb677a8f5504a65c1
SSDEEP 192:sxZ5Lp6RYZkoI/fIRsoj9Dq5gPOIdpd5VHW6+WNGYzQ57UJx59lIg5PVJ:sxZCXf/fQsY9WeFHbGc5
TLSH
T16122C7126E78A47B8CCBD219BB19BF43E6F9503291951E58A6FC961C04E7BCD230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dd828a491cf1842a95d2990f539195bd0cb560b5ff4bdeb7573900a70b18d970
MD5 17b3d2a31404b4bb448a03ffef922f4e
SHA1 99c06a3c4dae16828bf37518a29f7de3bdb1df09
SHA512 753245ec23501e7a91b73e0eefcff4573fc3be66f173221a47e19ed55c3dda1313e0eacdc632ea22da185d76bf1c1f6b205a45ff18a7abc25d8666ef4a2744a2
SSDEEP 768:qQk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBdroyvY+:qQk7u70WvqiEau1jai5LA3BWP+
TLSH
T16FC2EA3B744CCB7E4F801E9DEC566F972E9802C7A6948D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a375484545b16606666e9d7045ed4d5dea99e76c27265e29edf57e5fa90a5e1c
MD5 3bf9261e2ef7a4998a76d2773ed62033
SHA1 5d2566f787e1d4e36936df6fb23752e1abc372e6
SHA512 2ae959076b1bcc15224ca001384b262854c5b82a97e277a9a35c820f24d272a592fc4423e05c93543aca7c703cf3c1495a2dadda55c5e0b76c87f6d57a2928c8
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTTIIjK1Kc7y5CI/KT60ssb4cy2qk62hPIh0kKABYj:KIbCKcTIwK1K6aCgKT6M1+K++
TLSH
T17D916516313A0E5538BE294EA69697365F4232633014B46F7FB804A21D6FE214EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6b22dc60fdc083dce37c719bf0212057c4627af45ff3b7b51b21cf0ac266b452
MD5 65c146f9bd4ca710d4c2169c40880003
SHA1 26e2d55834198e4cf00f61d107ab73acc7c7eb8a
SHA512 33f45041161ede49d56c3cece640eb1ddb7c801ee53026ba67f6f6d9dbe6091a0f63a7e9c50394a8cbc45bbef810c2a929e59753dbd5889055d416df977ba3da
SSDEEP 384:XZcIhsNEgA5bxZTMdtp5CEJr5NBeRs9JKgqijU9Q:fhP5rgph5NTjKgqmU9Q
TLSH
T1D7929E304C75AD37A9F2B585F58A37075FF88037E6C06F94B1FCBB1D01AA6982316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4a6dae493ab93f44fbf8fd0fed1a45524d7d7c10ac65325ec781a9a16d9bfa53
MD5 54a40403d0b92b81e7c91a27a8ab5fe6
SHA1 a2810ca25663a3ebf035272169525aac6ab5b57d
SHA512 a1c753bc57ae252e0d2d8b2c99700019464c21f90db6864d742a4df8b551518e6fee3ea133630dfc654f3816cf5c42183efeb1fc2b6395c3c7c48986e1616f65
SSDEEP 384:QZcI/zsNENA5bxZTMdtp5CEJrINBeRs9JKgqijU9Q:u7O5rgphINTjKgqmU9Q
TLSH
T158929E304C75AE37A9E2B185F58A37079FF88027E6C46F94B2FCBB1D019A6982317516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f37164950a8b726cbadbaf826e81ecdc5f15ce047aab797b77d81a6a8f6ec33c
MD5 33f78f99f64afa5a944ce1792ba7a2a1
SHA1 7cedbacbff8f9058189b6c15390b5490b5ebdda9
SHA512 1f894651f827e830f632a1dbec7b7b147f1f95dbdc0a036e01bcb0e1066ea825d1f1edc77ddf99170ea193d2c721dceedc25b456b5d4d7bfc2ddba8917d2ca82
SSDEEP 384:4ZcIhsNENA5bxZTMdtp5CEJr5NBeRs9JKgqijU9Q:GhO5rgph5NTjKgqmU9Q
TLSH
T1E2929E304C75AD37A9E2B585F58A37079FF88037E6C06F94B1FCBB1D01AA6982317916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ecba0fd8817682048192ce3e1bdb34d2f0f7daf90d29905d7332604b594a6e31
MD5 68b828f048f12b1faae1ea91dcf0638f
SHA1 c10d1a12c698fd96644b1b721ea5358632e5ba31
SHA512 8e4999977d1cef581caa8cb298c3264bbdc2772f578f18e504a2bc05d3dc743b6bc7f6141bf5b6174686a21584442429ba400af3b7a9a749a2c5ef5f9a0f6df9
SSDEEP 192:bJONH164BUtQmiUy5H5xbF5GBPKK7+FdG29p9hFC1SJr6Wwq0qQU6:9ONV6eiYBLdtp5CEJr4NU6
TLSH
T186120A35ACB46C3B5DA2B545F48B36035EE84137EAC56F54F2EC6B1C01EB75C2316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7446d65d55bc2165534c126c16989a6c3c9165cd327d9cbbc98dda4b84bc4e3e
MD5 976aea4c2683674a46fe135036dca20b
SHA1 2b587aa107bb02afc102bf101a8f0c2ec4dd37bc
SHA512 d13cf569923505a3cf5ec7b3f6d828a246617facf5f380aea595acf465acc91257a17bd781cc0fa7ad4442a0474959c3047a34fb5d7766423b253dcde7a3f09e
SSDEEP 192:MONY64BAQmiUy5F15xW5GBPKK7+FdG29poaDqLUxU6:MONY6eAwpWLdtpRhU6
TLSH
T1FD021934ACB86C7B9EB2AE45F58A37175FE8103BEA805B44E6E85B1C01D774C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df39ae91-f49d-4b4e-b6f5-b2bffa2748d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df39ae91-f49d-4b4e-b6f5-b2bffa2748d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b53211e626f9496728145b2cfb524bdbaa1153437b6ce0812a959f92b2109a75
MD5 6b3e0b84cd304cc228fbae1725e8a024
SHA1 27c8674b79cd6477f2cf0e7799f386dd776192a6
SHA512 cf3cb20cb989ba811c72af3ed70fc2377d3e0ba31f49d65d448acddd5e9314f23896e92508a170bac6ddbf5cb68199600c7b278e075dd177be25dfaec49ea2f6
TLSH
T12D4127A9AAF91118B3B76E59AFF6A86D487BBD372E0BD45E00100D4F0672B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download