27ed5aa9970755e1048bb4d94f373bb9a790276e1a1741a55801f754977879ac

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Assets/Widgets/GeshinCard/index.html
Size 13KB
Sample260804-pjdrdszfld
SHA256 27ed5aa9970755e1048bb4d94f373bb9a790276e1a1741a55801f754977879ac
MD5 693535485b7f13ee327cbe652b29935f
SHA1 b332fc365b29e831be252d3d1c74ad3145685c19
SHA512 88df500dc255867928ea7ad9beace1e4bf98c6a200e3d9ce727f70457f062b7a77aeaa00ecba8f4c812c1a7c9e0aa73aa53d06e08276d70d857b9a7d1d934a86
SSDEEP 96:k2Hh1Vaeof+4Xq+UROtt9Uh9nMy/dAmla11WlBTJWlBTJlYj3IF55Fa1XAtgmTrK:k2Hh1Fi1qfOtGcEdTlBQlBPUSRh9C
TLSH
T18A52850861510836017323B697A7B689FE159047E70195ACFDBD97411FF28D4ABB3FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303198550267791"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1E24E537-2B68-4141-955F-18679B6620B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 640	1048	msedge.exe	85
PID 1048 wrote to memory of 3764	1048	msedge.exe	86
PID 1048 wrote to memory of 4732	1048	msedge.exe	87
PID 1048 wrote to memory of 4732	1048	msedge.exe	87
PID 1048 wrote to memory of 4732	1048	msedge.exe	87
PID 1048 wrote to memory of 1188	1048	msedge.exe	89
PID 1048 wrote to memory of 1188	1048	msedge.exe	89
PID 1048 wrote to memory of 2776	1048	msedge.exe	91
PID 1048 wrote to memory of 2776	1048	msedge.exe	91
PID 1048 wrote to memory of 2776	1048	msedge.exe	91
PID 1048 wrote to memory of 2224	1048	msedge.exe	90
PID 1048 wrote to memory of 2224	1048	msedge.exe	90
PID 1048 wrote to memory of 2224	1048	msedge.exe	90
PID 1048 wrote to memory of 3824	1048	msedge.exe	92
PID 1048 wrote to memory of 3824	1048	msedge.exe	92
PID 1048 wrote to memory of 3824	1048	msedge.exe	92
PID 1048 wrote to memory of 3500	1048	msedge.exe	93
PID 1048 wrote to memory of 3500	1048	msedge.exe	93
PID 1048 wrote to memory of 3500	1048	msedge.exe	93
PID 1048 wrote to memory of 1064	1048	msedge.exe	97
PID 1048 wrote to memory of 1064	1048	msedge.exe	97
PID 1048 wrote to memory of 1832	1048	msedge.exe	98
PID 1048 wrote to memory of 1832	1048	msedge.exe	98
PID 1048 wrote to memory of 3248	1048	msedge.exe	100
PID 1048 wrote to memory of 4436	1048	msedge.exe	104
PID 1048 wrote to memory of 4976	1048	msedge.exe	105
PID 1048 wrote to memory of 3112	1048	msedge.exe	106
PID 1048 wrote to memory of 432	1048	msedge.exe	113
PID 1048 wrote to memory of 432	1048	msedge.exe	113
PID 1048 wrote to memory of 2500	1048	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Assets\Widgets\GeshinCard\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,8119086218720971975,4263732820955538811,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,430334742020172996,65799209571412394,262144 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,1236621138654771019,5240420862681199902,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16618872775010525240,11102933289237378940,2097152 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8433828351717868309,10861823920535123620,2097152 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15597956701406250091,11928987597851781819,2097152 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,14487830676956853417,7048034658834674609,2097152 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9038960939988025121,5438336200505738745,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2516646290872492396,18290501605231747955,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,4616577830360634405,15739250279734314626,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,4616577830360634405,15739250279734314626,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,456178117013564507,8256010713116142253,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,17752029386434103763,1367110570171379956,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15480949472771356519,249203935509885811,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,774134001608645221,5512145222458739896,524288 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,4044210078137502805,5030381258578000186,262144 --field-trial-handle=2224,i,14027669111618230635,5658407735407492002,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 072a44cbaaedc8fcb6de02d2b3361a83b7d7dbf8eef8f7374e5d568f58b48cca
MD5 5961a4b884e8220d5b83951601aaabe1
SHA1 78ba6128f760641b0dea92388c33c2f763de193a
SHA512 d15c99dacc3ec967170287600a84492aefd015926b97a4af706fc1f4799b0a5b925db9a42155c64e3a15d9d16bcbf441bd39eee970d04add08a4dd2ea3b68d41
TLSH
T179616F69974208B5CF6316BEF3E0521239F2B4E83A1BCF62159079BEB11676C8D3B418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a2c3.TMP
Size 3KB
SHA256 2a6d895d04ed6c9b9a61b72ebb167245f3cd8812465c8a323b0491621f4d3c2a
MD5 6f5eb4101758ce86132fc791b5415dd0
SHA1 d950c5c405d319f3ed8e5e7a19a117232b011f31
SHA512 81bfaaa8b830f28d3718d6c39bcc86a443c4d5a0ad907aeeb25633aa0e0fd3162ed12d52ee92dce2cfa724fcccdc75e6ecb1f10879af04afb8f1957c0ee701c1
TLSH
T10F618F69974208B4CF6316BEF3E0531238F2B4E8390BCF62119039BEB11276C8D3B448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a9d3533e043624eb4f0f818a6035ad1c709512678db1d4b76e1eb29e6299ee32
MD5 f631f8dcacb68ab4db9712c936d8fbf6
SHA1 fa81780f16d4406207165763fe5c6198f54be888
SHA512 6c3a7d3f1ed243a7bdb69806dd234b21215a66502539efe05b5a44cd02bb87315c0925b9d4f42de9632a56e57f3186864fd211a7ade36853bacccd84d798e87e
TLSH
T160115BB3C3D5856E890556F05A24AE1BCE2D0605821C7D1985D4FF27D3E3065E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca0f95b36aa4c6f9f7a713897705d471c741b4b39bdc3d4585edc14e7b21d34a
MD5 4ca33059dccd92a956e886c32af65341
SHA1 3d408d8756cad36ab59009a0ec295e65a5204a38
SHA512 7e9fe31f1ed3d9e12de28b0f30f6485e07347b4651c663d7e291fa4cd87fd53a3ea98a66958eebab6e417412d334b180b622e7f0db50ddce32c980f46d0ced98
SSDEEP 192:sxZUR0yM/jK1Ml8Mk7/fSsu1PxrIdpd7HW6+WNGYwKZIMIgrJ:sxZU+M7/fSsu1Px01HbGG9
TLSH
T11D42F8016B34A977CCCBD209FA55BB53D6FA557392900E44A9FCDA1C04E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27f2386744d7ce749ddaa639636af795dad9c47c9a207b50c4644f85cb0fa238
MD5 d335f6fa7aab7ff61fdcf835312f29b4
SHA1 f2f5a18b24e5adbf630166f08aa39fce1966e8a4
SHA512 e8fbd6d3e8dbc2387c32de27202604f96cb148cdbc33995c88a89bf733b2411e0e1b819683d35ab85116e771d184ff49cec915309b8071988ab5c9ad8263de9d
SSDEEP 192:sxZUR0yM/jK1Ml8UQzk7/fSs11PWrIdpH7HW6+WNGYw56RMIg5/J:sxZU+qY7/fSs11PW0bHbG/T
TLSH
T1A5520801AA349977CCDBE209FA417F53D6F6547392900E44A9FCDA1C04E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8779013af55b774deaf24a21ee3361af7b32a2a3f5d203747f16d55d5b8bffc7
MD5 6338b42447bbb9b024be1b92fb09daa9
SHA1 233937275b9f7d7f395258bb4a8ed79b5bc2b27d
SHA512 d3c85fb8fb1847b5b7d9a8ec6f62b4704972ec43672ff4d45ad333c89ad2a44aa87644c61253a50be6b05a0914c39db48508465d8960d73e7090fd8418ec15a6
SSDEEP 768:Ne4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dqrohAcZaj:Ne4jeXmWvmKLEu1jacPLZQdBdC
TLSH
T1BFD20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 106b075cf968ef6e6fa1e57ab38aea95ee299f87821547a5f52953893314f9f3
MD5 2a2fdb44efa1d3645749e8e1ed8b33c7
SHA1 7af1ddcaf572ce807eaaaf101d32338570caff29
SHA512 d5e8ede1095a7d48f5e7fda8f315b3d74a4da7c9d3caf396f7f270e2e55cafa13fb1cd2747f26e92f783f9cc7f6763733a3c48e417f0aa26dc31d1b4d5e2e973
SSDEEP 48:KNOfCuD1IxKuEkDylrIBKsIMgkIbKBiUzy0:K41KKuE6mrmKsIjkwKBiqr
TLSH
T1CD91878B71BF12113D3E294891A087574B43BA63740CE42BBBA991754EAAE341DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593e47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593e47.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d496579a7aedb8322696165f53c519c7ff80a08c04d8fbf63993c3e4e8fbaa8e
MD5 6d3c10f579b009cbb22a94efe6d5e00e
SHA1 23fb8761f29cce88a562a6a9bd4b4466577d4532
SHA512 a0cc03a2f4c2e4251a3b540bea1cdfb3dd51889d77c7174867bedf853a7fae134e52ef97313025f59265e48103bd11874353feb20c44f62c4d4c83063abcee4c
SSDEEP 384:BZcIhsNJAnOZz1f+o8eHXoQF1OBeRs9JKgqijUrHg:Jhk1x3o+UTjKgqmUDg
TLSH
T14B927D315838AD7799E6BA86F48A36134FF89127E7D47F94A1FC7F0C008959C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9e3ba0249ce56adca0d724719f9ebf21134f6505b5930298679e5f37275935ef
MD5 e04f4467f5d385e0cd73946844e16651
SHA1 0830031696235b2e2fef717f836334f25adcee44
SHA512 66b1e1a8a5ec62db1ddfc5194faddb1c1078438d784948a63539cde5f72d6e4dd8be468989744faab92d8464ba8eccda573b571c3f819ccb7bbf2cbbacd26c7e
SSDEEP 384:oZcIhsNJtnOZz1f+o8eHXoQF1OBeRs9JKgqijUrHg:Whj1x3o+UTjKgqmUDg
TLSH
T108927E315838AD7799E6BA85F48636134FF8A027E7D46F94E1FD7F0C008A99C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 49ab801c49af3cc90b292629b510fff794206cf56a84cb84af00b0c18d927003
MD5 14d90e7917698fd6118d79169c6ee01a
SHA1 d06de20aa09af78eb908e564b3f9055e03dcd60b
SHA512 23142008b8324dcf4e059f39802a5f7b5b9b5737b7a84f8bfdc93fdb1b8ce178fe07229394c9e3498cc5e368de4e676ff818163ba531f7a1311a5c89e16741a6
SSDEEP 384:OiFiZcIUzsNr8TUNTUlIltnOZz1f+o8eHXo0F1OBeRs9JKgqijUrHg:lFQoawgi1x3oSUTjKgqmUDg
TLSH
T1C7A26D324868D97BADEAAF85F44A32138EF55067DAD5BB94F2EC6F0C00465DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a925bd0765ebbf91b1dd92b6fe13fcc994f4ac983f8ba15f0d4e96b2ab3209a8
MD5 73b540158fce62001a04498e9f8a8b61
SHA1 d5559ea7596eb3be295b0cb7ed6a73fa0667a57e
SHA512 eeab80098dcfb9d277b7c374f0f7fc73723501c8ac639f7453644e658aa6f8975676e8e840447dc989974d053090f0eebfc35cf0063f50bc9e0959c7e5422782
SSDEEP 192:EONG6hZ0QmiUycqpc/+jVSjzor9oZ5wOZzaU6:EONG6oGpu+o8eg2mU6
TLSH
T12302D83568686C678EE2AE45F48727139FE8217BEA956F84D6F85B1C00C779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dca3960b3355f051c462d5d9e4041919835d83a3f4c046908c9d863aed3d0b9e
MD5 2945b48378b0101bd371659248150902
SHA1 22bebc9b49568d0670cb5c728ed09a208fdff33c
SHA512 c5569191533e655a0aae6b4e37e460d0b65550d6f17937fa891c7621ee219f3913c6e0fc5227d07b19f723d52fc3925d8f6b050b8787aac056800763d5d0db77
SSDEEP 192:uONM6hZ6QmiUykqHc/+jVSjzor9oHXLEU5cOqnqGOU6:uONM66QHu+o8eHXon91OU6
TLSH
T106120A326868BC675DD27A85F48731135EE9516BDE897FC4E6FC2B1C00DB6AC1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40e201dc-0fa3-4697-8126-dddaf9d5618c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40e201dc-0fa3-4697-8126-dddaf9d5618c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 abbb26fa834e7edeb57546bbc1b5f29fc8688fe1df1adfa42dbb2e751ae7e3cc
MD5 825f6268c4312c7b36c31dfaeed7bbe3
SHA1 f28c7ce120603c0c28565b5a9d0a795728723459
SHA512 8da3f180d3c4eae71ebd5af3df4bb53682b32338e2a8f931b3cdac6a83d0614c8eb18a37a88a9c20abdd1ed08ee6c51d619b84ad8bc0e953fe5c94d2adb09e40
TLSH
T198412758BAFA1104B3B36E4AAFF7696D487B7D372F1A945D10110E4F0A62B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download