1f98164547ea16a9b6e83aadfa94ac544cc28cb9b0a93fd4a0a6a7b6182c7d37

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Assets/WebWidgets/SingleWidget/index.html
Size 881B
Sample260804-pjdrdszfld
SHA256 1f98164547ea16a9b6e83aadfa94ac544cc28cb9b0a93fd4a0a6a7b6182c7d37
MD5 a2042eda5e3b13e2eda52f25a69cabc3
SHA1 ed5506319fa876b001b1fbcab0c50fe756a6927b
SHA512 25e99212493bff267ecdaf87e9d9307f2f57c8cc2a853e1cf50bce64d23fe3e6c3e95a65551c29cc7e898b304a9eb01e2f4e23118bb532a2b2f413b6e008ec1e
TLSH
T19D11EF0558D08C6A033163281B85B218EF229643478EAD1534AF1B7B5FB29908D9BCA5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303198790324176"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E8401564-304D-4AFB-A532-DE65414B695C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3536	4844	msedge.exe	83
PID 4844 wrote to memory of 704	4844	msedge.exe	85
PID 4844 wrote to memory of 412	4844	msedge.exe	86
PID 4844 wrote to memory of 412	4844	msedge.exe	86
PID 4844 wrote to memory of 412	4844	msedge.exe	86
PID 4844 wrote to memory of 3488	4844	msedge.exe	87
PID 4844 wrote to memory of 3488	4844	msedge.exe	87
PID 4844 wrote to memory of 4732	4844	msedge.exe	88
PID 4844 wrote to memory of 4732	4844	msedge.exe	88
PID 4844 wrote to memory of 4732	4844	msedge.exe	88
PID 4844 wrote to memory of 1760	4844	msedge.exe	89
PID 4844 wrote to memory of 1760	4844	msedge.exe	89
PID 4844 wrote to memory of 1760	4844	msedge.exe	89
PID 4844 wrote to memory of 2452	4844	msedge.exe	90
PID 4844 wrote to memory of 2452	4844	msedge.exe	90
PID 4844 wrote to memory of 2452	4844	msedge.exe	90
PID 4844 wrote to memory of 3496	4844	msedge.exe	91
PID 4844 wrote to memory of 3496	4844	msedge.exe	91
PID 4844 wrote to memory of 3496	4844	msedge.exe	91
PID 4844 wrote to memory of 2784	4844	msedge.exe	96
PID 4844 wrote to memory of 3524	4844	msedge.exe	97
PID 4844 wrote to memory of 2784	4844	msedge.exe	96
PID 4844 wrote to memory of 3524	4844	msedge.exe	97
PID 4844 wrote to memory of 2200	4844	msedge.exe	99
PID 4844 wrote to memory of 5072	4844	msedge.exe	110
PID 4844 wrote to memory of 3476	4844	msedge.exe	111
PID 4844 wrote to memory of 2312	4844	msedge.exe	112
PID 4844 wrote to memory of 2968	4844	msedge.exe	113
PID 4844 wrote to memory of 2968	4844	msedge.exe	113
PID 4844 wrote to memory of 1600	4844	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Assets\WebWidgets\SingleWidget\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffe392dc188,0x7ffe392dc194,0x7ffe392dc1a0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,719756889534163262,13836316944995038036,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,12293551979492021427,12417998087583430681,262144 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,3837395814029848143,17983342223539768613,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9246134587515893074,11830156394823100976,2097152 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18180815533647547768,5043196194720746058,2097152 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1498531700754665894,3344373921645158869,2097152 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,205498041354215265,5403713320322247866,2097152 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12531789654220327083,1954671005171766035,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14642812581236776981,14614549458697483594,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8642585756069911969,10755083358118492748,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8642585756069911969,10755083358118492748,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,9633348002837154342,6683111647651339200,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,7276904599780228043,9356043128854989952,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16809485725489812098,13594138000739289914,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2996,i,9893549244336711401,923613038376517454,524288 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5700,i,3766375719829325912,5733008762927094431,262144 --field-trial-handle=2116,i,9408800902088561814,12063268192723882314,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 359fd1a33d0f42dd30204a66587fd5bd76fea0477d647bd7a72e31d68cdadf73
MD5 5d3cb20b937f24cc89509a96bf739a56
SHA1 b65ae9511b8e194896b5c3c26e7e424c9fbfdefc
SHA512 41a251e09b0a8288b6260d21b3008e6da6ab71bdfb222b3eb15e27b50b92fa8626f5f5265499150e18c2d596081748750a3075a7d32f41bdc71dd0990b61b3f6
TLSH
T1C581E7B4810B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587df5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587df5.TMP
Size 3KB
SHA256 20fa4056728133758b913e900e9230180d5433dfe97371d306aab8a70ae62024
MD5 c793d3fcec9b385a3873b3ef9a8026f4
SHA1 48774503a4e67d1934b91d59b0b5b47569ba3fd6
SHA512 1936afc437f830e3118d41431e98f903dbcd51c8f1366461620bdc0a45d4b28e8888d55f2b83fca4a55ab78fd0a3a53600d9c5d1f7890500e1a499dba114be89
TLSH
T1EF81C6B4820B35A9EB0C4F3190DA0D5A36306AE9FDFF3FAF5D8424B98779355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d4ccc84f83f831e5bc9cb437a2f3ccb565313b6f8256d04d259f2b56cedfe44f
MD5 bcbf740c550951ee2292fe9bccea878d
SHA1 e97a399bde2898bdb9e75cfa18cb9c4c416c32ca
SHA512 073cb917f6133fcd1376e422d31b3e454bb9e411ad49320f5add9ac45befb045bc5b3d86abe07cd5b2ce9121b36550fb552ad6973e5d30b67316d4f6a6c6c029
TLSH
T1041157B3C3D5956E890517F05A24AE2BCE2D0606821C7D2A99D4FF2B93E3079E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fcd9cc89a3751c59fd43a77a4816020e1626341b3d3a6bf86bac43326c2f53c5
MD5 98a9add783e6f2b500d93a0feca39aa1
SHA1 377321d5ae66770dceef248d86e45fa7ec83b724
SHA512 b85d13328073f3fe26df3b4cd3db41f11ba86756895a09c283e6018f9dd3b910ebd0fb2b091d0fee77de769a18f08b7a5bc67b85f7265fa84961978cb92690cb
SSDEEP 192:sxZDRNyM/jK1Ml8MkC/fssPiuYVoIdpdxHW6+WNGYvrwjkLIgrJ:sxZDDMC/fssPiuaDHbGZa9
TLSH
T1EB42E8116A34A977CCDFE20DFA51BF53D6F9147292900E44A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e07db00fd08ae14871e451eb686dcbe239bd1b85f927a05896ad00212d810130
MD5 c3578d62f22f0355e40d662f16da5ac7
SHA1 231d4bf451abd9182bb96a3bdf87db39f8dc4bd0
SHA512 ecb182a47b6ea790cf437589e0b8e9f2243cd1e39c93590bcc8b24408346e9e29dbcc41b80aafe1e2504d664084acea0220a0b9fd47cf1fd2e2e2fc26ddfb6ad
SSDEEP 192:sxZDRNyM/jK1Ml8UQokC/fsskiNYVoIdpHxHW6+WNGYvEnjkLIg52J:sxZDDqLC/fsskiNaRHbGzaA
TLSH
T10D52F9116A34A977CCDFE20DFA41BF53D6F5147292900E44AAFCDA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 84a00ebd7061518185fa075196d25f85afe0760c70f4925c902cdc19d4054d6d
MD5 d3996f4fefd92a3d3af2357aaf6f40a5
SHA1 66cd3b46bb3abf04d6869c7f2d08e04ee6c68d4a
SHA512 6ee8f10da56e7ffb4b8c29eaa5dbec73537dcdf4081166ad5f3c48db957fae4eb319388838138cc1e0a91f51ae22cd85e4a63b6dcbd5c259f842dc131fe9eb31
SSDEEP 768:+4seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppFroScW:+4seJ3xWvhfynu1jaVcL88p+S9
TLSH
T146D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5197cec2950e1ebd8dc17f8721b09ecbb0cf497b9b34fddfffe02c0fb64937a0
MD5 f39fb6c821731292ac4a477eb1ee41ce
SHA1 52acfbdfe5ffc7c6930934eabb9b6f2d9383709e
SHA512 3e50ed49d8065753d85483ae61197a12ec214870486bcddf5941c6b174908c39958e40980ecce9bdd25d1a3936b2c947e0926fd70f35f9102f151763a695c1a1
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1E1:KYHIhKggkXyFjIBKEYcXyBuIXKTag7
TLSH
T1D591F197743F0202387D254CA6A1AA369E4275A37458A4FFBBB845524E27E210EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591a93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591a93.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1ffdd212f35014c0999f8acec22b3a48a236dede1c21e95148db93bd33f99f49
MD5 d296e10161fafb5ed234a659fb7cfb9b
SHA1 62a4873bea93835788474e28e756db3ac7c3a440
SHA512 ee15842b8a08812e9afc319682141fb06f20758056971aa91db8974bf259ce96ec0bd112e2858de2a24a15dc766c2b613183a026624bb373fdba301effa8a57e
SSDEEP 192:uvm+xasuheOwQxMGsNoBQOZM7GSiQmiU1SP24MThcC5Kopa8z1MqthePYy:lZcIhsNoBY7de6ZI5KGzDhel
TLSH
T1E2625BB16C786C3A99ABF156F88A37034FB49077A2C85B50F5ED7F1D01DA168030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 910c5b8a8ca6884db98e18c85040e89d4272c61c8f2f91120f2ecfed54c9a369
MD5 a34334a5c6792ead68b55351c64d0c57
SHA1 4d8acc75330126fb3b485f296fdcd52d1ba06738
SHA512 9ee5f2d8e4d227db507141b045b2d342b632a5af3d847cdfd525e48715eaf4e13eb6392c3f694796734e2e31cb8fcc8ab32902e25b57cd58b3dd6e276d25f416
SSDEEP 384:XiFiZcITozsNY8TUNTUlIlwY7de6ZI5KGdDhel:SFQwZwgZleldDhel
TLSH
T1DD824B725CA4993FADBBA655F94D32038EF490B7D6C4AA60F6DD7E1C009B1AC030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebd528df23b86e7d0ba4395670d73b5426b96aa049d526c21e4fece65a0d9e4e
MD5 2c11a6b3f2702dcf70b991eb5a3ecf44
SHA1 aaf804d8249a4946136ba399b6a95060f8e7700c
SHA512 ddc98061cb5643f75f389790aa1876784fb81696a803429ad910fd6b0b28c3bc8145ac8345d05775019752945486249605722d9aee1a57a907560bf802b95c03
SSDEEP 192:lONny6vMtPQmiUyGzThThcC5KZ847CtU/u:lONny6UtRVTD5KhWU/u
TLSH
T1C102F735BC786C7BDAA7AE45F48E27171FB051BBA5905B40EAE82F1C00D765C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f77dfa60f46a9150dfcde5365940a716127832b6047f3405a2ee5df77745c664
MD5 92287e89525d777faf560dab79c8ae3a
SHA1 222d9d5143b75a8cdfbc4714a97014cb3a964449
SHA512 42c42974244defb11e299bd30b2b7499001010e16dae44f40aa82ea4b9317458a42edaa73c4c5f1ff33e0c95c3ac5834f0e9bf4b40fd19c549fcb1c1e936e618
SSDEEP 192:u7m+xasuheOwQxMGsNowQOZM7GSiQmiU1SP24MThcC5Kopa8z1MqthePYy:1ZcIhsNowY7de6ZI5KGzDhel
TLSH
T117625BB16C786C3A99ABF156F88A33034EF4907BA2C85B50F5ED7F1D01DA568030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 cec02aad93363b2e24dbce105d52a4269e61010be2b614258818fe18be2efadd
MD5 a0915637df94ea365748fdaa1cda9020
SHA1 6797c6d947b555665cf9db1f999cb49387adb334
SHA512 5740408fecb60c50817e2a5c166eb36a0c2683b8c4039e74422fb483f92d05295d24ce33d1b4902f9ac06f72726f98cb014e5293187af0cf9f5a3cb83a5018dc
SSDEEP 192:5ONB6vMsPQmiUyfzbhThcC5Kop480IMqthU/u:5ONB6UsRcbD5KGdDhU/u
TLSH
T108120972BC68AC2B9DA7B155F48A32071FB0916BE6C49B50EADC3F2C01EB56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 79c7e8af8df7ff9d39412b871a2f77f0a94548becf207635c2c7ab3f35f32ddb
MD5 1fb62323eab6277ce821d801ab4f0b8e
SHA1 7ab0bfb9fbffb6e8404c92d44b146a2656e07cd1
SHA512 379baf19a4e306b829d73329e30a066d60215f2e60addd09fd3d67d65d2677402562c39870fd0d7aed4789d2726f1eb28ea0059704a46bd3e1cd567f548eb7e5
TLSH
T1CD411A98B6ED1148B3B76F1AAFF6A8BE487FB9771E06C45D10010D4E0A23B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download