d30309fa6f32880c09779ab01d5df62c658f61c1b53ab5add4f5807c0b95d7a7

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
proxmox_power_button/templates/proxmox_power_button/vm_power_buttons.html
Size 1KB
Sample260805-262sysyala
SHA256 d30309fa6f32880c09779ab01d5df62c658f61c1b53ab5add4f5807c0b95d7a7
MD5 0ba098c29976e834e45c859d55ea4744
SHA1 977e9f520dc2b15d919cf970b1b1a882febbe74a
SHA512 267eca2713594ccfa34b841320a4f08015e93c8c7bf2365172918de3e4aa39d1afcd57c9783aa94891934e9b44e24ebce054808af3f15fba2454957a75225d5c
TLSH
T1C721EE8560013F73861B00AAD553C764FCD1C3D3C0CA3152369873C66F57DA412C7243
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3248	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304451537928052"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F7557D49-CBCC-4B36-A534-8017B6F0B5EF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 836	2552	msedge.exe	84
PID 2552 wrote to memory of 3248	2552	msedge.exe	85
PID 2552 wrote to memory of 3312	2552	msedge.exe	86
PID 2552 wrote to memory of 3312	2552	msedge.exe	86
PID 2552 wrote to memory of 3312	2552	msedge.exe	86
PID 2552 wrote to memory of 3952	2552	msedge.exe	87
PID 2552 wrote to memory of 3952	2552	msedge.exe	87
PID 2552 wrote to memory of 1696	2552	msedge.exe	89
PID 2552 wrote to memory of 1696	2552	msedge.exe	89
PID 2552 wrote to memory of 1696	2552	msedge.exe	89
PID 2552 wrote to memory of 1928	2552	msedge.exe	90
PID 2552 wrote to memory of 1928	2552	msedge.exe	90
PID 2552 wrote to memory of 1928	2552	msedge.exe	90
PID 2552 wrote to memory of 3924	2552	msedge.exe	91
PID 2552 wrote to memory of 3924	2552	msedge.exe	91
PID 2552 wrote to memory of 3924	2552	msedge.exe	91
PID 2552 wrote to memory of 3944	2552	msedge.exe	92
PID 2552 wrote to memory of 3944	2552	msedge.exe	92
PID 2552 wrote to memory of 3944	2552	msedge.exe	92
PID 2552 wrote to memory of 4240	2552	msedge.exe	98
PID 2552 wrote to memory of 4780	2552	msedge.exe	99
PID 2552 wrote to memory of 4240	2552	msedge.exe	98
PID 2552 wrote to memory of 4780	2552	msedge.exe	99
PID 2552 wrote to memory of 3100	2552	msedge.exe	101
PID 2552 wrote to memory of 1176	2552	msedge.exe	107
PID 2552 wrote to memory of 2340	2552	msedge.exe	108
PID 2552 wrote to memory of 4028	2552	msedge.exe	109
PID 2552 wrote to memory of 3100	2552	msedge.exe	110
PID 2552 wrote to memory of 3100	2552	msedge.exe	110
PID 2552 wrote to memory of 384	2552	msedge.exe	121
PID 2552 wrote to memory of 384	2552	msedge.exe	121
PID 2552 wrote to memory of 3740	2552	msedge.exe	124
PID 2552 wrote to memory of 3740	2552	msedge.exe	124
PID 2552 wrote to memory of 436	2552	msedge.exe	129
PID 2552 wrote to memory of 436	2552	msedge.exe	129
PID 2552 wrote to memory of 4352	2552	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\proxmox_power_button\templates\proxmox_power_button\vm_power_buttons.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe0009c188,0x7ffe0009c194,0x7ffe0009c1a0
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,10014260713838576058,15625371805741020882,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6415096571683271750,13678374787639842376,262144 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10825940615039918534,11270536324575954143,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12929374515521774301,14501830835691531645,2097152 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17942002137764155048,4899765590068479754,2097152 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,5500561820820161460,5141510575491289709,2097152 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,2394444473517018643,2677309988469938146,2097152 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5398690586615837330,7513030096409424727,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14926551562834514052,10760267676398288223,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,636332095104198731,10824232233900003879,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,636332095104198731,10824232233900003879,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7208885613906483666,14626729751192496045,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9813285267177959227,8736439248105660650,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,10311121396088663081,1331124282533742838,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,15747386610466921753,17889060087710430405,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10098376190375194852,14022048871028272580,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13644991074228159039,5768624444516344645,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,16724165710924283555,12399739713887783527,524288 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,14581921634874587403,17892888402144206227,262144 --field-trial-handle=1372,i,4083526577611942449,10979093817887403121,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6ac1610274f1a1fe7efb487499493de9e02abb0353ede585200d27e7d566ceb2
MD5 9aafd3c6a631d23d2fc5d16d5786b9fd
SHA1 10c1e74766f4f28594e9176e3314d0468398b076
SHA512 ef9b3fe910d4bf60d05f218e85bed9b85b78b05fbdbf92c9c4ca899b3f0468f7fedaaaa159758ab5ed7e1b6e7be9bbf9c3bfa7b175e3267150fc3e925ed76223
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T182B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 a3a49a9a6fc3e4f8ead8b06112de053c6c0e44f3bdc14efa1bda62b39891c793
MD5 edadb67d693a2749635ef4b37aa30cfc
SHA1 5ec9940472a25a11cdf556e5156be0b296185a5a
SHA512 c8e82806fae1c2d9c28ec85ed13b6e2dc7a4cbb8fdb01236ce9694ed9c5865d5d02daba671900c23452f09c45feb0459dedbf7368ba036455419eb665b894f74
TLSH
T14FE0205493E7E194354496C7E17BF7184291F307AE8CD4DD3314B25E5482051DF54EEC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 93922266e375c3425476d3566366f00bce4bac5e4f6b520a4925650d0293c82d
MD5 15e85959c9b52606104df577836d580d
SHA1 5e8de18b87f8c0b3b281537429bab8a2a031542c
SHA512 ac1831fa0cb363f4be6ebf92c09f069306df8c29a28df5de66a9b87391e3d00a2927b774c23eb1163b2389cdfef56d263abf851e43d17f34c3ef04c8de01f403
TLSH
T12AE0208904C5C21DA580748793B4E71CC2C0370B97C4E95D5704C89D75414507381DE0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0705e049bb6a36a4def4bbce0f97bc7ca45e68b88e53420e899fe878f1bb67d4
MD5 6cb69988baf65976313c5428cf3a6407
SHA1 348c6d363657a4aea6fed9dd536bb1654939aa55
SHA512 2c61c81c818203bd9995a9057a946623b1c854011226fb16ecd5fc2e2a5c66b3e0ccf2574a7d55389dbbf9fea90b131e1dea9f20969d5d0f4b0b633c2ea2bc40
TLSH
T179714CBB07F1A8B8E3D04872A0D25541743DC2F9F807EE9AF7D085B91E1172582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b1e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b1e6.TMP
Size 3KB
SHA256 55af3c428d909d54b5d633ce2259108213fab1394f3bd907210ee02e08a00d81
MD5 f0a2cf108a4aa80b9b8f58e38b77ee05
SHA1 a643271745007c9fca26092fcc9bfa98d9d7751e
SHA512 23159ef58d743fa3d68f8e7f0e3a23512f0fbe1bc9d6a94da5110f99fbb46d9c200d86dbded727ddcbff5aefe3b77bfa0cee42edba7a417b03e53a9d6c5cbca0
TLSH
T175714CBB07F1A8B8E3D04872A0D25545743DC2F9F807EE9AF6D085791E1172582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 065c300500815adac545a1e701813fe91a4fcb7b36cf66d207b6ba411d5a6264
MD5 5203cdde878286db46985ac3d8cad7e2
SHA1 ffbea28055c1bc4c2db58a6617124ef43143c77f
SHA512 c87ca2fe842063cdc13326de9b1b4e9eb6e40aa1d3f4f51a539b3503b090818c9ea6631e24b74e6deb560beeb6e5f6ac7d6d0e8e782001b5df8c587c36058769
TLSH
T106115BF3C3D5856E8A0556F05A24AE2BDE2D0505421C7C19C5D4FF2B93E3075E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a3e76b9f89102f1b763cc00eded1dfda382e8ab4f3c775f6e157fa36dbe33ec3
MD5 c34c76ddb25139278c5475f2c09b97b7
SHA1 d0be06b233cc1557dcfef065dc2c14a86e241236
SHA512 4923e0f9f8f142fa1f825297dcaf14d1446d29ae3a388c960e08bc580238542d54e53c52fc466c65694aa839bccbaa2fde8997bbf152f24a5090a2ab0439f0fc
SSDEEP 192:sxZDSDRG+yM/jK1Ml8MkWt/f2Csz6DAVGvIdpdD1HW6+WNGYvrDsyzGb2kOIgrJ:sxZcPMs/fVsz6c7HbGoT9
TLSH
T1AA42F711AA346977CCCBD209FA51BF53D6F91572A2900E48A9FCDA1C01E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 545ba3b31d0b1b8d94e7996d3144de06be0f6db13c95686a6891828a097456b7
MD5 8e19f4ccf3fa3ab15893510ca1b0d12a
SHA1 c96793080ef8780bf13f76edc042da66e0fe649e
SHA512 d209367312f0a0babce0522c0ea7344a7aabc9a76710bd20a5f182ff233f674c2d917551ea3410732f7ae1ac093f6e4166a1b6049b2364cbe0542b85ff60a8e7
SSDEEP 192:sxZDSDRG+yM/jK1Ml8UQWykWt/f2CsWwoeDAVGvIdpHD1HW6+WNGYvuDLypwGb27:sxZcPqes/fVsJPcJHbG9Tn
TLSH
T11F520811AA346977CCDBD20DFA41BF53E6F5157292900E48A9FCDA1C01E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 68e684e10dc346fd77758d5536b74cc1a2020cd626523251d87d11a50d286d3d
MD5 45af744f66462364012725e1aa928935
SHA1 05b407d11d452c9366b5aa4543c27bb9b7df9bca
SHA512 c928ab375b31d325b3f1ed6e90e9ca5f63cc1dededb3f77a22fc4ca82a123f4c847d75935152d0ed6e6572f8c7269d4980212595a758316cf22de7d87668be2a
SSDEEP 768:M+seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppdrodY:M+seJ3xWvhfynu1jaVcL88pWi
TLSH
T172D20B2B680CCB7E4F844E5CEC266F966EE802CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa62a73e582117f7d5f789b7bef459cb08c1f475fd360ba08f85b6bacedae572
MD5 92ccb9a8c88a37adde13f0c23ea57808
SHA1 6ff3781ee5029c310bac8e0425e63acd1e85a709
SHA512 402ee9d16c7bca620ff18a44106d670908362650ac1ab535583cd68a8d24604762dd0411c68b5bfd11b1ed9d8f9b0b28b5462a8bb401e2839bbc17b1d353bca3
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EI:KYHIhKggkXyi0InKxmUTyNrIlKkswn
TLSH
T19DA17E0A34390A123CBD2988B79196361F42319B742864AFBF7800524E6FD566FFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 58c2cc775e1a5d20d1c9ac9bad758b9561513ab4ba06ec7babbf6d102aa37749
MD5 f11c6925a8750251f10dee55c852ac74
SHA1 e5ce97fe4f47f669ba83810f67dfa4d4fa0d4949
SHA512 860b7beb645d7259be91deaad2b98caa3c0f85910d0bd0906a01f03bb72497f7316438929423c55f37abdec7bbdf7588576e24231c89837c53fcdc254c5d4cb3
SSDEEP 192:uVcm+xasuheOwQxMGsNt+A3QHqKTMM7pwggmQmiU1DQDj7n9Z4MTQv+FdLYxTkFX:qZcIhsNoC3kl7YC0bgQdExMdUZBOxkx4
TLSH
T103627C71AC749C3BADA6F546F08B37135FF4813796C42B90A5ED6F1C01EA6A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c03f957eb05e0255595e415eff128eeaffdc82d76a9d145ffbabdde8424ceb06
MD5 c4850f4ab306ec65b73df8710f2d6628
SHA1 89f054973cca4642033244d625fdf3c7fde1fab0
SHA512 b261de188ee928f8f4db7e02a8f19a70a5562ca6834eb2f58e2d8a53aaeb3a33062b6bf1cc76ccd380b543e3eb18fcf9ea2dbaac151e07694cd115f823ac8139
SSDEEP 192:uWhcm+xasuheOwQxMGsNt+33QHqKTMM7pwggmQmiU1DQDj7n9Z4MTQv+FdLYxTkF:XZcIhsNon3kl7YC0bgQdExMdUZBOxkx4
TLSH
T1BB626C71AC745C3BADA6F546F08B37135FF4813796C86B90A5ED6F1C01DA668130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a8297e1c072277085f2c1fe72cd094026ed0d8946ed038c001ef7fd98fdbfe88
MD5 628226e967e002c009b045ef33b0ca6f
SHA1 ad40102296f5e56ae0dd318912aca248888d4f47
SHA512 fad3faca0662b16fe671e2630f1e55b0afa84901b9319c6d2fc108e438a0f591d8cd11a763d9666f67f57da92f9eac5541b5ff7a759b56f89c0375fc84cfaea3
SSDEEP 384:uZcIdzsNon3kl7YC0bgQdExMdUHBOxkx4:Mle8bXLUH864
TLSH
T105727C71AC74AC3B9DE2F546F08A37135FF491379AC86F90A5ED6B1C01DA668130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 445135b552f6db60b785e2a3d5b827ba71ba889e3f4c7bf1a390acba5810d219
MD5 64af3061e5eca04f403d789e80f39951
SHA1 496188c7ed19041e77615e669a3a8b3e45f0528a
SHA512 fb11bbb4604d8ceae36470f34feefe31fe9d663f453ec70d9df2238735627b8226517c5cb21410ac111c68d452343c7fd679db6e60b5ee3ebb8fb6077574c901
SSDEEP 192:lONw6vMtPQmiUyDlDjUThTQv+FdLYx5847IS7U/u:lONw6UtRAUT3dExB1U/u
TLSH
T1B4020735AC786C7BAAB3AD46F08A37171FF0516BA5D05B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8b1d60f93e9a3401506f491aa943b90cc80a4a829d95f52889f4db90aeabc0ea
MD5 47e53af931d578be353cc16f7d06a3e2
SHA1 54f74abfc7b226da78aa7c7b37bc1355ad75f53f
SHA512 3754ec2efb96e12ad7b87eb79813fff9c5eb572a0c274d965f692ae7e13fa17bc7a873555bef2dfbff440905e0067608c9241b2122d33f3516a522e7398ecaf3
SSDEEP 192:qOONJL6vMSgPQmiUyDvDjU9ShTQv+FdLYxTkFd3EI80IIeDqe2U/u:DONx6UFRIUA3dExMdUNBOU/u
TLSH
T178120B31A874AC2B6E92B546F08B36175EF0926BEAC56B50B6DD2F1C01DE66C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0d33d718492e96cc8d6ff046e4ffafdec82ed84e6283df4ed6f478d01a4b152c
MD5 fbe049865bf3f31f3dab14df32ff80c7
SHA1 f4eef027ece02db8acefb274462160b7affe37dc
SHA512 3174e259686191a61ec090c20624f14a3fb5ba60e9574d2d6e43d554464bd427bb999163c16fca18cfdab3edd4a8b36bd0f387d1154903545cff5412d3d4cb70
TLSH
T164411A58A6FA1108B3F76F56ABF3A8AE487FB8372E06C45D10110E4F0622A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download