hxxps://verisuresarl[.]identitynow[.]com/passwordreset/flow-selection/flow-selection

Analysis

user interaction
yes
max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://verisuresarl.identitynow.com/passwordreset/flow-selection/flow-selection
Sample260805-ra484ahl21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304120324000712"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{5B1DE3B5-9728-42B6-9667-AA231F166633}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3660	4832	msedge.exe	89
PID 4832 wrote to memory of 4952	4832	msedge.exe	90
PID 4832 wrote to memory of 3816	4832	msedge.exe	91
PID 4832 wrote to memory of 4952	4832	msedge.exe	90
PID 4832 wrote to memory of 4952	4832	msedge.exe	90
PID 4832 wrote to memory of 1548	4832	msedge.exe	92
PID 4832 wrote to memory of 1548	4832	msedge.exe	92
PID 4832 wrote to memory of 3160	4832	msedge.exe	94
PID 4832 wrote to memory of 3160	4832	msedge.exe	94
PID 4832 wrote to memory of 3160	4832	msedge.exe	94
PID 4832 wrote to memory of 1036	4832	msedge.exe	95
PID 4832 wrote to memory of 1036	4832	msedge.exe	95
PID 4832 wrote to memory of 1036	4832	msedge.exe	95
PID 4832 wrote to memory of 3548	4832	msedge.exe	96
PID 4832 wrote to memory of 3548	4832	msedge.exe	96
PID 4832 wrote to memory of 3548	4832	msedge.exe	96
PID 4832 wrote to memory of 3868	4832	msedge.exe	97
PID 4832 wrote to memory of 3868	4832	msedge.exe	97
PID 4832 wrote to memory of 3868	4832	msedge.exe	97
PID 4832 wrote to memory of 4928	4832	msedge.exe	100
PID 4832 wrote to memory of 3608	4832	msedge.exe	101
PID 4832 wrote to memory of 4928	4832	msedge.exe	100
PID 4832 wrote to memory of 3608	4832	msedge.exe	101
PID 4832 wrote to memory of 5028	4832	msedge.exe	103
PID 4832 wrote to memory of 2196	4832	msedge.exe	109
PID 4832 wrote to memory of 3984	4832	msedge.exe	110
PID 4832 wrote to memory of 1796	4832	msedge.exe	111
PID 4832 wrote to memory of 3252	4832	msedge.exe	120
PID 4832 wrote to memory of 3252	4832	msedge.exe	120
PID 4832 wrote to memory of 724	4832	msedge.exe	121
PID 4832 wrote to memory of 724	4832	msedge.exe	121
PID 4832 wrote to memory of 4192	4832	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://verisuresarl.identitynow.com/passwordreset/flow-selection/flow-selection
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3676565055190537218,1675388712060704979,262144 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,1493090060717008959,16538516472118783394,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,6603698039340612705,4995851952533311186,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5968093729674770848,13880544524998551920,2097152 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9562034146392469266,14467616176435228195,2097152 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,7511224676421447420,18235251174654181241,2097152 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,1619148081459326958,8591540591137232519,2097152 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,2533439047240857677,13775228547805428227,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,8825941734609151940,11221764744632684751,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,5794228256067107598,13855981487852596190,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,5794228256067107598,13855981487852596190,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,9140703112732855109,3404325131227506564,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,872522251720636485,3337652415576549703,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4700904723146370742,11893257144692458925,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,13268959226561187864,10776046968076136324,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,5311039409342680659,6925694351180205034,524288 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,1515408394854306950,2502134750823083018,262144 --field-trial-handle=2272,i,14354692663498320948,4037280615548552263,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c493741bd802ded9a310074247924ff2b454d17d8c752f9e7c6aca1dfd9abb4e
MD5 717092a86ad72e0b0bc79c07c38c5495
SHA1 b0d7b60fb68cbf4aa50ae51bb1ddac9139114b48
SHA512 222637b5dea218c812aa8d8397f8470964022f3680fabf245d826aed9c7304ec2f10aa4a1b56bae54104a0a412bc073bc15a31f941017c3fc55e6b0df65b9c49
TLSH
T1E471D93D044E4469D3AA03F364F217167D71BBDBF5D32EA57194AAF028053D68E4F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588f6a.TMP
Size 3KB
SHA256 11a20f4317e5a8eb129c9f9897a623421a082f0eacc46ff9891a4aa029c23dc9
MD5 775fc3eff1f7fdf82df42f8174b9ab86
SHA1 431ad877e0ab6c7ee46a9e448bbb1d6f7b48854d
SHA512 7ad527ce82faa0e61b474880eca0837c3363e7392ffee8d60f86d1e2838681b24da8d9f77f243ef5a98d110ee91eedec1572f15f25cd8d3851e79d2f5c2e4933
TLSH
T18A71C73D080E4469D3AA03F364F113167971BBDBF5D32E9571949AF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eb1fd2d172222964519d890926e8a0950529567bcddceb30b1d6873668d94f2c
MD5 58ff1f8a8411e90b7c9d0fcea38134fe
SHA1 c0845978c4c2c4a77dd2fbb899d91456811c72a7
SHA512 f1eaddb2b32d458f05c1b5506d15a969dd99b1764b6720f04786fcda12685dda8b5b212f54427a5d06e027087e035894fab918320db6035ecba19a7c8b7fa350
TLSH
T140118BF383E1896E8A1156F0AA24AE2BCE2D0505421C7D2A89D4AF2793F3475E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b4b09867afeeb377d762728534112620bb57c228ba42c22d89449d08218cfdf
MD5 8331cd2170abd8ac99b44f7911adf891
SHA1 43eccd32dd64dd7a72f21923170dd1810ae90bce
SHA512 3015f21eb5048cd69194b308e50b66972f331edd55c6228baa3e8af88b436d4f4ffd11d519f4547bba121a3fe1c101ab2d5f8e76cfa1578c66e531a7cc124b47
SSDEEP 192:sxZLRrkw/fYsUzEtIdpydcHW6+WNMzJ/Yz3o3dIg5jJ:sxZL2w/fYsUz5vHbu/p3
TLSH
T11822C7526E38A93B8CCBD209BB19BF53E6F5407291D51E58A6FC961C05E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f24f610d2c59b948f49dcb2a5aafc825e599f8661680e43a1bc1111d287774d0
MD5 91cecc02bd1a1a81603f7ac6b8c638e6
SHA1 89c84e11502f528234ae376d9e8ea518f581638e
SHA512 29e375a31244f902e7a2e2a05399509962e9a06c7c524c1f6b513b66cdbfe1e29454f74f7ae8027cc1b0d2d37948ae13c150b72188b01e4ae6693092b5ab1fef
SSDEEP 192:sxZLRrkw/fYs4zEtIdpydcHW6+WNMzJ/Yz3o3dIgrJ:sxZL2w/fYs4z5vHbu/p9
TLSH
T14122B7526E28A93B8CCBD209BB19BF53E6F5407291D51E58E6FC961C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 74107366c0bf6237ce825d9dd8f4c8e56079e4a3d3ad6b2f1563134d84744878
MD5 5a85cdbadada2eb8564f6061222b4bae
SHA1 391ca9575d3fe2c0a35e9c124753d8e6a9ee8425
SHA512 6ab2d02e56cf9f1d233203446e6f6f1833426df8e18a39822936b708bf52fba666cab3562af280ead45cdc806c02b866a32172282ea5e22a69d57374b336031e
SSDEEP 192:sxZLRrkw/fYsU3EtIdpydcHW6+WNMzJ/Yz+g3dIg5xJ:sxZL2w/fYsU35vHbu/Mp
TLSH
T1BA22C8526E28A97B8CCBD209BB15BF53E2F5407291951E58E6FC9A1C05E7BCD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 40af7ea20105913a8d3b18315292ed8059f02e0433564570227ce950e89a9586
MD5 281b3b314cc511d84651aa411f5d9ded
SHA1 46158b856d5e8700eb487c09b3d5e3cb817e6071
SHA512 ef01fcd3c184544042337991aae7a4e814286a9ecffd3d315c409ae2cb79e14edb60e5d7298262a49729f309221d420d9e5c4b2eab79c7242f1a770df9136e21
SSDEEP 768:/3k7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBIroyRxYY:/3k7u70WvqiEau1jai5LA3BzY6Y
TLSH
T120C2FB3B740CCB7E4F801E9DAC1A6F977E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f172d15b3251f72ed1eb81581002a06aae41561a9e5a01558357791caf267fdd
MD5 91694aafc8368a5d9c2168f16c1f9575
SHA1 c678d98b266f80fa99d4f55c301d4cc6d860bfe5
SHA512 d26f10341c95d3301880e7fd7f8164fb41555d6ade21876dc380d580557cb9ffde65d949dac01b9488e1f26ee9a322ebbb2907358d87de2430aad578862c79fd
SSDEEP 96:KIbCKcfTWKIsSUN8BtjDj6RbiJv96KXPv/6ztVandzU3qTHtBdwR54jvfwKXD:si1UN8BtjDj+bit9lPv/ytVandzU3qTZ
TLSH
T1D3915F17317B0A403C7F794CA6D585270F4271A37458AC6BBFA801619EAAE211DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592cd3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95d86819534100022552a1720ec6cf0377befabae2639b6bde851e7730e8cedb
MD5 04ce396c8a7b47e9f5a928b340366c1f
SHA1 a5a3cfd86502977ee172209e2be46026774f4631
SHA512 037a0b1ad5e25798fbe223133f52b79e1d2bc0467f04bce90aaadb23cdedb212024424f3eec37cf7cdc176e42904653b15863d032e22b62ca0906300ee4f49dc
SSDEEP 384:8ZcIhsNBFflTAQbeoCQd0mEM4oBeRs9JKgqijUTiw:qhmPnfkM4oTjKgqmUTiw
TLSH
T12D929F305C39693B99E7B241F58A37175FF48127E6C06FA4F2EDBF0C01A9698231B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2d90c60c7387e7c44e997c4fbc51bac1a087490a054f304d55351c27222624f6
MD5 1090f4a1c8e3df725c61af72cadfddf0
SHA1 74b47e7f08f151d5fae391afc31eab3ad6b23082
SHA512 53aca9607c81aeb7479261d44380af4983143770c8baf825d0c2aaa2979b3ed7194e7a4427df4ec7d32ac56efdf744d4553765c8c9e110ab75ab21071c4608a7
SSDEEP 384:xiFiZcIMzsNT8TUNTUlIlmflTAQbeoQCQd0mEMnoBeRs9JKgqijUTiw:YFQwuwgkPxQfkMnoTjKgqmUTiw
TLSH
T129D24BF148E7953AD9AE6743A77D2E134EBCC067B580AA60B3D86A0CCC561BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c18ff22cf462d9e1413124ca8d8d949ac28658dbea9acc909c657a3617cd1a3
MD5 b760e5bbac97826bb77b6f5c570dcd84
SHA1 3558eb7f8d1b92aa85391725c45691bd19c9838b
SHA512 79337edde33c83291bced2dd3423f9a3d657029982595f0fa8c84eb974e020abb2a2d887528b551cbe223cc7cba0272b4f15686668de68af729ff6c07f816eec
SSDEEP 192:MONf64BAQmiUyk1lW5GBPKcl+FdGuom1baDk5U6:MONf6eAHbWzd0mSUU6
TLSH
T109020A34AC746C7B9EB2BE05F48637175FD8113BA6C45B54EBE82B1C00D724C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 78f8e5f1a83597e5da9d3f589cf2232e5b109365c0f149a54d3e29dcb503e919
MD5 04df238581d9fc5f2082f403bf4c0a9c
SHA1 ec4fa4dc220ed66f1e95ea5e7d1e39304f8ede86
SHA512 5aea0d705713145f985f9d27a3c8ef0acd6eca77e1aa544180a7aa8c5400fff79f540c7b3e45f412ee65b5d8af516be48d52142c5b2493a14d8b2bb6ae1d457a
SSDEEP 384:dZcIhsNBmflTAQbeoCQd0mEM4oBeRs9JKgqijUTiw:Fh/PnfkM4oTjKgqmUTiw
TLSH
T195929F305839693B99E7B641F58A37175FF48127E6C06FA0F2EDBF0C0199698231B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21cd13e6f956211bad99238c4260a2f32688ccf4ce722091da2f3d91ba8e79d7
MD5 93be01449e73c8a27bb4f0a76102cf07
SHA1 5970433e411c22b60bec002df0d3fab342669903
SHA512 5ae94990c192b6f428787948a445374e26595527c44b4a2c1cec320b0fc39dd1c9547bd19d3a10672f4cc40862aefef9cee07fefe1cd47931ed171985afc4ab6
SSDEEP 192:/ONk64BgQmiUySle5GBPKcl+FdGuom1YKEMmWwiqIU6:/ONk6egRezd0mEMEoU6
TLSH
T177120A356C79AC2B5E92B545F48636135EA4422BEA846F94E7ED2B1C01EF29C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 02994a101da98a832e0f64f09048580c56b672e2f5d54f71071f7fe8ab74fac7
MD5 243159297a4860a09e254fb592c6f535
SHA1 7db0af37c731d0ca59fcf230a4ebc680b65a6e1c
SHA512 326ea8f07f9fb680fd408370eb49cc087438b648efe18a8e06026a1dfd14f3f3787b848dda6406b3c82e93e8a06bffeb832c1ce958eb2c633e6e1efe741e47a4
TLSH
T1CC410759A6F91104B3B76E5AABF6686E487A7C733F06D45D10110E4F4A23A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download