74368e3d14ecd1d3769054519afe113f048f6b398ba1e4921bd7eefccae937e3

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5-second-rule-just-spit-it-out.html
Size 11KB
Sample260805-wzerysdp21
SHA256 74368e3d14ecd1d3769054519afe113f048f6b398ba1e4921bd7eefccae937e3
MD5 e107d40a888b6520c5ee4d4c16281aa1
SHA1 6034b1b32319a50d1458b1f9d2a187b96d53f4f1
SHA512 8981db797926be351e63588501be0afe2eb6404ff765f16f79d80f8b95deb80c3bdf7b8cdd04b1fca9dc8e767067df5d43fb3bcf7632a2ce8b487a8d1470c33b
SSDEEP 192:fdNK2OAaF8LmUVj5LmbAjfJVaU436S/3KidsMwuhNY3CAOMn8BgKVQAn+KkKLJAJ:1NKRAYUVj5LDhkU436S/dTweNY3CABnF
TLSH
T13032F9255E8D5C3F020343DAB4A8BE4BA47F9E36C6040F52B5FB4A5A67E1DC6902734B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304277028728229"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{591C9F64-5B17-4C93-AA74-DFC408A1A0D5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4196	3572	msedge.exe	87
PID 3572 wrote to memory of 3836	3572	msedge.exe	89
PID 3572 wrote to memory of 3340	3572	msedge.exe	90
PID 3572 wrote to memory of 60	3572	msedge.exe	91
PID 3572 wrote to memory of 3340	3572	msedge.exe	90
PID 3572 wrote to memory of 3340	3572	msedge.exe	90
PID 3572 wrote to memory of 60	3572	msedge.exe	91
PID 3572 wrote to memory of 2612	3572	msedge.exe	92
PID 3572 wrote to memory of 2612	3572	msedge.exe	92
PID 3572 wrote to memory of 2612	3572	msedge.exe	92
PID 3572 wrote to memory of 3516	3572	msedge.exe	93
PID 3572 wrote to memory of 3516	3572	msedge.exe	93
PID 3572 wrote to memory of 3516	3572	msedge.exe	93
PID 3572 wrote to memory of 4564	3572	msedge.exe	94
PID 3572 wrote to memory of 4564	3572	msedge.exe	94
PID 3572 wrote to memory of 4564	3572	msedge.exe	94
PID 3572 wrote to memory of 5112	3572	msedge.exe	95
PID 3572 wrote to memory of 5112	3572	msedge.exe	95
PID 3572 wrote to memory of 5112	3572	msedge.exe	95
PID 3572 wrote to memory of 4876	3572	msedge.exe	98
PID 3572 wrote to memory of 4732	3572	msedge.exe	99
PID 3572 wrote to memory of 4876	3572	msedge.exe	98
PID 3572 wrote to memory of 4732	3572	msedge.exe	99
PID 3572 wrote to memory of 2492	3572	msedge.exe	101
PID 3572 wrote to memory of 3564	3572	msedge.exe	106
PID 3572 wrote to memory of 1068	3572	msedge.exe	107
PID 3572 wrote to memory of 5116	3572	msedge.exe	108
PID 3572 wrote to memory of 1172	3572	msedge.exe	109
PID 3572 wrote to memory of 1172	3572	msedge.exe	109
PID 3572 wrote to memory of 2508	3572	msedge.exe	110
PID 3572 wrote to memory of 2508	3572	msedge.exe	110
PID 3572 wrote to memory of 4956	3572	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\5-second-rule-just-spit-it-out.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7ff86e12c188,0x7ff86e12c194,0x7ff86e12c1a0
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,16262794136645410422,7612701734469925995,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12248259931733413105,7551227102892078540,262144 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,3906138158261361828,15308370165612853166,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6781119700779613605,12281148115097031074,2097152 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1802459982883988291,15791904501257137985,2097152 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,11107340745779288179,2166017322497032370,2097152 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,224069855736044230,12021422859909622348,2097152 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,128693025159467870,2674393368976974124,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,16430693358386293470,5956893212414247157,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1110478713505638470,17210274532980717829,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1110478713505638470,17210274532980717829,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,18140428319278995381,16602428055893632834,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,11910334458954181420,5023014756636774271,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,1195496768220734476,17820799962197776698,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3098414994537486135,8673994152669188496,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,13391490244755669255,16431024750348531088,524288 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,8751794914413732862,4994722770476078263,262144 --field-trial-handle=2856,i,9811816353287292474,12058339636041186086,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b00dba5d43c304a665c82a47df082ef866a8d4f2b6febf2bc6df367e02bb1b2
MD5 78429c2940f97d3827fc368e502b8b2b
SHA1 ae0f9ce217c4e511d8967b6677cfa4fd29b79bfc
SHA512 aea661182ade5e77931548a420aad4f39729aeaed932e24837e77769d2cbf84fc7a77a91585c0b00f0696ec0fdde2d66529af813caf649442f6d90db40b41977
TLSH
T1E57184390A0E04A3E3714173A5F2024A713ACAE7FA1BAE7725F44D763A14F6183B45D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58874c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58874c.TMP
Size 3KB
SHA256 dde36fe8933b6897d09f7e8df591b1890689b3981bacc8a3eb21de71e65040a8
MD5 ab579d52bb45c01d31a6470a3ee58bdb
SHA1 2f3bb25025bc618959adf705d37b5180728a3898
SHA512 ec09150d59bd41383305b5634967d4d18039432b3757d0742900b6eeee89f0389d7d904a7cc8a3ac0064b6d5cc22c1ce38499babb73ee027751cc8942043451b
TLSH
T1667173390A4E04A3E3714173A5F2024A713ACAEBFA1BAE7725F40D763A14F6183B41D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5250325fe63e3b804b8bb9072e388967fb8ea486a10826ca4a45a6728c6e06f1
MD5 1bca1e5f4e1205fdcab46ed6871b7992
SHA1 aadd9d25b15fbafd99b860f820ce673746683415
SHA512 c60e17f1bf9da8552fe601e731bcb14828b6d2ac6c4d83984c46c228ea17617ccca39c7232a3ac26a0aac0e47e45a9d72b7a60a3b54a7f98c40a12e4015d90d0
TLSH
T1991197F3C7D595AE890556F05A24AE2BCE2D060683283C6989D4EF2BC3E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2ac1c4066e3810a01bdec2ce5a6f5ad05e8b3b2db5064ec92285139761459f4c
MD5 a054750fecf987e942dabd0ce1984715
SHA1 3fd7cfcf8aa220312a75ca00c9b602b9fcf8ba02
SHA512 913b387a33728966e9c3f8022d004e3df3421de4589ab3ac84c6e1128d3c744543241c641164844480dc317a16b43cc2b38363df8f383b4535f4ca12d288d824
SSDEEP 192:sxZjRLyM/jK1Ml8MkU/fus7b9dDBIdpdyHW6+WNGYzQk7gyIgrJ:sxZjFMU/fus7pde4HbGIL9
TLSH
T1FE42E8116B34A97BCCDBD209FA457F53D6F90573A2940E44AAFCDA1C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c0f6c3109267b9977d9f01495bd79145767efb398cd816884745d3a297471b2
MD5 ca157e3a763c6df438dc4ddc1116434e
SHA1 3316aa03a6c1ab964caca4ad0eb7550f26beec34
SHA512 d8042150b4435b120f3aed7c17ce0f5dbb24ffe63fc6528e3943d013502d51d5218a14103d5f5e57f7c0cda2ebb8259d83bfd0b0ec0588339e2e32ae350d7a83
SSDEEP 192:sxZjRLyM/jK1Ml8UQRkU/fusZb9zDBIdpHyHW6+WNGYzskqgyIg5qJ:sxZjFqiU/fusZpzeSHbGME8
TLSH
T13252D7166A349977CCDBD209FA417F93D6F9057392940E44AAFCDA1C01F6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 31d11c50852487d50bde5185b3a1a66081f0733d0e01426baa183e034c2eb5ec
MD5 a5d548a4e70011177ad9f3a16c083b37
SHA1 d1f81bf18ee1b700754b4103560fbd201bba58b1
SHA512 9b43ef9fefdc501c6efb16699ee44549e1465f5233b6cf807be97220e4fcbf40ec035477cdf9c630d103fe1ed387a02d0e05f56df5b27c4ad5b0146006e368cc
SSDEEP 768:HuW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjQroIRirYX:HuW7kf0Wvqidau1jaa5LA3j7iX
TLSH
T15BD2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ed08de54df1df8120d62598e783b0fc185b672463d03fd271d9d17d4a727b151
MD5 a6c26c8b5afd9d196d57770dfc1e931e
SHA1 cb1db14d7e8b74218432827d8d5f450c254c1c31
SHA512 85a43f4dce80e966e5fe9fe97262dbadd3657316bd4d042928e719b6265084ccbbee218f62c40e8358dcb6324be657370dd66baddc5d3cac17bdf94caac1d354
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcWqtUgCwEbVU3qIEIbKDir6:KIbCKcbwQKxKmmH6KEIz16KOu
TLSH
T1E091861A707E0B913CBE2889A25985365F423163321875AF7FF805660E6BE225DFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec66605-cb5a-44e6-bf8f-68ba7762894e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9ec66605-cb5a-44e6-bf8f-68ba7762894e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3ae4ee373339181fda5804ffe3887eab4ea04c39e706a4de971aee1b4b9fa685
MD5 d217b21e83c692d953a8efeb874d6e37
SHA1 18ed5717517d403bf5325744cdcb0185a42b9651
SHA512 6423b4bec8f97d6825d1a6e950ed71a0dd37595b9b0679c97825ae8ba11cda26c63c11999d234702a93f4cb9ecc5f85a00035209edb13701a96db620d75c36bd
SSDEEP 384:PiFiZcIczsN+8TUNTUlIlAuDbEjBCsmF+23CHhBeRs9JKgqijUEhOG5:aFQg3wgaoSgjlSBTjKgqmUEhOG5
TLSH
T1D5A28E725864C97BEDF6AA81F58A37134FF44177E6C0AA90F3ECAE1C019B1DC230A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 555dfacc849078e599f812d1617ef0cdd4dec8189bf324bd48574d5d92e51b26
MD5 777e189c00950caa4344a1d85e610153
SHA1 6498a5f7472b6b897ce2468f72f7d115a58c3076
SHA512 cfb30ed064f35de3af8a0857d25049cb3a9775572b2141908cbc63ed456f79f89a349a9e0f0168738aeee5addf0c35b68a266c0d92da160e236932848f738ed2
SSDEEP 192:MONH64BAQmiUy51QW5GBPKpcCsmZaDvFU6:MONH6eAuWW9smSNU6
TLSH
T19A021A34AC796CBB9EB3AE05F48637175FD8112BB5905F44EAE82B1C00D724C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dc00efc89dfbf423ebe7282c27dd96d3dc2697fa5944b0beec0fbd2dc14d7baf
MD5 932047a43c15fc8539d267278e37aef5
SHA1 11aab7827e12de2aa02dc5416267cd59aabc237e
SHA512 d9258ad550e1e23003fd52946b73bbaa8599a9353bdff495f7f3708f6bffc9dca9a2e66296f39f2c695b354061f61ba5c35bb4c6c1eb7a2f0230f5258a2911a0
SSDEEP 384:AZcIhsNuAuDbEjBCsmF+23HHhBeRs9JKgqijUEhOG5:+hyoSgjlXBTjKgqmUEhOG5
TLSH
T116929D70A8799D7A99E3F451F58A37234FF48127F7C45F80E2FCAF1D019A598230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 895d01105d417a0222641377d517a8faebab9449ecf6a590a2ce1ef90b41ad5b
MD5 9f0499c9c7d1cbdccb0f9237fe4e5f5d
SHA1 8d54349cdf65ce3740e92c1cfad0f6a536e7fcef
SHA512 32b2f2db42dd28d556aa949f4d586d7b5e193d95bc03f109d58629cbc1b29c95d9fe8975029755cbe0050ea57dab988753e8ce5304dab2d06a8767be8a72d232
SSDEEP 384:5ZcIhsNu5uDbEjBCsmF+23HHhBeRs9JKgqijUEhOG5:RhnoSgjlXBTjKgqmUEhOG5
TLSH
T18A929D70A8799D7A99E3B551F58A37130FF88127F7C06F80E2FCAF1C019A598230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ad5db2cf0bd6c789fbc48ddd8b5072231eb171bbbe215f22fb666b6e8c292b9
MD5 307400d20fcb75b89e68c9f157d74e62
SHA1 489ab0940b851926f20a8a95693c3ae20e4e2080
SHA512 ec3de8095be032395b8948702e174cc0ba9b63775e2dc978821d30f7c4b2210d4274f9769495a739c4ef948968de7f8ce3e67c7048026a067703ac86f912f2c3
SSDEEP 192:LONn64BQQmiUyyQz5GBPKpcCsmdb+23HWwxq2hU6:LONn6eQYz9smF+23zHhU6
TLSH
T136121A75BC68AC3B5DA2A551F48B37135FE5422BF684AF40E6DC2B2C05EF65C230A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4ef030c-977a-4df6-835d-fb7913608b0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e4ef030c-977a-4df6-835d-fb7913608b0a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad07ce95210d0c7833007b453c6ed77274077285e15ec05b481701b56a8769a5
MD5 4ab567b70800fa4829a8c17a35095790
SHA1 9d87d41977a28ec85d6e966a5f9b1fcd9538d0c6
SHA512 a9f4e3e5cc0e7a5bb2b85599ab09a74dd235294cd1b26d4c2c32df0adf13ed1da10eae493cccbdcfe5375e85d2d7b943a8ce8a61c234b6b775105404d9de3a41
TLSH
T1F2411C48B6F91148B3777E5AABF7986E487E79733E06D45D10010E4E0A72B40CDA2733
MD5 SHA1 SHA512 TLSH

Submit Download