272a5e4d204297d0c1edee1212cb966a641a1eb615b004179d40b5fc41d2b6df

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
egg-and-spoon-race.html
Size 703B
Sample260805-wzerysdp21
SHA256 272a5e4d204297d0c1edee1212cb966a641a1eb615b004179d40b5fc41d2b6df
MD5 1df59c9d8ac185ac48974b4af5925181
SHA1 1944a18af1a584a6e917f9f60880f574200cdb84
SHA512 bc57ed159eeda7e6d7e0b4ee471cfa69a078b75316899bdf193de6b0ef10b4dee46cea86a9d535c899dcdc99ba8253f342c880eb9ab3473face7d460d5298a57
TLSH
T12C01F4DE8F16D3037533D538E7AC7654A33B219F9244D04AC1290D9F52782A3A1979DF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304277042364232"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7E360F9A-C40F-4EE3-9CCB-39E5FCB42D7F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4504	556	msedge.exe	85
PID 556 wrote to memory of 4632	556	msedge.exe	87
PID 556 wrote to memory of 1536	556	msedge.exe	88
PID 556 wrote to memory of 3564	556	msedge.exe	89
PID 556 wrote to memory of 1536	556	msedge.exe	88
PID 556 wrote to memory of 1536	556	msedge.exe	88
PID 556 wrote to memory of 3564	556	msedge.exe	89
PID 556 wrote to memory of 3316	556	msedge.exe	90
PID 556 wrote to memory of 4996	556	msedge.exe	91
PID 556 wrote to memory of 4996	556	msedge.exe	91
PID 556 wrote to memory of 4996	556	msedge.exe	91
PID 556 wrote to memory of 3316	556	msedge.exe	90
PID 556 wrote to memory of 3316	556	msedge.exe	90
PID 556 wrote to memory of 4916	556	msedge.exe	92
PID 556 wrote to memory of 4916	556	msedge.exe	92
PID 556 wrote to memory of 4916	556	msedge.exe	92
PID 556 wrote to memory of 3936	556	msedge.exe	93
PID 556 wrote to memory of 3936	556	msedge.exe	93
PID 556 wrote to memory of 3936	556	msedge.exe	93
PID 556 wrote to memory of 4464	556	msedge.exe	97
PID 556 wrote to memory of 560	556	msedge.exe	98
PID 556 wrote to memory of 4464	556	msedge.exe	97
PID 556 wrote to memory of 560	556	msedge.exe	98
PID 556 wrote to memory of 3016	556	msedge.exe	100
PID 556 wrote to memory of 1776	556	msedge.exe	104
PID 556 wrote to memory of 4140	556	msedge.exe	105
PID 556 wrote to memory of 4636	556	msedge.exe	106
PID 556 wrote to memory of 3448	556	msedge.exe	107
PID 556 wrote to memory of 3448	556	msedge.exe	107
PID 556 wrote to memory of 2616	556	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\egg-and-spoon-race.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,6114216015604662978,5717887283436133758,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10092514430773747943,11574847091275868154,262144 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2892641932206752507,11709403735376712720,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16711663042073375316,4432200755879545201,2097152 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14464624356769614268,3961487164794276238,2097152 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,6828492339790618056,5084837124069659623,2097152 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,1542619332226720908,17412739968536543112,2097152 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15098532376447775317,726106618441207188,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4379656054364275153,7875527995313783378,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6773211532168264398,16484508107443132886,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6773211532168264398,16484508107443132886,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,16064339218486893587,1605362426589910491,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,7204565182212336194,6360174169722965528,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,7162912183194969429,10334434632622034772,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8083893072774096279,6104437754051178581,524288 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,16170511623480478646,944153334109611809,262144 --field-trial-handle=2896,i,14534569107645348490,7700031778317750279,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3b0179af02874d87c25bd83093c14a7fcd59af87b6b6d3d71c9742306fcff393
MD5 402abe245e6b7b078e3b33959c9a8a67
SHA1 6a6049427371d427ca22bae77dd865f9047b76c6
SHA512 bdb111d9439062d525b8bee37dd499b67023725550b4e34751e4e90417555163b5f5baddb64143e05f9369de8a939f482dbb7630e19ffdbb206be02a378a540c
TLSH
T188711B303642C8ADE343C131B8D286F37033ADEAF82B5E3001989E7529A5F228C1D6DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 92669fd17e1b98d0a352d19370a308252d7d728ab19729ef148a70b0d68b52ad
MD5 9958427870aa29558dc2ad787ab95bbe
SHA1 24d73ceb8e14b62b8117f6a63269769bb4d536ec
SHA512 4aae381d984df43809e3025d78af306b403204b23a2960e49667962f94a7f838ed6d43546e475bce5bf7287a4f28f553054013c724f5932abd765f81d4f15812
TLSH
T14911BDF3C3D5856E894556F05A24AE2BCE2D0602821C7C15C5D4FF6BD3E3075E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5066f2389264899ca554bc9f9d2f19ac69d3f33be7d64d79d008fc2175071783
MD5 4f3805fa7c6146123760c55f37c25f1f
SHA1 19074715712aa11b57f1a3108e888f4a0148533a
SHA512 5110c4fe0bfd17d58237a20223a2f355276a7cf01a6e43a3a458d8685aa516e93c2dfc6d4f40f7d9c74ae78c65011ddfb4acbd92beed9d741b79875adb6ea1a5
SSDEEP 192:sxZlRz1PyM/jK1Ml8Mkx/fLssnaKIdpdzHW6+WNGYIk9gaIgrJ:sxZlXMx/fLssnaD9HbGW9
TLSH
T16C42F811AB34A977CCDBD209FA45BF53D6F91573A2900E44A9FCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bc8392559d2f8c11f1530218b3d07d9b370ff96f37ead9f920f1fac7cef3377b
MD5 5a7a297deeb524bdcc974cdeb37b0f0b
SHA1 891707d636e522149b2aeff65d576b9cfd3456e8
SHA512 a11353e3effa45daad877fa5661485217f0fca42aee89aa4d1d5e3b8ea3e7c942dbb00c170ae364a560dd9789210cdf5b03d5b6915cb0db4898d9c28d2b89569
SSDEEP 192:sxZlRz1PyM/jK1Ml8UQgkx/fLselaKIdpHzHW6+WNGYIWMVaIg5DJ:sxZlXqzx/fLselaDTHbGED
TLSH
T1DC52E711AA345977CCDBD209BA45BF53D6F91973A2900E44A9FCDA1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 01a224a72cbc088f3f171211c11d703803b114af5a299904b0c69565f88d26ee
MD5 a24a912fb02500611509a5ac898d2db9
SHA1 3238e8754f1e31b2fd35252120adfad33e0c1b53
SHA512 ba491f724c761cee6484ce1757e4eae6d4b7bc5792c0e91921bdd225792e702ff915447695778432b804bdae694d260369ae3af62754109af36a1d598581c7e6
SSDEEP 768:q4sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9DrooyV:q4sqxXlWvJD6Tu1ja54LAs9woK
TLSH
T107D21C3B694CC77D4F840E5DEC2AAFD76ED801CB66988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 58810556a89d7fe1e98357b8857c8ba47b43496d1fab3346cf1de259729122d7
MD5 2447565e41aa95a02f8f27bbe5bda003
SHA1 99a68f853259a5f555ee388287a652435f4902dc
SHA512 4ae08bd0d98bcd78b4dcd18972d4cbbd175e75584934d17e09cd706221d26f863a8789d66334823a76f803dcca553f5c5d0105c2f3bb4375c2339016e68c18c7
SSDEEP 96:KYbaKYIKRktgESKK+Ea7lCk+KqLCe+mckDO0f6KQK/6u6ucKnqJ:ExV9/7PW
TLSH
T16DC1D21A317A0A1339BD3988B66A86361F4136733018B46F7FB840654E6BE235DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6b99f3f1548ec739986dcc9d56360791e10ad52f1d3358d3e793fff16e92a8c5
MD5 73bf14e74cdc3543d8cf3c615cc45611
SHA1 e5135dbeb0bb8510b7c77f5eeb0ce8a3eb63d296
SHA512 aff73aa05e2d2c06021a949c391c41d5aff48c799554806476badc856aff984a9098b274168ffc4eefdfcdef0f0f8b7b7296d003a2a13aad16575a69df7b6841
SSDEEP 384:6ZcIhsNDvqebpvPVRN5dc5sJryvlBeRs9JKgqijUghOGG:4hx89H5CmhyvlTjKgqmUghOGG
TLSH
T1A1928D3058385C7B9AF3B841F58736174FF49577E6C42E94A2EDEF0C02DA998231AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fb002d1e26763f5a7339d98afee846f3cbf820e735eed660d47945f20059b5e7
MD5 3037a6e59944fcc914f21f1659978194
SHA1 698225a54a117bd28b181d09aa2cfcfaf658377d
SHA512 9fb87ff863dbd9c980e763b4d5ba21e4be60494210f3f5ff209f41f84503418f563648250ac3b5205b84441772246f1f4c2aa7f13a79b974fd9a75e253313b71
SSDEEP 384:BZcIHzsNDmqebpvPVRN5dc5sJrtvlBeRs9JKgqijUghOGG:JT+89H5CmhtvlTjKgqmUghOGG
TLSH
T1A3928D31A8385C7B9AF3B441F58736174FF49577E6C42E94A2EDEF0C01D6998231B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0122abc51004ab43b4c6d1c424e649c7095b5c3e48b6bedd2d2644676b98a14
MD5 090e9355bf8383a36d23905fc8f46cfa
SHA1 667a7de8f866e6670746409bce9ccb070162fdf2
SHA512 5bd0454e5d372ce306fb6cf7f3e20560bf6eb1a49fd9ad0ad79368e7a60240a74485b32b906085d6f0d3739893fb0fc6f24bee028c5fd57dcc0ea623934eb296
SSDEEP 192:tONnm6JkRtQmiUyInW+RNW+Fd102owh3vyRJ7U6:tONm6Ur/W+RN5dcQv07U6
TLSH
T13B02E935AD382CBB8EF26D0AB58737175FA4217BB9952B90D6E81E0C01D765C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0f2cc630c52c92f15eecadc6cb36ccb4996d6b5528554eca096f49c91860bcbc
MD5 4f814cc1d5d33814a76aee2f24f7ad90
SHA1 d4c65b0a65a6ad2422b98bead12d33c67270638c
SHA512 df2668b8270263b927f8845e96f66352b7a8a53ddcd87cc7c67e1509a749734fdd6a1a2dd15c1e3c7098a4d9ab13d619d49556e3de2901edef11e9a2ac21c6ae
SSDEEP 384:eZcIhsNDmqebpvPVRN5dc5sJryvlBeRs9JKgqijUghOGG:ch+89H5CmhyvlTjKgqmUghOGG
TLSH
T178928D3058385C7B9AF3B841F58736174FF49577E6C42E94A2EDEF0C02DA998231AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ac0ddd5781630ad579e8a6af0cbfe0dbf0408a57b6b21507b50b5cc6b0b392bc
MD5 d20387c07354edaa34936cff2ce286ab
SHA1 72793aede25b80630374b37b4c02c3fd84bc1800
SHA512 c0779c6c96bf7b2dfaaf20cbc6097a1dd6f50c22f305c9e56ff1b05415fdd54168db1b66d2fa23a30fecc820f17651c7ca5043b52de068e15569a28461e82fa8
SSDEEP 192:BONe6JkRuQmiUyZnN+RNW+Fd102o1U2tSJriKVcv+qZ/U6:BONe6UqwN+RN5dc5sJrgvlU6
TLSH
T14D121C356C385C7B5EE26445F48731135FE49167EE8A7F90E1ED5E0C01DB6AC130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 60ccb165f84004e2ed11068f353fa19f5542f03f8c759069e555e4130949e72c
MD5 c73e8d2bfc93c5ad143b677853cd8b04
SHA1 2c2360fce1bdc2dbc176bc6ac81fe2565ac09ea9
SHA512 85223774ec0e5bd4bd04463aa8f0f9613dff20f6e1a2a40b7ccbd71b175ff163dde456f968b700e1fe8c84c60f1f5f6e0a46aab561f33a33d89c9d4e81562029
TLSH
T1B1411C5CA6E91148B3B76E5A9FF7A86E487BBC772E1AD55E00010E4E0B22A40DC71737
MD5 SHA1 SHA512 TLSH

Submit Download