d37acaa7d6bfd0fcaf2a77d479836734d6ee3c3c0ec35443dd487257188bc59d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html
Size 19KB
Sample260805-wzerysdp21
SHA256 d37acaa7d6bfd0fcaf2a77d479836734d6ee3c3c0ec35443dd487257188bc59d
MD5 a21c85c512d13ef0501816f2d594159b
SHA1 0ebbb0a7cf66660020e56cc70cbba6cd4277af80
SHA512 d33983bd7ed13eb81aa591c7e6e797321c0e5cfbb860ec476df153eb7c2a54d2787e5fffdd48e9e97274ece97de07757787ca7875d18e1b4d833962fa88dc8fc
SSDEEP 384:1Bal60hVEKLthjqrgfd22jiadNnh6udFqC5dKJgHdEbkOMd9hnjlyBdh0XhSHndw:JTuWgFvjiMdh6QkCnqg9XOmjJy/OXhSu
TLSH
T1F0920A7046DD2D7B122743D7B2907F5E68BFDC22C715068460FF5E9AABE0CC7941229A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
664	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304277063980645"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{52EC7EC6-17F5-484C-BF33-ABFC7E7887D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1624	1648	msedge.exe	85
PID 1648 wrote to memory of 664	1648	msedge.exe	86
PID 1648 wrote to memory of 3848	1648	msedge.exe	87
PID 1648 wrote to memory of 3848	1648	msedge.exe	87
PID 1648 wrote to memory of 1040	1648	msedge.exe	88
PID 1648 wrote to memory of 1040	1648	msedge.exe	88
PID 1648 wrote to memory of 1040	1648	msedge.exe	88
PID 1648 wrote to memory of 2368	1648	msedge.exe	89
PID 1648 wrote to memory of 2368	1648	msedge.exe	89
PID 1648 wrote to memory of 2368	1648	msedge.exe	89
PID 1648 wrote to memory of 4516	1648	msedge.exe	90
PID 1648 wrote to memory of 4516	1648	msedge.exe	90
PID 1648 wrote to memory of 4516	1648	msedge.exe	90
PID 1648 wrote to memory of 1728	1648	msedge.exe	92
PID 1648 wrote to memory of 1728	1648	msedge.exe	92
PID 1648 wrote to memory of 1728	1648	msedge.exe	92
PID 1648 wrote to memory of 3164	1648	msedge.exe	93
PID 1648 wrote to memory of 3164	1648	msedge.exe	93
PID 1648 wrote to memory of 3164	1648	msedge.exe	93
PID 1648 wrote to memory of 3176	1648	msedge.exe	97
PID 1648 wrote to memory of 2340	1648	msedge.exe	98
PID 1648 wrote to memory of 3176	1648	msedge.exe	97
PID 1648 wrote to memory of 2340	1648	msedge.exe	98
PID 1648 wrote to memory of 912	1648	msedge.exe	100
PID 1648 wrote to memory of 4656	1648	msedge.exe	115
PID 1648 wrote to memory of 1376	1648	msedge.exe	116
PID 1648 wrote to memory of 3620	1648	msedge.exe	117
PID 1648 wrote to memory of 3952	1648	msedge.exe	120
PID 1648 wrote to memory of 3952	1648	msedge.exe	120
PID 1648 wrote to memory of 1644	1648	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,11592153672012738810,15458344552166495770,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,11566225557858545790,9922530027463792131,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2641929143868453523,5485674782664675507,262144 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14954953731595377599,11691645501024993431,2097152 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,9967345453286719248,16995913723456636854,2097152 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,9406548471787487248,9190567795915535128,2097152 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,13382184989219264984,12631254800870626224,2097152 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3217633954348224022,925346427076605628,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12239563384827254910,11896050830437216127,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12506863307552132792,15706710786847724488,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12506863307552132792,15706710786847724488,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,16290988076709037102,13508472181301240951,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3537349419221855895,11869320444157403132,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,4948451810009841957,3106134311199453863,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13134631788379688327,4949444619969659419,524288 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,5925265352509751147,2409985066745176599,262144 --field-trial-handle=2232,i,17368693984442798719,7499722271377674779,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25f62999080c3399939c308be9a455b0169f190d6835ad10ecf22c0ac8785a0a
MD5 7e3ef5164aca11d68f83316c02c16730
SHA1 8bd05e819b6a5f4ce6ed62225e7931812815d5a9
SHA512 96cffff3e5e54aff8e9e05883dc151b076bae4b340e2175138a396882719c8144bbea7cad9de06bca1d7c11765586a16fd8b625561f981dabbeb9f0cc10c16b9
TLSH
T1B5611B380B5E0482E3A266B1B4E20105717182F9FB9FDE4DEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc27.TMP
Size 3KB
SHA256 0e8ea557eb0c2d2709f60356253255554fa48472fd237f8afb1496e055ffa6be
MD5 f2924728a2050b3ae92138c358e2c8e5
SHA1 8e281b66080f618bb20f7c3d958c36bc7e4af01c
SHA512 8efc45d8531c63ec56af7585795010e36fbc9b22d384573c14b8cdc65b0ad5f74bf390b9a40450f9703cb2a787776efb61604983a1358a78821b9c009c92a7b8
TLSH
T1F2613B380B5E0482E36126B1B4E20104707082F9FBCFDE4DEF148DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 653320039a2febe1b9eeb8c004f73f0d824a7cba623b057f73799acfd5a86ccc
MD5 600bd5975ba9138eb12069e0f5954448
SHA1 8ded36909f1896c717384c8402c4d48f8a02ffdf
SHA512 714c49cb179e8b5ec30921d1032f166f614b823c6801e14f3eb85a409417952ce8971c8577057efebd8c272b3a732043d157f310fe707401854343a7d0a5a4c4
TLSH
T16811CCF3C7E5866E891156F09A24AE2BCE2D0606432C3C6589E4FF2B93F30B5E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 691fe8f4b4d98cd0a7a967013a1d5f3332227c1f1e96459399e2c31ba26a28c4
MD5 e3be4f3ab27711f39b17304b8dfa46d7
SHA1 d5c6d422183130a562becc666549bd9338e98d09
SHA512 780f1652bfca922dd93fc8dd5a87ca3d21c580481e46dea841f1775f209c57a8d804c85d2690e32ff767f40975e71590f80c87d0e6d63eee9afad29d341bb21f
SSDEEP 192:sxZ/RfyM/jK1Ml8UQBkZ/fus4+cGbXIdpH8HW6+WNGY9IX9NoIg5jJ:sxZ/1qSZ/fus4+cG8cHbG87
TLSH
T18752F812AA385977CCDBD20DFA41BF53D6F5497292900E44A9FCDA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fa021a88baf4ab4a0c503015ea2997d8239b2e7645de554a9911d253c8c62a7c
MD5 b94690cd6c923b7a416b831f413728c6
SHA1 3b5f0c86fe85fbef2ea4b0b81a27c58c0ddbaec2
SHA512 d2a03bc729bc6be49c2360dca0928dca04f11632937933f9d5dfdf4ec3e3f6b871910b62bec6f3929d2fe1147328f67cf204d5ffe83b51fb929b5d928ee3ddc4
SSDEEP 192:sxZ/RfyM/jK1Ml8MkZ/fusniGbXIdpd8HW6+WNGY9IKGNoIgrJ:sxZ/bMZ/fusniG8iHbGs9
TLSH
T1DC42F912AA346977CCCBD209FA557F53D6F90573A2900E54A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00d932d28707fc21f54db16b4264f4aa32d4461c2cb5ec4c09ae9a85e943068a
MD5 e636da62b7b792d9d0d8b9c51fad3a80
SHA1 b6039844ac6f44adc5fe4b8d8d01859d82913bb0
SHA512 8a0f6a1b59c6dc22b331052808cb28a05003e70bc0ed1dad356693635f1e71a806183bcbd5d30d67c4b303195d3727ec86bac6b1ab80a66a382cb468d50a5f7d
SSDEEP 192:sxZ/RfyM/jK1Ml8MkZ/fus4iGbXIdpd8HW6+WNGY9IKGNoIg55J:sxZ/1MZ/fus4iG8iHbGsV
TLSH
T16742F812BA346977CCCBD209FA55BF53D6F8097292900E54A9FCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f1b1cd3f771bea5679816a0229f7e0a2982f0620fc9113e2cc356721f2f85ae9
MD5 7cfff9f2fb45beb5d2e1230900082ef9
SHA1 91395bc23084adbd6df93429db021b9107b67887
SHA512 61e2f837d327fc41a93af085d2a0a20024a6134fc22111c50645b36c8b935664b1c6d5c3d2e431f6644cdfc6cd38336734d4a844901585e283ba811b297653b8
SSDEEP 768:6ncv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNZro1g6CS:6ncv21wWvu+Z+u1jaeFLeRNS1X
TLSH
T13DD20B2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 646334841495cb561ac894a7ba1d26f2f762abc55ee9c81fe5c7191cf90d874e
MD5 7a6d32c89bb707d9d4401faade3fc2e1
SHA1 b2a32779b8f435e99fb12792a83cb87c8fe42c21
SHA512 14988c1532890989ee4fe0bc5cd12fa444d95670dea6a1ff8b3e3457d4d58052c48eb6f3fd3d5fde2a4af6a074cccb6c33582347faea2046f82ff59d5c9f254c
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWOBuKKoiacAKdCC:mTOpHH
TLSH
T175919506307F02C17C7E2C0C965689261B57366A351CA4BBBBA811A68F67E253DFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59578c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59578c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c01e44bcf67fcf80752190eb7178b17bc5a15742559f8f6b65be9dc316e8d358
MD5 af892c7bcb77170941936434fe3be7be
SHA1 12961f7ec1f8db3b4b81bcd209a54c1d32ee81df
SHA512 30059ff8c5246e39bf1de979ec8079565b002cd16ac4104e7964f296b78f55d5e1fe7b69227291506b141ad38589f2d544edc41679e47dc72fb19f45f67ee9b1
SSDEEP 384:7ZcIhsNhuM3FziSXtJe+CBd0esBIHBeBeRs9JKgqijUThOGw:jhkFdQJxsBCBeTjKgqmUThOGw
TLSH
T1C0928D3198786D779AE2B541F58736174FF88573E6C03F9091ECAF0D02E7598230A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5dc943845b5d20fca93a6ffeac5837591c28d35aa8679f34a13d9912d4e42eb
MD5 81b7d717342605241f272bc5a917528d
SHA1 091d67a7c8428f9d388785a31227386b024ceab6
SHA512 b9cea104fe09bf42c33406cb2b1563addec6c698180af99dc8ea508d3ee52c136c30baacffc84278a9a406911c5ca174fc588d28c96570fc32772e2b696cb81f
SSDEEP 192:JONa6v+YLNQmiUyNCVZh+CGD+FdeP9ospusIH32AU6:JONa6vz/qYZh+CBd0esJIHmAU6
TLSH
T18E02E935BD382C6B9FF2AE45F5873A275FA82177E9912F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38a7bcf69adccd373c7f405f1d5143852089db0b0723538030bf87eb2933137c
MD5 4a7b6dc742415282ce25ec63d0528ec9
SHA1 e8fbcc3a371e300f38f0a870ac3490036c101930
SHA512 e252456ac7d26f57a7cf8d35ee247ac21ab3c420e634fcabb380bd2e7a3dfd6493d3147e92c05a0cb2b96e5b09e7008e560c85a7b5e05f468b52d80d55cebba0
SSDEEP 192:jONk6v+YLWQmiUyNYVrh+CGD+FdeP9osNOeB+CHIHWqdeU6:jONk6vz2qOrh+CBd0eshIHBeU6
TLSH
T15A121A35A8786C6B5EE2A941F58735135FE55233EA863F90D5EC2F1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4b25f63900e2ba9249392f4a343f2092ab213ef49387bb2262f2c152b6740e07
MD5 0c2fafa835bfad9f15143aadbc598dc7
SHA1 395d3989b7d3426ea3c0de9e616c87f0a6810db3
SHA512 12f04b158980dc489e145ca7cbea993d4f3f7df3e882951d5a454e9a43d138df21022d50107d368c76bd537d806ea80ed2461f8e3d7cc2f4e4395ee1d7790654
SSDEEP 384:4iFiZcI6zsNz8TUNTUlIlZM3FziSXtJe+CBd0escIHBeBeRs9JKgqijUThOGw:DFQSCwgkFdQJxscCBeTjKgqmUThOGw
TLSH
T1A3A28E325868997BAEF6AA80F58A36138FF48573D5C17EA0E3DCAE0D01D75DC130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f25567022dad56936adfd7651a895ca976b9d0479419b486b57a5c5cff675ed0
MD5 0c1c1a4cf9abf5519a1b7b1cfca5949b
SHA1 ef7557ad5e9eaa89986dc3b2fd741697614172f3
SHA512 69294061e3eab085a1ee1c3466cc6d2b3b59ac1cb8128f030db5064dc78a66187949180e546a3acd6f90761ee86ef92613bb9d4d1b7222c0b3976680e27347a1
SSDEEP 384:oZcIhsNhZM3FziSXtJe+CBd0esBIHBeBeRs9JKgqijUThOGw:WhVFdQJxsBCBeTjKgqmUThOGw
TLSH
T114928D31A8786D779AE2B581F58736174FF88533E6C43F90D1ECAF0D02D7998230A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1251c5a2-caef-4069-8d70-f1e8a5fe0fce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1251c5a2-caef-4069-8d70-f1e8a5fe0fce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e408badde0ab2b9b906e502730d4b84d8c48ff96e453b8ec4978225f1ee4ee42
MD5 45c5a23c769165aa77ac8686a36732b2
SHA1 dc6f03a6c09f09aaf7891cd53c8c6b3033c6a067
SHA512 4dfcf9421cc90580943fd39530c838018cbedc4efbe622d1c22aa9313de63690400c0c9119e6d9d4d066099d2f1f2080be949be826552c0a442355f20b5d9590
TLSH
T1AC41D359BBF91148B3B76F5AABF6A46D447ABC372E4AD19D00010E4F0A22B00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download