hxxps://click[.]zoom[.]com/em-soc-blog

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.zoom.com/em-soc-blog
Sample260809-stfwaa1and

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307626976933028"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6C4FE045-43F4-4E0D-B032-97DA0C4EEB7E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4644	916	msedge.exe	83
PID 916 wrote to memory of 3460	916	msedge.exe	84
PID 916 wrote to memory of 4988	916	msedge.exe	85
PID 916 wrote to memory of 4988	916	msedge.exe	85
PID 916 wrote to memory of 4988	916	msedge.exe	85
PID 916 wrote to memory of 1488	916	msedge.exe	86
PID 916 wrote to memory of 1488	916	msedge.exe	86
PID 916 wrote to memory of 1328	916	msedge.exe	87
PID 916 wrote to memory of 3872	916	msedge.exe	88
PID 916 wrote to memory of 1328	916	msedge.exe	87
PID 916 wrote to memory of 1328	916	msedge.exe	87
PID 916 wrote to memory of 3872	916	msedge.exe	88
PID 916 wrote to memory of 3872	916	msedge.exe	88
PID 916 wrote to memory of 964	916	msedge.exe	89
PID 916 wrote to memory of 964	916	msedge.exe	89
PID 916 wrote to memory of 964	916	msedge.exe	89
PID 916 wrote to memory of 4796	916	msedge.exe	90
PID 916 wrote to memory of 4796	916	msedge.exe	90
PID 916 wrote to memory of 4796	916	msedge.exe	90
PID 916 wrote to memory of 3132	916	msedge.exe	95
PID 916 wrote to memory of 3132	916	msedge.exe	95
PID 916 wrote to memory of 3132	916	msedge.exe	95
PID 916 wrote to memory of 1152	916	msedge.exe	96
PID 916 wrote to memory of 3860	916	msedge.exe	97
PID 916 wrote to memory of 1152	916	msedge.exe	96
PID 916 wrote to memory of 3860	916	msedge.exe	97
PID 916 wrote to memory of 5044	916	msedge.exe	99
PID 916 wrote to memory of 4244	916	msedge.exe	110
PID 916 wrote to memory of 1688	916	msedge.exe	111
PID 916 wrote to memory of 4468	916	msedge.exe	112
PID 916 wrote to memory of 452	916	msedge.exe	122
PID 916 wrote to memory of 452	916	msedge.exe	122
PID 916 wrote to memory of 4836	916	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.zoom.com/em-soc-blog
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffeb6a2c188,0x7ffeb6a2c194,0x7ffeb6a2c1a0
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,5359513916941240369,8634562568442092040,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,7941742768699708222,7681101759243039756,262144 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,13321292974113937862,3872811274707993673,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11731454257551875314,16695554982842990755,2097152 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10450550464864524301,41834310095453233,2097152 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,16110283171317089579,9686810635932386270,2097152 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,332209550996680126,5029888951998328216,2097152 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3476,i,8129269905049367159,5177383773033814756,2097152 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,13612820463523451052,4065735254103096396,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,17690534310799542397,4592455687501458317,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,16591556555444754283,13355805715545922459,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,16591556555444754283,13355805715545922459,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17284746464705098157,15928120778208401972,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,365060846262143666,13233492249423587963,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10704795686171886220,11508654473360794676,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,4516786939314038635,15740073975803063889,524288 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5880,i,6317193386165653929,17380646488449497640,262144 --field-trial-handle=2260,i,3155682963040656552,10392788112773868716,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 344c415d2a79120cf901a38a3ced74a6dd40085b91b2c0d14cf17f0b2ed53133
MD5 79fc6064306a2dd13b0ab7f5d484245f
SHA1 1b24ab787b8ffdd37db74b5bc6d6f61d8052ea7a
SHA512 244221f0480dabe8a93d301b3179a36e4f7bba7d72264718259a8b1aebb7d3cbaa22b27d4ff4048566c51d6f76322ea254596104338d9f91287b351a5a5514b3
TLSH
T15661B4B80152092CE3671531D0D11500307082F8FBD3BE9782CCEABAEB37BA3805AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d4fe.TMP
Size 3KB
SHA256 855146a33dd788036992c4107c2dab7b2c970c7d58a36bed0fa3b136616ba6b4
MD5 d66c1d93c4307f2d81e83d3b1d2e9295
SHA1 ffe6703ac6adaf11eddfca6d7e7236b3d31d378a
SHA512 e3a7ec3cdfd8e4a0770bc641b7e828a16db7c769868ef37927438a182c69f18010eb112fe3bb9e4e8b81418a956a573112c428fcc3498000445f76e6df35c3f5
TLSH
T16061A4B80652092DE3671531D0D15500347086F9FBD3BE9782CCEABAEB37BA3805AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 057f15647f52da8d04416add354785a23194495481f9b100e30924f51af0f3b8
MD5 4bd501a5316d612de5382bb6f2d88fc8
SHA1 2faf851422393c57871e29df81556c2b8972ad58
SHA512 1bdfcb6386ab5ddcc5399a9a060761d2d298d420c90b11f929764eaee6f5235cc58d65a6f7f4ac757187fe5a5da0d85d91c2408fa80e15fffbfb58d6fba47953
TLSH
T13D116AB383E585AE8A1556F0AA24AE2BCE2D0505432C7C2985D4FF2793F3466E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c0ec4865d1509ea95668bc0cc850d0fc1afee73a1abbcf0d139f52d64d5a688
MD5 e89b267ad29132f6bfc3f58af50e6d0d
SHA1 1a5c32514c7de6523edbc7a147d62054c15da4c0
SHA512 bc21989966d7ce503f428d1ee33c4612b756310c00c2f3ee7bcea3ae07f37a043119e0183e493ce9f783421616d73c75d5db08c053b0d81d4351821aec7a4b52
SSDEEP 192:sxZlRbyM/jK1Ml8Mk8/f9sB74mIdpSqHW6+WN5qTp/Y9InfcLIgrJ:sxZlpM8/f9sB7C5Hb50/y9
TLSH
T1DB42E712AA389A77CCCBE209F945BF53D6F5147292900E5899FCD91C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f0ec76af134cb1544272533cf032285465bc28909d10d1ec28df17fe31610604
MD5 a4d7ebf7ce638704aa72690d9a6beff0
SHA1 8b61a9ae2a15521196bb15f9bd396e9b555d3e96
SHA512 aa25ecc12969d577000b378cb48402e6d0ee0ee407a8e10dc21d962dfe84bd2c98641d7c32073b752440e84233f56e73b91464e1e1479deeba7376c19173d1c0
SSDEEP 192:sxZlRbyM/jK1Ml8UQJk8/f9sSa4mIdpAqHW6+WN5qTp/Y9IXecLIg5DJ:sxZlpqK8/f9sSaCbHb50/xT
TLSH
T17A52D712AA385A77CCDBE20DF945BF53D6F5547292900E5899FCDA1C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e7103466d5c31ab1fd81b5372be9ea7d2c46d0deccd2ca4b1da3cd04c1aed48
MD5 0113637545bb5c2753dc1d2f544ac015
SHA1 3781d985cf11ceef21051513b5ba0e30b45a85e4
SHA512 4a8e1e363bd778f195066d44a7dc59af0fe1d36740eaebfc2cb868871fdd25c47de7f655cc7326788429b440d4917a6ec96d65b8c9a3b19405c7e5d02f052a32
SSDEEP 768:Racv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN2ro4g6y:Racv21wWvu+Z+u1jaeFLeRNN4C
TLSH
T1CED20B2B280CCB7E4F841E9CED2AAF966DD801CB57984D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5ef74a771481a833dee212c3ca6084080309f1453027e89feef40cbdee1180f3
MD5 b59d29f1c56eacd05bc0539ffba85fec
SHA1 3bd0e9858274a7386d4610bcd2d1374280f313a7
SHA512 20f97e1a56f7012b9002a3171123b490a46a1e50cb18c1fd1d8ec711ce082347a1c69dff0058314bfe68ba807dc7411bbaae3d7022f64b33dcacf164fecf058f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDOFWKeMTuogKd6ag:mTZKfg
TLSH
T166913111317A4292397F794CA2B69A2A8F813563781CE57FBBB910620F67E111CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5970d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5970d1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 8b2b22d3fcd58dbd9221b3026ed5dea0a78d38d785a882293601ee7ba34ac74f
MD5 4220ea1308a59516ed7604c038af897c
SHA1 1cd4495e8ef4cecef8b2b93f6489beb7b867a672
SHA512 8c7405ff8d55a66b7801a65319dcd004567d63a37444042fdd44c906269057cbbee8c8c4fa2b10bab1143c9b1d8260d8738d385b1b61da9ec975038d5163c277
SSDEEP 384:AiFJzsNj8TUNTUlIlMUJu/zi4aTe+CrdhMvr9nTKwBODNZOCB5CC:bFp4wgjicyzEvr9newBKZOOCC
TLSH
T119B2F8F248DB4C7ADA9D6707A73E2D038EBCD163B5412A54B7986A0CCC961BFD306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a6c8d9cd1b6b7e06b015179a6dc80637772e1602bcdd9490d2b5bfcedb7585ff
MD5 87a9f318b61dd560ea1087840d64336d
SHA1 a3ec0872528205bdfaec50cb446c42d1ac9faed4
SHA512 dd26622e4b115c9b8e81b68f0dc5d93bedf18a3cdfc9d1ac911ea7863a1e75362b572d7a4cac6ec9d28e096e2bc3e7e718a32b72a64bf2b619b3e8fb3309e3bc
SSDEEP 384:AiFJzsNg8TUNTUlIlMUJu/zi4aTe+CrdhMi9nTKwBODNZOCB5CC:bFplwgjicyzEi9newBKZOOCC
TLSH
T1B1B2F8F248DB4C7ADA9D6707A73E2D038EBCD1A3B5412A54B7986A0CCC961BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd703210b8a2b758e36329cba736c0c105e152c49b0c8f65a42ba81510adee23
MD5 ff2484056ef2e9670c43f4aa43ebfb90
SHA1 7a5ba17e878ea8272765333e64d80a81b116dbde
SHA512 75d521f49021ef843bbbb92f45ebf0dd3b88eaf1c4f3608982f0cc14760ec4988ba19da6e90e15cf14a6dacbdbe44287ba0390e593fe47e8faed9b331480744e
SSDEEP 192:JONVu6v+YLNQmiUynCZh+CG5+FdeuIcusOTK1U6:JONo6vz/rZh+Crdh3O2U6
TLSH
T1C502DA356D386CAB9BF2AE05F58736235FE8217BE9952B50DAD82F1C00D765C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 636955fd7bc75753164bc24abedcbf83ddfeeb48f97e8eae86a391e04f4f1a53
MD5 7d2614e9591e6679be3809b1366f0a03
SHA1 97ea1cb43d1d662956fd9ff79b7a9bc02cbe6989
SHA512 b2f13aee3fec36f679cb27c027f761285f3f0b96f6092b403fc6f9b807beb8422e186f0a6b605585c395d68b5acd11a1f562d8e6cc677d2ee054069c2b82a32b
SSDEEP 192:9ON56v+YLcQmiUywCBh+CG5+FdeuInIEHCHVrqgU6:9ON56vzYGBh+CrdhMc9U6
TLSH
T1CA121A32AC786C6B5EE27944F48735135FB85177EA863B80DADC6F1C02DF6AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ff9dbd6007bf2a137cd395aba019e38d1b1998510f2caaa6e6678a97724f8729
MD5 e7231b9512d695cc669e42781a2e962e
SHA1 adfce32e135e0259eb5bc578f6c0202e5eaf05a5
SHA512 6cdfe6d3c8c5becc768ae06c0a266353e4962a3dc9ab7ab6cfac85707c30b2a9613a7f02099783819259ac9a2d35110dd777b11cfabd23005297876d07f5106b
SSDEEP 384:9sNgRUJu/zi4YTe+CrdhMp9nTKwBODNZOCB5CC:9OiGyzEp9newBKZOOCC
TLSH
T1BF724B31AC3C5D6B5EE27104F84B35038EB851A7DA852F64DAEDBF1C01DB6D86306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9245ecb558c62a53d83e1386346a8084f0c7db2eeb3984665ae9b65120dd7243
MD5 12b04cb798f89ea03e712ce7123d29d2
SHA1 955670919f9474311a5892df02ab99f8f0461235
SHA512 8bb3a64ae5b42e1936a4e5180a1e3943bbf5ade1e3c0d2c26b2270524753287ce796fac5b187f02f74c154ad633eb48759bd6002fb8e313bf3fe75a68d31e017
SSDEEP 384:ZsNgMUJu/zi4YTe+CrdhMp9nTKwBODNZOCB5CC:ZFiGyzEp9newBKZOOCC
TLSH
T1C0724B31A83C6D6B5EE27104F94B31038EB851A7DA852F64DAEDBF1C01DB6986306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

206ffe70-f25a-45e1-a628-f6aa3419ab8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\206ffe70-f25a-45e1-a628-f6aa3419ab8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 091d5f9e2942b487354a6ce4aa5bb545701fc29ee90e9a1699fe5ba4a7a54a31
MD5 69d877d6a4d9c05046206d2c9a4b1dd0
SHA1 3bffe8d43227ab42b9f0e9d9c80a54b18792b66e
SHA512 934f2c768c35c6d799a0d9ea69f87f42fc5ccc4fa0395f045509f1a685650f995e594e043fff5178f08175bbebe5bf28287ca639cfae0ae6db618a5d6e7aad9e
TLSH
T16A413A98B6E9114CB3B76F5AAFF6A86D447FB9772F0AC45D10110D4F0A62A00C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download