63dfe3a863d66bed98e770c83fe96a55937a952efca3dc3f0896c68cf38f0428

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LabManual.html
Size 299KB
Sample260810-rhblrawshv
SHA256 63dfe3a863d66bed98e770c83fe96a55937a952efca3dc3f0896c68cf38f0428
MD5 8323bee30b4ef8b55c10ee360fa95b9d
SHA1 6048a977604d2e447218c405619de2ec95da9251
SHA512 38c51fe40190f58b3d4a422d6f7ffcf7a35249b6c3250f9dfcf5f9736972f1ea2944e75efed728c451c10c00816d6310b394d68a953f8f6deec1711065d7b42a
SSDEEP 6144:WhOSQQa7ubHSgkcD4wAhVeaPHMDh06bh9spZf1yhDCAu4JxxuQXG21Pm1rVRx68j:WhOSQQa7ubHSgkcD4wAhVeaPHMDh06b6
TLSH
T1C864E77192D313B30097DBE9A6726BA8F18EB92DD60314987AFC83F813C9D587539187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308446769572114"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{7C7652EE-01AE-4825-B9ED-BD9FCBB5DEAB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 2212	3732	msedge.exe	87
PID 3732 wrote to memory of 4608	3732	msedge.exe	88
PID 3732 wrote to memory of 3792	3732	msedge.exe	89
PID 3732 wrote to memory of 3792	3732	msedge.exe	89
PID 3732 wrote to memory of 3792	3732	msedge.exe	89
PID 3732 wrote to memory of 852	3732	msedge.exe	90
PID 3732 wrote to memory of 852	3732	msedge.exe	90
PID 3732 wrote to memory of 1932	3732	msedge.exe	92
PID 3732 wrote to memory of 1932	3732	msedge.exe	92
PID 3732 wrote to memory of 1932	3732	msedge.exe	92
PID 3732 wrote to memory of 2080	3732	msedge.exe	93
PID 3732 wrote to memory of 2080	3732	msedge.exe	93
PID 3732 wrote to memory of 2080	3732	msedge.exe	93
PID 3732 wrote to memory of 3548	3732	msedge.exe	94
PID 3732 wrote to memory of 3500	3732	msedge.exe	95
PID 3732 wrote to memory of 3548	3732	msedge.exe	94
PID 3732 wrote to memory of 3548	3732	msedge.exe	94
PID 3732 wrote to memory of 3500	3732	msedge.exe	95
PID 3732 wrote to memory of 3500	3732	msedge.exe	95
PID 3732 wrote to memory of 4892	3732	msedge.exe	98
PID 3732 wrote to memory of 4892	3732	msedge.exe	98
PID 3732 wrote to memory of 5080	3732	msedge.exe	99
PID 3732 wrote to memory of 5080	3732	msedge.exe	99
PID 3732 wrote to memory of 4028	3732	msedge.exe	101
PID 3732 wrote to memory of 1320	3732	msedge.exe	114
PID 3732 wrote to memory of 3112	3732	msedge.exe	115
PID 3732 wrote to memory of 916	3732	msedge.exe	116
PID 3732 wrote to memory of 3656	3732	msedge.exe	117
PID 3732 wrote to memory of 3656	3732	msedge.exe	117
PID 3732 wrote to memory of 640	3732	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LabManual.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8325c188,0x7ffb8325c194,0x7ffb8325c1a0
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,15378757437819553977,10519870909458253023,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16258624750276552199,12262827217365113660,262144 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,2319621538789856129,15595677714610330460,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,12535546296649122129,2792369761777643644,2097152 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3790213959778879652,14638002901526566205,2097152 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,7863000086635687216,7271865962978678736,2097152 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,14986806072112961337,658127750513671297,2097152 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4730416430916216834,3710125580535189175,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5301489457372752510,13022509838726787890,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5577422216596339372,13850440341160354923,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5577422216596339372,13850440341160354923,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,16530477496471266397,1747598970554901996,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,786863742333562414,6075103474021434117,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,4883581043524979686,17900144973268153041,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,6321042543807818942,12497079233152411741,524288 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,14066869585882268915,3892544698690276179,262144 --field-trial-handle=1992,i,5441451366776623256,3906791090005654866,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2854701b572581aca35f28934b128580840d426574b88b8077c257a7a0382c3
MD5 346515e26398b50301ba6f72db467688
SHA1 2d080b868368d15fc767a31b3bd5ce743606afa2
SHA512 85b68b5fdf1afb259520d4341b744e5f630ecb8c3f5a666483df42f571d833b0768cf8839fa74d264a8cd71cfe600b376165481a6268cc12a80196baa53c26d6
TLSH
T1D961F976C403C8F0EFF7407194968272747257E4FE82CE866D8F9AB55A2C7E68ED5008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c23299052c99cc59116ca1af9dfa91a5e50684c2aa40a0bc91486db9f774fe95
MD5 047abc9437419a8fbf4c920de01b6845
SHA1 6618a95258da079586f1b292811324d1419c244a
SHA512 16e2dad7cdceca3c29a7d8933cf313a254fa289a79b818fea1a75d9e61c85b8adb2c27a019ee8569648438e3fdb7d4a4d39e7dd84197c753413443d0680aff87
TLSH
T1A221BEB3C6D586AE881116F05B24BE2BDD1D050A422C7C2ACAE4FF1FA3E3075D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 93ba2dd49cd732e3d75b9224f4aa26858112d7c40994f354241d4260aa351bdc
MD5 5cbb76df6fb6c03a5ac8f65bf7c781ad
SHA1 4b634cb7a089844cc52e8f3031ebfde4e2007bff
SHA512 da2a7b71ef5b93e82d43145ccb9bad88ec1fa6df7030039df0364d1a45cc3b74bb764734abac1e5c123b991e2fe5a8e25863b16c3a2d733bc42c3cdc9712fb41
SSDEEP 192:sxZ40ReyM/jK1Ml8MkmG/fzsJtLrV2sIdpdWHW6+WNGYvr0O1FIgrJ:sxZ40wMmG/fzsJxk10HbGEz9
TLSH
T14542E7016A34A977CCCBD20DFA45BF53D6F91573A2911E48A9FCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6108597d9b2ab2575ae7384648e50588666fac46e77ee20e86d201d94d07f798
MD5 ee2fe40f593ddf78db84df0641a802d4
SHA1 bad17e8bd8c9e9078f05dd4561c2641d20a8ff70
SHA512 498a90ded2352f3b6480adcdd97cfee8becef93b7a82ff78c9055d70aac971c8ce98acaf4f17fa72099f901c481cce4a1f042c1f0ae6aaa020b627a7b29a2b89
SSDEEP 192:sxZ40ReyM/jK1Ml8UQdkmG/fzsLcLrV2sIdpHWHW6+WNGYvxz51FIg5DJ:sxZ40Aq2mG/fzsLsk12HbGUzX
TLSH
T1D65207516A34A977CCDBD20DFA41BF53D6F9057392911E48A9FCDA1C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d3263b3f2f3d5e88483101da7ef3c566102429176cdb5bc3ad9472486df52c80
MD5 4a4a61d81592b1700a4650fbd3418da2
SHA1 bd9f471ebb033cd6851e72a806bee8f5cd692b8b
SHA512 6a24c75d979effbd6f5896e19be89aa2232ffb7c0394a294ec36b990f987f40136b13dda5b53339dac2852fac5ffcca266d0c13c9af842966e259a1c94c9f315
SSDEEP 192:sxZ40ReyM/jK1Ml8MkmG/fzsLcLrV2sIdpdWHW6+WNGYvP0O1FIg5DJ:sxZ40AMmG/fzsLsk10HbG2zX
TLSH
T10152F6516A346977CCCBD20DFA41BF53D6F9157392911E48AAFCDA1C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 65d3862d6f75f02290660bcce8530c2319915e3518905ea54d7852c53a646e59
MD5 1061d6d6f67da450d5b3814f87b80540
SHA1 a6ae45962964580d099f73c9eacd403f29cd4417
SHA512 b23f3f46e5c4d13a7e44c683ac3438987824da9b1d00d5e0519c31fdc05ad409b95637a4bb43e74e2f2568da2597ee823889620b605abde62e9a67981c50caef
SSDEEP 768:xFseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppGroIV:xFseJ3xWvhfynu1jaVcL88p9G
TLSH
T12AD20B2B280CCB7E4F844E6DEC266F966EE801CB57944D5487EA980C02C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f9e01fab6b45124b36b46a6d73271b0ee6c8abeb4cacfc7dcb9cfc6dfaf6b4ac
MD5 292a211ecd2f929bd37ca49e29a89a18
SHA1 930bb61dfbc5700771945c69a5e91525e3f46e23
SHA512 15f8f8f5fbd06dba338ce38b1c3207eedc7acde0e1ceaebd39347aad6744a4446219b60490af53d00be99715b554f731116368123ed2ca93e1e00d433ef89a07
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Eg:KYHIhKggkXyNhIBKqck7ydTI1KccAq
TLSH
T1CF918716757F03023C7E285CA2A5D6374E4137A33494A9AF7B7804A68E27E121DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b03b3776388552bb2e3db3aa5f2181daeb031151c4108f4a6836d847870d55fc
MD5 3eefe2d6bd200e0542919c9a91b3d32a
SHA1 b39afb2e2d949059fd55819d58f0bcc5674aa6d1
SHA512 148f9822ee35ae2791b0e9c92304aaffa3a217308bf786eaa57d51a9a85ef3c4928b37925675b7e444feaa5958af319ee5df5af231ed514d43c116ab0fc6ce0f
SSDEEP 192:ucLsNlgQ/HM7qQhQmiU1LWy4MTp8CfKBY6Fd3Er8z1xqish:psNlges7r/09AfKhdUIbsh
TLSH
T1D44219B2BC785C3BAEA7B645F44A36035EB4817BD6856F94E6DC2F1C01CB29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e45b256595c5c1f983be20ca501d386663de69d7d0c2b54740178f068b3c7bb5
MD5 54ce0236ba278a2c509c3a3a9efa16e4
SHA1 cc9927ff1858f4644272b67ca2ae7e13cf8a2289
SHA512 80d3be755c3474b4578df4280e4d52199d8a045b20b9f5ba5ad2c1775f0e297da67eddc4323173c5c9b87aa15568b55c2851be5c0b958d1f6ae2ce6947f2f96e
SSDEEP 192:u+NsoHzsNAxQ/HM7qQhQmiU1LWy4MTp8CfKBY6Fd3Eds8a1xqish:xHzsNAxes7r/09AfKhdUd6bsh
TLSH
T1C44219B2BC785C3BAEE7B245F54A36035EB4816B96C46F54E6DC2F1C01CB69C130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 69d0c4b51841354403857eadf1b1af9344e3be01481131c14ccef49ade73b0af
MD5 d8419356be88c58ec60e79a3d92b117b
SHA1 7ad0df3c043cc59a1ffb108b27c386f55b02eeb3
SHA512 f1d30671ee6cafeb8f67f020fd8c3a8b19ad162eca7d30346dc08c1b5afa32a1ee37bbc320b908455b554e9c76fec25bfc7b4bbde660b31f52c841e372eb6163
SSDEEP 192:uMRLsNlxQ/HM7qQhQmiU1LWy4MTp8CfKBY6Fd3Er8z1xqish:FsNlxes7r/09AfKhdUIbsh
TLSH
T1B44218B2BC785C3BAEA7B645F54A36035EB4817BD6852F54E6EC2F1C01CB29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0fd2e1a6054b6d3de3ab20ddcd3e246dbfe4bcaf37dc3e5104b420c0200cf3a
MD5 bba9be7ca686207c42701baa877c6fa5
SHA1 5900023b489ae08cfa97262f5b14912ff33a1048
SHA512 51f1b806f7e2b081c4188c46dba8f72803a813732fbda92df9b03945f27785e394c43dcb712f8cd90b29715665c09abe2e4aaa062e32588d72678f691168088e
SSDEEP 192:lONl6vMtPQmiUyzgThTp8CfKBp847drU/u:lONl6UtR/THfK3hU/u
TLSH
T1BE020875BC686C7BAAA7AE45F48E23171FE421BBA5D05B40EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3fbd6bb86b754a1b2052ed777d84a40b0a8725918217155cb0663dd01c4cf8ca
MD5 7990c1beddf78be339c8bdf4d9169dae
SHA1 79df8cc4d65aa82f4480be4a54151e93e03dfcdc
SHA512 1f1cfacb9a20d102812618d9244538ffbfa6d97d8458b185918cd0d3ff646badc41468433643788b5cfbb2b4df8d22170321f20202699e2bb56386950ab10f7d
SSDEEP 192:/ONY6vMKPQmiUyUgfhTp8CfKBY6Fd3Ev80IxqiU/u:/ONY6UKRyfHfKhdUAbU/u
TLSH
T152121BB2BC685C3BAE93B545F48E32135EB4826BE9846B50E9DC3F1C01DF65C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f1f6998de38a3fda871726f114d415b36eff23eea10864c0cbde958858842fdd
MD5 57ddd55778e1deb0b929394648f1e1a6
SHA1 b067bcf734f201703be627ae9bad0ada25466236
SHA512 4d01ee185871444cbafd1d5968206f1200212988f1111d2a897feb003d78ccbda018e23d54fa348cb7ab22cb59620f1620f401c3eaa23f4a4f5d361e5c44926a
SSDEEP 192:u+NsoHzsNlxQ/HM7qQhQmiU1LWy4MTp8CfKBY6Fd3EdZ8v1xqish:xHzsNlxes7r/09AfKhdUIbsh
TLSH
T11A4218B2BC785C3BAEE7A245F54A36035EB4816B96C46F54E6DC2F1C01CB29C130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07cf5012-04b5-4272-9d3b-43dbd4470d3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07cf5012-04b5-4272-9d3b-43dbd4470d3d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fbcd508c358d3f7d9c20aed12e4c6bb443065f0c598fb6a7a02ee6941266c434
MD5 4a95c902089922a98905c77a2f4370d3
SHA1 f02bf9fa2a5e72e6c2b27c53c841e6bfb3e5bb33
SHA512 be091b2a334e8002bc6db86e282e796d5198eaeaf631fbf5c252a2f90715d58207326d4b796f232f123e495d3f1ea544669c6b87e3f9f1338d79ceec39bc0b34
TLSH
T10E41F698B6EA1148B3B77E0AABF6A9AD487ABC372E06945E10110D4F0563B00D871B33
MD5 SHA1 SHA512 TLSH

Submit Download