hxxps://solutionbrienholdenvisioninstitute[.]harianschzurya[.]vu/1cl22y0us

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://solutionbrienholdenvisioninstitute.harianschzurya.vu/1cl22y0us
Sample260811-dqergseq8t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308915669725859"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{A8A0BCDF-DAAE-448D-B2BF-3B1B3A23EE95}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4052	5028	msedge.exe	85
PID 5028 wrote to memory of 2432	5028	msedge.exe	86
PID 5028 wrote to memory of 2732	5028	msedge.exe	87
PID 5028 wrote to memory of 2732	5028	msedge.exe	87
PID 5028 wrote to memory of 2732	5028	msedge.exe	87
PID 5028 wrote to memory of 5092	5028	msedge.exe	88
PID 5028 wrote to memory of 5092	5028	msedge.exe	88
PID 5028 wrote to memory of 2236	5028	msedge.exe	89
PID 5028 wrote to memory of 2236	5028	msedge.exe	89
PID 5028 wrote to memory of 3676	5028	msedge.exe	90
PID 5028 wrote to memory of 2236	5028	msedge.exe	89
PID 5028 wrote to memory of 3676	5028	msedge.exe	90
PID 5028 wrote to memory of 3676	5028	msedge.exe	90
PID 5028 wrote to memory of 2540	5028	msedge.exe	92
PID 5028 wrote to memory of 724	5028	msedge.exe	93
PID 5028 wrote to memory of 2540	5028	msedge.exe	92
PID 5028 wrote to memory of 2540	5028	msedge.exe	92
PID 5028 wrote to memory of 724	5028	msedge.exe	93
PID 5028 wrote to memory of 724	5028	msedge.exe	93
PID 5028 wrote to memory of 3408	5028	msedge.exe	97
PID 5028 wrote to memory of 3364	5028	msedge.exe	98
PID 5028 wrote to memory of 3408	5028	msedge.exe	97
PID 5028 wrote to memory of 3364	5028	msedge.exe	98
PID 5028 wrote to memory of 3828	5028	msedge.exe	100
PID 5028 wrote to memory of 4048	5028	msedge.exe	110
PID 5028 wrote to memory of 408	5028	msedge.exe	111
PID 5028 wrote to memory of 4772	5028	msedge.exe	112
PID 5028 wrote to memory of 2844	5028	msedge.exe	114
PID 5028 wrote to memory of 2844	5028	msedge.exe	114
PID 5028 wrote to memory of 4608	5028	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://solutionbrienholdenvisioninstitute.harianschzurya.vu/1cl22y0us
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16817027495491333872,17809287473674958489,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4843951633832401822,8205739254196308083,262144 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,15954588549388659309,5822377747655813701,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,754739285698727442,16121605821356282520,2097152 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3171035529951540473,15437536709711259871,2097152 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,10913510540011400864,3665828438611816083,2097152 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,18068533366643266840,17944289660579744420,2097152 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15779957597495918471,2800745062477545956,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8598453495873165064,16104587856979984152,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2622801998061082217,7498994342701353020,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2622801998061082217,7498994342701353020,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,17196429078700565606,1434913862059402162,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,13815233464434452981,6733017377698622091,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17726757300975818315,3282854932908969149,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14241238860714757178,2822680595120248098,524288 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,18336688912709275669,17095774482160235407,262144 --field-trial-handle=2200,i,5047955007018382844,1592736884122807396,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d622a3531be47a03b69a5c687e26d3b0e99c7ea42343bab582fd974aadec700c
MD5 254bc5df94e07271eac9a405ceab529e
SHA1 83202158a958ba91b49e4ec3d5cd57f571f440ae
SHA512 2b68211d966089b26fda08a2b78afbeba0a2a96d64c0bc88dcc8788939387c46d2afc5d8b4f60b78f8d7a8a55096a235f6e89d8e6f6aa41708e8355e56c808bb
TLSH
T12D71270C0012CCD1E3E256F1C0F2F245B4B1B26F3B779AA12674C5BC6519F726369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc73.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cc73.TMP
Size 3KB
SHA256 9c7488273b9020b1e6100820f5c0636bd9fb180f84f36c31c7fa0ac6c3343390
MD5 709f1cd817543c75daf803198caa8f99
SHA1 901f8c4d02d6787fcd9019cc414ad54a350420fa
SHA512 bba163b4baa20969b0bd7bf1ee42177c2bd0e54bea49030665f51ffab06866d9558eb394d75d341c53ef3596cb74ed25e2f2a6688839641aced6824d4c2637a0
TLSH
T17471270C0112CCD1E3E256F1C0F2F245B4B4B2AF3B779AA22674C5BC6519F72676AC0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 094c4cfec7de08ec390143f62593135ed8288334948de4afa81ab411b97bf22b
MD5 5aac8594260d8f903472db4320b6a254
SHA1 19a0fa3865280bc6e52d8e5437ec0225b09ed5d1
SHA512 e577635d8a32ac07abc1e97a9f83ccd45180e772d9a191e4680bf9c4c6bdb223eb3785f269f1970452f59221ff1e8b36961e1bfddf491f0f0d382ed9c6b54b85
TLSH
T19241ADF2C6E8826DCD1156F09A24AF2BCE2D050483683C59C9D8EF9FE3F2934E10255E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f643b71d52ce310b92bed0687a3254b9ca11f928a34d417a6556b3d7e2d5a724
MD5 d657c4e0dc97b3ca8fca88b0266cdd62
SHA1 242dfddaa165017e41f5ea3b595eeebda71cc56b
SHA512 375d566ca8d60334e82dac0365d10d1cb06886f3549df7d05d1ff69e247aebe16f9f8604f5c4dafd5c8abf4ecc4d1db359f4ef546844e8353a953685b5b5cbbb
TLSH
T16B319CF3C2D4826DCD0116F09A28AE2BCE2C060583293C59C5D8EF5BA3E2425E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f862196d1c4be844fb883b3110db0ea03fa17bd266a213b41f7ca4b1e4e89c6c
MD5 d424b5fac348c1ca782ff7725328f984
SHA1 e6588836e9ac403f4e47532372090aeaaaf80229
SHA512 d69c3706737cbb0efb425837cbbd55e1befc95cea170030c08c6f82e51ad1d694c35b00832dc6b0c58518b3ed1f88dbc0f7024997ceecbdaab224d553fd7e926
SSDEEP 192:sxZmR6yM/jK1Ml8Mk4/fpsQLS1IdpgZHW6+WNbSw/YLnVMh+QIgrJ:sxZmkM4/fpsQLSGkHbx/rH9
TLSH
T10552E7116A346977CCCBD20CB955BF53D6F94873E2901E54AAFC9A1C04E2BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 638cd930e8a56aef6640aa57b89359472844cb456100db536fff6af305530ec1
MD5 b8517d4512b7d0377c66da1b0ef6a03e
SHA1 ebb82b8b2e3257a213aa80cbf5a3668dca63e64c
SHA512 401b911c16a825c7199db72a090e5982b4a95b413252f8fa01ae45532ce330db80ebca05718472e56ab5d9054591aabe9bfc7f2b17bc634f6a5892d5765f15e4
SSDEEP 192:sxZmR6yM/jK1Ml8UQek4/fpsveS1IdpuZHW6+WNb0LXYLRVXW+QIg5yJ:sxZmkq14/fpsveSGeHbsXpHg
TLSH
T1EB52F8516A345977CCDBD20DB955BF53E6F8487392901E44AAFCDA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 70638653c83b45ac61a5c4874d0118d8170a2746e1f7d5e7ef1b6ccc337c2ccd
MD5 c042466928da8d968c19dcaf4ad3ad90
SHA1 e04cbb2cb443fa44c0221d386a3545c5080b3c18
SHA512 5c22449fb54a215552e7ba8fc4e24a0a3f0a311e344fbb6252f38539f6dc85291f28cc02789a705a801dc1b7caae66e6ba14ed5040634425dfeca30da6d0260f
SSDEEP 768:phs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNSro9Y:phs6pD1WvxzWju1jahILIsNJ9Y
TLSH
T191D2FA3B680CCB7E4F841E5CEC2A6F966DD801CBAB98895447FA844C03C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a6866a26adec770746be6add7b4e39b5096a55c7913260c20f9a24177cf319fc
MD5 c17f8bf19a58fcaa167bbb5b837019cd
SHA1 2ad79c59b68dc204230a2721a7f6d183327ce2e7
SHA512 151d71dce30c2fdb69d307eb7bc83fc8424668470ad90f00f86b5ea0bf49700439a66243bbdcd9f48d5bc9b274d26a76f9e3967a100bd21813a6ce1bdf728d41
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkw:ii9J3aJx1
TLSH
T11AE1031272BB02123D3E691C935987676F427AA37418F42B3BAC10721E66E344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596a2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596a2a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 7fca3ec8f34efb17b76a7605c81c2eb98ec6ef992a58d5caca8e52dd1c037f56
MD5 7be4a2c5abba3ed9cdf3954a0764d1a2
SHA1 abb9f3d21d22cbcc959a3bec962d192c1223e352
SHA512 519315781a728d015df95b62b34a70bf2eff34fdfce84b5c008a5df798daceb0b9b720ed7d298d6241343bedb505dcfb55058e88910dee8a57613c2e86c323cc
SSDEEP 384:TiFiZcIAzsN38TUNTUlIlSSrxVa9ndQcMKVFOOPrXLpe8C/JK:+FQcQwg14RG6VFOi9Pj
TLSH
T188A26E3258A89C7BADFBAE85F94636038EF84177D5C67A94E3E8DA0D00D75981307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6a3ec149b21050c69f7a66c4a8d72200b135f469327d51a01f0668a6e60c3418
MD5 0e4b8063af5c230825d47aba141ed67f
SHA1 29fd7dcf02190e84974ee71d65508b400a3c2519
SHA512 c75ccdfcb8769f40596d3e4e5accdca610bd830dcf626ec3679f61ffe154b16a329d577d276a82f1d051e5cb3c222615eb19e2565c8bcfd77530031d9a080ac9
SSDEEP 192:uuLsNzUh+Q7aT7+3vxrQmiU1QeK4atb0h+FdPoYRh2vQLMVwrq7TU8:LsNzUkSrxVa9ndQcMtVFU8
TLSH
T1043208316868AC775EE3B145F58735138FB44067DA8A3F94D6FD9A0C00EB6AC234A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 f5ee4d9737176c9d47dc39e254b6c3ae93b9172f1fbd8e4b31a6096f12d8f8ad
MD5 4b4df555495f0edc8ad6e8e65546549a
SHA1 aa989f210f14da7d3599d81fab4a4ae1164f9c16
SHA512 e35c4242db82d78a71b2d69c3e66ab07d3ac65b0656f40264bb8cc1832db4f48cec2b58c7ea5646db34fdc0ac0cedc54c5f8e16d290e1586ba0321d4ed210055
SSDEEP 384:TiFMzsNo8TUNTUlIlkSrxVa9ndQcMEVFU8:+Fwdwgj4RG0VFU8
TLSH
T14662F93258A8DC7B9EF7AA45F9473513CFB44177C9867AA4E7EC990C009B2AC2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2515ab821ec06359be787beff53a7ba7deabe1f937afd6df8c58a55fbcabf88
MD5 b0541220cfce667c0e48c2f2c69089a1
SHA1 018a2e055a55b1478bd157f855d270c7e7224222
SHA512 6b3561f31620a1ed05da1e3a5014b58abb8aedaf9d799894d338572c760b0a088945eae718ef98a769387d8e24d49426faf2c76148aef1c0f3e8a49a6a569b4c
SSDEEP 192:qONa6O7+3hQmiUyuwGttb0h+FdPougGVnCU6:qONa612Gt9ndQwVCU6
TLSH
T1EC02C8396C786CB78EF2AD46F58726175FA8117BE9962F40D6E85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d1eeacacaa879b61f01b2af081fee5aea8c648ca8af74b01ad0812cdde60860
MD5 541ee9dcf4cc3ea0121f4c1678a227c4
SHA1 76c37517c762e9ed9b84530c7ffa6297b4b96392
SHA512 35fe0503c610776a9a10418f580407f12c98dcdc29547a52ab2198e7c854c289d4f46cb0544b67cb99e8f679f4ffb720e6aee06126fd65782341e2109b911e97
SSDEEP 192:HONZ6O7+3zQmiUyownttb0h+FdPoYRh2vjcNVwrq7TU6:HONZ6rKnt9ndQcMgVFU6
TLSH
T1CC12F8357868AC675EE3A445F98735138FA94137EE8A3F90D6EC5E1C00EB66C234681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5382d36deadc16b290e119e85d6dfc7ce6b6f9ecb11eb9cc3af1e52e89c2d717
MD5 2ad46b88f46157df3edf95ea2e2b30d9
SHA1 22d98cedeb784266eddabaf67f96a3abe86cc70d
SHA512 17e29d54bb485f84e68494ca6544edc0de5042e586ac12eb23de5edd3a9859bf1f4c64df20f725b9c643ac3df183b719d99c688ce0360328315083105ec24798
SSDEEP 192:uHLsNzU4+Q7aT7+3vxrQmiU1QeK4atb0h+FdPoYRh2vQLMVwrq7TU8:AsNzU5SrxVa9ndQcMtVFU8
TLSH
T1053208316878AC775EE3A145F48735138FB44177DA8A3F94D6FD9A0C00EB6AC235A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b160fae812a230b6385bc71b2e1ea1c9e247f6a7782c7e6a33bb4399da8a86f4
MD5 528ce6b203b5840367345980232a9c30
SHA1 8cec0c1fd153abf86590576c09932857f848eb04
SHA512 9ea45847db370ce7d597d562df857259a19aef2515f83dd6a7e233bd6c58a27aa193002711c018a0e2624d289ae419a72cd2fdb77aa217f6f9d584ed57e70da2
TLSH
T138411A58B6FA1148B3B76E5A9BF6A86E847F7D772E06945E00110E4F0A63B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download