f4f6155427d1de161755fa693d2cc810c0dc7d3ceb192d27041ac07864b01187

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexus_Spear/Nexus_Spear/client/index.html
Size 700B
Sample260812-twh9vsbn21
SHA256 f4f6155427d1de161755fa693d2cc810c0dc7d3ceb192d27041ac07864b01187
MD5 31ac97b62769a77ef256ce506475fe43
SHA1 d894459e44a601ae95aca47e1fdcf5afc87a1964
SHA512 c0f47aab403b9fba1f7c4847f9485ffa5b58f05c2a63ff707b291d95818a7a5345896cecd6ab6cd4dcb95efadaa69732b48a88f2430f1cc06273ab360babf62e
TLSH
T13201D3A260A4804A32108272BCD1B5269C0BC5AB2BCDAD70B59790AADBFC3965C9394D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310256294360067"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D658A887-6554-410C-A558-C94B5D57EBDD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 64	2716	msedge.exe	83
PID 2716 wrote to memory of 2688	2716	msedge.exe	84
PID 2716 wrote to memory of 2016	2716	msedge.exe	85
PID 2716 wrote to memory of 2016	2716	msedge.exe	85
PID 2716 wrote to memory of 2016	2716	msedge.exe	85
PID 2716 wrote to memory of 1260	2716	msedge.exe	87
PID 2716 wrote to memory of 1260	2716	msedge.exe	87
PID 2716 wrote to memory of 212	2716	msedge.exe	88
PID 2716 wrote to memory of 212	2716	msedge.exe	88
PID 2716 wrote to memory of 212	2716	msedge.exe	88
PID 2716 wrote to memory of 216	2716	msedge.exe	89
PID 2716 wrote to memory of 216	2716	msedge.exe	89
PID 2716 wrote to memory of 216	2716	msedge.exe	89
PID 2716 wrote to memory of 2344	2716	msedge.exe	90
PID 2716 wrote to memory of 2344	2716	msedge.exe	90
PID 2716 wrote to memory of 4676	2716	msedge.exe	91
PID 2716 wrote to memory of 2344	2716	msedge.exe	90
PID 2716 wrote to memory of 4676	2716	msedge.exe	91
PID 2716 wrote to memory of 4676	2716	msedge.exe	91
PID 2716 wrote to memory of 2288	2716	msedge.exe	95
PID 2716 wrote to memory of 1660	2716	msedge.exe	96
PID 2716 wrote to memory of 2288	2716	msedge.exe	95
PID 2716 wrote to memory of 1660	2716	msedge.exe	96
PID 2716 wrote to memory of 540	2716	msedge.exe	98
PID 2716 wrote to memory of 4004	2716	msedge.exe	108
PID 2716 wrote to memory of 1680	2716	msedge.exe	109
PID 2716 wrote to memory of 2328	2716	msedge.exe	110
PID 2716 wrote to memory of 3988	2716	msedge.exe	111
PID 2716 wrote to memory of 3988	2716	msedge.exe	111
PID 2716 wrote to memory of 1484	2716	msedge.exe	114
PID 2716 wrote to memory of 1484	2716	msedge.exe	114
PID 2716 wrote to memory of 3000	2716	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Nexus_Spear\Nexus_Spear\client\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9355bc188,0x7ff9355bc194,0x7ff9355bc1a0
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,11472461508401316336,9034779437274535604,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,13718574227936389868,17554471966803726118,262144 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,1189058957327586782,345193602909126179,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3969678732064568402,12669835918628544826,2097152 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,495642425411443121,4996068826697297605,2097152 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15139035084109914305,16183919950160323474,2097152 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,1958373203116433333,2495327593073239894,2097152 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17670644220108328974,10433319569802794940,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7116048067838744883,10098869703229272365,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11653500290820391367,17924877502977216777,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11653500290820391367,17924877502977216777,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,15048722856880401726,9628039251869833516,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10235543430103373914,15881699763526408085,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,6190186344261789129,6112365278010800623,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,17850819204393459692,9593971652804087887,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,17398477111290564476,3473643151431611994,524288 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,13074501856839509007,4134022945284456084,262144 --field-trial-handle=2248,i,13518224795367177431,5897672023709135238,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dfd94c748e674ea9fd9501a156f36fe98a91bc30e4fbb7a050b3e07b6da87251
MD5 48d2a74b9f9b337cd4d5ba5e79dfdd84
SHA1 6ba022dce5af70c1a5595b902b4e5bce7ba7ee3e
SHA512 26bb29893c5ff0f3c85dcbf16f331db1f6ab01b4ae8d6d9c68be344cab219d9861e101be415b454fea0375470c85b7e982f35351ad4c64e248be7c2bad9702e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 628785c087434e5efbe386eb720d0cec7ab63a745eab7bf2d3cbf507eae189f3
MD5 e7c13aae7b50c18d772609aebacfc7e9
SHA1 c3a7ddd96381c9fcf00cd5b8149bbd74b71dca65
SHA512 1a3945b0a419a442837564438d2596fb407e5794061facae0619321bc6f2744b02cd3709c01127c80491d8c275afb66ddee1cb1cc4c563ddecf51b87b4696603
TLSH
T13271D927065200E0DF691EF3E1E24641FD728CABFB13CE630064E47DB70BBA54590785
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59018d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59018d.TMP
Size 3KB
SHA256 6653b4848c1975f8a18868574a0523c63f572c5e85c0df193c6e0e6df95633ff
MD5 459d1a9d8b63603f8b25575aa21a8ea5
SHA1 5c973f0e3fe42da7179c601dbf43209c006dec64
SHA512 33fa0aa8bc332138fe638864cfec1c4e96f4ee128ce27af922aef3191d3e16d5d49b1c11c776664169a104920f43387218a5a18746db1650e89436b74c84c4f7
TLSH
T1B371D62B065204D0DF691EF3E1E24641FD728CABFB13CE630064E47DB70BBA885A1785
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 79486ea082dd0bf20c64ee6cf824327ea363930d6efaf0b144b92a9aa12c8355
MD5 baa480952cda9e1f0d306cb6004574a3
SHA1 1eb26d0bf2a97f5f577efb3311665776368f0e9a
SHA512 14f4f05471d48cf06978d9d5299855031d7450a7c49a08125dbbc5cd58030e4464af20ddcaf06ba8ba10764a8b36b715053eae0c71daf512d0dbc17047f40244
TLSH
T19521CEB3C3E5866E8D0116F05A28AE1BCE1C0546422C3C1AC9E4EF5B93E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cd4b843da2b33b55c3b8e914dbedff5d78028fa48bc1bbc09689fbfd6f6618d8
MD5 17953829d6c9f6775e5511b48ab06b8a
SHA1 9bc9aabff96d4c7a43b36fceaf70bdb89a39f130
SHA512 656d6de72d521d2bbf8108e5d0c2541cfad4152d5fb708c81ef2464d91a05745aa0b2543f515049a9c53d604604ce5c9d07a91fe8ce32092f5e591190f7f1d8e
SSDEEP 192:sxZBaRNyM/jK1Ml8Mk+/fPxsVJCIdpdl/HW6+WNGY4wwFvIgrJ:sxZBazM+/fPxsVJr7HbGN9
TLSH
T10A42E811AA34A977CCDBD209FA55BF53D6F90472A2900D44ADFCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c9deee9b0a2f9fb47681475fd1783e13b6a69e0f6d6e271489ddbc5aaabb474b
MD5 ee55c86a99cb0cbdd2bd69b31890ab5c
SHA1 951bf5cb864fe17be49f679f31247dccd75eb254
SHA512 b5d714cfe6b2becbc39062fae032d2467ad974c5fe1ed533679db102571d45d3cd3b2f50d8092b6afb330500f13f5194846461618da333d0c95d89a647126935
SSDEEP 192:sxZBaRNyM/jK1Ml8UQIk+/fPxs0dCIdpHl/HW6+WNGY48VFvIg5hJ:sxZBazqr+/fPxs0drtHbGEZ
TLSH
T1E752E915AA345977CCDBE209FA55BF53D7F9447292900E44A9FCCE1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3e6395e0edbe076a705822dd63993c65a45386d1481fbafeec6bdb2b15bcad7b
MD5 7f00adae4c1c02a445c92e916aef8224
SHA1 b46ff9408de7aa6fa552421d54a7d54a3cee9612
SHA512 837148ac9d4d122adba67b19827dc9f81d8808948bcd60bfdcf7ae8e5b11d9194021f03306538ba6fd89e984b72bf645ea606420f2ab15335e9794d521315184
SSDEEP 768:sa8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd3roAkGUnA:sa8iJPNWvx76ru1jahALocdkqUA
TLSH
T16BD20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C77EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4cce9743c043edf598538db4bf3bc6d424e861a75c0405cfa755dc6f3616de62
MD5 644b1f6c0499eb132324b796272ce094
SHA1 1c7152ad835f446a65300c23ed592f54a240c602
SHA512 177b8c1277bf57369c5a8bf53652c25a215de64585823f983ec069864699d888fe367e02ac0029acddf206387f87d297b337abbf5f65a0ec295126f6408546d4
SSDEEP 96:KIFGKWUqufiKs4hChCCCVCRC3CzCPCkfCzC4CP1C2CBK9Co1CYCB5CQCoCXC2CKi:cFdwChCCCVCRC3CzCPC8CzC4C9C2CsCV
TLSH
T16191525634BF06463DBE694CD2E9972A064271A370A9A42B7FEC00750E6FE244CFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2536e26d-8142-4f3d-aec7-00874c8a6ab1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2536e26d-8142-4f3d-aec7-00874c8a6ab1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c29fad91f9e82c793a34125266429501d3d3e5dc979ec376517fc3805452c536
MD5 58dfa77cecdbfbdcc7140a5d61bf52c1
SHA1 e88f5f4b5e8d9fd73c841b7ea1cacd8f82d02add
SHA512 1ed3b19f237444850d814d08d8ee01991b88817388ff54a7e9b5b4ed545bc1053c4792031889c496b3db27745f63cc029afeec30ba19c5e29428d4916ae74cf0
SSDEEP 192:uIm+xasuheOwQxMGsNlQQKDm+3FQmiU1+zon4k03YqLaJNEfLImqNMXcb8xG1nlq:uZcIhsNlQiSj+o4kcAi0hMsRnlYVD
TLSH
T1E0929F719C742D765CF3A443F48B3A134FB8D07797C96F8499ECAB2C05DA6984306D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d3155e59bab886a312a2184270d284e490455fd1cff216f86158aef38595159b
MD5 1e03aa5f57d96c0cd8fe2b217abda363
SHA1 0c915f516e09c7efccab9b4b48fdd540f1ba9f51
SHA512 6777e675a2988c31e9c02ae8ce1defa2461e68affb20483eee6f7a388ee905eee46c818d88363e03fb26e5ee036b6da3cbdad4d4c3d4c4f19ab174eb94e2b918
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5h5D1BhPwivh50xy0SFYKUAxL+YLz:gON56kDfQmiUyjLZ903YqLMQilFU6
TLSH
T11702E93568786CBB8DA36D46F4473B175FE5112BEAC52F85D9E81A1C04D724C1306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b192673268b49758460b01cbe708d4c167d2867781494911d78788ac75b84b9c
MD5 7a2382c5df80816732f6c12b7ffc553b
SHA1 0e2a0fe62afcf5db2ce8ad92043ce70094e5e556
SHA512 dfb03be111e55fca15009b5e2db5179c0ef50934618eece5c3d3c10ecda33603cab2736e9da305e9604e8e5765ff84abd198bfd5cee64e46f188e60feb2ca271
SSDEEP 192:u4m+xasuheOwQxMGsNlc8EQKDm+3FQmiU1+zon4k03YqLaJNEfLImqNMXcb8xG1c:GZcIhsNlc5iSj+o4kcAi0hMsRnlYVD
TLSH
T1A5929E719C742D765CF3A443F48A3A134FB8D07B97C96F8499ECAB2C05DA6984306D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5080a861fce5d5f7023fb170f9f67a47a171bde3486e0c40f94735e30186d51d
MD5 e9d3644d2fc7c37778bb0f3ddcdca366
SHA1 6b374c5c9590e203e53d2b0b773b3b1f21805f71
SHA512 838a7cf87a41354ae7c444e11a8bad384402bedfb8da62123847768d376a553a554a482f544edb1c435b2675efe8fc3f4a8e0dd6f2f50000b85df7ab85ef9a3c
SSDEEP 192:TONI6kvQmiUyZL7903YqLaJNE0cRmqNU6:TONI6Ui79cAidhU6
TLSH
T187123B3168787C7B8DA36842F4873A135FA49127DBC96F91D9EC2A1C05DF29C530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1a33a4c7d26016f1e8ff894345c7277be4128df7a0b8e3d9f97592fdfa6a4ecb
MD5 0537766091c0879f4962e2089059f3b6
SHA1 6ce06a882c10c74bdc894b13a8aaee50490f7da5
SHA512 046cd7120283d29afc79bb3d5ff9b9d073c5508a595ee5b7882f1b7089b19aa7288483451a6d0523c5021583da06cf883f10c50c9979e0b161539ac2bc5df823
SSDEEP 384:4xiFiZcIwzsN/8TUNTUlIlc5iSj+o4kcAihhMsRnlYVD:4YFQsOwgCKoIhhhn2VD
TLSH
T187A28E738CA4997BADF79D82F54A36038FF48077C6C5AF94E6DCAA1C019B1D80306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63a4794b47ca493ad5e932f26eaba406f9fa86eeb57ea209bbe1f477742dc35c
MD5 7598129eeeaad556b240f8dc001f7e9f
SHA1 f2d3a32618d600f7d5b119f6cf9736e691d54d9d
SHA512 c21ff95cf9dac3a3ae792c24958530698a1d6a68f7ae6f63374cfd9c8d2aa7847cee805266973a80c2ae98ec352160d2490a683929096978af647ac5dcbdc4ed
TLSH
T1A5411448BAF91158B3B76F5AABF6A86D487F7C672F07D49E00110D4F0B22A40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download