bf21a7489a5bbb1e04e6ad11a83e47c958b4da1610a5c272c0d2ddd5822f47d2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 138B
Sample260813-pnd8qazbme
SHA256 bf21a7489a5bbb1e04e6ad11a83e47c958b4da1610a5c272c0d2ddd5822f47d2
MD5 0b8d672cb96b50a89e2fb404804f91a6
SHA1 604fe9d10d1975090c63aeae820a7ed076f72948
SHA512 d7ec9c9c7eb519a96d67d3184c8d20511350951ef103e8973879a91eb9ef33ca3fba8bed0f017271c7b3f19c76c63d3b6e8692e0fdf5f60d233d84c1b07c53a3
TLSH
T1D9C0925B796F290CAB53168117CB3B80E196C37A8C8A48504B42C693F0C7A6BC8CB368
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310977298605951"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{BB929336-46B6-4E2C-932B-C02B53DCABF9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3744	3824	msedge.exe	87
PID 3824 wrote to memory of 1768	3824	msedge.exe	88
PID 3824 wrote to memory of 952	3824	msedge.exe	89
PID 3824 wrote to memory of 952	3824	msedge.exe	89
PID 3824 wrote to memory of 952	3824	msedge.exe	89
PID 3824 wrote to memory of 2656	3824	msedge.exe	90
PID 3824 wrote to memory of 2656	3824	msedge.exe	90
PID 3824 wrote to memory of 4884	3824	msedge.exe	92
PID 3824 wrote to memory of 3312	3824	msedge.exe	93
PID 3824 wrote to memory of 4884	3824	msedge.exe	92
PID 3824 wrote to memory of 4884	3824	msedge.exe	92
PID 3824 wrote to memory of 3312	3824	msedge.exe	93
PID 3824 wrote to memory of 3312	3824	msedge.exe	93
PID 3824 wrote to memory of 4368	3824	msedge.exe	94
PID 3824 wrote to memory of 4896	3824	msedge.exe	95
PID 3824 wrote to memory of 4368	3824	msedge.exe	94
PID 3824 wrote to memory of 4368	3824	msedge.exe	94
PID 3824 wrote to memory of 4896	3824	msedge.exe	95
PID 3824 wrote to memory of 4896	3824	msedge.exe	95
PID 3824 wrote to memory of 3968	3824	msedge.exe	98
PID 3824 wrote to memory of 3968	3824	msedge.exe	98
PID 3824 wrote to memory of 3176	3824	msedge.exe	99
PID 3824 wrote to memory of 3176	3824	msedge.exe	99
PID 3824 wrote to memory of 3108	3824	msedge.exe	101
PID 3824 wrote to memory of 4972	3824	msedge.exe	108
PID 3824 wrote to memory of 1148	3824	msedge.exe	109
PID 3824 wrote to memory of 3920	3824	msedge.exe	110
PID 3824 wrote to memory of 1092	3824	msedge.exe	111
PID 3824 wrote to memory of 1092	3824	msedge.exe	111
PID 3824 wrote to memory of 4036	3824	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,4698388797666354676,15907241098737782081,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,16367866864927967484,1613216779314173180,262144 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,9966027864559318599,11404627898863530824,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3116175270244108484,10222515835674514731,2097152 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12284533078804851493,3770316262299160271,2097152 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,17128974011076068408,4756568777004087525,2097152 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7103883705302772041,16900355856174981003,2097152 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1634909430828853387,9210698164409576760,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14459451751734942053,10512873392332619327,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6078961466724531167,7780254221973293217,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6078961466724531167,7780254221973293217,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,5934386354292993050,6212243449201912622,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,2886185555315954684,4872268453794173236,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,13674123579327292281,16078087389073844612,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,3931648285990894936,6121293041205968714,524288 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,17968749468780538038,6430502238465237897,262144 --field-trial-handle=2220,i,10812029986715193373,12123482293379693322,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d0f81cd-183c-4883-9e32-322f47853ad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d0f81cd-183c-4883-9e32-322f47853ad9.tmp
Size 15KB
SHA256 bb5647bf46f61b4147137ea78d21642426c34d2fb72f6f9ca096a72008f7ba73
MD5 39e46ba0a77cc6f22a611897581c45ef
SHA1 d8e8f0a934ab44874f4822c3c34d4c789bcc9f47
SHA512 87dbdd009e81b0c2814a7819175664e48f1fd7cc7df73109ecbe132fbbed04bbc9b392e9c5fa539be716e58436833eb7716858c2e28122ebb6c7416cef80b432
SSDEEP 192:uSm+xasuheOwQxMGsNkdQEADzuwM7QKqQmiU1CVQ4MTZS+FdLK7Fd3EN8z1RkqA0:EZcIhsNkdl+W7/mwfGdwdUaR2Rm
TLSH
T12D626D726C78AC3B99A7B146F48A37034FF4903BDAC45B54E6EEAF1D01D95A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 846b4bfc88be814129c7445332bc4b7d8b5aeaf2f2bf2facfc6945247e9af7f7
MD5 ca533925589508f160580ed8785fa500
SHA1 308ba72a5c2b13f58a149a2e156b9fad2ffad9da
SHA512 b826c91578dea9ade9cf2a8f6dc4b986af54dabeb06d82aac8b6b065dc68841de13667e29c8807b45b607e68ce9486bdbb38deef951b761742022692e1cc3ed4
TLSH
T127712BB4012E26ACE3965F31C0DE42913771AAFAFD3B5F97DC9260FED9017604829038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4cc1d5b7832991f564cad6aaa1c2d6db671a7ccd0726129d1e8986618cff708e
MD5 99746e5a95434d71414e76ab4e7ce40c
SHA1 354d1b199a93a4c56398ed11245e6771f34bf5ca
SHA512 7d78895ad06a77015da3c06935991f23ae1816b6eb97c7dee3fedf5d7b288b53c803435b70455f2e71aa9d8ca1ecf24e5596c79c329afd286aaba4a7cc3769fb
TLSH
T11E115BB3C3D5956E8A0116F05A24BE1BDE2D065642187C19C9D4EF2BD7E3076E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f5cd122963a3d4e6b124493ca728b744240907a9118872582dfd87afcb86e4c
MD5 9c0770646bca8d4516d28285b6e6b0fa
SHA1 05147dc326c150674054eb54fd435c445f882c7e
SHA512 71e1b6e688b8e952332f549b0099cf64051629cef6a4707dbf63832c517d378f6624ad552ad8cd6e52e193a11321f63af84e7fe8a51c3c42dc31e79a5af82adb
SSDEEP 192:sxZQRRyM/jK1Ml8Mkl/f9si+MVnIdpdsHW6+WNGYvr5FwPIgrJ:sxZQDMl/f9si+/aHbGGO9
TLSH
T16F42E9126A346977CCCBE20DF951BF93D6F51562A2900E44ADFCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e8b387e7277395b9525dad901e1ae347abf3f39ff8a05dc7a78d42358ecc483
MD5 4e4f2188fb032e6e7fd0d912c6bfa5da
SHA1 6571bac83c2cd9011b537a2bef9dc627173e74f3
SHA512 f8e02c87968c427d3fb4628e6fa4214044a867242b19150b516ff343fe94db5e7ca081b8ff26a977c72f7f1b0c04ba687abea6b32b8d4c280988958bfbf2ebe2
SSDEEP 192:sxZQRRyM/jK1Ml8UQ9kl/f9sJZMVnIdpHsHW6+WNGYv6o+wPIg5+J:sxZQDqWl/f9sJZ/MHbG/O4
TLSH
T12A52D6126A349977CCDBE20DF951BF93D7F51462A2900E44AAFCDA1C05E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cf04d0e36cbb126a303864bf1cce2f2fe39ba1eef4bde79d78f1b5e7ef280c5a
MD5 cab45797bde1acb124de98773c78efce
SHA1 38a18a4407d5d92fe952cbad24adf8f9596aee0a
SHA512 9f6e68ddf3ef97f4d15ee3a14dd3c504e208f2bbee1aba5cc833b0281223b8aa682d4f7bb688f40baffa2d3732bdcea5e9582b5718995b15af782ddaa7879613
SSDEEP 768:iIseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp1rogw:iIseJ3xWvhfynu1jaVcL88pO7
TLSH
T160D20A2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA880C03C76EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 87e94bdde0d3d7464644525bb2a27d3fb3fa108187da97c9031b00bfc93c0408
MD5 ab3c1e54fb3051067cbdc094175577f3
SHA1 97adb5c13a95e3753a9c2362483fd319d9875d31
SHA512 9c6cbeaa5a994fd7c3c0b16546b585466d848164bf9eb545314956274ffc71a516fdb9bad7d4daddc92add365e7cdf50f965d19c760cf2d5e1a8575d2c1feee2
SSDEEP 48:KYHIhKggkXyR8IHKZW0DypKIPKrCYfytJIZKSc0V:KYH+KggmC8gKZWiKK0KrCq2JyKSce
TLSH
T168C11342343F02022C7E2958B2A79E368E4271633418A5FFBBB900911E67E111EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 97bd64aa0cb5218d1be7bc5b315a81823856fee70ebce5d0afd7762665f92c92
MD5 e74344d983e68f0c058cb1655a4d154a
SHA1 6eaaeac69cca34d8966baa0729b10d070e3938be
SHA512 e8f99b4d8dce22217e3ca1f087e4097a51b5fa64c302b3fa37338700ac4fa2d24fa29e4f9a8f659290e93be3e3e1541396ecc9d0bbad9b1b5ef24fd579f3596a
SSDEEP 192:uym+xasuheOwQxMlcsNkyYQEADzuwM7QKqQmiU1CVQ4MTZS+FdLK7Fd3Ev8v1Rks:GZcIfsNkyYl+W7/mwfGdwdUIR2Rm
TLSH
T179726D726C78AC3B99A7B146F48A3B074FF4902BDAC45B44E6EDAF1D01D95A81307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13a2be4818905f9c27e1a3d80826750ac9af41f49af31b843a2c356ebbb28a0b
MD5 8244095fd4a3de66481c8a7dce162596
SHA1 c4f1cb0d8a6d60ff7b1f0fa68401a9d8a7462d91
SHA512 c445a64ed6bf12c2f967bcaef2e20d438144d014772c60047662fd99f6c8692dbe8a3106c4afb36e45cf4fd50bddf7cb154e43e9d94577eb0cfb1edf5c1b82d9
SSDEEP 192:lONnZ6vMtPQmiUyhCThTZS+FdLF847RQSU/u:lONnZ6UtR/TFdJRrU/u
TLSH
T1C7020735AC786C6B9AA3AD46F48A37175FA4607FEAD01B50EAE86F1C00D765C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 142a78a71ffc3869f7a4387a6edbf96c4a372934bc0c4f9da4ac088eb4b2bafc
MD5 002594506fe78853f5a695142b08d382
SHA1 0ec74d142f54220cd4483e56cd311d3f24246e7a
SHA512 8f2eb0659955d8825dcb02b4f311dd25fc124c003fdb49a6d555b1e07a6678593ee2914bd43cb89db8dfe186ddeb1ba0c36340946497832fcdb4d812db2bb166
SSDEEP 192:usm+xasuheOwQxMGsNkyYQEADzuwM7QKqQmiU1CVQ4MTZS+FdLK7Fd3EN8z1Rkq7:GZcIhsNkyYl+W7/mwfGdwdUaR2Rm
TLSH
T1AD626D726C78AC3B99A7B146F48A37035FF4903BDAC45B44E6EEAF1D01D95A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8d7df50b6dd4b5c58e9e5b87ec14f5fb7295dc3549de4e9d008f75385b15d0c9
MD5 e647b6ad3cd5b97c7a0f8be0be7566b5
SHA1 f21a5d1d9d8a41bc738817c2a265544c0df7a96f
SHA512 6f121df427f4d3d82cdd6f8a1230fcea4e6adba5303bcaacd465a91e3d4fea4c8ee3b1c6e96d919457db670a53ff7bf780e115fc5e35d41d869f9969c8f425f0
SSDEEP 192:hONF6vMEPQmiUy1C9hTZS+FdLK7Fd3E280IRkqAU/u:hONF6UERF9FdwdUvR2U/u
TLSH
T104121B32AC74AC2B9E93B541F08A36175FB4916BDAC46B50EAED6F1C01DA66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a63c187-50a7-446e-a450-7f93027acf88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a63c187-50a7-446e-a450-7f93027acf88.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db62db17e40fc8f6890b6321b23e46ab472371b2275b852e87ae57415c41748d
MD5 70603856af1346ae600cdbbf9ea6f245
SHA1 42ab024725ba4a1a064298b062fc24c309261251
SHA512 348c00a272b42709d3aa7b67358821a0dbfe9d597675d3d5b418fbe2816c9f497b755e9a0814d1effa973353dde1f42041006fcd16b750a232d355a37613b9db
TLSH
T15B410C5CE7E91108B7B76F5A9FF6A86D487FBD772E06949D00010E4E0A67B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download