4551598e592c11eeac6d77170028c5f42df3f58b2df443540e2864adb27ccec2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/scroll.html
Size 39KB
Sample260815-wp1lnser5x
SHA256 4551598e592c11eeac6d77170028c5f42df3f58b2df443540e2864adb27ccec2
MD5 968c104d97546aa9315fccd02f22a4d2
SHA1 84274ad9bb02624e9f8eb49508fe4db05fb976d3
SHA512 aa91b1348941f7e16e4c74339fd95490a4427c4f44edf407786e93aaa91d66ca0a49c2a86ce87c459c4c409fbde22763fdd39dc7f2fa29b64a7a61224ce0df60
SSDEEP 192:I78T5eH8IniRcLGPUvm1ETK5o50NSZE+D4r43YnRY5zgkkS+UGYNs9o/QzHL6SvH:I78TvXojY5LAVF8N
TLSH
T13403F944F8905E577372A2DA7F20E8F05F6B9278C8090657F0E4F65A3883C69E76352B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312911502991101"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{727AC751-E1E6-4D33-8F7F-09CA227923B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1236	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	86
PID 4640 wrote to memory of 5092	4640	msedge.exe	87
PID 4640 wrote to memory of 5092	4640	msedge.exe	87
PID 4640 wrote to memory of 5092	4640	msedge.exe	87
PID 4640 wrote to memory of 1040	4640	msedge.exe	88
PID 4640 wrote to memory of 1040	4640	msedge.exe	88
PID 4640 wrote to memory of 1804	4640	msedge.exe	90
PID 4640 wrote to memory of 4624	4640	msedge.exe	91
PID 4640 wrote to memory of 1804	4640	msedge.exe	90
PID 4640 wrote to memory of 1804	4640	msedge.exe	90
PID 4640 wrote to memory of 4624	4640	msedge.exe	91
PID 4640 wrote to memory of 4624	4640	msedge.exe	91
PID 4640 wrote to memory of 3164	4640	msedge.exe	92
PID 4640 wrote to memory of 3164	4640	msedge.exe	92
PID 4640 wrote to memory of 3164	4640	msedge.exe	92
PID 4640 wrote to memory of 3312	4640	msedge.exe	93
PID 4640 wrote to memory of 3312	4640	msedge.exe	93
PID 4640 wrote to memory of 3312	4640	msedge.exe	93
PID 4640 wrote to memory of 3640	4640	msedge.exe	97
PID 4640 wrote to memory of 3176	4640	msedge.exe	98
PID 4640 wrote to memory of 3640	4640	msedge.exe	97
PID 4640 wrote to memory of 3176	4640	msedge.exe	98
PID 4640 wrote to memory of 3540	4640	msedge.exe	102
PID 4640 wrote to memory of 1420	4640	msedge.exe	114
PID 4640 wrote to memory of 1416	4640	msedge.exe	115
PID 4640 wrote to memory of 2528	4640	msedge.exe	116
PID 4640 wrote to memory of 2272	4640	msedge.exe	124
PID 4640 wrote to memory of 2272	4640	msedge.exe	124
PID 4640 wrote to memory of 4408	4640	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\scroll.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12021680769379078519,2917959342862799526,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14103707133874704479,13254595400361659855,262144 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,14853529065326760529,315445471229493905,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15063831868325687251,11381867251296157253,2097152 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6606293268137376987,5956238826174002597,2097152 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,12501513621520194101,7324798406087268478,2097152 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,2283101948768936892,3095052821483488828,2097152 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2631408287468031546,15733955453460239845,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,8846951673600552403,15152729923687012823,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,5426686209550685762,18033947367437945860,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,5426686209550685762,18033947367437945860,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,7709810395839126076,7953662130429821411,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,404088280648792408,14325085588469687802,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,8359843452295262154,12688570196481442164,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2880,i,3411520883098686919,9678414004268000304,524288 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,13476575063372654364,9077021167699131670,262144 --field-trial-handle=2136,i,7220519830302271378,8184578918561097092,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3e165c42f329e7b921e675520efe3a246af4b36cbd25d3a544283899147e293
MD5 69e1ca9be29b40e4f759a716794db03d
SHA1 be91b17ab39bfa304f1e3837b0b6f6ff7253ef2d
SHA512 6213c6831b5d32ed36c6d9ddd11c9f92f118937002eaf3427ebe653e0c1278538c6646b354b0b7f0b160d52e1c053374a86994c02dfe5a8d1f13a2844b71f6a1
TLSH
T115611B380B5E0482E3A256B1B4E20105717182F9FB9FDE4DEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd5f.TMP
Size 3KB
SHA256 318ee40e579dfac9588fca4b5a5bc613e954e02adbefb21081c17bb9cc6bd244
MD5 079acd8f4ae6b85f34a36795b4b58a5b
SHA1 c99ccb799e744f0c8331b1c46df0b57815fd4b31
SHA512 a16ca5daa360912d4b77aa6d2488f4b94e7c1bddcfd4470021061812918f58e8548a12f82dae1f397734fa29394601996231442d0fbc8adfcfc71ac0a00bfe5f
TLSH
T185613B380B5E0482E36126B1B4E20104717082F9FB8FDE4EEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 289251e1e63a8da383359686f94ae80d81f0bf7c13afb2dbb344d9569558cee9
MD5 02ff493e5250b4a418e914d88c1cc34b
SHA1 4bb7eb0015a4aedf86ce61c2068436d31be236de
SHA512 1ac2be6d9e39b4c8b75d5ca64ce4b1b925dedb5a7a7b520f3b1eec2ce7e54e90498dff273d90f8369500283293b6e1528cb90ebbe240b6d25e6ab7e38cbe4589
TLSH
T188113AF7C7E5C5AE890117F05A28AE2BDE2D0606421C7C19CAD4EF6B93E34B5E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b066469154823c6de7ccb45d73c9e9f7062544769ea5e97d3c17a7844942cdc6
MD5 3caa5821853e2be6772a3e049ae7d334
SHA1 be16a6f568dc5acf1ca500699c7af955fcd662b2
SHA512 2ff49710bc0bedb45471350f75d11e0afc2c3795e59fd4713c31a97971c3a68423e0e209b30a3e10e2cfa0295f44cf6f94d29b1b62bb126bf2767b6817aeb2f1
SSDEEP 192:sxZhR4yM/jK1Ml8MkT/f+sC0YbBIdpdrHW6+WNGY9IKqrmIgrJ:sxZhKMT/f+sC0YGJHbGw9
TLSH
T15242D7116A34A977CCDBD20DFA55BF53D6F80572A2940E44ADFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f071063e569f174607da3b7272a2ca640b42310b85082c3c30fc75f4b9cf41c0
MD5 67f11951cebca23e3be424658bf98bcf
SHA1 96f42d6edd7f5d39ba9c9d1ac58b573bcfe97c66
SHA512 832d9365b49caf820e4d5fca41bd61040b87ac51633361c5a9196627b30d2fe111f6fc77ce4ce4a94fa1536091513bbfe932d8f6c067bd29f7f297660fb0c2dd
SSDEEP 192:sxZhR4yM/jK1Ml8UQ6kT/f+sV0kbBIdpHrHW6+WNGY9IiGprmIg5nJ:sxZhKqJT/f+sV0kGLHbGq3/
TLSH
T11552C6566A345977CCDBE20DFA51BF53E6F44472A2940E44ADFCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 90aae05fed1d30f60acf32470d3a1ecc8f67ab8483ca28e30a712f7ad473fc0d
MD5 695a056f0b299f38c44d254cdd815729
SHA1 df2c0721858006395e5eb28d8ac58dfccbfd822b
SHA512 12a0772f00e0a29b26254d6873dbc3cc0ea5757934d1f3ee9111c3741d9840fee302ee30dc0b746c723b380d347ec89970b23d2947208c679c15607e3fe8aee2
SSDEEP 768:Rqcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNGrowg69:Rqcv21wWvu+Z+u1jaeFLeRN9wN
TLSH
T163D20B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be5ccc719308b4c4c15ab562a8ac27a63f280728ce35acb6e33fbca465ee1684
MD5 db8e848296d4b47de9ad0b03aaabff9f
SHA1 7d6c6c35922b92286c4f02d3ea10baed99aadc27
SHA512 c66ee1e5a5b2a1a6f27b9a3c2443389c275284e35111ff3abd2f9a6ca8db8cd7d34e56173178d33c140eb770d71fd5f53442e1a39372e5cf5c11d03909c9e010
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDW6owKhi+iK4KzSK:mTkrfz
TLSH
T1B0918882757A02423C7EA84C97E9A6261F5275B37418A87F7BA800E15F67E501DFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

162ee125-84f6-4747-a07d-d83a305e2337.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\162ee125-84f6-4747-a07d-d83a305e2337.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e3edebedb78d6df7233ba41fdaab735d471085153c522d0ac7aa33ab15fde700
MD5 ecccc5d7dd65284206313d44db899f16
SHA1 e55984c32a11e059c02cd0b24ea14fbd83189e47
SHA512 519bba468e115ed3889581b29bd7c399e7041fd94e7adc706e6345064e07b9305a86936c7c57fb81ebc2e202de4c72a577698caab07ded17867846a757437665
SSDEEP 384:3ZcIhsN71Co0gziZ+pe+CBd0esXw+OOPrXLpe8C/N:/hzodVwJxsXw+Oi9Pe
TLSH
T1F4928DB1A8782C779EF6B946F58736035FF88177F6D52B8495ECEB0C02DB6581306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5995f21b70998c6824e51fbd9d1ecefa10169d73efa4ab2a7ba5cf6ad7c4ead5
MD5 9c0c152d5539897f9ef262c796d4a8d9
SHA1 cd40c69201ce07e4ae4741429cb6033d096a4d15
SHA512 c2a17360442faebead1bcf15d1cbe3c3b0794b883014af261318c61f3e1dbe0cde2501de2277e8a6aee476485c936c3972f3840263f8032b14be5c3363988d4e
SSDEEP 192:6kONm6v+YLEzQmiUyb+6ch+CGD+FdeP9osNOeByCHvqwK+U6:DONm6vzKJLh+CBd0esZw+U6
TLSH
T14D121A35A8786C7B5EE2A946F48735135FA85177EE8A3F80D5EC2F0C01EF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6d20573ec67219a3ca66afe786e2737b2358cf33d00838e091a25505102457a9
MD5 3903918642b34b8bdc27aed58bc738d3
SHA1 80b16cdcfa5dcc16495f680d08956bd16d711958
SHA512 1c422ba413cd382d64f9971a05f345464c869cb7d1cf61d936ef823f80b9f5b5074028422c81002cb19e67299587eba3eb10ecc22a702f76a768e2aeb0f600e2
SSDEEP 384:0iFiZcILsNF8TUNTUlIlgCo0gziZ+pe+CBd0esaw+OOPrXLpe8C/N:PFQLEwgfodVwJxsaw+Oi9Pe
TLSH
T1F5A27CB298A8987BAEF6AA45F94732038EF84077E5D56A94A6DCDB0C01DB59C1306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a3756971d1df7d2dc9cc35dc75c6aabec3ec68a0bdc237e892aa94a50d7a77a
MD5 f76c3d62555f770ea648bbf3784ad537
SHA1 86867263961d23187710079251128d3aeb7f6330
SHA512 023fd11fcd9526eef90e9d38e87419bcef6b0ad1308f11a24483a7c2238398afc63b05b7c36921102a9512128da94995429395d55a4fb8922cb84b631d965d4f
SSDEEP 192:JONa6v+YLNQmiUyT+Zh+CGD+FdeP9ospusq2AU6:JONa6vz/jZh+CBd0esJHAU6
TLSH
T1F202E935AD382C7B9FF2AE46F4873A175FA82177E9952F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 92b783f40ad24c85fa75500b52d2cea6ff71850c9df6c32dedd6654b3d5c4824
MD5 a4f867a0e35a5237fb51d0653133702d
SHA1 788741ba19e779dd24aa3f83feda51ac69e96803
SHA512 0d70e4643a485a9d64ef38ce9fccac50b1a1fa09de6ce796e9f9b8e74e1676f8ad907a720ab265a17ab287aab60dedc048025389ff893df99a8ef92688e7a1d3
SSDEEP 384:fZcIhsN7gCo0gziZ+pe+CBd0esXw+OOPrXLpe8C/N:3hkodVwJxsXw+Oi9Pe
TLSH
T110929DB1A8782C779EF6B946F58736035FF88077F6D52B8495ECEB0D01DBA581306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b54edfb1-908e-4ed1-bdb2-12e3fc531ba5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b54edfb1-908e-4ed1-bdb2-12e3fc531ba5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba597ac0172522457cafe9a4e20e20587c3016a4174269c811c144b3a70c9623
MD5 a57bc6014dea9fc82ccd05daf614bafd
SHA1 9b6616868525672bbc84493d05249bbd69dd7fd8
SHA512 f8adb268f32bf24d303c44cfecbc446c4d87fec1ad68af088cce195d7f9513f8e4640f53e0fa40066fc40a2b55eb30e869da526d614111b7b27ddebdaeee2307
TLSH
T19F413998B6FD1148B3776F5AAFF6A8AD087FBC772E06859E00010D4E0626B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download