1d55105e632396f76b046513f1805f8144b8d2dc2a0d75dd78b37cb771be705c

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/tr_files/scroll.html
Size 4KB
Sample260815-wp1lnser5x
SHA256 1d55105e632396f76b046513f1805f8144b8d2dc2a0d75dd78b37cb771be705c
MD5 fa5e9eb978e1acd9cb8e6cbe2ba76510
SHA1 a08920b5c81bd559a859757f6555863b1b0b804d
SHA512 8a156d805f20029ce06e9a78922f21410c0a2b99ec6b9f7d8c26bbc69efefa221c8c9c3c7264a544405eaccac54c259ddeb77384b9ac826720d60ee5a3ef1757
SSDEEP 96:QD9KskjS+e0nOJOJ3nctYcoUV1FzTOKKInCBsHSM4imf2fy:89LkjS90nmm3U3PFPOCnHmf2fy
TLSH
T164A196311F81557A9109F32CBE3AC14CF4749329D883B806A87C98E05BD1EB95ABED7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312911512185992"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{1530C2BE-1A8F-4BA5-958B-17F98D4A60CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
212	msedge.exe
212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4244	2296	msedge.exe	87
PID 2296 wrote to memory of 3744	2296	msedge.exe	88
PID 2296 wrote to memory of 3456	2296	msedge.exe	89
PID 2296 wrote to memory of 3456	2296	msedge.exe	89
PID 2296 wrote to memory of 3456	2296	msedge.exe	89
PID 2296 wrote to memory of 1476	2296	msedge.exe	90
PID 2296 wrote to memory of 1476	2296	msedge.exe	90
PID 2296 wrote to memory of 1180	2296	msedge.exe	91
PID 2296 wrote to memory of 4188	2296	msedge.exe	92
PID 2296 wrote to memory of 1180	2296	msedge.exe	91
PID 2296 wrote to memory of 1180	2296	msedge.exe	91
PID 2296 wrote to memory of 4188	2296	msedge.exe	92
PID 2296 wrote to memory of 4188	2296	msedge.exe	92
PID 2296 wrote to memory of 5008	2296	msedge.exe	94
PID 2296 wrote to memory of 208	2296	msedge.exe	95
PID 2296 wrote to memory of 5008	2296	msedge.exe	94
PID 2296 wrote to memory of 5008	2296	msedge.exe	94
PID 2296 wrote to memory of 208	2296	msedge.exe	95
PID 2296 wrote to memory of 208	2296	msedge.exe	95
PID 2296 wrote to memory of 5000	2296	msedge.exe	99
PID 2296 wrote to memory of 4492	2296	msedge.exe	100
PID 2296 wrote to memory of 5000	2296	msedge.exe	99
PID 2296 wrote to memory of 4492	2296	msedge.exe	100
PID 2296 wrote to memory of 4196	2296	msedge.exe	102
PID 2296 wrote to memory of 1468	2296	msedge.exe	110
PID 2296 wrote to memory of 1472	2296	msedge.exe	111
PID 2296 wrote to memory of 3860	2296	msedge.exe	112
PID 2296 wrote to memory of 4748	2296	msedge.exe	114
PID 2296 wrote to memory of 4748	2296	msedge.exe	114
PID 2296 wrote to memory of 4732	2296	msedge.exe	115
PID 2296 wrote to memory of 4732	2296	msedge.exe	115
PID 2296 wrote to memory of 4964	2296	msedge.exe	116
PID 2296 wrote to memory of 4964	2296	msedge.exe	116
PID 2296 wrote to memory of 212	2296	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tr_files\scroll.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffccf63c188,0x7ffccf63c194,0x7ffccf63c1a0
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10789503056652206077,9314849412832253932,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10244766691418306609,15910561818868341162,262144 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,9172819731031239399,11550361594293108306,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1493818167069246757,14256654208498812180,2097152 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4136291325714107257,5706642239551400537,2097152 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10625018232607711646,12417562032513655793,2097152 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8483264105355218424,8231602053435257534,2097152 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,16014941661373627492,3660180050124282179,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,18323379839699507153,3494162263526725813,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6696028211783411044,8355077757984076544,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6696028211783411044,8355077757984076544,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,11349131906873550544,2075606080390877172,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,17277451202510953059,6246190295039198726,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,15701236714051030741,3787573874235487889,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3060,i,7136214358198930218,2890712608964675064,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7934118715615508621,15323807325790844608,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,3548452760490518383,14765276361607087243,524288 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,8024224558990505711,10411916554220190277,262144 --field-trial-handle=2300,i,9336643742634251825,16436558321983307873,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ad43660c05c5e572097c3e4abe661afdbd3ad22bcd07a5c9d484530f7f111c99
MD5 8b3c62405b7b16df492518c2ef220cc4
SHA1 47a88a3458900613d0fb69a779d72c6abaccd6b6
SHA512 576f95dc14451bcdb68b4b2838f08728a9aa56da16c4fde44137f50a4792c8aacedafba422ba18fa18e0ac860994e145c0e6bebbbf7ba9cf78c7575c8d1625ab
TLSH
T116E0DFCA87C8C22EAA80748752F8534C82803F8BD3C8B90A2B008A88F083154AB82694
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 27a30bfe62458fcf3622ff635e85096caa2ecb72f2ba74980d7c1dcd49975cae
MD5 96e256187d3eaf476d815869771c5b16
SHA1 935b10433f206032e341d6953e951b3249f1e476
SHA512 fb09434c3cc43f345fb5fc6cec77a6824ad89a2a1ec58505ddfc5bb9922be0f843aa5ad5afb133095cf181b7380b4b3dc69aa7c2063cecdeba173599cc6adbd8
TLSH
T14561C6750B10C4ECE79031B098D932927872DDEAF8834E4670735EB1FA04F5149EA1BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d742b140a31ede2f558e8944af3b2e24b37974c9c64e1a968cbedacc1910fafa
MD5 747448f942b73ed333254eb7e96b94d6
SHA1 9641bc664f9819527785e6d2e5467c98c6eccae1
SHA512 d7218dddf178d8f0cafb6c98d2424f4c1e7f398393981f28af406a97a5bc9d174b4d174c990d6e76ad21bb6360c3d449bcc04065ff2068c543f2dbd40b36391c
TLSH
T162117DF3C7D585AE890117F06A28AE1BCE1D0605421C7D1AC9D4EF2BD3E3475E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aba592c84beb7fb6d0b2fc93d7e729119634753aa507a76f55a57b7110f19cc1
MD5 c4379001e6f5c83564d6076194d7cec9
SHA1 3e9476bb8a05699ec675e0596f436f2ce0983235
SHA512 27c626cf58a9b0ff14224bd49a181ea1744a4e6e74c27fdeeb00e078927e763249e7db19d110e5433fc35e817179ffa18b7848dd10c497b76f3d0d9f9933c166
SSDEEP 192:sxZxbRgkG/fG4s3XAPV8IdpdBHW6+WNGYvrIMnlIgrJ:sxZlFG/f1s3wn3HbG6p9
TLSH
T1C122A7526E74A5378CC7E21DBA15BF53D6F51032A1911E48AAFCD61C05E6ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8cce1e64fd1b056e2ed7a3d98049d30699d696f60f3c2ebf742a8e85b1f80099
MD5 51ac53ba4f8a36ab6357dec0fd8d5fc5
SHA1 a53d24f260d2e128450ffaa2c233cd3d03c57acf
SHA512 8ad3086b26a09f348a8e7cb6a729d3fc8a6babbe13efd05000c96efcb62319d172af81cc0eae151a8c443384109b8c85305062980622021ffcaa430d46edf0e6
SSDEEP 192:sxZxbRgkG/fG4sLXAPV8IdpdBHW6+WNGYvrIMnlIg5qJ:sxZlFG/f1sLwn3HbG6pQ
TLSH
T15E22B7526E78A9378CC7E21DBA55BF43D6F91032A1911E48AAFC961C05E66DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b2c585f36d80285f5c4928029ceecec07b48b6b59cf71163300458e80cf5f13b
MD5 ed638f0c38bf0abe5b91b94f3aee23ce
SHA1 6594e4a0fcf141c22fdd3c1239eee0b434a61a6e
SHA512 778cec5cc539e0bb7fa4f6b4a13dc524142204dcc97a24257b4c183f1a2d35ad1ec46f3895805e05d77e5a6f343003e15a84211f8909a030613d2543667b4f84
SSDEEP 192:sxZxbRgkG/fG4sLXRPV8IdpdBHW6+WNGYvkAMnlIg5AJ:sxZlFG/f1sLBn3HbG7pq
TLSH
T13522B7526E7869378CC7E21DBA55BF43E7F55032A1911E48AAFCC61C05E7ACD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ee457de1f5903b25bc3212ae037f82b5a155c5c1a2192e1dcf843e0bf2c383e1
MD5 47952d37fe2ef3feb00140791d2d4aea
SHA1 acb7224d98db8dd81a328a1a82f3f7f8d5785eb9
SHA512 ecb1a21f0177e2be0ff356f31dcb10a7b2f71601387d2a9d0fe10e3140df19c061db9050ed1a43b5e4e659076566b313e0ff341619081f7d9d17014990d9920c
SSDEEP 768:apee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbUroL:apee3rxWvhffnu1jatcL88b/L
TLSH
T15DC2FA3B640CCB7E5F800AADDC5A6F976FA802C7A7548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 690977c3656e83553581cdd0416ecabafc81f12c84f29b5016df1d14df122938
MD5 99cb4accb80651e9bc09c3a8a8f7db4f
SHA1 05bd850219ba00fb63ad4891759f32876ecee8df
SHA512 b2cd87a063c3f38b3a122a8f059a0932ae847c2f7cf8e630e34ad239441306d96d9aec1216e2bbb564d38e8fcdf750a8e8f325140a4b16f8772819052401f9b9
SSDEEP 48:KYHIhKggkXyFrI1KAUonyhziHD1RFARpETIwbAKjV7dAXrQe09h:KYH+Kggm+ruKAUyyQgKJuw
TLSH
T1F8910516743A02022C7E3D8CB6A596360F4531A37464A8EF7FB804A65E67E115EFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 66d2c2244a880fd76c9cbb3a2301882daf9b2c01e02f3f018882b987a0164df8
MD5 70bc4e49a927e93dc8e7610f8eb128b8
SHA1 368ec50eeb3791fbc82d7c4c8c13ff849cd46f53
SHA512 390511d310b3e0d72faf313cab7f8c904a4b717529cc4c3568c34e170a536d835d2041d1f5987ba05bbd13543679aa5a179a0f100abe70a6315fc5977e3b08eb
SSDEEP 192:uqm+xasuheOwQxMGsNPyQ2Fq16M7aetQmiU1gY04MTAn+FdLQx6ptFd3Ew8z1dq1:gZcIhsNPyTU1X7dr3LkdcxMdUJCQfY
TLSH
T146625DB15C749C37A9B3F64AF48A37035FF4906BA6C45B54E6EDAF1C01DA2A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 acbd3b4d76ede95f924f694aa8a22bb939f4e954c9e6d38182ced779d5255f97
MD5 8ed988af554c2a8cbe89755a2c7ae246
SHA1 22fcab9ee70280fa51c6c12746e1ff456e4dfa4c
SHA512 7e459c067199b9c7c9f92bd07545fdc9a843373be5bddc9b5047c74c1eb26aa6292573dc433ed864bbb3cadb23ceeee5cbe7c09f0ad234d479f0737bf2a239a1
SSDEEP 192:uzZm+xasuheOwQxMlZsNP3Q2Fq16M7aetQmiU1gY04MTAn+FdLQx6ptFd3EM8v1I:oqZcIWsNP3TU1X7dr3LkdcxMdUBCQfY
TLSH
T1CB725DB25C749C3BA9A3B64AF48637035FF4906BA6C45B54F6EDAB1C01DA2981307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f8b86dd229b99963d5f151a968b9c7ef9d41d8f3581e952f096027582be8561
MD5 9689de078c751173f3595f1fdbd57989
SHA1 1088684d002c58eadd67de082a397221fad5859c
SHA512 4d9df38f0dd8989f0e086d81de76c7f4c9a5118afdc616ec95c554cbfc812819a724493cc707c716478e56ef134c588b9e10b19986c6e21fde495b69856b00bb
SSDEEP 192:lONb6vMtPQmiUyP8ThTAn+FdLQx6/847hMU/u:lONb6UtRvT7dcxEmU/u
TLSH
T120020835AC786C7BEAB3AE46F48A37175FE4516FA5D01B54EAE82F1C00D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 31ed8071df9830309fa6c09b05f73e501db792b3720e11cc9dfde72cafe4297f
MD5 9a905d87382eb456e817696c9ca60843
SHA1 839e6f52913c57d934b6dad72dd8a9e5628dbd89
SHA512 53d96bad7bee4ba947994dccf0bd8d03ed2acd2f8b7fb430e4353793cf92290d3afb20ad008cf51fbd54b69e695683c842d5b7f2757abea15b397ff5c0947806
SSDEEP 192:uxm+xasuheOwQxMGsNP3Q2Fq16M7aetQmiU1gY04MTAn+FdLQx6ptFd3Ew8z1dq1:7ZcIhsNP3TU1X7dr3LkdcxMdUJCQfY
TLSH
T14E625DB15C745C37A9A3F64AF48637035FF4906BA6C85B54F6EDAF1C01DA298130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6ab65bd3e3dafe7922abe6f0d2a903f0b1dae899b86e27398983cc1a00c6de82
MD5 9c891f72086aa3914926edbc7e2b1ebe
SHA1 ac04e26af82f56d5349232be3acb11c1a94f3efb
SHA512 adada123cbd393e19fa0df20bb11dc35ee7d5343bff73a90db609a32eaef293dfaa299c81838beb9ceaa80d01fb60285f7122fcdbad1a5fca59552fce3dbd9df
SSDEEP 192:lONq6vMIPQmiUyP8JhTAn+FdLQx6ptFd3E180IdqNQU/u:lONq6UIR9J7dcxMdUaCQU/u
TLSH
T173120B71AC649C37AE93B546F08B36175FF4916BEAC46B90BAEC2F1C01DA29C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf273a58-6302-4270-b217-4d0610196b0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf273a58-6302-4270-b217-4d0610196b0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e0b737f8ef5b12c803707f4eabf1d67c808860b0da8aa54cca07b385fffa3e2
MD5 566ed5a37ccd17d72ab2bae73078f6af
SHA1 b1c90e013b99ed39c122d5fd20cfc11a9a25c93b
SHA512 5e692bd5a321fabfecb26e02896a5aa28ca7c5a582715bfaf22d1aaf7f00b766ce52bebd9bc650f83009889ee6912b932ff21901caf8e06cb75366364073f96f
TLSH
T16A41285CA6FE1048B3B76F4A9BF6A86D487FB8772F06D45E00110E8F0A22B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download