hxxps://clarity[.]microsoft[.]com/projects/join/ed092d26-4243-4b31-9598-f3619a2df205

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://clarity.microsoft.com/projects/join/ed092d26-4243-4b31-9598-f3619a2df205
Sample260817-rtcm7ascmg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314505309020994"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{21150E94-FD39-4DC0-808C-55F55CC01FA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4164	4352	msedge.exe	86
PID 4352 wrote to memory of 1812	4352	msedge.exe	87
PID 4352 wrote to memory of 3108	4352	msedge.exe	88
PID 4352 wrote to memory of 3108	4352	msedge.exe	88
PID 4352 wrote to memory of 3108	4352	msedge.exe	88
PID 4352 wrote to memory of 1716	4352	msedge.exe	89
PID 4352 wrote to memory of 1716	4352	msedge.exe	89
PID 4352 wrote to memory of 4840	4352	msedge.exe	90
PID 4352 wrote to memory of 4840	4352	msedge.exe	90
PID 4352 wrote to memory of 4840	4352	msedge.exe	90
PID 4352 wrote to memory of 1500	4352	msedge.exe	91
PID 4352 wrote to memory of 1500	4352	msedge.exe	91
PID 4352 wrote to memory of 1500	4352	msedge.exe	91
PID 4352 wrote to memory of 4664	4352	msedge.exe	93
PID 4352 wrote to memory of 4440	4352	msedge.exe	94
PID 4352 wrote to memory of 4664	4352	msedge.exe	93
PID 4352 wrote to memory of 4664	4352	msedge.exe	93
PID 4352 wrote to memory of 4440	4352	msedge.exe	94
PID 4352 wrote to memory of 4440	4352	msedge.exe	94
PID 4352 wrote to memory of 1944	4352	msedge.exe	99
PID 4352 wrote to memory of 3936	4352	msedge.exe	100
PID 4352 wrote to memory of 1944	4352	msedge.exe	99
PID 4352 wrote to memory of 3936	4352	msedge.exe	100
PID 4352 wrote to memory of 2008	4352	msedge.exe	102
PID 4352 wrote to memory of 3316	4352	msedge.exe	108
PID 4352 wrote to memory of 5088	4352	msedge.exe	109
PID 4352 wrote to memory of 3652	4352	msedge.exe	110
PID 4352 wrote to memory of 4840	4352	msedge.exe	121
PID 4352 wrote to memory of 4840	4352	msedge.exe	121
PID 4352 wrote to memory of 4608	4352	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://clarity.microsoft.com/projects/join/ed092d26-4243-4b31-9598-f3619a2df205
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12219571062019534076,6596461006250497950,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10391745723250575216,9082010206938387157,262144 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,12398374801242620918,16452503069404450476,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,16102762737613386731,3324422021484033390,2097152 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7842201793965914435,13336282134502475574,2097152 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,17746187798833933388,1701643506988392817,2097152 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1328076902931769352,9942384837209939174,2097152 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,1145661138572949989,7864319249078080342,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14651268974737994317,4488841695663437249,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,5031283482014604350,10763503759984073236,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,5031283482014604350,10763503759984073236,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13577425666962289681,12551186124241144623,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,14969044814625360008,15844573221467831396,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,7261248520379499582,8752988832455512864,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3020,i,9682821746296390527,9039367499971527615,524288 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,1370914486744244840,4100927484343534373,262144 --field-trial-handle=2284,i,12290238718876613954,13178684366280410423,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0ac4c2f08eef0430676370559bcdcdc5fc5a0a6933182d8bd324f1353fb1c00a
MD5 fb98916903ef9b1921ee296aa3eed049
SHA1 ecd8f09389669656b6a14b2994b5a228a9639076
SHA512 743e5ff4c823259fad1103cbe9e8d4d2222eb6ca173a7d363ff1c70e1dacbb82f84f64cc8b5a1a4c28842357c171271439880f1494e4618b2f35e993c7935118
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T127B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2858a47a7b3d790faa84739acda8591aae3f137b910b7d35159524a2a3d3c8e0
MD5 f988c36b305e904647f16c17f2fcda5c
SHA1 41bf1c0b8aec13e1213634c1e4d41ab0be9e7ab8
SHA512 58dac90ba9073eadc97157147319e8ec16c2efde225a1360bd544097711ad8cad3c0c4de47de60f25a3c22b7a1c04ff10648f04d0512b076ffe6b6b646e155eb
SSDEEP 48:xTsBZp5LqpGuALz2GsJY7WyGSvzBOeQMNRN1FvGDhWJt4oRoA:xTsN5WphALz2EWyF9OjiRbds1MX
TLSH
T16191505A02D240EFDB305378D5E00D2535F5CBAA27C67E8692E59CBE7F077A34A29019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d7cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d7cd.TMP
Size 3KB
SHA256 555c4c5cf9ccdc58c72ada1ff882fbfa46be3c5a8cf0bf583bdf4059ccc97900
MD5 8611f39fa47ed3ec5f325eb84a421f0d
SHA1 649c13652e8a02ec55f42da242da3c9cb4963f02
SHA512 66705856520f148b60e16db3084130d121dea154a7673af34d7e3378051a8861b22b08014de413043fbb246344bc7bbd8463082eb65e0c630da83201387b3ad8
TLSH
T129615F5A03C240FDEB301378D5E00D013571CFBA2ACBBD9552A598FF7D16B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8b11ef06b4ae8f2ed43646c2d12c47e4cc060f50cfa017e89d6951b4115e5ad0
MD5 9063a386909776ee89d5ae5cbd43e60a
SHA1 d4b6fe169e891cab3bf3d24d808bfb2ea496f3ce
SHA512 460aed87040bec984b314aed48aed6e768e6cce695b20744613140eed9f47e3c7a316cb867d8f4d223004c55ea95de60fac62c44e7e5932cdbf1b2f0cff5bc7b
TLSH
T180315AF787E1856EC9015AF06A18AE2FDF2D0615421C3C19CAD4EE67D3E3462E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e6ef973d6ab20e38904e0ca81c574f78af893f9ece27f24b46fe285456fc8991
MD5 403ca25740e06e3aa71a6ff250373178
SHA1 34efffa66b1e22d10e35fabe0901488795b63dc3
SHA512 062a7397759a5bb4e55fddca8a1b3afb3cdc5dde320ad43883eeb2f9a5599cc07c775a4250ea009dd8d9f0c649ace5179b33c9190006487303bba194b15a486e
SSDEEP 192:sxZbR2yM/jK1Ml8UQ9kN/fMsB/g9lIdp6DHW6+WNhZe/YwKkiNMIg5HJ:sxZbMqWN/fMsBo9W0Hbe/Lnf
TLSH
T17D5209166A345E77CCDBE219FA45BF53D2F4457296900E44AAFCDA1C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f1689d86eb063f860c5a62b30fb6e884316a42cf3f9743e3012a5e0ea6adb48
MD5 c27e61693e4ac8d62280dde82fc999b9
SHA1 e55b1619eff74b37c65eb3909ff84ef1aa25f8c8
SHA512 eb3ee7b97c6787c78aea205be032c8a205e378c5dbac11dbce9ca5b4e06c557f61fbb7a2bbecfeb126bdaa1d2c2489037209a99588056c9ad13ea2be5704c44e
SSDEEP 192:sxZbR2yM/jK1Ml8MkN/fMsR/39lIdpwDHW6+WNhZe/YwZkBNMIgrJ:sxZbMMN/fMsR/9WqHbe/YI9
TLSH
T15142F8126A346E7BCCCBD209FA55BF53D6F5456296900E44AAFCCA1C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 466e79f61a78465136cc8524ff0ec927f8917746b8661ee323ac983e0bed5f0d
MD5 f30779bba20f5950422231934f366d06
SHA1 e4eac302cab51b1bb1e67510c8c0527fa2333b11
SHA512 38eac05a7d87bfc2a40efe1cccb83853977d2b7a35a5b5b6f9d216456d4e1806607710d3cea2fe56df72d145d903cb53a69108c64a5a29879fd84bc10a953b1d
SSDEEP 192:sxZbR2yM/jK1Ml8MkN/fMsB/g9lIdpwDHW6+WNhZe/Ywdk9NMIg5HJ:sxZbMMN/fMsBo9WqHbe/Ukf
TLSH
T14A5209166A346E7BCCDBD208FA45BF43D6F4457296900E44AAFCCA1C01E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 50b5a184461bd4fb48b386155211329891d720186bdc2a7a30ee2c1496ccbcfb
MD5 5067fdc742ca7000d96ad7d63bb8e60b
SHA1 75a18f7c653560c810c92a973b0fa31fa5263b01
SHA512 d1108eadc8eb4000d87d443ee7007a210f70429fe5a3df3ab2fe12c776b0dfbbb1b2fcc388b6df44831045e4ba05127027f9d475af1ab21dc493c815f2e5872c
SSDEEP 768:Z24jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dyrohQcIaF:Z24jeXmWvmKLEu1jacPLZQdptZ
TLSH
T1AAD20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f5f47a727eec3b9a60a1a920390b3a6bd016f1ae24e3e85821e8f57c46e6f39d
MD5 b39beb9b48c6ef1a6dd0b36ad38e8802
SHA1 10cd170658884af9484b77d89abd3ed58b74e06c
SHA512 47a9adabd245b9a747c6066c56bdc7ca446a305e07e3980be21575a191ca8dd94590603413d929e7e00046e6244daddf3326cbf13f41ea8315285f8f832217d7
SSDEEP 48:K8mIfKji0vyWmTKGQ44+GItlInm+KYLA0+suu1Fkt6P4k6IoxdENsIqMxKf4Hax+:K8mQKjiWe9eKmwxveKgAuD
TLSH
T1FC91534174B746013C7E2B0C8655C76AAA81B263362C746B7BAC04721E67F508EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3444d0-d9f0-432d-83d3-c2bff36c0ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fb3444d0-d9f0-432d-83d3-c2bff36c0ff9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fd0eaa588631041fca1f12d98f53b8b79dcfee62a83eede5276a124cbfec442c
MD5 cffa0d9e4d7c8edda6c0eebfc85f1169
SHA1 91726bb21571342239df64228d117fb9f1054dab
SHA512 e8ade48b4529a237bce55a9ee4001e6d2980a71b905fa165445d73dcb098c5fc1e7ee08683cf51e8cb13b71688be96350a0d328fd2427dbe4b53e278c459ebad
SSDEEP 384:piFiZcIQsN38TUNTUlIlAB1HHZ2if+g8GYZX4+2fdFoOOPrXLpe8C/oBL:AFQQawg60qU4lvoOi9PjL
TLSH
T1D7D23AF248D79836E9AE9B43A77E2D134EFCC167B5806654B3985A1CCC865BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6aea0da7694f7881f9e4adeb04c5e6fc811bcbd044616ff107934781dbfa6f3e
MD5 bc658e1e4e206be9c275c86dc56fab89
SHA1 56a109a182079b243175fcee318c6d971e148306
SHA512 959a6e2321d798dcd52801ac9cb92aa802ebbb5a696a2ac6050080ebfe5129879000ea2d520113fdfa8bffcb76e608f6fb5052ff61a3abb6cba2f7feebba769a
SSDEEP 192:zLsNtJBGQ8IQ2ZEEuQmiU1Z1Qt4H/+jVWjzorGYZX4+2fE5cFTUqyD3:PsNtJBG1HHZGif+g8GYZX4+2f3Foj
TLSH
T103421B356878AC775DE2A641F04B36139FF881679EC52F94DADC2F2C00DA6ED130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8457a117f5516e483564ad6dd72c897097ff05b061b4612f9536503d45fd9661
MD5 8f19b37838f19a030122e9512195c788
SHA1 909b105293dcb5ef1f523b6b72c0965135dd2bb3
SHA512 6ba7f6f65861dc069f82d3dde54a7d9a53954599b17f306f3b27290cfd41ea7fcff5ed1927b9d781ff011928c163b9ee1fa3e6efb1af013d11e6421eee980ff9
SSDEEP 192:EONl6hZ0QmiUyPjpc/+jVWjzorGYW5wOZOlnU6:EONl6oApu+g8GYV2InU6
TLSH
T16402EB35A8786C779EE2AE45F48727235FE5112BAED52F84DAEC1F1C00C769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9c0ac78ce812b222dace0bace53b3341432c2ddf2e88b3525494f89c9f7e3b23
MD5 dcbe1e09662eaf240093b1ace0858beb
SHA1 45e034208f3128b8f82e3f5ad1cf35d1a6214c7b
SHA512 1ca96d093231214aea4e2fc43ec42d6943162e6f92f1dc74e1495cf7dda82b1560369aecd2edf736cf4da7ea77edc66a5889a9032d17f8d5870f2112c882200c
SSDEEP 384:FZcIhsNtAB1HHZGif+g8GYZX4+2f3FoOOPrXLpe8C/oBL:9hjcqU4l9oOi9PjL
TLSH
T173928F715878AC27ACE2F641F48726135FF89527F6C42B94D6EC6B1C04DAAAD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91f684c29bdd2ea7c1edd882f665f116b5dcce36ecf5edc6804735e572b854f0
MD5 1c3613746bff2106351533b276ff9164
SHA1 76f4f5194d8ea9f2ff71f163af6c2468fe7d1f6c
SHA512 0be41b169ef4736120ff9bbd80b8581ab0dd43ef6dd3de93e3c66890b728ed2b3b04f767d09745d87eecd55caa16780e5c4da32357c16d91bcd9b972e4be08cc
SSDEEP 192:4ONg6hZxQmiUyNOj+c/+jVWjzorGYZX4+2fn5cOqUqyU6:4ONg6rR+u+g8GYZX4+2fK9oU6
TLSH
T12312FA356868AC275DD2B641F08736235EE55117EEC57B94D6EC2F2C00DFAAC234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6cac43c-52dc-45c7-9074-8901cf690667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a6cac43c-52dc-45c7-9074-8901cf690667.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 295fb441d02cd4af9f665b0a435b352ed4eaf7b9fcebc30bbe711da3c52563a9
MD5 84ec752d4b3033fd9ced39384c339b12
SHA1 26763a7bc00f71da3398e3872c594444a162c575
SHA512 39a876d48dd815077491d155c57c309ebce9fdad96995fe845e907b33311fc7c50376ba5bb174e6df4319ce7cebcd3e0d1ee50b5738898cda7259bd45adbc3f2
TLSH
T1AE41E958BAF91118B3776F1A9BF6A8AE487B7C772E06D45E00010E4F0A62B41CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download