7fafa9b305c997ecee170c0700c12a74db6814a9d337fc2431add711adaec32e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
citizens bank/Online Login Citizens Bank.htm
Size 21KB
Sample260818-pmwflsscnd
SHA256 7fafa9b305c997ecee170c0700c12a74db6814a9d337fc2431add711adaec32e
MD5 34e5c55dd21d6976c781980183542b8d
SHA1 316968b757ffb54b2e771173fa350fc30cd920f8
SHA512 c2366607d33958cf6f4405852f38a5315b7abd62ae335e15ed60819b03bde8c5b254e4d21033404927a4979e11e3d3bbf213d6d851a12cb932c88d2cc5a709a2
SSDEEP 384:THgiHgmlvnWB+xA0iX9vPmk/MsuppVqeIV3VX/okosheCe8t3yKPRXc/nW/dWXWv:8lm1E+xfitH1/Ms0qRqCcakWwk
TLSH
T18EA2F92A96562C2752B386BDB44277AFD4A48302B3031EB474BE115B27C4E5ADFF325C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4600	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315296469668176"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{FDE6358D-B0D4-402B-B861-359CC2FE6345}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 5104	4576	msedge.exe	85
PID 4576 wrote to memory of 4600	4576	msedge.exe	86
PID 4576 wrote to memory of 4156	4576	msedge.exe	87
PID 4576 wrote to memory of 3612	4576	msedge.exe	88
PID 4576 wrote to memory of 4156	4576	msedge.exe	87
PID 4576 wrote to memory of 4156	4576	msedge.exe	87
PID 4576 wrote to memory of 3612	4576	msedge.exe	88
PID 4576 wrote to memory of 5036	4576	msedge.exe	90
PID 4576 wrote to memory of 5036	4576	msedge.exe	90
PID 4576 wrote to memory of 5036	4576	msedge.exe	90
PID 4576 wrote to memory of 4240	4576	msedge.exe	91
PID 4576 wrote to memory of 4240	4576	msedge.exe	91
PID 4576 wrote to memory of 4240	4576	msedge.exe	91
PID 4576 wrote to memory of 5028	4576	msedge.exe	92
PID 4576 wrote to memory of 5028	4576	msedge.exe	92
PID 4576 wrote to memory of 5028	4576	msedge.exe	92
PID 4576 wrote to memory of 4996	4576	msedge.exe	93
PID 4576 wrote to memory of 4996	4576	msedge.exe	93
PID 4576 wrote to memory of 4996	4576	msedge.exe	93
PID 4576 wrote to memory of 4924	4576	msedge.exe	97
PID 4576 wrote to memory of 1116	4576	msedge.exe	98
PID 4576 wrote to memory of 4924	4576	msedge.exe	97
PID 4576 wrote to memory of 1116	4576	msedge.exe	98
PID 4576 wrote to memory of 3360	4576	msedge.exe	100
PID 4576 wrote to memory of 4688	4576	msedge.exe	109
PID 4576 wrote to memory of 1652	4576	msedge.exe	110
PID 4576 wrote to memory of 4440	4576	msedge.exe	111
PID 4576 wrote to memory of 3356	4576	msedge.exe	113
PID 4576 wrote to memory of 3356	4576	msedge.exe	113
PID 4576 wrote to memory of 3320	4576	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\citizens bank\Online Login Citizens Bank.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc57fbc188,0x7ffc57fbc194,0x7ffc57fbc1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15462428325776001290,2974670075998852218,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,6165478491595313096,11409609661084609338,262144 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,18356117388996181845,12011782570874776662,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4800262318250987631,14081442760019742446,2097152 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2704508356163906788,13043362640602573624,2097152 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4508670263852865102,11618293372505679831,2097152 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6779264963726796623,10329625093677205649,2097152 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2970646719195539536,13562734323592549089,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13398239051529768604,16009129430986748924,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14986999652134932788,17430578889096123066,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14986999652134932788,17430578889096123066,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,13576606697528867360,3651780491394780925,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,11705974526009915780,15624222407741491410,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,12197048361876434009,17467980920143288288,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,2145523254396223753,8656795656089877780,524288 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5872,i,791583423471858666,1809025624049436972,262144 --field-trial-handle=2288,i,5248557033812308847,15972724873392322950,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a442967d4b92121b056278623db77d815668ed31c2f2bc3b5e7c76a928445fe0
MD5 01d89dd9b1fe95c6feaf9faf720e6433
SHA1 9101cc140d13f09f76aa845f0db2f9b96e1346ce
SHA512 d13ab12d0a497c55c87f5466a06e68291a9ebf37871ac187de82652d09e4df00a372ead9a77e647503fe69d1547c59050e98854f2037a8b5f16cc0672480200f
TLSH
T12171E53B0139446DE353C27182DA82123C7B4EEAF5C35E45B0D05B3D59827F2DE22A8B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4dd05daf9b01a34f7116bcd0494ae1372cd03acd7679dcabf5a146eb05848cfd
MD5 02b84715abf0ae2a4920f06acf661e06
SHA1 075dae3b0343fc2db6df87459d59b6ba2d55409c
SHA512 b7dc1b87d00ffc93f08702fb7c5a45f6becd63e7c6c1261201cbfc36ede9f07cbb0854afd99e723cee1f30098ba615fba199e5eb3b4f875a000af8ca2361723f
TLSH
T156117DB3C7E5856E891156F05A24AE2BCE2D0605431C7C1989E4FF2793E3475E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 396675df79d4745c56ad334d202ecf61a21bfa29e4366e616bd25be8ced28d15
MD5 276ee0f8ab61166ac5498101531c859c
SHA1 826727a4805dc49af781f48756a94e59ea922b2f
SHA512 7f4b6ab177b5dab16d4c11e6d65b3248e440d870bb790a270de603b35f8b4ee37b2cb3a8be4d58b83375930a2d4dc429648561c056d1b7d41d309174135e6360
SSDEEP 192:sxZhRpyM/jK1Ml8MkJ/f0s9PPIdpdnHW6+WNGYIkSLBFIgrJ:sxZhbMJ/f0s9PglHbGh9
TLSH
T1D942F712AA34A977CCDBD309FA557F53D6F84472A2900E44A9FCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b645ae4c88df11b7c0e007a5cbd0356fe35e7191fad278a2a46be5234924a12f
MD5 850a749465b02df5b5e25aec4124cdb8
SHA1 4f1dfa96ffa6cdac50c8870331b3028391f1c81b
SHA512 ae51d7fde75628a26b4e0980f844413ad8f30a9c42d0e6bb3ec728afeb704d03db1228935f5c355508374c74e0304000c1cb819095f3538d83a8f0ecb40e4daf
SSDEEP 192:sxZhRpyM/jK1Ml8UQYkJ/f0snkPIdpHnHW6+WNGYINJvBFIg5tJ:sxZhbq7J/f0snkgHHbG1h
TLSH
T15F52E812AA34A977CCEBE309FA457F53D6F5447292900E44A9FCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e8f3af0271ea94090b63cf2e42e1c90932081b8f5cf6d9745cdbfe12330f3806
MD5 5711ee966ee193fad13b4856a9842031
SHA1 50bace7667778f58f8f20165e0639872d20bcdf9
SHA512 60a96039b728ddeb7df89a103480b68bd309a7b3ac0ab158406e9c9d1732f99f4a80c48ea7b49c43593820c1220b8f2a8552eff32257ffc2865b64f0db5ff0b2
SSDEEP 768:nTsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9IroumY:nTsqxXlWvJD6Tu1ja54LAs9zun
TLSH
T14BD21B3B694CC77D4F840E6DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 934e973421b08c4c80a116747e093da5c745437956f018ab52d660be8dbb813d
MD5 627d393effb23ac2997b4ddf95661bdc
SHA1 bee1af53af194402db17e1edf315ce298a080687
SHA512 81c9db2578d5d5dc4a91010ffb60ed7d57fd18467aaf50b758d30a9264e6c90df06894a737a53994eb422c8145cd46bba4bda2266140196aaec7c81ef6e7cd58
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyJ2IXK7KEHyh5CIfKfqMHy5WInKPK80:KYbaKYIKa2wK7Kui5CAKfqGqWgKPKr
TLSH
T164C1FF47753B02427CBD294CA3FA96379F4232A33419A46F3FB851A65E66E110DBC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5929d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5929d5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c40fc802872b34413a6244eefbf6ee4dfabe150ab452489bfa99a8752c25a368
MD5 e4658501f7159d87c4aab3739234bd1d
SHA1 340534684220f4a5220d781a21cbe6b827b40983
SHA512 aceaff8ff870cebba262d58b0bc3f2f56a7bee6c0e4294e99b6cadf53702b5e09b346e71e09d04fcf6dc027e1e4923610638ad0cfb5d68767f38c798ee200b73
SSDEEP 384:JiFZ3yFaeO8GsN08TUNTUlIlNGpb28zVRNkd/2Fr2Yq9m6BMMj5kfh:gFZ3IzhG5wg0RHkwFaX9m6yME
TLSH
T1B7A26B37AC6099BFADB66A45E94B3213AFA44067D9D97F90E7D89E0E01CB0DC130BD05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7282f9d49e51c07ead35cd85d07b4752852e0b70a7d15134ad5e19981c8af843
MD5 55ebe89252fa99bc711a4919d7eee04e
SHA1 26ab27300f8f56eefa30ff3327c514395a63fe43
SHA512 2a8b8532f144aa0d45dac74be02ed18f2fb992ef4a80b727105eaba516100b50d185922b9e07215c7095d3c9b985a3f8ad077642e3c48e5d37f09329839b2d63
SSDEEP 192:tONu6JkRtQmiUydLW+RNX+Fd10IeReh3pPR7U6:tONu6UruW+RNkd/FplU6
TLSH
T1BC02C835AC382C7B9EF2AE0AB58737175FA4117BBA952B84DAE81E0C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b5700631dbdb6626da2bb41a2ceea09ab4a0af1f72e52388667b73f9170cc056
MD5 d63bcaea84285c5c54f13db3f2f78d37
SHA1 62e5e268a3baeba961fde8a6d6e8f2700afee89a
SHA512 04747ac1b877c4c53428d839d4dd898e01a70a0a86251b0d5aa87a13f370050d885bbbe7ca7cb9bd81920ab66858dadf916550e96dc65019d3a520500c460856
SSDEEP 384:Y3yFaeO8WsN8uGpb28zVRNkd/hFr2Yq9m6BMMj5kfh:Y3IzhWTRHkbFaX9m6yME
TLSH
T13F928D36AC302DBBADB27545E4473213AFA440679AC93F94A6EDAF0E01CF59D131B909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c8b153a5243688380080ff50142312e8fad5852a8a3f880022fb2071eb7ebbc2
MD5 fdd9abd2eb222a4af6be8c5c706c6894
SHA1 274e46129d4ccd8dc5c1d61a9801f83d6d5d74e4
SHA512 00bb0d67d51ffb2a93d2908db090356adf778bba03cca2a3f95455a45ea0dfea235c0f414c8137089382e5c25a1df7b50111e78241616b26813a04c9fb8f082a
SSDEEP 384:13yFaeO8WsN8NGpb28zVRNkd/hFr2Yq9m6BMMj5kfh:13IzhWSRHkbFaX9m6yME
TLSH
T10C928D36AC302DBBADB27545F5473213AFA4406B9AC93F94A6ECAF0E01CF59D131B905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c75706fc0a9f3b4f74d99920e0cc6d99b28adb4f546ef990c2fa92d7417c6242
MD5 a96d04bce0aff3905c937b4c8f95520f
SHA1 73605af9503b730f8daf6abac30ce85efbf3cdeb
SHA512 969916dd218928c8b0f81f72c10d5d4964c84025563d6e24d91e549a7a1145c9795c97dfc2abfc2143beaf160b97a287c157388f1cbf0ab4a6352fe4b6f4d682
SSDEEP 192:mON16JkRKQmiUyULh+RNX+Fd10IeRfFaVcuqhDU6:mON16UGdh+RNkd/IFU6
TLSH
T1D712F83668386C7B5EE26945F48735035FE59167EE8A7F80E5DC1E0C01EF6AC130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a95df76b-98a8-4bf9-9148-60b57f9fbfb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a95df76b-98a8-4bf9-9148-60b57f9fbfb4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e23b89445761dab32cca8c881e27128a6da7904a3735b63af2faf62896383d0
MD5 7b86b366fde634b13c4b7220f96f3aa9
SHA1 4b5a04232c137c162ffa1fcc44bb57cfef76d871
SHA512 780e454f1e443455c9579762487c3025dbbfef0c1fa7c6c95692769812c82204b15448b45329fff4f81f68bd512df838ee8be96e7341d25cbf4b772c1182b505
TLSH
T125413998B6FD0148B3B77E5A9BF2A46D487F79732E06945D10010E4E0A22A41C871B33
MD5 SHA1 SHA512 TLSH

Submit Download