hxxps://client-data[.]knak[.]io/production/email_assets/669125dc9f993/uQUOeix3Ci7rmNzyB4VJM6gyBueKfyCCnbe43hiK[.]png?utm_source=email[:]69d974e49879d

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://client-data.knak.io/production/email_assets/669125dc9f993/uQUOeix3Ci7rmNzyB4VJM6gyBueKfyCCnbe43hiK.png?utm_source=email:69d974e49879d
Sample260818-wfhphaae89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315491115538444"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4621FFB9-595E-4CBE-A316-BB304E7C7E3D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4596	1908	msedge.exe	84
PID 1908 wrote to memory of 5008	1908	msedge.exe	85
PID 1908 wrote to memory of 3068	1908	msedge.exe	86
PID 1908 wrote to memory of 3068	1908	msedge.exe	86
PID 1908 wrote to memory of 3068	1908	msedge.exe	86
PID 1908 wrote to memory of 1688	1908	msedge.exe	87
PID 1908 wrote to memory of 1688	1908	msedge.exe	87
PID 1908 wrote to memory of 4176	1908	msedge.exe	88
PID 1908 wrote to memory of 4176	1908	msedge.exe	88
PID 1908 wrote to memory of 4176	1908	msedge.exe	88
PID 1908 wrote to memory of 2000	1908	msedge.exe	89
PID 1908 wrote to memory of 2000	1908	msedge.exe	89
PID 1908 wrote to memory of 2000	1908	msedge.exe	89
PID 1908 wrote to memory of 3364	1908	msedge.exe	91
PID 1908 wrote to memory of 1488	1908	msedge.exe	90
PID 1908 wrote to memory of 3364	1908	msedge.exe	91
PID 1908 wrote to memory of 3364	1908	msedge.exe	91
PID 1908 wrote to memory of 1488	1908	msedge.exe	90
PID 1908 wrote to memory of 1488	1908	msedge.exe	90
PID 1908 wrote to memory of 3852	1908	msedge.exe	97
PID 1908 wrote to memory of 3852	1908	msedge.exe	97
PID 1908 wrote to memory of 3344	1908	msedge.exe	98
PID 1908 wrote to memory of 3344	1908	msedge.exe	98
PID 1908 wrote to memory of 2736	1908	msedge.exe	100
PID 1908 wrote to memory of 2544	1908	msedge.exe	111
PID 1908 wrote to memory of 3696	1908	msedge.exe	112
PID 1908 wrote to memory of 1832	1908	msedge.exe	113
PID 1908 wrote to memory of 4212	1908	msedge.exe	114
PID 1908 wrote to memory of 4212	1908	msedge.exe	114
PID 1908 wrote to memory of 1412	1908	msedge.exe	117
PID 1908 wrote to memory of 1412	1908	msedge.exe	117
PID 1908 wrote to memory of 3508	1908	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://client-data.knak.io/production/email_assets/669125dc9f993/uQUOeix3Ci7rmNzyB4VJM6gyBueKfyCCnbe43hiK.png?utm_source=email:69d974e49879d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffbc092c188,0x7ffbc092c194,0x7ffbc092c1a0
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,1829920941229489735,18172054573816376871,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16741766040777529507,1657672276206065989,262144 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,1358853344469069658,9202282644350474332,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2784281126007574569,1287328427550704175,2097152 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7297399318141969442,5188995770155915668,2097152 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13470288333920351582,3345907089002341256,2097152 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14529250569355640403,3937222018020755652,2097152 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,14487872225980359257,9126230067663330177,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7822229392231451492,8154581185325924494,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15326033368574817587,15409086966908527465,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15326033368574817587,15409086966908527465,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,16336850265585877451,18050341883199102738,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,11857201693633573146,17955784856418873526,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,15809033400544304915,2044434523865447441,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,9233859841954278221,4946670315865006926,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,17978043824676487611,16070291713612486560,524288 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,1252175135679279587,6644120044005717475,262144 --field-trial-handle=2032,i,6279054705478067892,12413262968462683598,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 518d372739a84424b0a925cc150974f5ea06126ec16e9fe5a0b6f1ba76f6d092
MD5 c89c9b4c7a428d0d6b032c72eacbf482
SHA1 a9408da885f2b8032d3ebce9156d721feff0859a
SHA512 0c6aee823f60c69494be388115f489089a8db6f32469740db018288354439a6765fc56f6541a7767cae14a2a4a1d4ea446d3df4e129e672275a4f8e401176150
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T1F6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6402cbf0518a91c745a06b352f10248e1c0bf30480a17fc39afe0b9ad0a46d39
MD5 c75701030905839b322fd0fed328dddc
SHA1 dc2f18011b02acdc78375a1340f9c2375011de6c
SHA512 67938ac4823bce1d00452882cbf05d755d08296a09a1a3e61f029403b1d9f4f8cea3bc85fae25785df9e2d2504d29da95dbe0d38c7a0982fbf607ca51cef084d
TLSH
T1967127340E4900A1FF201A33D4D50239FC72AAEFF61F2E56235D66B5EA0334A13AC55B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586e45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586e45.TMP
Size 3KB
SHA256 54606163eae5f3f116dd201ed9867ccc75787d884169c1b27e167d4f7b893323
MD5 dda35771fd7bd0dae691d776cce0f067
SHA1 9294c0fc2eb55de040ac2f2f2c40d09e4fa2187a
SHA512 448b2e52f06be4ba02d0a4ed8b6a04299ac71d4531d1f839cda06f38a4c3c8a6cf42c96431ee10fab833639575e051083469177dcd88d717e205b6016a8eda45
TLSH
T1297127344E0900A1FF200A33E4D50639BC72AAEFF61E2E56234D66B5EA0234A139C65B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 233adc0288d5ea7c1f6c28a0d419f0d126d7eb2510c9c56812e316d0d98e38ee
MD5 86e189c21181dd8616d4c32958b32d38
SHA1 799556a8c905abd1443410aee902d3865daf20ee
SHA512 8aabddae6ff4f35b26f4ed1a6715750072f93cfa0a476f7958a6d219ab7850fdcc6accc4e4eabd30f5e82b6dea7b9911ccd67d4f550c5d942639b10cdaca1667
TLSH
T1681157F783E5856E8A1156F0AA28AE2BCE2D0506822C3C5999D4AF7B93F3075E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fa9a3533bc5b576b33a8ccfd7376168dde7fee01b414f06aa6ca797435c7423c
MD5 322d57baea548d0aa166f91027198de5
SHA1 4b9ed3aef846a0769957033115774866c4061aa1
SHA512 75e482ad6cdb1bc181e6dfde6cd1e12257be07864bc741637ed4e56543720bfb5f658777bd531ab26490812502c324219800385972d1bcf449c5b4105078f4c6
SSDEEP 192:sxZsR0yM/jK1Ml8Mkb/fLsNOCMiV1IdpGlsHW6+WNJbo/YviIldkIgrJ:sxZsOMb/fLs3MbDHbO/Wa9
TLSH
T17442E6116A34A977CCCBD309FA56BB53D6F91472A2900E44A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ce95ce44838f66187f2530e2c2b9fc1df9e865adbdd77cd3d78e0ad0ebd0fd02
MD5 7df60c3c677aea908880daf4c244789a
SHA1 73d1832e4caecf896dac243cdaa5c8b9ba452d0d
SHA512 7d44dc2fb4a8a6903d90c2a35a0c2ace6beee656fffeb0deeed877c94aed24d06a26a3a92627dc6aeefefd8d47e5762ef0c93a1076599f3fc585e17590c8cade
SSDEEP 192:sxZsR0yM/jK1Ml8UQnkb/fLsfOC9iV1IdpElsHW6+WNJbo/YvDfJdkIg52J:sxZsOqkb/fLsV9bJHbO/8aU
TLSH
T12252D7116A746977CCDBD209F942BF53D6F554B2A2900E44A9FCDA1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a1cecfab033b25ad5b655f27d2ecd6943b349e9d730927cddf5b48e741d9a03d
MD5 494fd515050c0d0a2eeb543e0212dbb7
SHA1 b4a13ae11c91728536d5c29b7df71b51e3ba0cff
SHA512 83478541c3da1d67d4a5aab8876c0cb9c2ac91abbcbf74e0d353277592622174cb26aed1f6b32bcabc5d7a0484c6e087b4f70e4dc996f1cbebc85f0299784d85
SSDEEP 768:V1seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppWrog6l4:V1seJ3xWvhfynu1jaVcL88ptzl4
TLSH
T125D20B2B280CCB7E4F844E6DEC266F966FE801CB67984D5487EA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7adc082abbdad0bfb2ef0146d9f862779657494daef356c525e044e243dd169c
MD5 4f20679c793d14163fec1689a37c7a96
SHA1 86ca616efb0540067cbb8f7dfdb3369731ede5fe
SHA512 fa7c509cd87acba22b940d30123b8631d29de8a9fe26469feab12a0c616fe4226b34e1983684e4114508408466af2f1299007c43aa37ae50cee130b14ca3bf38
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiwSDOhtDq:KYH+KggmiAgK1KyODKKkU2yesKLiD
TLSH
T11AC1B822713F02023C7F395CB2AAA6375E4135A3355868AF7BB800655E6AE117DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5908ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5908ef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4f3e8da522f2d5fdb2d7272e614c8fccd639eccacd2857edb4bfd66c3ecd56ed
MD5 4bad642ee5aa5ca1025b686393bb1952
SHA1 eb52ffc5aa5130302c20ad9390123d78a636f83c
SHA512 a39383e0d7634dabc993fc1c877a0f0eb75948368b1ec1aedf158e47be6f933fb8dbccf7ff1c9b5424c9a40d2def5a4fc880560d730f31700f9721c9d196c012
SSDEEP 192:uLm+xasuheOwQxMGsNGEQkuHM7HjAQmiU12gd4MTW0+FdLuhpFd3EZS8z1KrqrdE:fZcIhsNGEJ7DAVy1dyZdU5TdE
TLSH
T183625B715C786C6BA9E6F145F48B36034FF48077A6C45B50EAEDBF1D01DA6B8130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 c3de522883add95789ed41b8fbb583e65505a51fad72d1e6d9132ed8d1b4a2d1
MD5 3c6992b5a3a7d759c43d504a6eccfdcd
SHA1 cfa575d6e7e9b5cd43c2e10c12811a2691acedc6
SHA512 3de7b817e721bbcfa75c944d2d5c92ec211ceddeb984e40a6ed0ad55e4b7db9e7d168281c16de128d5db53490348adb481e38551d912259470f3c2892673cef0
SSDEEP 384:rziFiZcIysNG8TUNTUlIlRJ7DAPy1dyZdUbTdE:reFQybwgtKUkUbTdE
TLSH
T157B21AF248D7983BE9AEA743E77E2E024EBCC067B5845650B7D85A1DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 df1e6d19810a7f0b7a16f49f4433b7890927669db9958fb131e2bb36eaa83ec6
MD5 1c0c7021b291412b6a60400c2fccc272
SHA1 8a5d7f0802f8f46d1e4ece7aaa0549956af9cb75
SHA512 23afd6c23f7f3b1186180d3ae41ecd62efddc5ab5cfba425293f4c899006e64d115a7b27b19c6f87217c0726497234595b181cdbb182fe7323cbf4f6da046ae1
SSDEEP 192:uQsm+xasuheOwQxMGsNGRQkuHM7HjAQmiU12gd4MTW0+FdLuhpFd3EZS8z1Krqr+:D/ZcIhsNGRJ7DAVy1dyZdU5TdE
TLSH
T148626B715C786C6BA9E2F145F48B36034FF4C077A6C85B50EAEDAF1D01DA6B8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aaeb58a8791d1ac2384c3ac5da174012bb10fc30aa671c740d3b91b5fc953b7e
MD5 e12d2520dac5fc8b23833129e8951713
SHA1 b2195f21469dd7ae98c6f0e6176bad8b2e2c38cc
SHA512 d09f4a2c7c6f6f79c50f94cd8e036e73fe72b6f3c3e088867ef84ef05fb462b635dec0b20ea3c9310efc36d495b377df209588573b5c349192acf884d6b69399
SSDEEP 192:lON06vMtPQmiUyhCThTW0+FdLuc847+bLU/u:lON06UtRvTudy+aLU/u
TLSH
T115020835AC786C6BAAA3AD45F48A27175FE4507BEAD05B50EEEC2F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8e9546b8d0014b1ee109b04ba8f6020ee7195165e1392ed800f26f6e6a3db942
MD5 854aede76440d018af9547f8a1563515
SHA1 04eda992fa4f0ec9120b969b70c9855730de82bd
SHA512 5408759808b48d45ef6151f7c3ce5732ac5aeb72cff9b51a0a3c33652c92c9cd0cc9107017ab1a2d0ec6c1659d958d00bec340bb2ef3e67ad943cad0ed55e53b
SSDEEP 192:/ONH6vMJPQmiUyxCuhTW0+FdLuhpFd3EZg80IKrqrU/u:/ONH6UJRNuudyZdUjTU/u
TLSH
T139122B726C686C2BAE93B545F48B36135FB0817BDAC46B50EAEC2F1C01DF6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 67b12d0dac236dd4cf38890c1bd7a6eeefc768d78507d82b8d23bc7fc7d4a5ac
MD5 bc515ee8578424c663cb6b5040a847ea
SHA1 bfb30f1d1aae68a04cf0f16fa271ab8168f3d4ee
SHA512 17a58acb51e481b09afc2120849a0c836d9c4986527be964b7a8ca1d69b82e903f45a128b78fd4ebb772d0c72c5c76e7744cc79c1e2319b89b407d4efede6bb9
TLSH
T17741076CAAED1148B3B7BE1AABF6A86D447BB9672E47C45D00110E4F0663B40DCA1737
MD5 SHA1 SHA512 TLSH

Submit Download