81e6e4f48b63f587123bbffe2b6e6b0b2fd8550dcc1cb59c761e1b673adf4132

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ngo-samity/resources/views/auth/login.blade.html
Size 2KB
Sample260819-ahejzacb56
SHA256 81e6e4f48b63f587123bbffe2b6e6b0b2fd8550dcc1cb59c761e1b673adf4132
MD5 c39a62c2b74f7d0643aeb3d65538576a
SHA1 9ef83e957cc1c983ff768ddc3d68e304d79c7ba7
SHA512 9cfad805b3b23d21855399e6b277807c53c0aa3f665d1ce74ce23573a11c4bd6e41e061105f953d2b37d7d903283c9abcecdc2ae2709c7220c8cfbe09bc37e4a
TLSH
T1D741436130FC0E63F452C8D09A8427162D828D03C356DA08BDEE1A95AFAEE73C857218
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315721263943714"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FC17E596-A9F8-48FA-BA5F-D83BA35C6C44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2244	4708	msedge.exe	85
PID 4708 wrote to memory of 4720	4708	msedge.exe	86
PID 4708 wrote to memory of 556	4708	msedge.exe	87
PID 4708 wrote to memory of 556	4708	msedge.exe	87
PID 4708 wrote to memory of 556	4708	msedge.exe	87
PID 4708 wrote to memory of 1876	4708	msedge.exe	88
PID 4708 wrote to memory of 1876	4708	msedge.exe	88
PID 4708 wrote to memory of 3128	4708	msedge.exe	89
PID 4708 wrote to memory of 3128	4708	msedge.exe	89
PID 4708 wrote to memory of 3128	4708	msedge.exe	89
PID 4708 wrote to memory of 4952	4708	msedge.exe	90
PID 4708 wrote to memory of 4952	4708	msedge.exe	90
PID 4708 wrote to memory of 4952	4708	msedge.exe	90
PID 4708 wrote to memory of 2728	4708	msedge.exe	92
PID 4708 wrote to memory of 1964	4708	msedge.exe	93
PID 4708 wrote to memory of 2728	4708	msedge.exe	92
PID 4708 wrote to memory of 2728	4708	msedge.exe	92
PID 4708 wrote to memory of 1964	4708	msedge.exe	93
PID 4708 wrote to memory of 1964	4708	msedge.exe	93
PID 4708 wrote to memory of 2708	4708	msedge.exe	97
PID 4708 wrote to memory of 2708	4708	msedge.exe	97
PID 4708 wrote to memory of 3392	4708	msedge.exe	98
PID 4708 wrote to memory of 3392	4708	msedge.exe	98
PID 4708 wrote to memory of 2528	4708	msedge.exe	100
PID 4708 wrote to memory of 512	4708	msedge.exe	107
PID 4708 wrote to memory of 4644	4708	msedge.exe	108
PID 4708 wrote to memory of 2604	4708	msedge.exe	109
PID 4708 wrote to memory of 4632	4708	msedge.exe	112
PID 4708 wrote to memory of 4632	4708	msedge.exe	112
PID 4708 wrote to memory of 1692	4708	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ngo-samity\resources\views\auth\login.blade.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8818692038867112926,8136984132025647646,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7706839787892853967,17440175446507573803,262144 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,10360530108567376714,218777348423285555,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13803031797713472591,11113773872220501761,2097152 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,14280070850765678827,16243134559132093801,2097152 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8783484474210210339,9348252646188614034,2097152 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,10870022537982343448,2744002697474465533,2097152 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14761737954421032256,5874745463585968256,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8149566405674291854,3244919101115095745,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14129710731928685612,11895428029411524975,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14129710731928685612,11895428029411524975,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,4247479189619490303,17481582988443732071,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,15233890888244837278,4058321338449038987,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,7784622003892661134,6424682824133920704,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,609424510326908200,3239826836466996573,524288 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,11461266348215658767,16329523830280978364,262144 --field-trial-handle=2164,i,29404319187922487,17488711844184053187,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 943b7d0054978d954c88274d47120188342d45e171009d9bd6bcf65a44caa3e5
MD5 41aab2c336f1cf0ee16667f28d63363d
SHA1 dd3109a6812c9dbbd667ed3b8b5ce9c9ff2cc192
SHA512 98fc0506994dda6525d69c451eee693ba821462dae089538c7167fd668cd537702fc93aae29f5ac852adeb85e262d01a7f2c8903cc54b17a39d84699c0c71991
TLSH
T1A261A5750A9312B1EF14C63294DD025D3777C6F7FA2B6E89908096337A1231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587625.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587625.TMP
Size 3KB
SHA256 8ee69b16751d83732032b13a1ad7afde218d6af7c34db6ba8115b214f38614b0
MD5 b2d480bdb26f4467135f29c307ec22f4
SHA1 c47a7d36bf49b0869dd2c0a694b3316c79186c3e
SHA512 50bcda937242ebad946d546eec2fe24dc4d8a567fb45bdba575794f8520b2a4e0180c7ef3f144f53700e472754c8338a7460ca455498fcd91e9f0b010e85a017
TLSH
T1A161C5750A9312B1EF14C63294ED025D3773C6F7FA1B6E8990805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 909e2b12fbbc16fdd53ec01dc1b6e16e9d265bc6747c1092ca5263cefd3740af
MD5 05459e03b6f8e1260f3ae59b64ff6dae
SHA1 c80188c51442598c49b23b94fa3437135ebbe926
SHA512 16356118ce37d28229042619f48c7d1e3f5e7ba7888492288b098bb24bc893737eb518c47d29abd2e48a435f66ca6f113942d990fcddd3cb49aa6fc20506433f
TLSH
T101419DB7C3D4866E891156F0AA24AE2BDE1D0556422C3C16C9E4FF5BA3F34B1D10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ea1298779fe59202af8d56e6e4fd6e995f5399b36ac0acd5046e73dd9f696383
MD5 39c0ea7e69d5fc6d9bef91d76a35cdbd
SHA1 fecf4346c0966ba64680b78ccea222bff1c0db73
SHA512 c31d0bfdcd5c29850b04fbb22615ea0773b45f5da8ec96512f103d07b67fdb3149e411221255e026ed92e7a363da3ccf98652a785c5d5f70c081d84eece2766d
SSDEEP 192:sxZSRByMojK1Ml8Mkb/fHsULrV1IdpdiHW6+WNGYvrIj4tIgrJ:sxZSKMb/fHsULQ0HbGpM9
TLSH
T1B542E8116A34697BCCCBD209FA51BF53D6F94472A2901E44AEFCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd7bf6452e789693270adc156d89bdf7a954af3c8cffcebe9a5a5431bf7458c9
MD5 700669286de8faa47184fcea47a47c16
SHA1 22e802f1884b7500f943a9055a53fdff0678c7bf
SHA512 63a1f4c4d50d206f231bec928d6c9c77d3a866c919715e81066cd4277eef788d3871aa743b42435ec689bc7cf198092f71531285b7577fbdcfea81c27b85340d
SSDEEP 192:sxZSRByMojK1Ml8UQYkb/fHsqirV1IdpHiHW6+WNGYv2fj4tIg5bJ:sxZSKq7b/fHsqiQCHbG7Mj
TLSH
T1C252E815AA345977CCDBE20DFA41BF93D6F5447292901E44AAFCCA1C01E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 246854b5047ac4bf6f1466da75a85860f62f4043306fe413ce7c9a4edab4f84d
MD5 7b7d5bbf1f3b97a82dcdd78758f2f231
SHA1 d7c5c69e7d2b59c257cd2cf6fc2e906b22a1bae2
SHA512 8bd31cecae645000ff66476d344de4a1b771d4d38ebcdce6f85f9275c12575feb9a34dbe0f799c7726f099665bef652f4b1709f47e6536edfd1affa2d7a1b9e8
SSDEEP 768:7LseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp0ro89:7LseJ3xWvhfynu1jaVcL88pfu
TLSH
T1E9D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 48e418a348d48e56a26c9cc5ac5553909c2542ca953a5fbcc9905c55a0e085af
MD5 6209a09e1734dfd5369b317070f91244
SHA1 a03061c72bc919596783f064baad386ac7bccbcd
SHA512 49a695741326b649cbe509c348b044acbbf9af5bb46a4624dfd964bad529de072c1344afff550ecb51f27041234465a09492856713a9349d4f6cc8c322179156
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Eg:KYHIhKggkXySdIxK+cMjyJIIbKdCcLyi
TLSH
T1DA918746347E02453C7E288CA3A99E368E4135A3742CB5AF7FB814512E66E510FFD8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590f39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590f39.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b564095f970513190744c809bd5a177a7d83af2b90673f5cf58fed074e39425a
MD5 b701505da1abedf36125b5613c134362
SHA1 70802f5e003fb60e7ad763da6e3ae76d2fbcd7a5
SHA512 c3261f0961e46c47b4b44d829cb6895e66db66c402195f5bb03080ba13ee87455804c68ffaac208a63232c0bbfc4fe1913e8b6d0eb0f2d636fe55ceb998c8d85
SSDEEP 192:ugm+xasuheOwQxMGsN88Ql1QGM7YL0QmiU1IvBKy4MTobWCIK++Wyih8z12qh+fN:WZcIhsN88Ui72ECK9zFIKPlLF+1
TLSH
T1AA626C72AC689C3B9CE7F251F48A32135FB89167A6C45B40E9EC7F2D00DA16C131791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6b37ca2bf912ca8215863d40952b0a86fb40e03d93d99589bc4744f116d247c8
MD5 e8d07ae783133b9e861fe5fe7de891eb
SHA1 c71b5bfbfae0cace93fe69ad223fa9fd6c023446
SHA512 0609108304ff02b27f699d8aacc44ed8f3034c33e4f10e2bdbdb5aa4646214f18fdf62cee0c26b419fcbbd3d40fdc77b96f13bb00e8c89e3473415c99f3ca422
SSDEEP 192:u2m+xasuheOwQxMGsN8ZQl1QGM7YL0QmiU1IvBKy4MTobWCIK++Wyih8z12qh+fN:YZcIhsN8ZUi72ECK9zFIKPlLF+1
TLSH
T1CE626C72AC689C3B98E7F251F48A32135FB89167A6C45B50E9EC7F2D00DA16C131791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 68850b488633ef802624e64c90860513d29fa409f6cc86b0120adc94b8d546bc
MD5 0e01d2920d8bf8af30ac78b387049fbd
SHA1 dcaea8f97a858f5e5a976e8e3b09130742081554
SHA512 da5962ba590f901b78c07c11ddfd24b2cda428fc96707ef764a93857d5ac9a2fc88b5d45936156ebbf068293935646cbd406844dd516a6dd262987c3ef9c535c
SSDEEP 384:CiFiZcIzsN08TUNTUlIlZUi72ECK9zFIKPlDF+1:JFQzNwgsiWKtFxlDF+1
TLSH
T161825B739C94C93BADE7BB41F98E32138FF581A7D690AA50E6DC6E1D009A19C1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c8f234372be0c4b68a544ee4318aca5f4f7ab34df0b4f0cf79b6d82d8d10a3b1
MD5 44401a1dcb3c4aee504836446018dd2a
SHA1 4d02361bc03bdbd56424bbf41741b31e74bdab56
SHA512 8c642272f929da29bbbb8f2aec0f2289cfe75ef7a4764a4e0dd8037d239116625daf20bcc3b25ab5a3f53f77385c8810420e2a4e24df0d55fa00ad399ee9e0fe
SSDEEP 192:8ONt6vMFPQmiUyI4AAhTobWCIK++WyiG80I2qhU/u:8ONt6UFR3AiFIKPlOFU/u
TLSH
T146122A76BC689C6B9D93B551F48E32131FB4826BEA84AB50EADC3F2C01DF55C130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b167f5d8-1557-45e4-a127-21c080319e5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b167f5d8-1557-45e4-a127-21c080319e5a.tmp
Size 8KB
SHA256 8f1a45254afdaeaa4b8c1d37673e0fd4a469963ca7d51c9dad04a36e7a5a47ba
MD5 cf199904adc06a57be41c1da6a60afaa
SHA1 72612d2a1f4d7618737eb16892e751867cf1c2b3
SHA512 bec1b9ec50bc62264dcbe8fccbd56206112bdb16b4b2a22d8b86a0be62894e7ba55eaafac73609969de3c0fbe53e657e2d62b3da85397f3f97856970c0248ef8
SSDEEP 192:lONG6vMtPQmiUyInAThTobWCIKp847LLU/u:lONG6UtRgTiFIKRPU/u
TLSH
T1A6021875BC686C7B9EA3BE45F48E23171FE411ABA5905B50EAE82F1C00D765C230383A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36d689e6-3844-4258-bc50-296412ec4895.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36d689e6-3844-4258-bc50-296412ec4895.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 896e8f8f5690f4a76aae038f499f32005bd42458bf3ebce3dc5db3b04dfaa943
MD5 f70a861e976bfa7cac1749f364e2c887
SHA1 63bd5bbde80195b3baecec305f525599154b570b
SHA512 2eb1e62826889935b567c0fb173d4d2d0abed42ad872d4f1e76a815179f22310a79fec85f11226c667aec53c12831deddde92844b21d57707a813c38ea0cd3fc
TLSH
T1C9413B58AAFA1148B3B76F56ABF6A46D483BBC372E07915D00010E4F0A63B00C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download