3858e28ae70545dac482354dfcd1336951924461b9663329b4cf4ee6d26712a1

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Public/ssa_french.htm
Size 40KB
Sample260823-d39sdsxtcs
SHA256 3858e28ae70545dac482354dfcd1336951924461b9663329b4cf4ee6d26712a1
MD5 26786e7ad64a6a538270cc4e90bae9cd
SHA1 8bbab872c28395df51bedd35f40de1ed5dd5ad6e
SHA512 34484201da9ea960ed7e788f524c0b569b13232f9dc20d6318b1ab6b74f12e3ff5eff097c1036b4341de5ce3c81d9e36ba309d0d38728af288addfc5a26a5222
SSDEEP 768:jt5Gz51xug5x0McBUbOrKfycgKLvx16DxRfgsUyPjD7fEHDlo+dRmabXWzRly0Zt:aFTRhcBsEOyc9vKYDyPjD7f6v/4ly0Zt
TLSH
T1C21395AEEDD823460ACB12B1BF66C297DA3CD3486129D110C8D78547438796CE3DB9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319296466842173"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C2591743-43EA-4DAC-805D-F7F17DBB4F23}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4884	4352	msedge.exe	85
PID 4352 wrote to memory of 4892	4352	msedge.exe	86
PID 4352 wrote to memory of 4140	4352	msedge.exe	87
PID 4352 wrote to memory of 4892	4352	msedge.exe	86
PID 4352 wrote to memory of 4892	4352	msedge.exe	86
PID 4352 wrote to memory of 3820	4352	msedge.exe	88
PID 4352 wrote to memory of 3820	4352	msedge.exe	88
PID 4352 wrote to memory of 2480	4352	msedge.exe	90
PID 4352 wrote to memory of 4232	4352	msedge.exe	91
PID 4352 wrote to memory of 2480	4352	msedge.exe	90
PID 4352 wrote to memory of 2480	4352	msedge.exe	90
PID 4352 wrote to memory of 4232	4352	msedge.exe	91
PID 4352 wrote to memory of 4232	4352	msedge.exe	91
PID 4352 wrote to memory of 4444	4352	msedge.exe	92
PID 4352 wrote to memory of 4444	4352	msedge.exe	92
PID 4352 wrote to memory of 4444	4352	msedge.exe	92
PID 4352 wrote to memory of 1520	4352	msedge.exe	93
PID 4352 wrote to memory of 1520	4352	msedge.exe	93
PID 4352 wrote to memory of 1520	4352	msedge.exe	93
PID 4352 wrote to memory of 3912	4352	msedge.exe	98
PID 4352 wrote to memory of 3912	4352	msedge.exe	98
PID 4352 wrote to memory of 4616	4352	msedge.exe	97
PID 4352 wrote to memory of 4616	4352	msedge.exe	97
PID 4352 wrote to memory of 1500	4352	msedge.exe	100
PID 4352 wrote to memory of 4212	4352	msedge.exe	109
PID 4352 wrote to memory of 2660	4352	msedge.exe	110
PID 4352 wrote to memory of 3248	4352	msedge.exe	111
PID 4352 wrote to memory of 2556	4352	msedge.exe	113
PID 4352 wrote to memory of 2556	4352	msedge.exe	113
PID 4352 wrote to memory of 2064	4352	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Public\ssa_french.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8b7ec188,0x7ffe8b7ec194,0x7ffe8b7ec1a0
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3118325203126063623,18435704384175086847,262144 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,12093614896624338033,17297585039040066646,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,3537877855931849029,5898359090065695461,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10705611943999917876,7489770971373880921,2097152 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,11627014767546403337,14593809135018147570,2097152 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,9319832993973351662,13389157370992006197,2097152 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3446064065006649645,12642699308460068585,2097152 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,3569295728832405690,8306768167313426454,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3150675225988814237,14802734528855197644,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10099243195389723617,17550315639423263314,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10099243195389723617,17550315639423263314,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,13543834827276195872,11566384250931308746,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,13332916242640691804,14756949119363236213,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,18280072611717296121,12377888462911815407,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,12159366616474753782,3961384175683445101,524288 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,4630170755495758676,13145604230432473784,262144 --field-trial-handle=2276,i,7839641774026733948,4340413960030257595,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84aea918e55b183eed630ece1651066833d51e88adbb38291f5287dd36b58f7d
MD5 53b9c38b40640d7b0d8b9441b7eefef6
SHA1 c224af945436f4ce9ecca64f90d4c183ec1df6ad
SHA512 c36ed9fd979eb9c992518dae062cfa4263be2abd46665e12588847ff7aff4e07bc2f88ae077cdb1dd05c9db4c1a59e8001757d71e1af62277482ae8b056cd5c7
TLSH
T1BB714F19CB434C43EB418E34D7F112B175324B98466F5D7A2174CBFF5E0EB258519D29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ba23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ba23.TMP
Size 3KB
SHA256 186b16ae395f3cb248cbd8c4431452453324123f22c527d603b9000d00c04468
MD5 177ecd7a6869bfaff9c8eaafa77ba986
SHA1 7eda75aff80c555f977c508db53a4f6d102b0e99
SHA512 91ad5b5a6f810b60f54da5b3adee25e50650fac1a0f2c6fb0e68e51ee75a65559aeae22f495d330d81e27371d6f9dab815488a89efc350ca0d7c5213d0ccdd67
TLSH
T13A715F19CB834C43EB018E34D7F102B175324B98466F5D7A2174CBFF5E0EB218559D28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 75d19feb5db93c4af8a817e20e87eb4d33bfec3d52e2f5160e68bca9a4158e45
MD5 6b133854055bcfb8c4d32793ef1643af
SHA1 47cd12c356c58361a04b1a5d612d11e34ac298c5
SHA512 d519d83374985890ccb9f1d54aea1feef0580d1eaa877e3d3ddb33577433e28c5824d550719d644ad89be618c9950286de1c39f72fb9bd144e6fc00250f8a46a
TLSH
T10D117DB3C3D5856EC91556F09A24AE2BCE1D0506431C7D1989E4EF2BD3E3075D10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56fa517d7171d6d2c8590e872135485e7582e42f675a1527afb8175059a605c8
MD5 d7a420315a366bad0f0d9323b127d178
SHA1 688dc06210a9a693ebb685500cd6bb80ba757fe2
SHA512 358dbe4fd2912bcfb11585586181813dcf3d677759cd0f6b5e554f30e47c9e71a69856a659b49345090e4ede9cf7e3e38f485c4391dfb650e4f7ceb9daee3fb6
SSDEEP 192:sxZERXyM/jK1Ml8Mki/fNsKC7IdpdzHW6+WNGYwKp0SyIgrJ:sxZEpMi/fNsKCkBHbG79
TLSH
T14942E9116A34A97BCCDBD209BA41BF53D6F54572A2900E44ADFCDA1C04E6BED221BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 88fd82d3c38bce78523c91f841f600d2bc0c6b05719b454c0d74347c9f44d7d1
MD5 ba6bbd4561eb3d506986adaf1cf92363
SHA1 609967ef742013b7fa508593db353823798adaab
SHA512 caf452a3b444b71a7768b70df86d2a73be1785d75734f6072bf536d4f83d155d7b03f0605e11f91ff7ed769ab3c51a1f9e66701f921835c921dda280f64bcecd
SSDEEP 192:sxZERXyM/jK1Ml8UQQki/fNsvj7IdpHzHW6+WNGYw4qKSyIg5vJ:sxZEpqji/fNsvjkTHbGKD
TLSH
T18052E8116A346D77CCEBE209BA41BF53D6F5447291500E44A9FCDA1C04E6BED221BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 54a63fe33a20373ac8f47c6895513644a3c655034772799efb471340751f10ac
MD5 29d10bad73fe143e5b47294f1da98a7b
SHA1 15675bd4de59e5ff48a684c38965521571b98864
SHA512 2108662a8f8709210d93e4490833d68b37e54f988417b4cd87cea4666a29311270127b0549d6d31850db19b3e700ccc1c679df734deaa8a26c65ea32dfb55501
SSDEEP 768:/04jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dkrohJcQa4:/04jeXmWvmKLEu1jacPLZQdvsk
TLSH
T1F8D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 efc3c758c9125fed8be7f7d5633fe04cc84c290fc66d44c2d655d4ca117f61d6
MD5 b470076469b50d0701332436cc4cad44
SHA1 8075266ac37bbdd8d03057c3ebf8f959c2b468b0
SHA512 ca10a474011d386df5ebd09f3227b0d10873fbfd10c38ad50860cb0eb8237f68b78c9ac54a35dff838f014ce03a5314cd7edeb9880ea0d31680d6ff092cd75a1
SSDEEP 96:KA16K2sCOTKK8cs0597PLgv3CzFFgK91FzgpVFyTNtJ:4tBD0597PLe3C5FB1Fz2VFyTNtJ
TLSH
T18E91C81231F752427C3F684CA7A4866A6B4272B33415B82B3FE844761E66F654CFE8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8ddafef-c00f-4a67-aa45-2f19d17fd5dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8ddafef-c00f-4a67-aa45-2f19d17fd5dd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5955b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5955b7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 70e68015fde3aa17492ded29c364eb79154dd4c6bb68c832e988e43c76a55a6f
MD5 c1e8a639f6d635c23d792a998e82a625
SHA1 1f068609c93bd5c3d427952bfbef79ce2d5eada1
SHA512 882e5fc4cbba5d672bb75f982752852646560edd8cf36a065e6f5821d4fc11d33c20d7da4b2db04df50c6f3cb3e46b9373d41f35d68d7b073c00973ffe7fccd8
SSDEEP 384:PiFiZcIusNz8TUNTUlIlAZNoltLf+D8h8RX/KFFivJRog:aFQuKwgnbn8/8FiPz
TLSH
T1CDA25C735CA8AC7B5DF6AB85F54A31139FF48027CAC9AB90D6DC9B2D009A5DC130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 17fa63dc0493df387c215ae9f55b859f378d8dc4caa7e0f683ed74a3a097b001
MD5 efc6f0ad075f7e0f998e7f3abb6d9f9f
SHA1 f8772a1ad0cbf7acdfd4fc0a62f2c10cda575789
SHA512 ab34f1b6649085c3d02115a2437eebc6751359ac63ee75d5d547017fd3d5117d65d65c40c6b33bf343b0bbeeb9ec8ed5a01cebd7a8c3485c5bf3677f1837b9d9
SSDEEP 192:EONnF6hZ0QmiUy5zpc/+jVpjzoruo8a5wOZ4GU6:EONF6o2pu+D8h8h2PU6
TLSH
T1B002D8356C687C778EF2AE45F48736139FE8112BEA956F84D6F85B1C00D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 aaa674626a23c5229a327ce03bbe558089d50554fc18f50c4a769081cdbbe1c5
MD5 df83faaa8e5d7fd19927a98947c36e5a
SHA1 df6794532872fc8ad61ef203d2cb4e97cd1a2994
SHA512 346ae90656513f4d144492f1742f1d9afe2f27f8f2ec93750e75f3634ed03cfe1509c37d7865242eb93404edc923901e7337f5cc916b1b0493df1fba811975f2
SSDEEP 384:iZcIhsNhAZNoltLf+D8h8RX/uFFivJRog:QhGbn8/gFiPz
TLSH
T15B828D311C78BC7718F6E285F54A35139FF8902B9ACD6F80C5ECAB2D00996AD131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 930ca776eb1bd93747aac2f6a5904659a61b78e2db9f009a5a20b619d11e5b87
MD5 d771c01f2b71742011b4773b4bf4a73f
SHA1 16b7134f195b345d5c8c52840c522c350a5cdd28
SHA512 3bcdfa609b75b84208b2860fac98991ebfe19be98607522c204dc2d04831d8ea8936dff2473f3bc6bda6086ed6b06446a7056c2d73f1851fcb0a28629d4c07e3
SSDEEP 192:UON86hZaQmiUyvzJc/+jVpjzoruo8RX8EP+5cOqZqMU6:UON86yGJu+D8h8RX/p9FU6
TLSH
T11A12FB326868BC675DE26685F48731535FE4512BEE857F84D6FC2B1C00DF6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4b2e237-2046-46b4-853e-94a7992f6a6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4b2e237-2046-46b4-853e-94a7992f6a6e.tmp
Size 18KB
SHA256 38f56623aef457ae7e04e82f871be1032630b434e4211358f883ca33bb0a29ae
MD5 c57ae976ce4cd7217a559b7785209b49
SHA1 59b9023ca13a6d5e8c66f8833d3632f09c073661
SHA512 426676adeca0abc1c870916d75c4a32c059c952419dca46c25e6a592ef728f8ba3aae02a90766c2239fc2842dcf30edb3b7008191dd63ff2137e4aa640560141
SSDEEP 384:FZcIhsNhlZNoltLf+D8h8RX/uFFivJRog:9hJbn8/gFiPz
TLSH
T141827D325C78BC7718F6E285F54A35135FF8902B9ACD6F80C5ECAB2D00996AD131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1efa4ca3-06c1-4578-aaba-03cab71f6bbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1efa4ca3-06c1-4578-aaba-03cab71f6bbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fff8b1a51a23c4edcdd2f5b6c33ed2be458fbf9517a1fb07913043be3fd28c26
MD5 84b7e5a06d91a976f6d41e209171abb5
SHA1 275183ec4ef60b384197de0dc7d9f00fb2b81d1a
SHA512 b582391cbd7b1a0727ea994c609866d2acbea5d9788223e4cb25c5355e116885bef14e4f3bfac2461434066a59f5219685c20789348a56309128f34f49f25481
TLSH
T14F413A5CA6F91109B3B76F5A9FF6986D487BBC732E06D49E00110D4F0A36B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download