2b1ee39db5b4bdcdcd3261c597c244297d031dc17ffce771899ba039ef502a8e

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
blog.html
Size 742KB
Sample260826-pptpssdn91
SHA256 2b1ee39db5b4bdcdcd3261c597c244297d031dc17ffce771899ba039ef502a8e
MD5 4adf0a20ff85990274abce3759b7e68d
SHA1 7e0b92cf55b427b6b26466cfeb8cbf39190d284c
SHA512 01c2f7d33b9ea6a09f6add43fdab335c102f18e04afadea04dbafb78b86e310e4a4ea30a3f9ae0f8037426aa8d119945db8532bb4f882162df899eb89536267c
SSDEEP 6144:Q1ck41K99d9MEhMDtoOMjMaa2jgY+7CGAKiERk1BT3VNVF1L5FYoYDPGFFttWXx:wcR1KzhHQapkEtVyyFFttWXx
TLSH
T191F46C68A20D64399DA702AF7548BB2D29765903FFC24ADDFDD94E9009C36F302B3719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322210892861799"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{2AD721F1-D256-4C41-896A-CA7A47E4D06C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3152	4352	msedge.exe	84
PID 4352 wrote to memory of 1828	4352	msedge.exe	85
PID 4352 wrote to memory of 592	4352	msedge.exe	88
PID 4352 wrote to memory of 592	4352	msedge.exe	88
PID 4352 wrote to memory of 1232	4352	msedge.exe	86
PID 4352 wrote to memory of 1232	4352	msedge.exe	86
PID 4352 wrote to memory of 1232	4352	msedge.exe	86
PID 4352 wrote to memory of 2244	4352	msedge.exe	90
PID 4352 wrote to memory of 3104	4352	msedge.exe	89
PID 4352 wrote to memory of 2244	4352	msedge.exe	90
PID 4352 wrote to memory of 2244	4352	msedge.exe	90
PID 4352 wrote to memory of 3104	4352	msedge.exe	89
PID 4352 wrote to memory of 3104	4352	msedge.exe	89
PID 4352 wrote to memory of 3272	4352	msedge.exe	91
PID 4352 wrote to memory of 4388	4352	msedge.exe	92
PID 4352 wrote to memory of 4388	4352	msedge.exe	92
PID 4352 wrote to memory of 4388	4352	msedge.exe	92
PID 4352 wrote to memory of 3272	4352	msedge.exe	91
PID 4352 wrote to memory of 3272	4352	msedge.exe	91
PID 4352 wrote to memory of 3804	4352	msedge.exe	96
PID 4352 wrote to memory of 4976	4352	msedge.exe	97
PID 4352 wrote to memory of 3804	4352	msedge.exe	96
PID 4352 wrote to memory of 4976	4352	msedge.exe	97
PID 4352 wrote to memory of 4036	4352	msedge.exe	99
PID 4352 wrote to memory of 4836	4352	msedge.exe	103
PID 4352 wrote to memory of 3356	4352	msedge.exe	104
PID 4352 wrote to memory of 4576	4352	msedge.exe	105
PID 4352 wrote to memory of 4580	4352	msedge.exe	112
PID 4352 wrote to memory of 4580	4352	msedge.exe	112
PID 4352 wrote to memory of 3332	4352	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\blog.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb6771c188,0x7ffb6771c194,0x7ffb6771c1a0
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,10576209125520230216,1424761458437547136,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,4876747792525773226,11936633348201419655,262144 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,17646256663487349303,1517134899668771542,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1756467167273253509,17164219291598098944,2097152 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,6408053182870933113,16019672480084739151,2097152 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12230692413062660670,14262590035715604345,2097152 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,696630709238879076,1480978849999786744,2097152 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,39295339114628072,4495931728918238750,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3354868369827054075,6160729495862286612,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,209348934677575584,6343565743483994334,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,209348934677575584,6343565743483994334,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,4304827141600814428,11455687582644423799,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10618691985948343347,3689391011968693655,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,10896795277470085345,3503286033311011405,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1026113305439168945,12977463526119231215,524288 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4848,i,16591211291878850318,18294921176549992702,262144 --field-trial-handle=2284,i,6015675696997732300,4588887991391430427,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac31ace4222e3ca84330fd899f84fd167e12f352ebcd9725a30f4508e81b2d52
MD5 b019e6ce0685ca27faa68ae13aae54f2
SHA1 2a71bd33e3e3b8557e5e6b544ad2b44ef5653964
SHA512 c0dc00529019af1996a7efe280b1402a37d7671af8e6c79533b99805069b6dd286fcedf85f0fa8c644e82254c07c7862f64532d9de6ba7a00411b6b0c35dfca7
TLSH
T1A771D815057380B3EB243C31E1D93E9334FF84A83E9F5FA616D1457F9A0A7A6E021838
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586bf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586bf4.TMP
Size 3KB
SHA256 cac96ba851b0b68644193e362cb345aad0bdd0c5c71c9029b13ce8e6b7d93cc4
MD5 f006cbe2f3392bb99e28093f97d26d37
SHA1 6cba586133097f43d182a0bc37edd25b2727d239
SHA512 18f98fe17052bd10e3420f53f3234e51fb5e16ecf5f044558bbd8e50d22b81eb66e5b616e9d22ee2bfc7c84ebb73d052e0c40075978ecb2c68f7ff4ec7af61ca
TLSH
T1F871E615017380B3EB243C32E1C93E9334FF84A83E9F5FA601D1457FAA0A7A6E421838
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3b26ef022208485c0af63dfaee000f1452c755cecdb882e17a786cbbdb9d9069
MD5 435f7b45a1e5d08ece774001bf93eeb8
SHA1 e72b9f4893f41f6ed5a8020684b5e93d83999553
SHA512 631e6d317c00ffe807df899c9adf0f867c458283010c471b1e8b7ef34421c0ec570b8ff3b8bd4a8c43c9cfee294c803493e1d4b06faf61ac0dce04597ccd4805
TLSH
T1A2517DF6C3D5577E891162F19B256E2ACD1D455B422C3C26C9F4AF1BA3E24B0D20229F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 728a07661b765e79d296597022d0d51e4f689589e4f21a2c78879eee505020bc
MD5 c11a1333ec7497c69582fb6e7d534db8
SHA1 a8163736d6abf637d3baa917e35a8444bf4f51be
SHA512 7d0b822a3030deffe2de764f7a179c79eddd1b52d40fa36dab6ad8a9e338eb69fd080d9e715558540c29965630f0d4d5e8d4f10bd64b74ab4dc2fb5d406245f5
SSDEEP 192:sxZfDRWyM/jK1Ml8Mk6R/fagsniS50IdpdLHW6+WNGY4wbKsIgrJ:sxZfDEM6R/fagsnN5tBHbG09
TLSH
T1FA4209116A346977CCDBD20DFA45BF53D6F90472A2901D88A9FCCA1C05E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f2a006f215ee4be99a0273a197605c878df5b10e4743464a1c12a5ab750bff23
MD5 31eb5c468d3c35b5fb37b71199ccb482
SHA1 b81d9cbc7305b2b56ea026519bd4c247610cde11
SHA512 5475cfc8fc774f407501d75afc0a9e5c0f482a3e90f617f47f330ec35fe1eab72ca0a9fe364dd4cf11f28a9ce266d1e408d4263230beb3cbde80086ef2db1d5d
SSDEEP 192:sxZfDRWyM/jK1Ml8UQyk6R/fagsb1S50IdpHLHW6+WNGY4IMdsIg5ldPJ:sxZfDEqx6R/fagsbg5trHbGApR
TLSH
T1CB52F811AA346977CCDBD20DFA41BF53D6F5147292900E88A9FCCA1C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb83b9aa2dada745305dbc96a5d789e0907b22da0b971d00770d0367a60ed44e
MD5 fea4c33c36a384b010f575b20ab95fb1
SHA1 42defffd06f398c2665a27c7370df17a5154c011
SHA512 4c745c75b4385826bd1f098ed48892f31ee027bdb868c22e66ccd3dbb0941c1ad4e01a57742121108d6e30838e69fbc8b650737532a064e617e4a783c36d46e5
SSDEEP 768:oS8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd/roEko7UnW:oS8iJPNWvx76ru1jahALocdsCUW
TLSH
T197D20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA880C03C77EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f48ab9d66ac5ce65fbbe07b68278beceb4d3d7ee0b4cd4d89f93c3e864072372
MD5 7e829aacb7aa3684ff4ca4e3f088ef61
SHA1 c66585b024265d65ff3a1fe20bfaea88d2f427a9
SHA512 8762486722ab68d79a455216a98ccdf7bb81e2d6c5b0e49fe8f3eb021985c4a407e78f72866fe5fff50193bc1d97b4014ba96e426c75dcd253568f741a15cc38
SSDEEP 48:KUQILKlCcTytFIxK20ceBIBKaEUTyd9IRKu0MV:KUQQKlCS2FqK20hBmKaEaW9SKu0G
TLSH
T126C1391230BB1A872DBD6F0C9695CB1A474175A33018A82B7FD940794DAED380DFDAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71b01dae-1b8f-4ccb-87ee-e684670f5638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\71b01dae-1b8f-4ccb-87ee-e684670f5638.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ab9ed064dca971de7a4d2c02c33395743d4a42c6de938a80ad558af686ed9b2c
MD5 d0ca3a488755a57d8ada2109f6a9fd7e
SHA1 7c04e9addf9451761d52b96b7cbc47c37ec2edb1
SHA512 bf2e856241df5f1ab383b74c320454d699a717eeece37f58be39fef9d9b3b0b1c0487ed8d61771bc3b4828363a2ef8f866463aec70ca6a42b819974971927a16
SSDEEP 192:Fm+xasuheOwQxMGsNjwQ/aQ4hymeMqQmiU1gYb4k03HZ/NeLIaqW+jtPcf7kZrRl:WZcIhsNjwGuB+bEk8lze+Zcf7IoK
TLSH
T184828D7258F46C3B58E3E245F84736175FB8816BD6DC6F90C5ECA70C05DA7A8130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 bf05d5c560e552600aeb5f0d8f53644c14f4f290dbe9232caa92477594126ad0
MD5 a70b0b675a3bc5767335dbc570fd9601
SHA1 51c95950ab99396d088a2f84963fc588da493491
SHA512 fa0c9e8b7f31328f038b6f7b44261158f78ebc766a07e9ee64cd0dee1d65dc0be0114022193335bda3987caaa3faf05732dfde7de2080474888b3e9d3b7fa13f
SSDEEP 384:4iFiZcI2sN98TUNTUlIlSGuB+bEk8lye+Zcf7IoK:DFQ2kwgpRNeecjIl
TLSH
T166A26D7348E49D3B6DF7AB45F94636078EB481ABC6D9AF90D6D89B0C01DB2D8030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c168769c08efbfb3e81b361d90ad34e423596909ec3ab06f6644ef3ed3140e69
MD5 8c1f4909996e71c00aafa6d8d4dd9502
SHA1 8fe32938a6d71a9dc9e05d206d871365a1f3c191
SHA512 ecaab51beca6ffe9afd16b436e81a21f19bb74318cd14fbb5e8733a096cb4d4e39e987d9de0545ec267da555c31e3e994659697a6969d3b3e250282c61d72983
SSDEEP 192:ugm+xasuheOwQxMGsNjfQ/aQ4hymeMqQmiU1gYb4k03HZ/NeLIaqW+jtPcf7kZrv:KZcIhsNjfGuB+bEk8lze+Zcf7IoK
TLSH
T187828D7218F86C3B58E3A245F84636079FB8816BD6DC6F90C5ECA71C05DA7A8130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 39a6de47f65ea0166d42a951974aa14b80ed87928fa8d42fa222f0812bb0e349
MD5 375346580519d4821bd95d315be70da1
SHA1 3bf5cbc28015bf2252bbbf0f22acc4ef479d1330
SHA512 b60834d43197de95b96b35c6a79a1e79aa772f955d4c3cab61304efa42bacd1b5222ac76dd29919815e986f18e847f134c1e69c2e4be5bc2377ed4cb4fab7184
SSDEEP 192:uCm+xasuheOwQxMGsNjSQ/aQ4hymeMqQmiU1gYb4k03HZ/NeLIaqW+jtPcf7kZrv:IZcIhsNjSGuB+bEk8lze+Zcf7IoK
TLSH
T12C828D7218F86C3B58E3A645F84636179FB8816BD7DC6F90C5ECA71C05DA7A8130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c44ec5e8858eef8e5d25209de8ea43e4498a82eedfe1975022e09b84b4cc7721
MD5 a4329dd7d5f38eaab604eb30b2b123f8
SHA1 20db250f6634400e159483a62f7891f0e4d5237c
SHA512 465256133b84e40df7f0abc2112f63f76c3b2b059f42be731472ed317d5d4c2e514ab83518a7ffeb058ee17e82b4f08f31ae4172dd2242fea1f778e82446b17b
SSDEEP 96:ZqONkTQsjpfmUTmDK5ih/cIPURHl8h4otop5J5DbBhPwivh50xy0SFYKsAxXeYzV:gON/6kDfQmiUyblZ903HLQiJ0U6
TLSH
T13C02F93568782CBBCEE3AE49F48637275FA5212BEAD42F84D9E81B1C00D764C1743827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dec81e42a53aec02e8a676ec563f30cb39dd43ea1825d78c86492203e0eb4624
MD5 53406d02ce050133d6f7d8c7e96b96e2
SHA1 378dee0422009be542d1e7c70c36744818e64a7f
SHA512 60e7850d9939ab76f5c0842d98e8ceb0724824d6b8e4e5c3cf9679e6b363279e2fafe48c6bc9ede46e921c579d0498b137fcd8af9a7e20bb54ad1af88d9e56a0
SSDEEP 96:xqONkyQsjpfmUTNK5ih/cIPURHl8h4otop5JwyDbBCPwivh50xy0SFYKsAxXeYzO:4ONu6k4QmiUyrlE903HZ/N/cRaqWU6
TLSH
T12E12193268B86C6B9DE3A951F48332179EA5812BEBC97F90D5EC271C05DB29C170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ce020806756b1f1293144e67436d123d6f1046c206c980802b2658655a6736d
MD5 b8379d3534fadae75453d504c140f63d
SHA1 b0b5525719e382a5d48ec8d111c95e15440d3712
SHA512 d34ae0d1d305c405e7423d80fa8287b8d1794b89c056cdd5d65a71d9e7d98ed24f430c0e32a5ca4854870bfdad10a0c07dba282fbc4a8ce94710c6fe4a115c00
TLSH
T16E41D958A6F91148B3B77F5AABF6A47D587BBC762E06D09E00010E4F4A63B40C962737
MD5 SHA1 SHA512 TLSH

Submit Download