02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.html
Size 1KB
Sample260827-plz3eatsft
SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
MD5 2d939d7afe37b02f77e4eb4d5e5916fc
SHA1 7aaea8ffacef9986f3c99c9a172763fc90c71217
SHA512 26df83433c38890b4e5bfe29b508666257b3abd562568c5fe7558925128c28d89d237420aa872db4710ef7d511b478e867751cb6426679a52554dc7b89ac948a
TLSH
T10021FEB3C2526B3AB563034E305BD6D42F12F28150545F5C72B640DAB8CA227B41B3DE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323071809366601"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{5277075C-7F7C-4ABF-B419-B7ED3CA00A6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2620	1088	msedge.exe	85
PID 1088 wrote to memory of 4108	1088	msedge.exe	87
PID 1088 wrote to memory of 2460	1088	msedge.exe	89
PID 1088 wrote to memory of 2460	1088	msedge.exe	89
PID 1088 wrote to memory of 3812	1088	msedge.exe	88
PID 1088 wrote to memory of 3812	1088	msedge.exe	88
PID 1088 wrote to memory of 3812	1088	msedge.exe	88
PID 1088 wrote to memory of 1076	1088	msedge.exe	91
PID 1088 wrote to memory of 1076	1088	msedge.exe	91
PID 1088 wrote to memory of 1076	1088	msedge.exe	91
PID 1088 wrote to memory of 4680	1088	msedge.exe	90
PID 1088 wrote to memory of 4680	1088	msedge.exe	90
PID 1088 wrote to memory of 4680	1088	msedge.exe	90
PID 1088 wrote to memory of 3384	1088	msedge.exe	92
PID 1088 wrote to memory of 3384	1088	msedge.exe	92
PID 1088 wrote to memory of 3384	1088	msedge.exe	92
PID 1088 wrote to memory of 3700	1088	msedge.exe	93
PID 1088 wrote to memory of 3700	1088	msedge.exe	93
PID 1088 wrote to memory of 3700	1088	msedge.exe	93
PID 1088 wrote to memory of 1480	1088	msedge.exe	101
PID 1088 wrote to memory of 1480	1088	msedge.exe	101
PID 1088 wrote to memory of 2848	1088	msedge.exe	102
PID 1088 wrote to memory of 2848	1088	msedge.exe	102
PID 1088 wrote to memory of 2616	1088	msedge.exe	104
PID 1088 wrote to memory of 1692	1088	msedge.exe	111
PID 1088 wrote to memory of 2184	1088	msedge.exe	112
PID 1088 wrote to memory of 4464	1088	msedge.exe	113
PID 1088 wrote to memory of 3012	1088	msedge.exe	121
PID 1088 wrote to memory of 3012	1088	msedge.exe	121
PID 1088 wrote to memory of 3948	1088	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5400057966526448648,11021627416435886004,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,10201380427775343841,2205558453930881748,262144 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,1810369006873109507,17435877744597628756,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,9873831597373941727,9760600391321284703,2097152 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,716087618870422458,14313027331886928329,2097152 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,2225248043516942810,5365772587556331410,2097152 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,5362448789507355950,6991470821894267392,2097152 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15226554903653458120,11188509591348442544,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14225515305758211366,1160123233903217302,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10820098016702323573,12075862907633041103,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10820098016702323573,12075862907633041103,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,3375761308829556800,3120195854458521974,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,11013383289658031532,17198517652900212180,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,2190328906835590739,1152351906708193875,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4125544936889647440,15884505357795004994,524288 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5744,i,4167603818310833071,9082217104314317511,262144 --field-trial-handle=2300,i,3699680974021904740,4807069967068649679,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46cfab67-bb89-4b77-b1b7-12b25eff7396.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46cfab67-bb89-4b77-b1b7-12b25eff7396.tmp
Size 18KB
SHA256 c0b150a5ffeeb47649e121b1eeb6188bd7e0045d7f8dacc388ab3f39381eb108
MD5 908ef737e773fd843c7e505f7e6444fc
SHA1 5f389f41617c947d2a483c3fafe71b0c946aa975
SHA512 4674305f4c0c775764f2a063a6657050d6c0500df748a5892502c5958efd38eba5386f140972483c16d26622bfbbe3f01281faff348ab15618b093727ef33899
SSDEEP 384:zZcIhsNBGktewJLZFf+68R+XGxJrETFK+LBNj5ylo6:rhwttlZEhqKWN5oN
TLSH
T183828C3298789C7758E2B265F44B26138FF45137AAC97F80D1ECBF1C04DA6A9131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

83c16a6c-7bfe-4b55-9302-43009b0722c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83c16a6c-7bfe-4b55-9302-43009b0722c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 711829d2c1aac58aa19018dfadfffadf6722108a34a3da7d4ea2deaa68c54db6
MD5 a6778af177cb3534ce283506e7b17421
SHA1 642f57aa287147defdd67eb54513188be7ca21ba
SHA512 c3667db3bd136ab5c56b78748eeddfdc3c5db82078e6d2896b724a4b306ae2953b704dcf837a36863ff535cbb64ecbd8c999e8b32e673a78d1a17532ea25f50d
TLSH
T1C071816F8D4201D3EF611131D1DA1A03373E8DA94903BED6225498BDB82EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b169.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b169.TMP
Size 3KB
SHA256 7b74202cd7dd5ca031557e839a2293bb90e16139841453a45fb01f7d5b566a70
MD5 74e46e48ed39a2023ce38280f87449c4
SHA1 2b7f1cd70d922d90149501d4abb884f677b843d9
SHA512 206ec9ec03de4b2b9517d667e3d36cf1b1edbed8d59cf3a024b881db7a9675795f2f524761647614d662d541e59d0c9e8b6abb4e0e230f79750c86a35b58db56
TLSH
T1A271816F8D4201D3EF211131D5DA1A03373E8DA94903BED2115498BDB91EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fa2278adbc53bf13f81afcabd22c7de96bbebeb31be6d32280f8716f46df7884
MD5 88dbde3065602a05ebf1187252c35c7b
SHA1 eff0e75a92081c847656e57f8cbf55a32007cc42
SHA512 e2ca089dc03b0d1472bef34412d447dd4c0be26519464ef6d25911c111eb04d005797561984a7a935d221fbb3d1ce4ef40ad38af1af52838fa2cadf451ad3c76
TLSH
T1D5117DF7C7D5956E890117F09A28AE2BCE2D0606421C7C15C9D4FF2B93E3475D00295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ca738f0c70f0ed49b00a8036b692fe4c7426a0874be7f7e100acdb987d96096d
MD5 233bff07edb81445b5698671e5f786be
SHA1 65524d9d9b1c998897b903d3a5b3010ed926b41c
SHA512 2e13e064173a4c5da8598d683eeb317ca0b8bc888ba64ea90365124045ba74db430d60af0dc468dc0aff7a81f631ba28f2ba4595e1a8ff70195d89f10e4c446d
SSDEEP 192:sxZDLR+yM/jK1Ml8UQ/kO/fuseV3kIdpHVHW6+WNGYwcAw0pIg5QJ:sxZ3UqsO/fuse191HbGHC
TLSH
T13A52F701AB34997BCCDBD219FA417F53D6F9147292900E44A9FCDA1C05E6BED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e16c90c93a48c7da3aa578a97c964f3bd7d5ed8ca189a07a4d1964bc004862d7
MD5 2a3e3453d433c1aa9348c1f84710dc8b
SHA1 58e18ff89588ee9ebeeb7d00324ba92384fbcaee
SHA512 89371cedb9396b5108609710ea7335590618b5975b236ff6dac74416161dc65392ee03e16ab87df8316834e678a849b6c784ce7bb75962ad352f005286b1f512
SSDEEP 192:sxZDLR+yM/jK1Ml8MkO/fusmy3kIdpdVHW6+WNGYwKTspIgrJ:sxZ3UMO/fusmI9fHbGt9
TLSH
T1734208016B34A97BCCDBD209FA457F53D6F95472A2940E44A9FCDA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f4ffa8775562990ffebd77328d6ef88df17b84fec5f03e34ce229643226b9c8e
MD5 0bc0b2a7cfcf842d561a4a23add6917d
SHA1 086d6b2148dcd29937ac50d1cc11e98b55b7d10b
SHA512 c7a9c9bb03fd9cd832f4e88b872f38d34eb797422da7e8a32068e7ccd1d0b0585afa2bed387b1ae2568623ad3a8976721f48d10484d4948051944c6bd4725f0f
SSDEEP 768:VO4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d6rohic0ai:VO4jeXmWvmKLEu1jacPLZQdxPy
TLSH
T19BD2093B284CCF7E4F844E5CEC2AAE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 947a302b7606fd37568d47b678198c04e6d9eb66bf92af5a10fed1ebf9107803
MD5 6aa413725230947dad19345345072522
SHA1 b827af7dd3f80871f993517fbccede0197f8ee2e
SHA512 0de6fd0a77d56d0b7c47922b8907d85444d47e67db91082ec8d4db77a669de342e4a53e01180225fdcc5006e64d9ee172246a160251f57457de1ed747b6f9ae8
SSDEEP 24:KdZRfZcZHZuaZLdZzZfZn4Z3Zb+Z+IjZ7ZnKiZwhaZFZn1EZRZ3SmZJMZ88ZPZsx:KMUIjKJSUjyxEIHK1+cVeIfKrCc3yJ
TLSH
T1DF91662675BA02016E3E290C85E4A737AE52B663355CB42B3BAC40F54E67E118DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ffa6281f009445896d1860b7eb287c7cec1e40acd5aaeb3d098877f5bed17bf5
MD5 bab8b1557b479da00f4fff124106eb2c
SHA1 cc8df48ebbb3047854fbd64a3cb39e9ea7b7ff41
SHA512 09142f4b7a4787f4ef793c074c2262f80d4ae476a25f1b374814c981988cd836cc60ec162026cc8bb419c0ae3f1a24268757f3f30364b07194c9e3e5cd76833f
SSDEEP 384:UZcIasNBTktewJLZFf+68R+XGxJrEdFK+LBNj5ylo6:SaPttlZEhGKWN5oN
TLSH
T1DA927C3298789C7758E2B265F44B36138FF85177A6C97F80D1ECBF1C04DA6A9131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0f008e6c75e527d380e4cbb5900a129cde33774bf859311a596f37ba6ad5c641
MD5 461ec72c4e7e3e11f086643fbca2e4a3
SHA1 f5bd39cffc0f16e8ee2893dafbc3c3e4dd90ab82
SHA512 285255b3d25d178246ef07d05b9134d1b4ce5cf103772303e623202f535fc23dc836f6b6fd92240cfcf839190f59e895e151dd50ed058dfb970ec23abb02a848
SSDEEP 384:JZcIhsNBTktewJLZFf+68R+XGxJrETFK+LBNj5ylo6:BhPttlZEhqKWN5oN
TLSH
T1D9828C3298789C7758E6B265F44B36138FF45137AAC97F80D1ECBF1C04DA6A9131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f86f8b3e6266311c8e3bf73f6a7575a768a11c1583801a121776ba63dbfd7ba
MD5 868751ab0771d2ac46bdddb9817736fb
SHA1 59676c7800e79f8469502926ea3c955d76077b5e
SHA512 008949a4488710c2327a8561a422b92493ab38abc945381d22bbe3ed2e79e621b4a8219f99210aa50416e9ff1f52b1cb275a222d15a535d5c5f12bd47348615d
SSDEEP 192:EON86hZ0QmiUybPpc/+jVIjzorRV5wOZg3U6:EON86oEpu+68R02uU6
TLSH
T14002D835AC686C778EE2AE45F48727235FE5212BA9E56F84D6E81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e98c2f8d1f24c1d5dc30997fa8687fe59017876f95443e10b281661175cb352
MD5 f647dfeffee28ff416f3c49f523c07bd
SHA1 6905b15904d978687bf13e126349e8ceb43da936
SHA512 cc3788ee0527dd4828a2df1038dd6cfac95ffdd81c1abd980b68e3e50b7a063f49961efca71344e0c37cd04473c2410d418f16a738ae05ca0d745a5fbbd7fee0
SSDEEP 192:3ONs6hZ6QmiUyBDP3c/+jVIjzorR+XKFuSJrER5cOqwqcU6:3ONs6KcL3u+68R+XGxJrE09KU6
TLSH
T1D6120B356868AC675DD2A551F08732139FE51127EEC97F94E2EC2F1C00DB66C131EC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d28af7fa-82db-4374-82a4-5ef1d6242897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d28af7fa-82db-4374-82a4-5ef1d6242897.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b7c15a23e72c9884197f0a8bec03031cd0b6483bd4eabea7eddb6a4f01d0cdc2
MD5 7607a419c0fd0a6fa1d5e96e9f03f194
SHA1 28a7ca4aad4b23a14a3b89a257313d77498746cc
SHA512 99ac26acae112078efccc61ffeacf1e10abd3a5b7d2fe9fe4029514e0b3a2c62b55fbe10cafa1e24c1e721e3f18aa828d86abba83f00f9ccbe3edb49247f699c
TLSH
T190410749AAE91148F3B7BF56ABF6A86E487BBC772E07D45D00010D4E0A26B00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download