4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crypted.html
Size 1KB
Sample260827-w2b4vaaf97
SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
MD5 8150f458ed6fb9b1db4e5cfa57a1a281
SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
TLSH
T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323286829377472"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{749F52B0-B206-4A09-B001-EF7957C3357C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1744	4916	msedge.exe	87
PID 4916 wrote to memory of 3908	4916	msedge.exe	88
PID 4916 wrote to memory of 4124	4916	msedge.exe	89
PID 4916 wrote to memory of 4124	4916	msedge.exe	89
PID 4916 wrote to memory of 4124	4916	msedge.exe	89
PID 4916 wrote to memory of 4304	4916	msedge.exe	91
PID 4916 wrote to memory of 4304	4916	msedge.exe	91
PID 4916 wrote to memory of 3480	4916	msedge.exe	92
PID 4916 wrote to memory of 4492	4916	msedge.exe	93
PID 4916 wrote to memory of 3480	4916	msedge.exe	92
PID 4916 wrote to memory of 3480	4916	msedge.exe	92
PID 4916 wrote to memory of 4492	4916	msedge.exe	93
PID 4916 wrote to memory of 4492	4916	msedge.exe	93
PID 4916 wrote to memory of 1636	4916	msedge.exe	94
PID 4916 wrote to memory of 1636	4916	msedge.exe	94
PID 4916 wrote to memory of 1636	4916	msedge.exe	94
PID 4916 wrote to memory of 1708	4916	msedge.exe	95
PID 4916 wrote to memory of 1708	4916	msedge.exe	95
PID 4916 wrote to memory of 1708	4916	msedge.exe	95
PID 4916 wrote to memory of 2164	4916	msedge.exe	99
PID 4916 wrote to memory of 3280	4916	msedge.exe	100
PID 4916 wrote to memory of 2164	4916	msedge.exe	99
PID 4916 wrote to memory of 3280	4916	msedge.exe	100
PID 4916 wrote to memory of 4520	4916	msedge.exe	102
PID 4916 wrote to memory of 3500	4916	msedge.exe	114
PID 4916 wrote to memory of 4752	4916	msedge.exe	115
PID 4916 wrote to memory of 3352	4916	msedge.exe	116
PID 4916 wrote to memory of 3832	4916	msedge.exe	118
PID 4916 wrote to memory of 3832	4916	msedge.exe	118
PID 4916 wrote to memory of 3280	4916	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\crypted.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,6009209251826215905,16301431891826693399,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,2414490306113778369,7041304439784085746,262144 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,9721198394428621918,2940283739505270034,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,7725443292615064642,14392314683059396552,2097152 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,6526569998417558399,15533573878758296504,2097152 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,11005659866252984637,16225752949205587817,2097152 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,1118973909107918187,700506049629053661,2097152 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,3440494475582072653,16824948613104119695,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11194008827367902583,6584387972426777361,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10073385170091120492,5779120317703905778,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10073385170091120492,5779120317703905778,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,5094388124063211307,14302741362964330848,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,11206809082733435929,6451815745356476009,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,14790561298692758823,8584098150536275675,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,327115147815421014,18427898833979059496,524288 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,4702108876599678068,16345227011593612180,262144 --field-trial-handle=2288,i,12509018220159182288,5697445596801480169,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 233152366560756f0d22a3456745a49c528253a2c003cec9c54e55e60cf2d4f7
MD5 eba5ff017dd737b5a3ed92cbe118efc0
SHA1 f05a500fba8c47e291fd870abf1f2253b0230046
SHA512 bd9650e30dc93d843c59b08b07cab6e05ae3ee17181e8947f6fec1ff7e3aa2f9ac27fdae7cbb2131fed476ff196742900d7f2c4e7015954755eec1e2a6cf63dd
TLSH
T1C9811A38715612D8EB6686BD73D1D24032F0A5E8F8931E46918B59BC3A0A7D143FF4E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cfde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cfde.TMP
Size 3KB
SHA256 957fe1ed0d8f36e0ebeeb3a5dba859c03a7e32cee5919a7897566fbeb8bdeeae
MD5 84dfaa31d06431b49161b1a980ae4d82
SHA1 618ca8bdf3706b0cf1b570602751dbe14eb4ac81
SHA512 70b8db324e3106f74df2c26c3cbd09dd391a2c4ee0fc40130b63b32d3f3d6b707e45acfcdd6aa1139d699be3e87944dec7a4ce8ac56b8ff9ca85071ea61b504d
TLSH
T16F811A39719612D8EB6686BD73D1D24032F0E5E8F8931E06914A59BC3A0A7D143FB4E8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f57ee5cf73f00e16a088221f4264c176484b5ec736c44efcaddaf538f2a8fb1d
MD5 47827b0c88e42e9f37f68e7d6eb30971
SHA1 aad3426b3a9247da3d4c849164e91d410eef1f43
SHA512 057d7950d80190461f2fde44b2d2f79cc99fc902c4f6335a42ebf7103cb09d4f7e452010ab9be7be11b1f2bee00feacd00d028617df2f3adf3629d7f45d7adfd
TLSH
T19911BDB3C3D5856E890156F0AA24AE2BDE2D0601421C3C15C5D4EF2B93F3476E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 559b2531b30d67304d36726e7c81752dc9dca87e983ad1324672137d9e29ec08
MD5 043df6cbed5b6897a70fff9562ca0600
SHA1 5e30660b0ed929fb78f9a0fad5df7a41cf323f1a
SHA512 ebd6e14d51cb7a6452ad07db6c2d4724182e6cd133f630ea2e6992fd60a429a94981022577e6ff2487a54f4c0dec8891d8c4d8e41cb04ca66b2b759b73ff39c9
SSDEEP 192:sxZERgyM/jK1Ml8Mkn/fisvM2SIdpdOHW6+WNGYzQE1jDIgrJ:sxZE2Mn/fisvMu4HbGk79
TLSH
T17D42D8116B34A977CCDBD219FA457F53D6F9547292900E44AAFCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1b6be6271e2759583296f4af1528aacaf3ac4d83b65ec2866a708fb1fd49fab
MD5 7476a84f1d1ed93eb16424c47ff56843
SHA1 9cafc59b5d2a0a7865396b2283569ab0d34977bf
SHA512 cad5c3a5866d297cbf77ad9cc40cbc9932d9581650c6ea74b3d28508d76a52200b969245fb04e4891bff92c725c6ed432a369dcd646fc60ec895bd73b1733dbe
SSDEEP 192:sxZERgyM/jK1Ml8UQ4kn/fisz92SIdpHOHW6+WNGYz6H1jDIg5/J:sxZE2qbn/fisz9uuHbGj7T
TLSH
T1A452D8116A34A977CCDBD219FA417F53D6F9547292940E44AAFCCA1C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 696a5724414b7e766d210d9718e29edee38d9c965b59be1f9fc6874195f56734
MD5 f86ab954fdf0122730bb2654b7e23843
SHA1 2de5944618c5a9626d9acb3c466092e3bc8d5313
SHA512 7ec7bcf265c3b2438b58d7b17568d7a5a75f98fb74e0c130c6625a698ccca579af8f237f89b4d00910029a3d5f16cc54b8bde11220c76dccb32a99a971cead12
SSDEEP 768:ZkW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjqroIzivYQ:ZkW7kf0Wvqidau1jaa5LA3jB0Q
TLSH
T1A7D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 356306c93bacf2756c9198e4894711ad002ed160f2ff1a4a016d9fabb8feae80
MD5 5992cb361dda32ba51036a57ffc9977d
SHA1 97828af8d3ffb134394e99cbe6243ad9616da363
SHA512 65ddf372e3236aa2e593699c56de8226cdf562df1ce6120809c5ca79aa0b61d5a15cd2ca08de230f6ea350c54906f65038219d0bdd071b7614cfa89e45b5e507
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTrGIvKLS0ny1LIJKUgkHy9DIpKAY:KIbCKcrGgKLSu+LOKUg2+DqKAY
TLSH
T134915C5130BA96813C7F2D4892E695279F4231A3355CA4AF7FA800E60FA7E124DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596e7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596e7f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7bc2c91c917e8077ad748e24d4764e69bacf65548982c29b4edb00cdb3b97616
MD5 b78f2dde71b02afebc18d7a547ca3a14
SHA1 118076b090bed94b618905863699bb29060a3e38
SHA512 19fa09985ab145eff48c8632ce3d1bdc1fd078595dd20450e93e9fda24cfe0d1c414590db92f7a8e6b8203a69fa6899125845f3dc4a5135ddaf21d4ceccb2658
SSDEEP 384:IZcIhsNPuVb761uoDFD7e+Sv9qmhhHIEL/eB:2hDKFJe+SB6
TLSH
T110829DB2ACBA6C3A49F2E155F84733031EBC8177A6845B00E1ECBB1D04EE268130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 07c5c18ff5e84a817c718c8468c753e9eeaf55ac4bd2b17e0646dba9864b5fba
MD5 c547164b548d7c593a8447df098d47a7
SHA1 ac3889cd4ee7e037660adfb69b8f95fc5c422be1
SHA512 1cb6942abceb8e41c9e52b636bd7930516bf090e65ebe0a9c5c5a2ba55283890f27c053dd1f32d23c38bd234a3edf1a5472164f89e268e9b8d8311462fbcdfca
SSDEEP 384:eiFiZcIdsNx8TUNTUlIlTVb761uoDFD8e+Sv9qmhhHIEL/eB:1FQdowg7KF2e+SB6
TLSH
T1E3A28DB39CB59C3FADF6D655F94A32138EB880B7D5849A50F2D8AE1D00AB198130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1b64ea927534cd196cc22c15208794bbf1549353d1a64f6047b1350288289fe
MD5 e20f7e9392c84111f5c4a8baab455d04
SHA1 da6012725f1ad63b622de701ccb2a64565389970
SHA512 8450bbdc50ea8d3f71cb2dd4fe4dd8baacf62f65a8c0ffef12f6e38c76d55b035c9b1ac2d63c05ebdff9f8dd7a0488fb78a6abb445d694994d2be8302d836d6e
SSDEEP 192:MONH64BAQmiUyY1HW5GBPKulCx9FUaDeV0U6:MONH6eAzxW7DFFe6U6
TLSH
T1D4020B356C796C7B9EB2AE44F58637175FE8117BE5945F40EAE42B1C00D724C230742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 80c0735b27bd3168bfdb4c3eb58f7e083bb5563731163c10b4a9becedae14fd8
MD5 9205904f44f30377a39ccccfdd5bb169
SHA1 77dfde5a3a38e3ed77e11a264fc2bbb4699199ee
SHA512 81c9f96c8efa7f96b1c4b8155b11aaa70f9bc5bdd8b4ced851f57f3f94682c657b56e7815a28cd7069d1ef5525c35cde225f27e3ec1053caaf1dfdefe00fecbe
SSDEEP 384:eZcIhsNPTVb761uoDFD7e+Sv9qmhhHIEL/eB:ch+KFJe+SB6
TLSH
T158829DB2ACBA6C3A49F6E155F84733135EBC9177A6845B00E1ECBB1D04EE268130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 269577375fba3811285350136f66bf9242b5cc136ebf6996cd9325bc7c21a694
MD5 13583adde36ddaa7dad3193cbde0f5e1
SHA1 3d347af46d426e36f6336de15b0ef96ac585bf24
SHA512 a556e83274ae1597280d6a5ad8a9d4a9b9f42dd1e7a3b7444743f5ccc7fd17ab2e55f5172751a82d447df6051beecf9bad96b568f51ba87e162edc4b6b6cf381
SSDEEP 192:6ONa64B1QmiUyeHA5GBPKulCx9FLvGbWweFqwSU6:6ONa6eTbA7DFDqe+U6
TLSH
T1D4120976BCB96C2B5DA2A551F48632075FA9412BE6846F40B6EC3A1C01EB69C230B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13a153b7-2e2d-460e-840d-fe40f8396f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13a153b7-2e2d-460e-840d-fe40f8396f0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f355e22aa0294c01c8d2f976346e62844f41e713139ed7dd9550c4c24913e9ab
MD5 35f72b209c5cef08515e1335738b4f41
SHA1 9400afd0c5da6e0797945ca824ee8a548b0a7e55
SHA512 7bba0a8dd7cf7b8e2f4f9968df00234efe0e38718fbbd46ce5eca5611e20ab0ca692ebb102a8cbd981c64c649394c17573fcaa13d4c1e4d694106e2196596d5e
TLSH
T164410958BAED1108B3B37F1AABF6A96D487F78332F07D45D00010E8E0663A45C961737
MD5 SHA1 SHA512 TLSH

Submit Download