a50595e95b26afdd92d43fccb53d497df88983e85ee7679b81f2bfc4c57caf65

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 79KB
Sample260828-akemrabd46
SHA256 a50595e95b26afdd92d43fccb53d497df88983e85ee7679b81f2bfc4c57caf65
MD5 3ad054203e435e17b38cc7367a4198e7
SHA1 6d9b8e63f2c9dd8ce8e6d91f24a433b193e36159
SHA512 a30ef7c0ed393e6d3271f82eb62d202143849e46b509d64792193dc98fb3a0055b1748a7877c4dd204770d4e022a5b062cb17f0e47f59412cfa9f38469146d4f
SSDEEP 1536:qYPypwYMIuEcd5Q2OZwD0MNlbCFVgeqNYNXKNH8XEUn10GJZMpd4wvSAIXuTVXmO:qYaZXZMpd4wvSAIeTVXzAvNmhRf
TLSH
T1CB83C521937884F4395FCF6A808AB31AF448A951898513F7F1F592185CCDABB25F7B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323497664423415"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{CEEB8678-E5C2-4977-94D3-E355A562BF68}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4488	3240	msedge.exe	85
PID 3240 wrote to memory of 432	3240	msedge.exe	86
PID 3240 wrote to memory of 2336	3240	msedge.exe	87
PID 3240 wrote to memory of 2336	3240	msedge.exe	87
PID 3240 wrote to memory of 2336	3240	msedge.exe	87
PID 3240 wrote to memory of 4360	3240	msedge.exe	88
PID 3240 wrote to memory of 4360	3240	msedge.exe	88
PID 3240 wrote to memory of 552	3240	msedge.exe	89
PID 3240 wrote to memory of 552	3240	msedge.exe	89
PID 3240 wrote to memory of 552	3240	msedge.exe	89
PID 3240 wrote to memory of 3820	3240	msedge.exe	90
PID 3240 wrote to memory of 3820	3240	msedge.exe	90
PID 3240 wrote to memory of 3820	3240	msedge.exe	90
PID 3240 wrote to memory of 4296	3240	msedge.exe	91
PID 3240 wrote to memory of 2716	3240	msedge.exe	92
PID 3240 wrote to memory of 4296	3240	msedge.exe	91
PID 3240 wrote to memory of 4296	3240	msedge.exe	91
PID 3240 wrote to memory of 2716	3240	msedge.exe	92
PID 3240 wrote to memory of 2716	3240	msedge.exe	92
PID 3240 wrote to memory of 912	3240	msedge.exe	97
PID 3240 wrote to memory of 4336	3240	msedge.exe	98
PID 3240 wrote to memory of 912	3240	msedge.exe	97
PID 3240 wrote to memory of 4336	3240	msedge.exe	98
PID 3240 wrote to memory of 3212	3240	msedge.exe	100
PID 3240 wrote to memory of 1716	3240	msedge.exe	103
PID 3240 wrote to memory of 3712	3240	msedge.exe	104
PID 3240 wrote to memory of 1792	3240	msedge.exe	105
PID 3240 wrote to memory of 4456	3240	msedge.exe	106
PID 3240 wrote to memory of 4456	3240	msedge.exe	106
PID 3240 wrote to memory of 2064	3240	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,14815759339507042409,7748070385189867651,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,16254419337530759330,16453375361888547269,262144 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,5605852766109161840,9789779218506231120,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,5577270370766595866,17648308080351698625,2097152 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,17508506031126248807,1552625704364958425,2097152 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1013433930390559953,10867168643629126382,2097152 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8094658550560965392,9029337014578856810,2097152 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,5982365520207205071,10909755448748786558,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,3087428249406111581,5824510400566427046,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16921649049531451912,4608186230384963205,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16921649049531451912,4608186230384963205,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,7600381735189927951,5606049177672087707,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,9515404381533790669,10519325472506431419,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,4558969102087353880,14454433876091576048,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14379891505863992340,6049709310154683510,524288 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,7153103122424090443,9020766745791497333,262144 --field-trial-handle=2360,i,17935666713169054965,13951001139015167841,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f33c1863f26d1ef95055bbc63876b5fbdf6a39a9a3155904084b961f1d5fe1f5
MD5 24ef53bd28df12174790d9cbde0c0f54
SHA1 843d806d66af6f7b7c6ebcb440fd3e963901d841
SHA512 be30ca257eaf6173f2becde078e845e01941f6b4813505633fabbb595ab87349e957feb6fc76cc093378c90cdaf72f1ec2a6d5584b76327cfa6f94ca9836a4c2
TLSH
T1E361B5183E924B51F3320973E4E91275357C51B48E33DE55C290B47D9617B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58729b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58729b.TMP
Size 3KB
SHA256 204250aada1f15f72b23b3de0c26495d302beab834916266fa97167208c6171f
MD5 67de99a490a7064108d649c21b853e46
SHA1 aae5faa3058f00d0af45fed566cc42c4d8216e9d
SHA512 bc00fc6efedf4ee8ebf10e8391b5a325c3b8c56d24fdf7946e1e4660591b9a1c98c27590ab2832d9595bd9ab5ad50dea148ef12c8e5b3f02945f45811b61ee85
TLSH
T1B06182193E924B51F3320933E4E91275357C41B88D33DE55C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b8a0adfb426c8a810fbd9be40ad24bf9b41ef4b865c67096f845bc62d8d23e24
MD5 bac266deba2c06ede06eb35088c7a107
SHA1 f6429eed8ea42ce4e0a8a7703e2a508d8ef9ac46
SHA512 50eaf1ddb5cfd4584a5fc05cebf8f1d83ab21d89a871226e224712d537fc142b6a0c55fe6610c8b121496d77bf57ead96211a7820da75dec09e8ee42c9a8fa50
TLSH
T15211CCB3C3E4866ECA1116F09A24AE2BCE1C0616422C3C1589E4FF2793F3075E50255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 38513b14ba814aa9dbc3ab1f3fe3426b7e19840c2f23cd20f99a423d36d26675
MD5 15d9ce07760b58db695fb4b03c924519
SHA1 5fd6b6a99a4853339c5d874b0f5229b6dc8e58ab
SHA512 4d6d86bc51a0f58f26a0ea18d71311e41a61dac1a668df1d6f837542a593c90dbcc66fc8654caca4f2b0b2a550b4bb7e759f44d84cbc63f620546b5ff7a85156
SSDEEP 192:sxZrgR8yM/jK1Ml8Mk2g/fssqMwZ9IdpdeHW6+WNGYLzFKEIgrJ:sxZ0mMp/fssqHoEHbGs9
TLSH
T14242FA116A386977CCDBD209FA55BF53D5F51433A2940D88A9FCCA1C04E6AED221BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c4e7747d8ec022a91c6340b98cfbb2cc3a05bb346cd5983797a73d1b42da54ba
MD5 cfcbdb6894eda260e7be244719cbb275
SHA1 b35d904cacfc18c0925d728faf194c5ba3876713
SHA512 808603aad2d75dce1a39c2db344da609cd05f8c54c0c2314bbd4fd2f0e63c9d79a382c32f085e7a5ff04023d239ecba61785b212f9da5a0933fc8aec36c90df8
SSDEEP 192:sxZrgR8yM/jK1Ml8UQhk2g/fsstDdwZ9IdpHeHW6+WNGYLdMfEIg5WJ:sxZ0mqyp/fsstDuo+HbGiE
TLSH
T19752F9116A385977CCDBD21DF945BF53D6F51433A2500E88A9FCCA1C05E6AED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 78ab390be73b9b9b4209bfe1f735d9d963a6777ac7f673794d666bea4cf114c4
MD5 92693aab70fde7d9da3655c04171d3fa
SHA1 b2e36b8c164118fcc6c91469e92844b196d69694
SHA512 03b24ba0a6754beda7cb33cedb03f521ba4f4ad395dbb130a1acd31a1c91b1f9feee70ac1ef96e69d6cc21b7def1c528918e39370849c0496407cc6159e611e6
SSDEEP 768:V9s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNmroKy:V9s6pD1WvxzWju1jahILIsNdKy
TLSH
T14AD2FA3B680CCB7E4F841E5CEC2A6E966DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1df63adac9a70043ec407c64f1bc191ed7769afb22ea0041e7e4f64c7ecc04b1
MD5 877ea639d29e999689732e0582563377
SHA1 5a1d5bda3c7530002a08a7cf545d6abc19d70c38
SHA512 f71b9a40282b3d82dae41ea2cb2c4e3c0205c54f9bb6b9e6bd3b7739bed69380a9e699694a332a8ef8726ebc60e65fd93ff314e534263263c2f2c5f15f75da8c
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1Bs:KUAAKteP+y52KakSa2oKDif
TLSH
T1EDA1031632BB12433C3E2958A294C7279746B1B33168B82B7BA811724DE7E344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d4ff8bc9a2988b3f86d4bd0bf728249d228e5156a072526d2045a09c2ccfb40c
MD5 836fe1af4edad112a1fe2a653b511918
SHA1 e856892a54209b5dd4b2a7ed1946b22f59e55167
SHA512 5c60b0a0866fddc0f485998a458b4d89617a84606d0d8de54ed12b8affc5c5b5b4daac01ac24d33754b37f96381ddf5bca608211b1cd8d44bd5fa67aa2deb59c
SSDEEP 384:vZcIzsNJns2pE9Jqua91ONMGgzJruc+HBbs1BkJoV:nzvSayPO5EhucgykJC
TLSH
T1B4927D76586C9C7758F6E142FA8736138FB88067E6896F8095DD6F1C00DB6A8234FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 43f65088ed01e2f06976c6852025a755f8754032f6a267508ca231abb88e5ae4
MD5 a846dea206b204fb75d6d526cdd82467
SHA1 22bfefcbd74ed7098a9bba1709265e27c8823a04
SHA512 4daa2fb3af99855826d8d4da77a998c7be0353f9c30d8040e70f3792f09c7e19197e7683195fa5e3bbe5090423a8b023ca70a0f49eb9a9cfa662278f838c6c89
SSDEEP 192:gLsNJtQhJUrpQ47+3vUAQmiU1VtqB4atb0oO2bKh2GkF0SJrwLMUqyRU8:2sNJts2pE9Jqua91ONMGgzJr1cU8
TLSH
T18032083568289C765DE3A141F9873623DFB54077EA862FC4D6EC2E1C00DF6AC234E91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd496c19ae699088dc167840b487c5eeedb1d01c96c935e8ac21990896561e80
MD5 668044cbd6a813036735f184a7f1133c
SHA1 158781c2c962f41f125fb02fbfc072bf5bb8d4ef
SHA512 229db98a56a7b2e57e90b86b60e2b47e8784e1dd5a254d6b1618173ad80882780cc13f911f6eb09150a8c8bce293e501871233a0879e5922a2eac7e265ca40ed
SSDEEP 192:qON86O7+3hQmiUyk6Gttb0oO2bKh2hgGM+RU6:qON861+Gt91ONMBPRU6
TLSH
T1C90209356C2C6CB78EF2AD05FA8737235FA5103BE9A52F80D6E81E1C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30a081b32922a9c5bf0398817a0bc57725a732b742d2461eca7b09ac46ea2290
MD5 fe1957586ecd0803f91afb30ad9b217a
SHA1 b848182134e959ca7e53a10aa5d06525555cb2c5
SHA512 bc3888270f4792cf251c4b539425b08db0db545c1053a741d869b304e969c985eef6e65ee55e4f7e9fb39aee62cf8bb87c5b51a6d574e24fb40e32f3bacf5d19
SSDEEP 192:YONE6O7+3UQmiUyG69ttb0oO2bKh2GkF0SJrGcNUqyRU6:YONE6yC9t91ONMGgzJrncU6
TLSH
T12F12093568689C775DF2A581F98735139EA54127EE8A2F80D5DC2E1C01EF66C238EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 24814bd0cdca0c9e64fea1c64a3e8127631e6b39638fb85faae861a03e438997
MD5 76f82c949347095719add9f66df4e726
SHA1 f423b94d7db503ca42dd7066881e6228b31e760e
SHA512 5d383a1c8c78ff52c9fa2fa0af479b76f3d2cf4a5d6173ec7b9ddf5273ef0d95a9b070ccbb14b898380f1aa8d4482b2e24c85704e2033c6c5baa4fb470e0c58e
SSDEEP 192:uyLsNJIQhJUrpQ47+3vUAQmiU1VtqB4atb0oO2bKh2GkF0SJrwLMUqyRUt:3sNJIs2pE9Jqua91ONMGgzJr1cUt
TLSH
T1D432083568289C765DE3A141F9473623DFB4407BEA8A2FC4D6EC1E1C01DF6AC234E916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a571a6d6715058c39de8baf305515d744a5d65e4f8a27b394bfe5ca05a427cb7
MD5 9ea14be9529f021702a266652711230b
SHA1 4c2d87b5a67a4658873788a615941e44af5dab45
SHA512 0c2ee4c9a36dccad2345681b87de7388eec36c4715eeee4b1685e22568192fadeedab635ac57e0b0af1b959369ed9d93e1cb44034ed5d459092f280636b911b9
SSDEEP 384:4ZcIhsNJns2pE9Jqua91ONMGgzJr1c+HBbs1BkJoV:GhvSayPO5Eh1cgykJC
TLSH
T18D827D76586C9C7758F6E142FA8735138FB88067E6C92F8095EC6F1C00DB5A8234FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0dc6766c9759e1bb352816eeb9acb483bdf4336d4e63debd8e87165197abc77
MD5 7e5e05dc6534e9eb1063a669d2a146b7
SHA1 2bd1c3876f530e284dcbe1697717f5910164e28d
SHA512 8e69e1218102f0371a0ccc47c9eb6f844c6916730d4167bb5b7a184cbffbdae9128aa444835914c9c5a3776f0ee87156fdf207dd74007114b76f9f2bdc70d432
TLSH
T12C413B58B6EA1158B3B36F5A9BF7686D88BEBC731F0AD55D00110E4F0A23B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download