d423854fdae5bdde8d398c911444d0582ea7e9b586c34a681b0b83c7b890938b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d423854fdae5bdde8d398c911444d0582ea7e9b586c34a681b0b83c7b890938b.html
Size 82KB
Sample260828-gqq2astsbs
SHA256 d423854fdae5bdde8d398c911444d0582ea7e9b586c34a681b0b83c7b890938b
MD5 6a528934d75dc16014c57fa39a5dd6ca
SHA1 6672fe64713963d75124cc232aae95809e63a285
SHA512 53ed8520bd75264a8f681776fc7780fa01838ddd22b919a40c3374cc032deccd6a565e02024e51f700beaa20c183ff096a45403b6a8d5acc9d8c016d897a53ba
SSDEEP 1536:uAofUMEdhQjRlt2ntpHXZ/9yjktsoEJOQaEKRx4:7MAs8ioER
TLSH
T12683F8B9F1A170325A13F970402F810FB93B646BE44C09ACF254DCE16EF698A8567F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323704546209944"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{878289FC-C789-41CD-9D64-AC0180BC469D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4852	4124	msedge.exe	84
PID 4124 wrote to memory of 2132	4124	msedge.exe	85
PID 4124 wrote to memory of 2064	4124	msedge.exe	86
PID 4124 wrote to memory of 2064	4124	msedge.exe	86
PID 4124 wrote to memory of 2064	4124	msedge.exe	86
PID 4124 wrote to memory of 4452	4124	msedge.exe	87
PID 4124 wrote to memory of 4452	4124	msedge.exe	87
PID 4124 wrote to memory of 1804	4124	msedge.exe	89
PID 4124 wrote to memory of 1804	4124	msedge.exe	89
PID 4124 wrote to memory of 1804	4124	msedge.exe	89
PID 4124 wrote to memory of 4840	4124	msedge.exe	90
PID 4124 wrote to memory of 4840	4124	msedge.exe	90
PID 4124 wrote to memory of 4840	4124	msedge.exe	90
PID 4124 wrote to memory of 3012	4124	msedge.exe	91
PID 4124 wrote to memory of 3012	4124	msedge.exe	91
PID 4124 wrote to memory of 3012	4124	msedge.exe	91
PID 4124 wrote to memory of 3020	4124	msedge.exe	92
PID 4124 wrote to memory of 3020	4124	msedge.exe	92
PID 4124 wrote to memory of 3020	4124	msedge.exe	92
PID 4124 wrote to memory of 4772	4124	msedge.exe	96
PID 4124 wrote to memory of 1644	4124	msedge.exe	97
PID 4124 wrote to memory of 4772	4124	msedge.exe	96
PID 4124 wrote to memory of 1644	4124	msedge.exe	97
PID 4124 wrote to memory of 2392	4124	msedge.exe	99
PID 4124 wrote to memory of 3488	4124	msedge.exe	107
PID 4124 wrote to memory of 4180	4124	msedge.exe	108
PID 4124 wrote to memory of 3512	4124	msedge.exe	109
PID 4124 wrote to memory of 5016	4124	msedge.exe	113
PID 4124 wrote to memory of 5016	4124	msedge.exe	113
PID 4124 wrote to memory of 3192	4124	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\d423854fdae5bdde8d398c911444d0582ea7e9b586c34a681b0b83c7b890938b.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8057c188,0x7ffb8057c194,0x7ffb8057c1a0
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,14744225027581696490,5209130426616011707,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2290135395788649687,5557960542503202635,262144 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,11617564758548185660,6602661593212017225,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6225932165292839138,4798188204027366090,2097152 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12019400634442134613,9524372656144114798,2097152 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5304395485332849827,5450437883005622240,2097152 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2948300535849113362,8219396897747194647,2097152 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13621522194815218911,11338850911629564338,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,4717958255802942150,18156840509858206408,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,8318150591691449273,14290289264306761655,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,8318150591691449273,14290289264306761655,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,2678917193299929983,2852435839535163904,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8140344729838374277,4025376002590517229,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,12017902277499059892,7526840927175432183,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3998909644244795541,10366474748844118581,524288 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,3753796241389004148,11659146122235099655,262144 --field-trial-handle=2252,i,766090893939881421,7800813205929505416,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37a35851cc72f27015ba72354fba4fc2541d2b3879b8b8935f72f6c1673062f1
MD5 8e045aad0fe07c1913be9233abf65822
SHA1 67616591d6f2b175fcdd414a769b633ff5c3a1f3
SHA512 77e1e354768cbffaf2c5ef3bf2f3a3ad4a257ebf0b015b48476b9efdc5910f890ee462ee725c493237af3dde37aa73c70835af54fc462b732d012cf8cdcdcd41
TLSH
T194616EC545E23558F3703371E3D2220434B0C6DA4C038C7255846BBED6E9BB6BE5EE48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a2f00cc9ee6f28f6f426a351be6d9cc03af95653f4fd0af5bb7266c758106c6
MD5 90092b425805294f25b223ea7c929867
SHA1 df3402234e0b27e7dcded980395830a9cbe422d0
SHA512 2f3e2eebcb51b211ac44561789b14cf024ac6e7dc7848731932cd791926485e242686d89b5cd5bc09f0056432c7573d5133d426805a16e0d342e5e0ae4a1f28d
TLSH
T17231AFF7C3D4866EC91556F09B24BE1BDD2D0616422C3C16C9E4EF5BA3E24B1D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 51c0aac4b14008901519388359748a3a4177cecf78100db4f204514ace4ecb2f
MD5 da74f3150cdc4ff4d31c29bc6800931f
SHA1 923685834650a8e5cfd63d0d0be1167a3ef1d05a
SHA512 e01f75269f301d923847da608e69a089543c29346d9ea3abe93feffd31d12eaaec347d1c8a13b21710d090d95a734b30b10f08691c31dd3994e9c712254b21da
SSDEEP 192:sxZrR0yM/jK1Ml8UQzk3/fTsdyuNIdpHjHW6+WNGYLctYNIg59J:sxZrCqY3/fTsdyuuDHbGed
TLSH
T1095209156A346977CCDBD21DFA41BF53D6F51472A2900E48AAFCCA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ada74ba0ba050e83d9777a7e404887ff0951643ef4d0d88cc06dcaabd6ac9443
MD5 927ed32aabfee85d42d40ecad0f33d93
SHA1 4c0eb8a5f745e47a6bb00347ef47ca2f0730d5fc
SHA512 478eb27478aad3049672d24a89dba1de78e1f55d8e468dd3800a1e7d4def78fc8d0afed4bbfda019971516ec02283e399e045372de06ce330c74598c9a2a3e3c
SSDEEP 192:sxZrR0yM/jK1Ml8Mk3/fTseyhNIdpdjHW6+WNGYLzG9NIgrJ:sxZrCM3/fTseyhuxHbGX9
TLSH
T1EC4208116A346977CCDBD20CFA55BF53D6F51432A2900E48AAFCC91C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6478165e55d849017dae4dea4f525242e8d724213c465682127b0e94684fc5b4
MD5 9a452f5d743d3bd383ced84fb0d65069
SHA1 5d92846521adafbb7a0f0aacb2f8f7329b7e42eb
SHA512 a31ce237fe6e9f656f32db5124209aec27044c37c3ecc38f40ac0c77b73fb4e194f70c6b9afd60f1c996896cc868decda22ee927a6df3a8f77b5253b7c58eab0
SSDEEP 768:QKs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNTroWQf:QKs6pD1WvxzWju1jahILIsNglf
TLSH
T18DD2FA3B680CCB7E4F841E5CEC2AAE966DD801CBAB948D9447EA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 30cdec0cdfc1979f70500b6985177b24e4ae3cd3a654412a913916656ba0b3ce
MD5 bc9cf4efff052cb0047d18055ccec02f
SHA1 4d22aa1d6eddf398db171961d009e4ce54936e3d
SHA512 8ad98b570e78ba845cf7ebae11d6a20ab13eab9d7fb7a3e3c70bba5bd5a4808a405ac7b22378a4697151224040d6da58b468f6371640b9aa7ffae255f5c56e3f
SSDEEP 96:KUAAKtePCcAKp26OhOKiApKIKbq66aMKrKD:ii7r9tX3A
TLSH
T141E1251232B747123C7E390DA35497A74B42B6633014EC2B7BA920B15EA6E740DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f671.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 773b2d6e5cc54ce8449ca18c6b8bbc5da7c13c7ab21df00c38f7b69526852a53
MD5 de83d3000087609778200afb20fc4de5
SHA1 9512dccb32f74d1b469c8c9a0b28124adcb9b26c
SHA512 adbcf7be99c3230cce7a30e011187d00317151a4ae5107bfc38f783b81c57b57d5ab8e507d7f7e0aa00f84789947c316a0958abdfb6cd00204218b0d19f383aa
SSDEEP 384:FZcIhsNPZltBAkYa9DO5MzYzJr3Fl0X1puLbQDo3:9haBhOs8h1lsyLbQDA
TLSH
T18A826D3179785CB769F2E185FA4B36178FB88033A6C96B80D1DDAF1D01EE59C130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5439c9dbe8cb14f1e82b1d4f58bf58dcb0ffbaad2cf1bcbd260fc1dbadf8cb9e
MD5 e030ccf7b632f53509d4a515ce1684ca
SHA1 49274bec6e537f17d184cc0383b80f932cb8c71f
SHA512 3f7f29e4c4cfe135c0e60fb102cca1a0ac45aa9a2b589b5823a95d19dc2799f813357baaaaa70c6f6c4ef3796753c9cf748bcb27ebbc680fe2ec25cb476a5b64
SSDEEP 384:9kiFiZcIDsNx8TUNTUlIl0ltBAkYa9DO5MzYzJr3wl0X1puLbQDo3:9FQDowgiBhOs8hglsyLbQDA
TLSH
T1F6A27D3269688D7B6DF6E685FA4B3617CFB44073D5D9AA80E2DC9E1C00AF19C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 288e422d9cdf497f8639b52eff98596f1f38077a61080851572153507d3ad160
MD5 c990d9a937ff5b13dfc8c5e3cf293a20
SHA1 1a1172d7829f2233c9164c8a7d9f0877cd1376d6
SHA512 06d6a80dbf1dd4adc7ad3773a4b3f9aec2a145c3d5adbbc761c2644463b4b8b036d34e32d4d1c29ad8d9c48375e5d7d474e2b62fe9bc3f21391efca0f60ca326
SSDEEP 192:qONx6O7+3hQmiUyjlGttb0CO2b6h2SUgGmZU6:qONx616Gt9DO5MSaWU6
TLSH
T18A02E83579686CB74EF2AE45FA872B235FA5103BE9952F41D6E81F0C00DB65C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2e4034f0fa641c5eb873854eeb14dcbd153db9ec6c59027bb48087b14001df8
MD5 63ff8546129d1bf848d8951761d0742a
SHA1 a89c8f473a5797ee88e16536db47bd19739a8d79
SHA512 86a08f67962e929e9c1bf84df5cf96ccf4da63ad872eef2f3a8fff1e6e9b3eb315bc6cca0b4b4a3f331ff294637f6fdeca7349c7ebb70b4ba801bb4b1356c034
SSDEEP 192:8RONa6O7+31eQmiUywlottb0CO2b6h2zcF0SJr3HcNvqZsU6:4ONa6enot9DO5MzYzJr30lU6
TLSH
T10C120931B868AC775DF2A585F98736139FA50127DE8A2F81D1DC2E1C01EFA6C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fdaee97e01e4643352f4c33c13a95d6fb5e10d563b10f2319276f10f1e5043bf
MD5 020d441dff204e0bcaffaecb92b2e58f
SHA1 84e9a1187ee3096f39a3b645f06b47b515e87de9
SHA512 53bbb1728a9a7c09f510e9ef8e812bdbdaa0d0ebaa8e5a9ff8528db71b104a29492530b990f240263ec920b18341cbd06afbf646b6b57fe4f636327b5c8b0633
SSDEEP 384:7ZcIhsNP0ltBAkYa9DO5MzYzJr3Fl0X1puLbQDo3:jhZBhOs8h1lsyLbQDA
TLSH
T157826C7179785CB758F6E185FA4B36178FB88033A6C96B80D1DDAF1D00EE59C130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 39a050ec0498aea111a1fcc0dd0972bea0d53d59834585b4c4044112f3687bdc
MD5 a30a6e12076ede68d4c26be78339ad26
SHA1 9f9b518c3348337c9a1443dd7d8d3bb8c53648ea
SHA512 fabca7348c56491b199b2ac6ef79800280be12ec81d73c074c7b11cc0801236da99ce288b4b897436bb166355ea91f38708242f228e6b0db2a5efa8548204174
TLSH
T18E41175CB6E91158B3B77E5A9BF7A97E487B78632E06C45E00010E8F0A32A40D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download