hxxps://www[.]ncei[.]noaa[.]gov/cdo2nes/proxy[.]cmd?productid=GHCND&orderid=4382956

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.ncei.noaa.gov/cdo2nes/proxy.cmd?productid=GHCND&orderid=4382956
Sample260828-phlevaxdpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323931994879275"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{33FDA55C-2ABC-44A9-A8AE-D7F821EED310}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3404	5084	msedge.exe	86
PID 5084 wrote to memory of 852	5084	msedge.exe	87
PID 5084 wrote to memory of 3108	5084	msedge.exe	90
PID 5084 wrote to memory of 3108	5084	msedge.exe	90
PID 5084 wrote to memory of 4336	5084	msedge.exe	88
PID 5084 wrote to memory of 4336	5084	msedge.exe	88
PID 5084 wrote to memory of 4336	5084	msedge.exe	88
PID 5084 wrote to memory of 4756	5084	msedge.exe	92
PID 5084 wrote to memory of 2120	5084	msedge.exe	91
PID 5084 wrote to memory of 4756	5084	msedge.exe	92
PID 5084 wrote to memory of 4756	5084	msedge.exe	92
PID 5084 wrote to memory of 2120	5084	msedge.exe	91
PID 5084 wrote to memory of 2120	5084	msedge.exe	91
PID 5084 wrote to memory of 3416	5084	msedge.exe	93
PID 5084 wrote to memory of 4992	5084	msedge.exe	94
PID 5084 wrote to memory of 3416	5084	msedge.exe	93
PID 5084 wrote to memory of 3416	5084	msedge.exe	93
PID 5084 wrote to memory of 4992	5084	msedge.exe	94
PID 5084 wrote to memory of 4992	5084	msedge.exe	94
PID 5084 wrote to memory of 1948	5084	msedge.exe	99
PID 5084 wrote to memory of 1948	5084	msedge.exe	99
PID 5084 wrote to memory of 3852	5084	msedge.exe	98
PID 5084 wrote to memory of 3852	5084	msedge.exe	98
PID 5084 wrote to memory of 4544	5084	msedge.exe	101
PID 5084 wrote to memory of 3724	5084	msedge.exe	114
PID 5084 wrote to memory of 772	5084	msedge.exe	115
PID 5084 wrote to memory of 4596	5084	msedge.exe	116
PID 5084 wrote to memory of 1524	5084	msedge.exe	118
PID 5084 wrote to memory of 1524	5084	msedge.exe	118
PID 5084 wrote to memory of 2340	5084	msedge.exe	119
PID 5084 wrote to memory of 2340	5084	msedge.exe	119
PID 5084 wrote to memory of 1948	5084	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ncei.noaa.gov/cdo2nes/proxy.cmd?productid=GHCND&orderid=4382956
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c026c188,0x7ff9c026c194,0x7ff9c026c1a0
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3059536726780916389,5978138139815317275,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - System Time Discovery
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,4572243855827701889,12544216725303224881,262144 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,17394472467687641792,9750516985662880743,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9310006291529977639,15720440565283673970,2097152 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10911766063177401232,16076297879889844966,2097152 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3381032514855526664,13723596198302296597,2097152 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,15471075985462979019,13922838167614132405,2097152 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2994424573280791172,6319417556853470926,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2129791198833101339,15537084874640268514,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,467830624548178708,10217885393863670588,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,467830624548178708,10217885393863670588,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,1015222641457515974,1307947740604884342,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,11291890675032995974,10234927855802580317,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,3500963040403514973,11936517714457596900,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,13147695400982170281,6125466625808000119,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,13210287493802751103,315321533696713454,524288 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,4437521164441725784,7532116508382844605,262144 --field-trial-handle=2008,i,6523505934254645024,17693760172762532171,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f230a2487daf6f70cd7722009887806aa3f5507afb9f228cc6706d84f5bd22e
MD5 664aca37737ce6f03c2afbf9412d1bc3
SHA1 354d8408019f6cd2459d8f6dca791d155bb43b28
SHA512 77069054a9831e40b9b7b694d367e6951b9235b982e11a834b779c1067cacecf7c40af7301a17b4993a53cfa21865aa3e1d4c7e14847079089e649755f3a99d3
TLSH
T1EF81C53C026643BBD76E01B193CD760D393242EAFBF32E8580A779375826761CA497C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b62a91b864982c8b566ecb00af8e0d9b83992182ce8acbafb69cc69bc47c788
MD5 6966d3e80b5921523c951aeb30bc2558
SHA1 3b0d328d8573b17e5b7d4f72f0ef92f3b46e51a8
SHA512 0ab0b4ae524a454ead88f7e8693c060a1fc101afe97eb74be71458abc73b4ff1f45bf599838fd618d8f43157448a230ce6e2d8f9c89f5e832d62913110c056b2
TLSH
T1677179F7C3DC866ED85212F1AA247E27CE1E0A05522C3C4AC4D8EF4B93E2472D251A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d1c70b575c333bafb8141b25e3307ea77014ad06fbfe66daa6659b47dcf34932
MD5 14d327627232a23588b4c711acca43f3
SHA1 77e93c5d57c4954c8eee1cd22638049494ef3203
SHA512 11851695e9368bfc8fefef6a692d52f78c5fed8da55528be19684b5ef9e37e27cd9a40cf184d8e715c47a1da37ed395b3e1a071bebf40d0f5ed5c981b48e660b
SSDEEP 192:sxZ/R+ko/fCs+28xIdpgwHW6+WNjM9/YzcVf5IgrJ:sxZ/fo/fCs+2tlHb4/R9
TLSH
T1A922B8526E34A97B8CCBE219BA15BF53E6F5503291D41E48A6FC961C04E7BDD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 204133fb07500e92bf4375196e3315f807f44b56e20f1165b0f60f3db222eb94
MD5 25ebdb094d489255db548073a6427af9
SHA1 aac0b6b3d8a47f528fc8579c3aab0d97f03282d4
SHA512 42b4f8a511ce04d325141a3b27c896a17166b55cea05ef2d631df9dedb613a7d17b2034ccf8a79cf84c8516af74def163e5e86dd85d2078776509a4ca3d92313
SSDEEP 192:sxZ/R+ko/fCsGh8xIdpgwHW6+WNjM9/Yz9Hf5Ig5CJ:sxZ/fo/fCsGhtlHb4/GU
TLSH
T11032C9526E34A97B8CCBE219FB15BF53E6F5503291951E48A6FC961C04E7BCD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1a2b204124865465255b29366e34ad884b42c8baa311e65c77059cc3772cb830
MD5 7b4cf0f6a0881115e82a81a854ab4472
SHA1 1e95625f7df59577e6f66a6488f67f81220ce413
SHA512 c9694ca2fc82037ee53b14231b00862557a959cc19a3f2925678a2b789e22e6a07bcffca42ef6c8b14bc856d12d818f3cc64003362e0d80ce07e0cc8cea1d5d5
SSDEEP 192:sxZ/R+ko/fCsG28xIdpgwHW6+WNjM9/YzcVf5Ig5QJ:sxZ/fo/fCsG2tlHb4/RW
TLSH
T11532B7526E34A97B8CCBD219FB15BF53E6F5503291941E48A6FC961C04E7BDD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 865543af1112b5ef773177ca3ab8660a28080d519b9bb929abc4997323fedcbe
MD5 7d6e062624a899c8a5c8273e02a01976
SHA1 6b1d22df887b3237a498cd1e2bcd77f124c21e78
SHA512 33f01bb94103dc13777c3a955c90aaa5cb5889abdcebf6bd47af617f32daf6fc90992a14cff98cd7736aaacb5544430bd3b923e0dd253ba80a6dffd63cb49806
SSDEEP 768:rPk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBAroycY3:rPk7u70WvqiEau1jai5LA3BL63
TLSH
T17FC2EA3B740CCB7E4F801E9DEC566F977E9802C7A6988D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae67a6dfdc9de569c7321b3d947e6519e7fd1dcf553ce044b5d27abd79161c90
MD5 4157297672670b603d6f02f51775b548
SHA1 50226e75c7daa2d42a7bd8eb73b407345db0f2b8
SHA512 c27772b941fe758aded4a6a51259c3ac3969bb314e810ee6f0652e8f282fcbdf894b43d3d8b3752f6f1b67977ad9e25f25f9ef1bf49c22be9c3e967dc724e769
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT//I9KA8QCy9dIBKeEMSuIvK3B:KIbCKc//iKA83GdaKeENuIK3B
TLSH
T1CB91721631BB46523C7F2D1892A6852A9E4235A33418E57F7BB814A60F6BE110EFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb709dce-1d9e-4214-a1cf-d82cacc84975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb709dce-1d9e-4214-a1cf-d82cacc84975.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594c03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594c03.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 15c15d548fb61514b3d864ca50235b4c9c28aa7061ca2a2ed2d4b485dc22697c
MD5 9df016a23ebfb096b4abdbd506278eff
SHA1 953d26137fae9786fb23c5b72cbdcc913b7f8f06
SHA512 4272bb0cf1ba30fdd64109b9e1373ea1dcbabe3ce7b8b77864ee17b296023de181f79b0bdc11a18091e671eb17524bbcd37cfbae65c782fbdaf2b9f299de235d
SSDEEP 384:giFOsN98TUNTUlIlKcbJF3rdPsqk20X1puLAU:7FOewgtv7a2syLAU
TLSH
T17EA2E7F258E7993AD9AD5743E37E2E034EBCC167B5846A40B7D8560CCC9A1BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 6bfe510c0a2419980c96ce1eff6b0e42e3a8e21933ec7857cdc336c8b469e371
MD5 7aa52301283e5ca496ecc66b15064262
SHA1 1158b66ab7acc966c07c5ed4e3d5dd570d88b69e
SHA512 b69f588d0aba77b673fd475558dd5532e9e27b494102b41bf0f8cea32d83f8ab4713132f81d713242895de98346bad2c20751d7a1c8265294a6dfd632d2932c8
SSDEEP 192:u8LsNmvQVzDBbVZQmiU18uI4aGBPK1B+FdGw5LGPNqqdNRrqj0X/dpuI9MHQ8A0d:DsNmvcbJx3rdPsqQ20X1puLAU
TLSH
T19A624C756C74AD2B5AA2A145F14B32075FB8417BA7C46F44F6ECBB1C01DE29C131B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a560103a44148db54fa79ac174641debb6d42a9785849789b4a8c61be8b459e9
MD5 b6449dd331bc573d285320bdc852b6ae
SHA1 79afc7eea428892bfdf3c78ff7e743230800803d
SHA512 1ca4bbc3378aaf2a7dcc5e2d5228650c44250b225ff1a87152386ed7b7f8242d5e374f9cf09c8b35977ebe4c67963718903d73e5586ca9f44bd2ec0cd13dd772
SSDEEP 384:giFOsNm8TUNTUlIlKcbJF3rdPsqR20X1puLAU:7FOTwgtv7H2syLAU
TLSH
T171A2E7F258E7993AD9AD5743E37E2E034EBCC167B5846A40B7D8560CCC9A1BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 e961685de0b6bc3a3fce86bfcb1b83cf80cf437b9dbb14cda86d9a00065a0415
MD5 a519d6596e88d6a7879e3ab11dbf9da5
SHA1 b573fc2a8111b5fd56ce5efc59c3f82ed29df45b
SHA512 4b708a2d66a3580425b2155e93593c4f356c4f40dfbded436d8e43f23f67ccf24b0f0ae3303efc2fb06b7aa011052e3392f82f2bea82ae628b7cd09d1f510731
SSDEEP 192:u8LsNmTQVzDBbVZQmiU18uI4aGBPK1B+FdGw5LGPNqqdNRrqj0X/dpuI9MHQ8A0d:DsNmTcbJx3rdPsqQ20X1puLAU
TLSH
T1E2625C756C74AD6B5AA2A145F14B32074FB8417BA7C46F44F6ECAB1C01EE29C131B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 9b6dfed7ec0e97b1521df62d0378bb87908a28175b6776213d1f17c7b544150e
MD5 62d6ff1a501904642c7e7c01ebf34ab5
SHA1 d46c2d2c9f50232ab595978e5459b934a4f37a09
SHA512 c0ae26b3d13cae13ad90ca2a5d51b6ec6ae253e90221305444840cca30714ca0ee178b6b0757dfdd44fa646261eb77206f83c65781daf83404aed5b1d7ee248f
SSDEEP 192:uALsNmKQVzDBbVZQmiU18uI4aGBPK1B+FdGw5LGPNqqdNRrqj0X/dpuI9MHQ8A0d:DsNmKcbJx3rdPsqQ20X1puLAU
TLSH
T1E3625C756C74AD2B5AE2A145F14B32075FB8417BA7C86F44F6ECAB1C01DE29C131B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41826a62a0b26a5198b7c43d0667dd1a9b1a1d8df08dd0541b9d79b833545e0a
MD5 7dc531c5d1f7e1754e45b657df08db6d
SHA1 cd2e05853defcbe329aca0d4b229edcde3c605e5
SHA512 07610537d800f435b0832bf05e54a36c029046b66fd2603e330209d131bf18300723cc0b57faa8b254c2f71e597a4858b5029deb8cadf1f7f305ef7825196bc6
SSDEEP 192:DONP64BOQmiUy/NF5GBPK1B+FdGw5LGPNqKWwRrqjU6:DONP6eKAFUdPsqI2U6
TLSH
T1DB120A359C74BC2B5EA27551F08736075EA4423BEA846F44E6EC6B1C01EF7AC2316817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae6ac7c318f3bca8968c43790db154150ff4c79e780b9ac4a37ad1eaccdea0d9
MD5 6907d3c9d45672659aa223ee2d7feac7
SHA1 a9d7461701368f4a2f48096364a68033beddec03
SHA512 c163a6590d1e242d2aa2a8183d3fd01badb55dc1c6d8d705d3e74c33e6cda7ef82a8e234eead05feecb20babf13aa101d90b9a84b00ed7f8676acd2cc58fe32b
SSDEEP 192:MONg64BAQmiUyy1NW5GBPK1B+FdGw5caDLmCU6:MONg6eAZHWUdPTJU6
TLSH
T1DC021B34AC787C6B9EB2AE45F48737175FD4103BEA942B44EAE85B0C00D765C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52e8eab8370229fd7c07ec439b9c2fd4f129914ac7b65b9ce9fe707d8f3b8d61
MD5 2499cbb72ee991aa03d18f77ee33b112
SHA1 7a355b2858839fa585b7f8c6ed75b58a7769fcbb
SHA512 7a8d7836aae678cb21afacd4376ba66f5e64a5258563c5548c9987d48976ab85a63e525b84c92c462a3d03a4302465923fb03e6bcf22b2e2130c8ed00e648657
TLSH
T1E5412D58A6EA1158B7B77E5A9BF7686D487F7C732E07D09E10010E4F0662A40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download