hxxps://support[.]servicenow[.]com/nav_to[.]do?uri=change_request[.]do%3Fsys_id=46d04d6c97cf431810c633f11153afb0

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.servicenow.com/nav_to.do?uri=change_request.do%3Fsys_id=46d04d6c97cf431810c633f11153afb0
Sample260828-pyb64sch86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323946381656350"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{8D4514C1-9313-452B-97F5-E09B4297B7F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1912	3892	msedge.exe	85
PID 3892 wrote to memory of 2388	3892	msedge.exe	86
PID 3892 wrote to memory of 2324	3892	msedge.exe	87
PID 3892 wrote to memory of 2324	3892	msedge.exe	87
PID 3892 wrote to memory of 2324	3892	msedge.exe	87
PID 3892 wrote to memory of 4588	3892	msedge.exe	88
PID 3892 wrote to memory of 4588	3892	msedge.exe	88
PID 3892 wrote to memory of 2008	3892	msedge.exe	90
PID 3892 wrote to memory of 2008	3892	msedge.exe	90
PID 3892 wrote to memory of 1540	3892	msedge.exe	91
PID 3892 wrote to memory of 2008	3892	msedge.exe	90
PID 3892 wrote to memory of 1540	3892	msedge.exe	91
PID 3892 wrote to memory of 1540	3892	msedge.exe	91
PID 3892 wrote to memory of 1996	3892	msedge.exe	92
PID 3892 wrote to memory of 1996	3892	msedge.exe	92
PID 3892 wrote to memory of 1996	3892	msedge.exe	92
PID 3892 wrote to memory of 1824	3892	msedge.exe	93
PID 3892 wrote to memory of 1824	3892	msedge.exe	93
PID 3892 wrote to memory of 1824	3892	msedge.exe	93
PID 3892 wrote to memory of 5020	3892	msedge.exe	97
PID 3892 wrote to memory of 5020	3892	msedge.exe	97
PID 3892 wrote to memory of 4272	3892	msedge.exe	98
PID 3892 wrote to memory of 4272	3892	msedge.exe	98
PID 3892 wrote to memory of 2036	3892	msedge.exe	100
PID 3892 wrote to memory of 1692	3892	msedge.exe	101
PID 3892 wrote to memory of 1692	3892	msedge.exe	101
PID 3892 wrote to memory of 1692	3892	msedge.exe	101
PID 3892 wrote to memory of 656	3892	msedge.exe	108
PID 3892 wrote to memory of 4476	3892	msedge.exe	109
PID 3892 wrote to memory of 5008	3892	msedge.exe	110
PID 3892 wrote to memory of 3532	3892	msedge.exe	114
PID 3892 wrote to memory of 3532	3892	msedge.exe	114
PID 3892 wrote to memory of 3468	3892	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.servicenow.com/nav_to.do?uri=change_request.do%3Fsys_id=46d04d6c97cf431810c633f11153afb0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa0554c188,0x7ffa0554c194,0x7ffa0554c1a0
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13141285571013757077,2624016969075524201,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9352129828391276259,1144810463603695160,262144 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3644041804851322864,11254133977506904113,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3514152415452349503,4300509522162188991,2097152 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10546911105918290033,13693323871516543175,2097152 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,14049224980945566330,3788236335449325119,2097152 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14473614747390914329,16084913397985030574,2097152 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,14518208347450318731,13384117624576576348,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,11145865543824065046,4939820714068324085,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7810816127472276902,662549189160653342,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7810816127472276902,662549189160653342,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,13610449872953744769,6928393041140626974,2097152 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12110430066882326079,4407999533322982924,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,7616756911502022934,11584108912014197466,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,7191780357421255192,8071616476909545337,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,16233595550577668858,16438533263966038374,524288 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4476,i,4663454193114345081,8987919138047718241,262144 --field-trial-handle=2300,i,11513707265047636349,10725583820833092883,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ef37df19e58f8d3f54444efd2905fd468d659df56495a60d0ba3c59c19dfa95d
MD5 ae5be8dc7e18a5226c6b1a28efd9e9eb
SHA1 edd6ab9dda902f96b1e1c0ffe0f047c663a9dae5
SHA512 0ef064e16ee8a2c40316af5f3b6f04d0593727717c756e496748d46c72ab6464e156b9e94af9a6b13c6748b87f539426104d3631ffdcd87dd950652f3fa0c169
SSDEEP 48:u3bJDYqPdwlAsoKOKgCAtccymBGhF1QvuXUzUoEBWHkjVOoYf6/A+FexD:AlY0wesBathcBvXYoz/7Fex
TLSH
T1A0914C3622A100E3FF3140727CC11A51F93CACDDF6AFEF1A4828E8B72C5A781D199804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588a49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a49.TMP
Size 3KB
SHA256 b680963055ef8b63feb2d69393900dc5bd1b4b43a571b9d12b3a3083e9dfc79d
MD5 9028b8608915c0f482694b225123f0a0
SHA1 690c6fecd882b806f30242bfdd3846fb2ca7d1e3
SHA512 0fc7bf142e65f0aaff0694252c7accd2104f733ffded9328d38e00a62c6a14cf46e21c0e41ac4f56bafa7c352e0e14bb16a102158f787f29ac9369555a3190e8
TLSH
T1BE71C236222100E3FF31417239C16205F9BDADEEF6AFEF2A4964D4B71C69712D1A9918
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 45d54b6940014c013d10f074deef87d6728c556abcc636458748f37e0a09cf28
MD5 258a42f83a86f5005c8878622290a1da
SHA1 fde89d6a9b17613d157a10a204e1ed4b4c9a7b7b
SHA512 75306bd7e62ab4f581384a22175f2719ad526d65e8a2e17c4a8fb8d8bceb92c2999fc0620be16b823bf7bfb5f65260f75cd6bf9668b95b2f561e32ec9e75e3d0
TLSH
T1AB71ACB3C7E4DA2EC90192F097642E1BCD2D062452683C57C5E9FE8B93E2472E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 df2b439da779c2d13711c0f763173cf95cf759050c3889cc28eae40f88608660
MD5 ec4e67ecee7343957feceed6f50c78ac
SHA1 1fb0df7dce621baed89f78181edd381e9ac5e140
SHA512 bf3036f372f10f5007abb10ae4be98ada698a69278eebf55868c12457ac3ad013049f4e932aa0d9b3c576cb9921ac735d193bc313f57185d9a043f890c8b909f
SSDEEP 192:sxZLRTyM/jK1Ml8Mk7G/fWsQzF/sIdpondoHW6+WNsd2P+O/YI+g94IIgrJ:sxZL5Mq/fWsQzFd6oHbkw/cE9
TLSH
T18752E702AA34A977CCDBC219F945BB53D2F8147296941E449EFC991C04F6BEC220BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 218555f9fada263871accb72b0d4e96c8b9f18fd703fb0122dd85dd3fe08b33b
MD5 39875744a9c1ecf80870597c781354f9
SHA1 3ba3fc5f79ac265d9b91b496a3febb161346eb22
SHA512 d9ed9c5a740ad286bd2f168fd843fb49901b34d9aacce855488cc54b4669f6813cf3d2505cf4e211965f11c07adb5926e8037a695e2d913918b9749f712309af
SSDEEP 192:sxZLRTyM/jK1Ml8UQhk7G/fWsysF/sIdpWndoHW6+WNsd2P+O/YICjX4IIg5yJ:sxZL5qyq/fWsysFdAoHbkw/ZEk
TLSH
T15E62D742AA34A977CCDBD21DF941BB53D2F8147295941E44AEFC8A1C05F6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bbe0faf0e6ee9c82b9ec21286a2c6425de45ad10c884662e69a6cfc89e4d1621
MD5 1b6ef897073d63000cfc90a436c50f71
SHA1 6c0bd3c2776eb2d01e7f88ac38d53ef17fbe1d5a
SHA512 7f10b31e252cd4c862233bad25f6e8c2756417055e347e4bb35147edb9d999439007745db0cfe3f7570be565f76217b73575a57a3e83ba2d97f8df096155aa50
SSDEEP 768:cWsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9zroC8t:cWsqxXlWvJD6Tu1ja54LAs9ACk
TLSH
T1BFD20B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a365c928e3af6d9b01b7e4efa107cfba7830c4a825343eb0dc59aaf2cc4535f8
MD5 41afd16a8e09cf571115928bdfd61479
SHA1 d1c9ae4af213b99b2d509973406ab7c0914e65a6
SHA512 5a8bac2fff70a9df2b9705154d50aa65fbd28457cb6477d5858789558a3f7dc2ce5cfeb297814b9c36b3747df8861a1cfdf4b335cc2502fee8ea2abddd9b494b
SSDEEP 96:KYbaKYIKmXGKwg2uzCnTRZZezpoFhzeKZrhFe9bzg16yBmSgYI2qYX9IS2KwTIUF:ExN9uzCnTRZZEpojzzrhFYbzg18ld3
TLSH
T1ABE15A1236770202387E6908E39EC5779E5376633419E46F3B7850624EABE212DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb8a8719-1c61-442d-a69c-24b4c6c2f383.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eb8a8719-1c61-442d-a69c-24b4c6c2f383.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9d21c94d767c37698a83a73ce77bf9d3227121130f54946397a656380f1abdea
MD5 15fb0d2de46e48ea709c330518ef12ba
SHA1 e34717a27c202608e8f6697b5fba70c1f2e7b162
SHA512 09fffb4f48799947f3a5a543f09435257ef65c5f6287cb8b04c0a89540ea13ae9b531cf4b1569fecd7d7125c5a8fd5c3c58863ba16ee1007bac08f32eefcdc2b
SSDEEP 384:9ZcIhsNDu7MDb2C3VRNNOE+l9R+2Wl0X1puLwQ9o4:lholHNOEI9RlWlsyLwQ9b
TLSH
T143828D726D385C7B59F2A541F54B36074FBC9037A7C96A80E1EDAB0D01EE999030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 132b5398d403e61af3035b79a74cfaceee1109b300a41c9ba0b2d61d4c9df45c
MD5 aa3bd0b1103d56786c3aacb4fe03fd8c
SHA1 1f99bb5dbb208e2b35cc0e1fa56de8d2960c41f0
SHA512 aff3faba1b7d594a841a5a5446c089f1120bda0895f3c73e84eab0802566810a29851bb6085a2e56a2b47a3df0b31f723141745e13f9f7d89d80bec2ecf9d436
SSDEEP 384:OiFiZcIpsNd8TUNTUlIlv7MDb2B3VRNNOE+l9R+2Pl0X1puLwQ9o4:lFQpYwg/lHNOEI9RlPlsyLwQ9b
TLSH
T1ABC22AF259D7887AD9AE9B43E77E3D074EBCC023B5859540B3985A0CCD9A5BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a560741de2dee33a66032be9955211b323a6289d6f0f6016e05e297aeaaa6d5
MD5 cd8bc0d699e3b816a36d348a6563e423
SHA1 e2345e6acbd234412860c4f3b6c1634129083e56
SHA512 ed1a0b75b470680cffbede08295c07442f4d768dd7b523fafdcff81c097921d61b6d2b22a7d8a1c8887021a932f696b9354d77e3bb9d1c8e460f0b5ba1ad26d0
SSDEEP 192:tON16JkRtQmiUy4kW+RNNOmz+ih3uRIU6:tON16UrcW+RNNOE+6VU6
TLSH
T1B002D8356D386C7B9EF26E09B58B37275FA8203BB9856F80D6E81F1C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1284c2a4456d9c1a7b0efac937267bc3d960bf8778346d36d6ebad9439c0318
MD5 6e83eb83abf709b95f1bf264104e801a
SHA1 78219bdd66114dfabdaca271891fcdfae963c344
SHA512 0dcef9419374e27e042823c24f1fabd6430b8449e3e2a918e68f869c5d747633879c9a5f6bc6f2ed2f4c159e07693e0e805019af83f2886ba0dafc7d2890b4e8
SSDEEP 384:qZcIhsNDv7MDb2C3VRNNOE+l9R+2Wl0X1puLwQ9o4:Ih5lHNOEI9RlWlsyLwQ9b
TLSH
T10C827D726D385C7B59F2E541F58B36074FBC9037A7C96A80E1EDAB0D01EE999030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a820b8353a753a66cf3408c383a961bd3a6d7a35b76711f192685e5e32a8ed3
MD5 18a91c8ea982b851fb6c1a03b25d5dc9
SHA1 39e8aa03e7a556a0581b8eba58687c4caccb4cfe
SHA512 0d087cd8b03a9ece12754df08ccb39c6db5748db61572369c2ad1c79761907106af74d8ca91f076e52072da686bd0e49645411691de9ecf02cb01aab04715804
SSDEEP 192:JONu6JkRqQmiUyIkF+RNNOmz+7R9R+2YVc6qd3XU6:JONu6UmGF+RNNOE+l9R+2vlU6
TLSH
T1581209326C286C7B5EE26945F48731178FA95137EB8A6F90D5D81E1C02EFA6C134F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b7f0a0e-d913-44e7-9544-68714058b5da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b7f0a0e-d913-44e7-9544-68714058b5da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6f5b1187fb3c5a8c5cfd7ced9cb80f308be33d5dd0a9db77294551a36945008c
MD5 e2c82e72e6238b4ebbdd0dfd083b6930
SHA1 eb64b7cca9d28982ddd1d7797383aa7c5d0efcf8
SHA512 07655cebc888822458796af4d917684411462ac358cff6057b53750f1ce1ce3dc13648dc3ac61b04747ecb7acd8e278cd49b6b5d595d766d26924bece28e2285
TLSH
T17041FC59AAF92148B3B76E56ABF3A86D487E78772F07D45E00110D4F0667A40CC72737
MD5 SHA1 SHA512 TLSH

Submit Download