3a7a811f1d4a0454c02e2577a7e2551107ca9721fcce9458ec830e2c2626a225

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vanguardpapers(2).html
Size 130KB
Sample260831-pg6dmaaj2s
SHA256 3a7a811f1d4a0454c02e2577a7e2551107ca9721fcce9458ec830e2c2626a225
MD5 97b914ea8c8d430014f80bf7c74c4806
SHA1 8b70b57353fce00daed12fa85f3a2acf57b43db7
SHA512 f12bf5e4df0aada7020b4353e3ee9721f902dfe2a0bc3bfa134fa446450ecc0e55639f8f37e924e7369c1c70b04476792e40363dcc265533692017ef7b14ed69
SSDEEP 1536:o8d8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllU0r5ju:+L6WVMllhAYu
TLSH
T188D3B66647D2252E101BC55D89BEAF45FBBA484BCF4840AC7FFD0E71AF99C92184EC09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326523503958905"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{BC879EE0-361E-4D61-9529-7CBBC2E4933F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3908	2276	msedge.exe	85
PID 2276 wrote to memory of 4744	2276	msedge.exe	86
PID 2276 wrote to memory of 1112	2276	msedge.exe	87
PID 2276 wrote to memory of 1112	2276	msedge.exe	87
PID 2276 wrote to memory of 1112	2276	msedge.exe	87
PID 2276 wrote to memory of 432	2276	msedge.exe	88
PID 2276 wrote to memory of 432	2276	msedge.exe	88
PID 2276 wrote to memory of 4316	2276	msedge.exe	89
PID 2276 wrote to memory of 2868	2276	msedge.exe	90
PID 2276 wrote to memory of 4316	2276	msedge.exe	89
PID 2276 wrote to memory of 4316	2276	msedge.exe	89
PID 2276 wrote to memory of 2868	2276	msedge.exe	90
PID 2276 wrote to memory of 2868	2276	msedge.exe	90
PID 2276 wrote to memory of 1100	2276	msedge.exe	92
PID 2276 wrote to memory of 4848	2276	msedge.exe	93
PID 2276 wrote to memory of 1100	2276	msedge.exe	92
PID 2276 wrote to memory of 1100	2276	msedge.exe	92
PID 2276 wrote to memory of 4848	2276	msedge.exe	93
PID 2276 wrote to memory of 4848	2276	msedge.exe	93
PID 2276 wrote to memory of 2616	2276	msedge.exe	97
PID 2276 wrote to memory of 4792	2276	msedge.exe	98
PID 2276 wrote to memory of 2616	2276	msedge.exe	97
PID 2276 wrote to memory of 4792	2276	msedge.exe	98
PID 2276 wrote to memory of 2980	2276	msedge.exe	100
PID 2276 wrote to memory of 2076	2276	msedge.exe	112
PID 2276 wrote to memory of 2700	2276	msedge.exe	113
PID 2276 wrote to memory of 2288	2276	msedge.exe	114
PID 2276 wrote to memory of 2984	2276	msedge.exe	116
PID 2276 wrote to memory of 2984	2276	msedge.exe	116
PID 2276 wrote to memory of 2076	2276	msedge.exe	117
PID 2276 wrote to memory of 2076	2276	msedge.exe	117
PID 2276 wrote to memory of 2816	2276	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\vanguardpapers(2).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9704dc188,0x7ff9704dc194,0x7ff9704dc1a0
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16491616450116373754,9879269657890787318,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,1063072882216803688,4826640221918651338,262144 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,10692544512969883940,3077993517316420231,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,10281917045847509751,9882193126889238245,2097152 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,14141168296997403118,2352993556036880010,2097152 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,14229255613303173030,12739118914573178835,2097152 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15263052863584780245,6758057062979457960,2097152 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8181372204196005688,12717968605792188360,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,17678998857151535668,9826017562819224820,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,951447513849606702,11105450931256419521,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,951447513849606702,11105450931256419521,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,13455285600345173877,12090942764802802489,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,10460862146529649542,16548274874029389872,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,18362495531990906325,4077285738276992943,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,1115178689917015071,6980968786612655538,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6156603095676935784,1624956458590064229,524288 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5228,i,7689351101862767405,3095038233446634856,262144 --field-trial-handle=2320,i,10162017115186138597,9182644704239030745,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ea9bf44534381974e8d6b23576dc98ee95d9f42fced0f33c32430c6ecfcb211f
MD5 86a08d9d8f33565b074a40f2f142be91
SHA1 981fdedfae111847dd05548818f71abb431e5282
SHA512 d541c411936920e6df197922894c0bdb8b365c593ced1c4175f282f30873eb3e112381fcf69e376fd4f67d4625b37a75842439dbb2258ca68412c6e3437cced1
TLSH
T13B41D27816E3044DE3201B3BA4F02E1639F88D953EE36E1D9D4889743A4FB22830F278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58914e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58914e.TMP
Size 1KB
SHA256 6f289f289cb46549133456a45c00bc0c3860f60887bfe03bc1336773d7f6c4f7
MD5 c7a0866331531ca293c79cd55d08d518
SHA1 aec65d767eae0aed6bcb854e88c2e9f850b41acc
SHA512 c3cedf1c2eb4389c7f1d1d9cc256cec0f12b1ef81a776d77cc97a843b392c726659b8a6642217c67ea9530e185301a35f05cb80d0666165c06820f91b364db6d
TLSH
T16841C57816E3454DE3201B7BA4F02E1639F98D953EE36E1D9D4889753A4FB22831F278
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f177c052ba7aeeab9c325b0c017a1ccd37c850f4eb53fa96cb4b17eb51fb2dd2
MD5 4fcac90a3d6da27fd40bb08d6cb3629e
SHA1 739e0a7253ac0807b2a88cc247e359f299302c6e
SHA512 2193944387d937ada4fb9572f79a444031bd60128dd0a10befb35887b97d5f9ed35ef8a9d09715c6eb2ba3b66dff7407ab1de05127b1a0a6b14132d635e8300f
TLSH
T1ED117DB3C3E5856E891116F05A24EE2BCF2D0606821C7C19C9E4EF2B93E3475E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 38e44e8930d59a4178ac27b17331cf5fbfbebccf70565ac0d7932a93e258946c
MD5 f4ca53301b2d255cdcad12bd7db38f79
SHA1 09058ed26f9e60b06f3dcfa83d62c4e2fe156e0c
SHA512 7680b0f7de9f53ed1b06901a003f79f968f2670c510f7ae37487573a2b769d760fafc4d28a9daa1917b2a8682acb9e58e948c4627599fac38d05b73d4fa37554
SSDEEP 192:sxZnR/yM/jK1Ml8Mkd/fFsQI57IdpdZHW6+WNGY9IKeoTIgrJ:sxZnzMd/fFsQIWHHbGc9
TLSH
T1AD42E802AA346977CCDBD209FA557F53E6F8457292900E48A9FCD91C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fb5cf4dfe866e039d98ca67cc97acdb34f409bc54248fcac885250f2bcb39e04
MD5 1457616dca28d0e6c8c1c216d4c9f388
SHA1 a018e8ec39aeac6211eef600297813af58737b1c
SHA512 e1568e8fc9f453707e5077905355d85bdbdb4597eaaeef51f3694b04bf3bfe75367bee4099ca44fbe8051203a6c76de8f89801f1eb959efc76bf480330165201
SSDEEP 192:sxZnR/yM/jK1Ml8UQlkd/fFsIfp7IdpHZHW6+WNGY9IRpVFqTIg5FJ:sxZn9qud/fFsIfm5HbGwl
TLSH
T1DB52D716AA345A77CCDBD209F9457F53E6F4457292900E48AAFCDA1C00E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f2f643e81409ae64b10a030f4d5a677bdbbbc48d4a6dde30d4550bd2d4c12f1b
MD5 f42de3763c22b09df4c9d97810b93a6f
SHA1 edcb7350addcab9cb6df3e6e2d9a3916f0a0c33c
SHA512 b549d17150d229fdf190b46481fa27a726f9afe459d9b355ec028737248d6d8fba309d7bdcc9e0a5825948f8f080f7be9ac45321a747cd7246214db0efe016d6
SSDEEP 192:sxZnR/yM/jK1Ml8Mkd/fFsIfp7IdpdZHW6+WNGY9IrpOoTIg5FJ:sxZn9Md/fFsIfmHHbGpl
TLSH
T15152F905AA345A77CCDBD209FA457F53E6F8457292900E48AAFCDA1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d5d21711ba4832e6c60d8233ae283190e3ad42782c838f9d7ca7ad1abda2c69d
MD5 24e8bb55154cbae77b1d7fbc62650eb8
SHA1 a35de6b9d7c3dd62087d8a1537bc413abfdbd234
SHA512 8bf5709d8f48be06de7d6035834a2a43b7034d7f27db94315141728ada3d32fc2a0c5c3b221e79d2abfe438fe87ef6dbe60be725bf037e3b76723ad0ece3de2f
SSDEEP 768:Ficv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNeroqg6V:Ficv21wWvu+Z+u1jaeFLeRN1qF
TLSH
T1B7D20A2B280CCB7E4F841E9CED2AAF9A6DD801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 99853840994636a3eff5a90f71953facbc7b93347355f5a89cbb80beba5b3976
MD5 15e03ba5910ee0ceb26c07b871a855fc
SHA1 ad27eedf46b93b6000caeeb75e43eb20bafc12a4
SHA512 30435e3d626726b9aa852bdc2cd9dcec2bf43a9dc0fb9327e368a902f69c3ac3201e0a6b2d0b5b20f3f6e3470bd9d5bf255228163f79f9b965e64091d9b36100
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDujeKEoeEmsKbSOeDmKocQ:mTtNlThZ
TLSH
T175C12457B2370742297D690CA3669A368F4531A33814F5EF7BB900910E6AF221EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 08c59c9cbd07b2bc114f5aa18089ef33882c568b0ed7f94a5e8e207d19ac2cce
MD5 ef24f5880227ec9f4be6ae02001732ea
SHA1 7829b8761d60b3053f38ffd84f69452abb0c4d0b
SHA512 842c223f9ff19ab65e1f3f8ec17a2357440fe28c2f37582c6f2727ae6f2604b3e7aeb0b192f99775b8d9445a359ccdb13481b6a372ae4d3369f2ae0f20167cda
SSDEEP 384:LZcIfsNZM67ziliRRe+CnOhiJr5n0X1puLaLor:TfgiEIvOhih5nsyLoU
TLSH
T195928E71ADB85D7B15F2E144F58B36079EB89023D6C92E80D1DCBF1C05DA6A8130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4d7e6a23fad11c443a5f1ca4dcb53dfb9271071a5da92773a35b9b8cea5a3069
MD5 82e8f714f34b803220f0de020041e892
SHA1 4d2849c73bb9301428c4c346f6daca9764c987db
SHA512 000b5f59c78b768efd111258cbc36da65e4f699fddff487a987be47fff1baf3884b8100e24d98e0895520d5dc16802c38b69b30abb826ca2cff33354eff54f52
SSDEEP 384:7ZcIhsNZ/67ziliRRe+CnOhiJr+n0X1puLaLor:jhziEIvOhih+nsyLoU
TLSH
T162827D71AEB85D7A15F2E144F58B36079EB8D023D6C92E80D1DCBF1D05DE6A8130AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21b871ab30017b10d51ed22c11e7d3f469c6f3bdc9dda7232bb90226da912dab
MD5 91b5a8d899d44e41a0c01f6e5475416c
SHA1 376e748e288737a16c5c1f6fee63238504472eed
SHA512 db8776f75e78a19e06111596a7d01daa234f0b83917b79523cc407104d8aa27b982103ca03b4f7559544dc7f01d3bbbd669a01e206cc0757f14d80dccb35db7b
SSDEEP 192:JONo6v+YLNQmiUyibZh+CGKO1m1ushb2U6:JONo6vz/TZh+CnO8R2U6
TLSH
T16102EA357D682C6B9FB2AE49F58737179FA8213BE6912F80D9D82A1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af49b19678c9112b681e01c4c1038c79971e8ab514dd708fcc89c56ba0180c6f
MD5 425bf32309f4cd6f90426c5c6e32474d
SHA1 3268bde87f8dd6f91749001e411c65d2cdb54151
SHA512 fe12f26ca7fb90573f7303ede960447c80cb2aa7041d023105f6b5b6c6d4cc2fca4f57e78f6db7e220589c7de73bafbd37d29c099e6a080146b5ed33f717642c
SSDEEP 192:yON86v+YLvQmiUy1bjh+CGKO1maXSJr+CH0qHVU6:yON86vz1qjh+CnOhiJr/nU6
TLSH
T1E8120B31BD785C7B5EA2A544F4873513AEA85227EA863F90D5DC3E1C02DF6AC230AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 663240d247ee58339e9ecb8d357504a3ad53843fc7090bef0ddf597822d448c9
MD5 e4bccc91f7c3b05d5f521b09b933aa41
SHA1 3aa2f8d1a0d7d2d1894f68d14cfc014661588909
SHA512 5be74eacb3f8f91e3d15cc069f214e897d8ef2d09c19d18096e0aa39c37a1ca1f4aa67065c4c91323b00b19b2bcd73247ec149fd2babe0424595e18aa3db9f70
SSDEEP 384:vZcIhsNZM67ziliRRe+CnOhiJr+n0X1puLaLor:nhgiEIvOhih+nsyLoU
TLSH
T1F1827D716EB85D7A15F2E144F58B36079EB89023D6C92E80D1DCBF1D05DA6A8130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03685656-ce01-4535-a6f9-13a7d2e9a937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03685656-ce01-4535-a6f9-13a7d2e9a937.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f90fdd3126955fce9815c31898f5efe685ac38cefdda6b8e45767aa40e3d0c3
MD5 55c6b31dfc67e0f9711c80f961c3d248
SHA1 888c352768d8b89b0146e579cb6044f51dc259bf
SHA512 1b30932fd127c3bef0d80bd663008a0e9830d9a06759eba8b647c31844312e3aecbe22d5a1d9c3d7ba6e6509e33c7a5ece2eb7fc3b05724422050980c4050222
TLSH
T1B1412D5CA6E91118B3B36E5A9BF668BE487FB9772F06C05E10400E4E4762B40CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download