hxxps://production[.]penleyinc[.]com/penley/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://production.penleyinc.com/penley/
Sample260903-sd5jpsaa44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329212995943150"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{A6A53E7B-1731-41D8-84D9-A718A94417EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4364	3600	msedge.exe	87
PID 3600 wrote to memory of 3312	3600	msedge.exe	88
PID 3600 wrote to memory of 4252	3600	msedge.exe	89
PID 3600 wrote to memory of 4252	3600	msedge.exe	89
PID 3600 wrote to memory of 4492	3600	msedge.exe	90
PID 3600 wrote to memory of 4492	3600	msedge.exe	90
PID 3600 wrote to memory of 4492	3600	msedge.exe	90
PID 3600 wrote to memory of 3428	3600	msedge.exe	92
PID 3600 wrote to memory of 3428	3600	msedge.exe	92
PID 3600 wrote to memory of 4024	3600	msedge.exe	93
PID 3600 wrote to memory of 3428	3600	msedge.exe	92
PID 3600 wrote to memory of 4024	3600	msedge.exe	93
PID 3600 wrote to memory of 4024	3600	msedge.exe	93
PID 3600 wrote to memory of 3944	3600	msedge.exe	94
PID 3600 wrote to memory of 3944	3600	msedge.exe	94
PID 3600 wrote to memory of 3944	3600	msedge.exe	94
PID 3600 wrote to memory of 3288	3600	msedge.exe	95
PID 3600 wrote to memory of 3288	3600	msedge.exe	95
PID 3600 wrote to memory of 3288	3600	msedge.exe	95
PID 3600 wrote to memory of 3928	3600	msedge.exe	98
PID 3600 wrote to memory of 428	3600	msedge.exe	99
PID 3600 wrote to memory of 3928	3600	msedge.exe	98
PID 3600 wrote to memory of 428	3600	msedge.exe	99
PID 3600 wrote to memory of 4540	3600	msedge.exe	101
PID 3600 wrote to memory of 2388	3600	msedge.exe	104
PID 3600 wrote to memory of 4548	3600	msedge.exe	105
PID 3600 wrote to memory of 912	3600	msedge.exe	106
PID 3600 wrote to memory of 404	3600	msedge.exe	107
PID 3600 wrote to memory of 404	3600	msedge.exe	107
PID 3600 wrote to memory of 4476	3600	msedge.exe	112
PID 3600 wrote to memory of 4476	3600	msedge.exe	112
PID 3600 wrote to memory of 2784	3600	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://production.penleyinc.com/penley/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff8ae7c188,0x7fff8ae7c194,0x7fff8ae7c1a0
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,7216332460508704710,11342252671525943963,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,16465659368128533279,1893129906417029522,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10730563578486113311,1395582319888587474,262144 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9582785763252735811,9897365115468720224,2097152 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13447190869622726627,795726543523037912,2097152 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,9149502219519676995,10346576463631067614,2097152 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9927564142788454929,12870508429581516354,2097152 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,13251639097720942999,12615591011870699362,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15935337852604967067,15174540461444363204,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2701388448063271065,4404025646144740875,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2701388448063271065,4404025646144740875,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,17971261563980955413,15145275091981003833,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,6786049214423881691,4474567440833660591,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,11717957774542854392,13327597735054508686,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,10677358348738231538,10809522125773749672,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8960491545961791301,14931925745916854822,524288 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,16054834850253318671,13866714450871842140,262144 --field-trial-handle=2464,i,15631962158123464350,2510192615040160097,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88f4d91fffdb15d2568663457c69a59e8dd0bfa04bfe5bbc3cd481a4d75d390d
MD5 0f0af677b9b8ae706083a82dfd2ea715
SHA1 ec0c51073ec40f589b37fe3e5006ddad31cbe16c
SHA512 c56878494259f08ba5f1a2e87ed08ced52d0afda491dbbb9c7b28b92105876608821e8a5765950db106ea5cc26f6098e511ebff45b24a21e4a7490b33a36bbc6
TLSH
T1C4716D4BC891D892E33FE3F0C5E24E813CBC902B09930EE9A940A4BD9838BF1D45300B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cea5.TMP
Size 3KB
SHA256 f948dee482db118741c402b65bc0f70c6b25ad6af31c87c8129f8e8dd1b3124a
MD5 f7f63fa6e571b76c5e8f6e7998e803c1
SHA1 ee222509c377d20b8252b6c7040f224658f1701c
SHA512 75100acdd52e1600239d09304c05049eefbcd16045268a8c4305aa3baa118f4c61b7bfd0fb9fd31729ab025dbe76b0d3c78566640e7a096a75dc51e5cf6a7738
TLSH
T1DF714C0BC991D892E33FE3F1C5E24E917DBC912B09930EE9A944A4BD98397F1D55700B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a8f1764efeefcde1a3374d703a7a68fa67981b98a47fa8d13270372a4e468dfc
MD5 2e8d4b54c9c5f07c38ed6ef6bf9419e4
SHA1 84a09a036edf28cc749e68fc64dc3947906a2f82
SHA512 3b2a3099f95b34be7a83888db5a56e0b26365de48062e470aebd5a6ed459f31e892d2e80b1374cdd92eabb9711aaa0c3125c8a273d6d4af0132331bc73a94cf0
TLSH
T1ED11ADF3C3E5856E8A1156F05A14AE1BCE1C0515431C7C598AE4FF2793E3075D00255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bfa8edb22ebfab78288387c290a2dedb80991542e58ee85322dcc2940fbac181
MD5 f12072d3448bf871540e5173f5022196
SHA1 1832ffbe62addab797e5b81fc939f94784e3943b
SHA512 e98ed830a1326ec73c1a6a4a6dbe45d1c3f7a3e6cbffc0f548b6c2bb5c87cdb06291c2695c26c4f59ba01dd57480ed83f4dd183377670bda6488be4c9a56e6fb
SSDEEP 192:sxZeRCyM/jK1Ml8Mkz/fwsZxfIdpbRkHW6+WNS2HV/Y4PW74IgrJ:sxZe8Mz/fwsZxQbOHbSo//9
TLSH
T14252E8116A34A977CCDBD20DFA457F53D6F94563A2900E44AAFC8A1C05E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5001059e6ae810f8450e6586330e7066702a9bc350c97532765e1b0f0a37a0d2
MD5 09591f3fa69c5d87e8936a3dd84658fe
SHA1 ee9445e4a5fd246aa3afa6015b100172a6fea7ec
SHA512 2517da63f496c2eefae4dcec4cceddef11e914d62c21e33069bcceca72feac91bdea4be186fcdba59721c5a9210416aa96c15a99367803977e9d0e5107f334a6
SSDEEP 192:sxZeRCyM/jK1Ml8UQXkz/fwsZgfIdp9RkHW6+WNS2TIXY4z/l4Ig5qJ:sxZe8qUz/fwsZgQ9OHbSBXIE
TLSH
T10C52D711AA349D77CCDBD20DFA41BF53D6F54462A2900E44AAFCCA1C05E6ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4121607eda0f3977a1d54765d0ab69b74abe4636e8df8d2359f134a97252fd79
MD5 df48466a708e5aaa42c94c0d515370d9
SHA1 0b09781ffa8b229d7ff0d87943e9f733cfcf7fe5
SHA512 0f2a9016cec85aa49dfdb85be7691357e28dc8d8c9fa2dbe855b46b26e868d3468113701f7629d584d24fd59123ec2823f3d918bb6e281a8d4f480636070310c
SSDEEP 768:XL8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdqrot7kqUny:XL8iJPNWvx76ru1jahALocdBPUy
TLSH
T19DD2FA3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8e290ab5e630640d1e66314520cd03e4837cf25edadc39428260ff71e0dee527
MD5 820ff41ab2640fd2d97334b4195847f7
SHA1 fb55f9d8249ac4d5b603f1272bc20629103cd3c3
SHA512 ccfdae13f1ae92a253ea847a1b3895854490fc1851b135ecb2d8f052697feb1a74aad75bb5cc5c701c0180c179815186d73486a2284a0b94700f224647bdcbab
SSDEEP 48:KgxINKiAwfyJGInK3qokGDymIQQeGgVFIPGeKQrYEe8uOdN0W/ya:KgxmKiAa6GcK3qktGKWs6V
TLSH
T19F914406357F0A413DBD250DA5A18B2B474176677019BA2B7BF900B20E2FE291EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596a88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596a88.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bda394739b86985c0453a349623ed8bcac179fc09704f15cf01b7e2d18360fa8
MD5 7215cecbd7af3d6aed77e78015609455
SHA1 85902a887b5404c2f316df9060d33262157ff798
SHA512 05979ba8c3d8986e026c0ac2fc9d8e48890e148db3e8e1d48199670ed052f1ffc8721c27cf10b1da6b4b0f14bc712c1af7038d77ed801f04f2973d5b5807c43e
SSDEEP 192:ujm+xasuheOwQxMGsN7oQ9/EnWm971QmiU1tPsF4k03Y951cLIyqOqva+4LcYLWO:1ZcIhsN7oK8nD54akh951h+sa+VYCoT
TLSH
T182827D722878ACBA5DF3A645F58736178FB4816BE3C96F84D1DC9B0C05EA29C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ea6368421fa0d87bf4d5d211982b359ec6f5f8550431ad6bb825e2e2dbbe1f74
MD5 8d384ea2b795898144c296467868c8b6
SHA1 8aa7b64c8ff2229374bc8ae8e166133f037ac547
SHA512 e97d76f7a1e5c96cbb08b6e45dce9107b8523070d5e2744bb57468a76a6fa592932cd9cdea0aaf39ed4b6f87e9b34dc77b1fd235741ce894a836224f972a8a00
SSDEEP 192:u9m+xasuheOwQxMGsN7AQ9/EnWm971QmiU1tPsF4k03Y951cLIyqOqva+4LcYLWO:nZcIhsN7AK8nD54akh951h+sa+VYCoT
TLSH
T10A827E722878ACBA5DF3A645F58736178FB4816BE3C96F84D1DC9B0C05EA29C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 184442d3f2e997cb73c146a6732cc5b0553c5e994690aff8f07c5cc880e79f65
MD5 e0b1018b64675a664790db2dd48c97f7
SHA1 8f098934c07c8c974416ec620b4fa2a2daa9f0f4
SHA512 1b6dc92b4d3fe925cd1cc2379b142947f200ed1a455976b17f20266f5c7bcc5b6dd8609da0be4db743bc81db21e923feeda027fa8aeb356031dc23bb01ce645d
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop5tO5DCBhPwivh50xy0SFYKzAxqbsG:gONp6kDfQmiUyt4CZ903Y2Qie9U6
TLSH
T18C02E83968BC2CBB9EA3AE09F48737175FE4113FEA952F84D5E81A1C40D725C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ca942ce9455035a1de3f6c6ba9bf8d8c4c2a4f76507d6a63ff9af0b669a3ef2b
MD5 074ffa61feb46d01f5e77cd7ce6b6803
SHA1 85ffd10b016ad3708969b6c0eff9cb550141e475
SHA512 1ecfeca755998b6d1df85c1b5d1925d7ab463f3158bcac56177299218705f635e55ea5298f5ebb9471eb91906fc4bbcb4926f240cba526f90e25b58c4c52d8f5
SSDEEP 384:SiFiZcIfsNF8TUNTUlIlAK8nD50akh951A+sa+VYCoT:ZFQfIwgqCN1A+hgdo
TLSH
T1A7C21AF218E7987AD9AE5747E77E2E034EBCC167B2856A50B3C8550CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f2aeb1f080523b2fbd8177ee834a2268149f86cc9c109bbacafb0fdeb5496f2
MD5 d57c33c9c4f680e45e898ed67e53fe68
SHA1 a4b2b83d5aea5c94a2b3acafea827f5c8c367b76
SHA512 ed28c66b573aebf5b07188c61cb6c62ae456999a6853ea92b4173c4580abc8d5cd97de36464906f159b6dfe185020bf23e6391c26f54e8244bc439c4b523222c
SSDEEP 96:rqONkWQsjpfmUTjK5ih/cIPURHl8h4otop5tOtDCB8Pwivh50xy0SFYKzAxqbsaN:uON+6kGQmiUytiCG903Y951/cRyqOU6
TLSH
T1C112083178B87C6B5EA3A545F08736179FA4422BE7CA7F81D5DC161C05EF2AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

708df7b8-89fe-48f8-8d75-5f851e6a7527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\708df7b8-89fe-48f8-8d75-5f851e6a7527.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 51328d66a2fc8b4a723cf27f03c1049ae14065dbdb17e5cfd4cadf333eb44b99
MD5 e3eef0777a425f62ccb246b66a8b5717
SHA1 dbbbe4f8099748b33fee0cbde25e2e99e487aca3
SHA512 305faf5fae7223112c011d81abb47b9f4bfac96ca58845b04464d534e64bee0714e13a3571ac9fe165525fda2cb4228b0a6cc2af32a627074d2aa58df6f2ce12
TLSH
T18741079CB6ED115CB3B3AF569BF7A9AD487AB8372E06945E00010E4F4922B01C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download