1dd503e93d14aed96ecc993aedd091d0cae241bc08570a0cea2412ec062cc0a7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mode-3d-main/docs/index.html
Size 77KB
Sample260905-tc11kavthy
SHA256 1dd503e93d14aed96ecc993aedd091d0cae241bc08570a0cea2412ec062cc0a7
MD5 79db065481ef2d084438c141545beabf
SHA1 11735eb2957f07b48f018a48d0070be42d7af08f
SHA512 202e27e6334cfb3ceb1b3d9fb988546e8903dd347a7cca7d1ce7483a73096b201be2ab4378485106132197a4ceaad0903e967c4d7e8f817384f5e1d3a4484f6b
SSDEEP 768:QS4XP2ppgJcaYzLoDT07khZFfl9UUulurWbd0uC4RM+4t8yWicH+hopAj/cX:9wcayyg+PfTWMWbd0sRM+4t8ylceMO6
TLSH
T1B573192622F1223E13938372F36B6766E7799147D50BD92C70AD81A42F86C64CABF344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330973441753330"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6647F74E-9177-4035-82F4-CFEA7AB961A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1252	1364	msedge.exe	86
PID 1364 wrote to memory of 996	1364	msedge.exe	88
PID 1364 wrote to memory of 4544	1364	msedge.exe	87
PID 1364 wrote to memory of 996	1364	msedge.exe	88
PID 1364 wrote to memory of 996	1364	msedge.exe	88
PID 1364 wrote to memory of 4136	1364	msedge.exe	89
PID 1364 wrote to memory of 4136	1364	msedge.exe	89
PID 1364 wrote to memory of 1768	1364	msedge.exe	91
PID 1364 wrote to memory of 1768	1364	msedge.exe	91
PID 1364 wrote to memory of 1768	1364	msedge.exe	91
PID 1364 wrote to memory of 3824	1364	msedge.exe	90
PID 1364 wrote to memory of 3824	1364	msedge.exe	90
PID 1364 wrote to memory of 3824	1364	msedge.exe	90
PID 1364 wrote to memory of 4896	1364	msedge.exe	94
PID 1364 wrote to memory of 3852	1364	msedge.exe	93
PID 1364 wrote to memory of 3852	1364	msedge.exe	93
PID 1364 wrote to memory of 3852	1364	msedge.exe	93
PID 1364 wrote to memory of 4896	1364	msedge.exe	94
PID 1364 wrote to memory of 4896	1364	msedge.exe	94
PID 1364 wrote to memory of 5056	1364	msedge.exe	98
PID 1364 wrote to memory of 5056	1364	msedge.exe	98
PID 1364 wrote to memory of 3396	1364	msedge.exe	99
PID 1364 wrote to memory of 3396	1364	msedge.exe	99
PID 1364 wrote to memory of 4924	1364	msedge.exe	101
PID 1364 wrote to memory of 1064	1364	msedge.exe	105
PID 1364 wrote to memory of 4224	1364	msedge.exe	106
PID 1364 wrote to memory of 2004	1364	msedge.exe	107
PID 1364 wrote to memory of 3904	1364	msedge.exe	114
PID 1364 wrote to memory of 3904	1364	msedge.exe	114
PID 1364 wrote to memory of 3400	1364	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mode-3d-main\docs\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8b7ec188,0x7ffe8b7ec194,0x7ffe8b7ec1a0
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,15796152988784639804,18214007042411036495,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16367536125398794323,1958445387817438409,262144 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16330022486737026984,14556177579637553239,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10277090678692234096,6405227782327052139,2097152 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5783226734566625074,6147039974076943954,2097152 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,10029907490674997453,17111854204854968508,2097152 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,1617104456650989969,2829375741479447673,2097152 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,475448047223686310,9374303817089410020,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5126430312320751728,918927348209222446,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10708452042583769098,6663878612149574501,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10708452042583769098,6663878612149574501,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,3185469887562330090,104860694956565140,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,11451262221815016892,1008139221238279280,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,9414921740101601219,13445879658189339166,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,18154059248068696470,6882635345585843764,524288 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,3052040858583615268,15922275853941693173,262144 --field-trial-handle=2228,i,4702530669732225194,9620685601756615307,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

4aa37ef8-de74-489a-9257-1df257bd1691.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4aa37ef8-de74-489a-9257-1df257bd1691.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f0dd9949aa8b19c99d8925d6da2d0bafcd06ba90efeeb177b3bdb989f62750a
MD5 f3c52817513412323c11bbed86b0ec2c
SHA1 d4cf35fd0ec0f4a89cfebb6011367aff15d4035c
SHA512 f6b82dc5ca828fc17fe89aeca1ac44a4307b26713d0eeb8d983686c4c81526e412745518ce298f05bec213e444ed1ed7237affd3df3dfcfec7fb85369e1dc723
TLSH
T1DE714F19CB434C53EB018E34D7F102B175324B98466F5DBA2174CBFF5E0EB258519D29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4e4.TMP
Size 3KB
SHA256 82ab47ce04cc5e687be4a8e1a7d0d50d839a5c64e4ce0ff061f0cce1c5a777c9
MD5 d3b34e458caf267b8481ceba4ad022a8
SHA1 0702409b52a90386c6c8807dae3f841e140c05a5
SHA512 aa4bba661374a7bb5dc96f17a9faf76607ad132ff418c1565bfabb140fd33271560d84606cb1440618c7d7a4c12bd07ead2cb0cc652adae748f5dae93f01be59
TLSH
T144715F19CB434C43EB018E34D7F102B174324B98466F5DBA2174CBFF5E0EB218519D28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b04f9f0039c78a8ebce3e2028353e88b861ee54851bd6237a9ee9cd74dc3213d
MD5 eb0be49bb9d0c1b51d673e5cfcd9a151
SHA1 b54b9bc0ec6ff7c0c4ea5b398de622964f0f6bc3
SHA512 592c260bdb3e4503feea149426d0b6e6f3463e257dc3f34b1e919e9c85147119b5f4736bf22d15a99d6571cc7c34276a4ac8a21de3e55eee8119eccdc9de59d2
TLSH
T158419CB6C7D487BE891112F09B246E2ACE1D051B42283C5AC9F4EF5F63F24B1D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae8852720c4b16cf93d22dbb1b039a2744eb11a038acbae5acc4f5e70c9f04c0
MD5 21df399a08dc5f98036653dfe6a19ef0
SHA1 05da26123b566e12e10b9f6abb9fc98c1cc1c5f4
SHA512 2492776706d6f06ca062aa10f815740ab8a53579fc2dfce8424be7ccdc752350e8d66a446f3c046241b4b225319978d3b985e4fcd28765156be775253de0a2bf
SSDEEP 384:sxZWXafZMRp/fxXsW3W9lUDHbGpGO+NA9:suXafGRp/fx53W9WDHbGpGO+N6
TLSH
T19442FA026A34A977CCDBD209FA55BF53D6F5047292940E48AAFCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 29851ea6514f9dad7d8394419b14c0a11fc0850a25d830ad5e0b6fa105aeca18
MD5 03264f0ab7b1b0214883e92f1a40648d
SHA1 a130ed8d3bd485b4b257fc2cd3f58a12456acccd
SHA512 c427c5488ef4ae1259309824c31480255dbc3bdd7b515474e49e189ad8dff52b4562091d17544a298ea0fd63ae34d76126837b71ae57de7d03620bc10f19b9d1
SSDEEP 384:sxZWXafZqCRp/fxXsR0d9W9l2DHbGhNL+NA6x:suXafACRp/fxk0d9W9YDHbGhNL+N/x
TLSH
T1F852F812AA349977CCDBD209FA41BF53D6F5447296900E48AAFCCA1C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 37c8b9b69e850e0fedf284fa9fb89df1175e565fdddcae2f2e1a01e4c5e6787e
MD5 4485e0c30141540d9b8919286f652786
SHA1 3d5083a14d4c32a17bb9b94820bcaed250283361
SHA512 e8e52fec1f22945e807c24463f55a119ba21aeb121c85a965f6d255fa3a1f5eb3f97a0ee22cb9ecb4ab8fba9cc92fd9473368b2d2f449c2ead5260443381d045
SSDEEP 768:odERdM4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dRKrohFcfa0:o6Ra4jeXmWvmKLEu1jacPLZQdRh0X
TLSH
T157D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b717760aa48b8d08cc9e270f6544d822e69115305e3a7fe58e8d89df3cc5443
MD5 be5f6627b2e0dbcdbb3451c43cd896af
SHA1 449f416e6ad462cc5c1c87969c406633e3d762b7
SHA512 506406e752dec5943077b8c45ee4aafc8e548a79fdd9c403617d27b61a7dd6257bf08caa671e08d7ba6648eef583ae121b068d3215a85bac2bd6e16ebdaea397
SSDEEP 48:KA1IBK2s8rydTI1K8cQAWIvK/6sryTjIHDJhh+z:KA16K2sCOTKK8cLWgK/6S6z
TLSH
T1EE912012727716827C3E284993908A2B5B4275637015B96F3FA848B64F67E381CFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59501a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59501a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6bb8b9d073bc5517ee1962026c83d84f67586c83742b6cb55f0b959758a34245
MD5 f49a555fabc21fd7beefc8b32aeadc1f
SHA1 0fdb1a0018a229c75688c85c7c2f9ef6d6117bf0
SHA512 1cd4875328ab963e035447c8ab694f1e267600cb2b413f58d1d4adcdcd4416d8137ba5233356432d7e771473250ebe3b471d802babeb67ccb1675ee79120e0d8
SSDEEP 384:PtZcIhsNg7z6NLEF7UYamwPuf+D8h8RX/BF7n7O6R2FeoFh7UXsCoK8:P1hzn6AF4Yamw2n8/b7n7TR8SsC/8
TLSH
T1C7829E332C78AC765DF6E246F84B36134FF850679EC96F80D6FC9B1D048AAA81306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 29520f19ec4a4c9d79fb7e9200db389b4ae26559fac7113fc76cf87fe1167ad6
MD5 ca93da58eba012eab149d44f2248d524
SHA1 32831d99efd41dacb9af2c50c0891bae19bf131c
SHA512 ddf1a9354b84fbeba6d2af5e2c3b0c1aea13b68e523e64f24e822d83a7472f093726c7aaafe1513ed2463c812483a0dc59245419e689ed74a5802a1414fc3ed1
SSDEEP 384:E462iFiZcI4sNgF8TUNTUlIlC6NLEF7UYamwPuf+D8h8RX/dF7n7O6R2FeoFh7UU:E46dFQ4zFwgU6AF4Yamw2n8/37n7TR8b
TLSH
T1B1A26C3358A8DC7B5DF69B45F94A36138FF450A7DEC5AA80E7EC9B1D008A5DC1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53432c11be3a3f1f2a612c671531492819d8142398ba9a7c5b1c140edf8fce3e
MD5 d279db7bb8bda97649a4bf1bb86fd033
SHA1 0b77bd8aaffec1c760700a584d40ad3e2ff0eb35
SHA512 309f0b2e40d3763f48bbcfa22190789ea90b58ef334298cfa7c22afbd999f25bc9a0fa376d7cf13322eadf44b3a0a216a75cfaac671064d45a862b4d13fc7f51
SSDEEP 192:EONnF6hZ0QmiUyWVWFpc/+jVpjzoruo8a5wOZ7GGU6:EONF6oz8Fpu+D8h8h27ZU6
TLSH
T19202D9356C687CB78EE2AE45F48736135FE4116BEE956F84D6F85B1D00C769C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3340557068b661a2b86ca664727f885f79c9c9dbb3caf2c104c4f6b1134d478
MD5 0f7d7bf22120bca1a25735b8ee945c8f
SHA1 798ce9befc2db0d43f791bdde2b526e3d3596265
SHA512 1d848ae290a687134614a5e9500ca863de42c38c77225c9bc974982e01a79803a1feb4b2693e14ce097964684e8e3314cfe355c5d892870279494cbeb762f187
SSDEEP 384:c4tZcIhsNg7C6NLEF7UYamwPuf+D8h8RX/BF7n7O6R2FeoFh7UXsCoK8:c41hz+6AF4Yamw2n8/b7n7TR8SsC/8
TLSH
T191828D322878AC765DE6E246F84B36135FF850679EC96F80D6FC9B1D048AAA91306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f12fc9aca39bda559da2bc3bd8edfa2d4c6b3b012d3ea0d52cb022c067c7870
MD5 786779f097634a3a9394f5c16333cc0f
SHA1 19e83397d24a06e0efb4fa47aab34be6b40b80c1
SHA512 38678bea1906cd9e2c101ad88be03b257c6649eb10a696a882fc0f2291653c84b1c1f64bbf414c96ec3e5a2d7b9e6aa3eb609c73d20463c4e36ea9877fa0eac9
SSDEEP 192:wMONkK6hZ0hQmiUyWuWFwyc/+jVpjzoruo8RX8EPu5cOq7TqgU6:wMONkK6A/z/Fwyu+D8h8RX/Z97nU6
TLSH
T15912FB326868BC674DD2A945F48735139FE4522BEF897F84D6FC1B1D04DF6AC2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d492210c-6f70-4f89-8473-b25d51572d7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d492210c-6f70-4f89-8473-b25d51572d7e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b9d1806cbc499772291283b3325d81176f72509c4b7f1589ff41cd338fdc67d3
MD5 34447f62d617a0c3f8c69ac96fa73cdc
SHA1 fd83863e94b1289e5edd3c7a4f8b055fa5fdfee8
SHA512 6182fecbbf71f1cc4d553b9e11cc83e365a5a0dbef7e0bd8415c998c691a504bff5ddb30f05e59b83bee0df195a9a9cd1c7f20798a1814e1c4ce5d64b320e690
TLSH
T1C4411C58B6FA5148B3B76F57AFF7B86E487AB9772E06D05D10010E4F4623A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download