0cb35bb885938d0ea4f0cc9686835259bc905089eff7c89ba300b0239448cbd2

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
htdocs/a/backup/hash.html
Size 1KB
Sample260907-dlk3psed85
SHA256 0cb35bb885938d0ea4f0cc9686835259bc905089eff7c89ba300b0239448cbd2
MD5 249f5784fb442d6f53edc03216b9348c
SHA1 89d8d3ef469435667225d0f4f37859ca7565fd93
SHA512 d83e16ceca620d5aed2ecc2e8a6bf4df7921096f1b4537662ee83844a09188431879970ad8818d5f8a0d6eb63f2d6239d5d91dbf2d2c45ddf9e931b41c57d6d5
TLSH
T1E4217CA131826D378A1669F4EF720E04F2D60187DE47B945706731B346A8CF026BED7E
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332239580081156"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{6A49AE8D-5110-4D53-9BAE-92BE569C4A26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4936	4792	msedge.exe	86
PID 4792 wrote to memory of 1536	4792	msedge.exe	87
PID 4792 wrote to memory of 2484	4792	msedge.exe	88
PID 4792 wrote to memory of 2484	4792	msedge.exe	88
PID 4792 wrote to memory of 4156	4792	msedge.exe	89
PID 4792 wrote to memory of 2484	4792	msedge.exe	88
PID 4792 wrote to memory of 4156	4792	msedge.exe	89
PID 4792 wrote to memory of 4740	4792	msedge.exe	90
PID 4792 wrote to memory of 4740	4792	msedge.exe	90
PID 4792 wrote to memory of 468	4792	msedge.exe	91
PID 4792 wrote to memory of 4740	4792	msedge.exe	90
PID 4792 wrote to memory of 468	4792	msedge.exe	91
PID 4792 wrote to memory of 468	4792	msedge.exe	91
PID 4792 wrote to memory of 3512	4792	msedge.exe	93
PID 4792 wrote to memory of 4004	4792	msedge.exe	94
PID 4792 wrote to memory of 3512	4792	msedge.exe	93
PID 4792 wrote to memory of 3512	4792	msedge.exe	93
PID 4792 wrote to memory of 4004	4792	msedge.exe	94
PID 4792 wrote to memory of 4004	4792	msedge.exe	94
PID 4792 wrote to memory of 4224	4792	msedge.exe	98
PID 4792 wrote to memory of 4284	4792	msedge.exe	99
PID 4792 wrote to memory of 4224	4792	msedge.exe	98
PID 4792 wrote to memory of 4284	4792	msedge.exe	99
PID 4792 wrote to memory of 1084	4792	msedge.exe	101
PID 4792 wrote to memory of 3016	4792	msedge.exe	110
PID 4792 wrote to memory of 5072	4792	msedge.exe	111
PID 4792 wrote to memory of 4444	4792	msedge.exe	112
PID 4792 wrote to memory of 2444	4792	msedge.exe	113
PID 4792 wrote to memory of 2444	4792	msedge.exe	113
PID 4792 wrote to memory of 3824	4792	msedge.exe	114
PID 4792 wrote to memory of 3824	4792	msedge.exe	114
PID 4792 wrote to memory of 3812	4792	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\htdocs\a\backup\hash.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd7390c188,0x7ffd7390c194,0x7ffd7390c1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,15277697453807808066,15497358237254619683,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,17544133583506715536,14809327243698443202,262144 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,18170464879983071833,13698043024398718151,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11472589619216696477,12676974500739757203,2097152 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,729448950303438364,10900245019341453748,2097152 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,17013325017594703296,17859471438427763286,2097152 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1667497133743994700,15994114846529993816,2097152 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15640559356164897713,30258993637900257,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,975257582608463945,4475704870039422312,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7884585627533271886,11316812692622205707,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7884585627533271886,11316812692622205707,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,18352182674911408420,3787614901898846156,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13093081670975851725,9305544530483132908,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,9430004342481304947,6400379218622796728,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,6021317825494666414,6712545943431788636,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17292945104288680727,1369179436724154618,524288 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,1118864252896818177,5972966380030330177,262144 --field-trial-handle=2984,i,15344151704737821092,4623611374400614181,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3e43d6970ce902199da87f6b794c20aee05d0d2d39dbf0826a9d45e8ef9d1dd
MD5 cb2fd2b2d33b98900f6947abe0b8aeab
SHA1 2989c0d9074e7f2a4a5f2054c564d8badd53fe15
SHA512 7683f54882051067da820fd6779da6054f534f03a9b9cc1ed341ea33bf36ceb31c4a3d95df879118030f2a8a3ed8f00c4a6294cbb489a83be189e330f03ab30f
TLSH
T1D7613B9C02FA41D0E360D73CE2F1964138B584AA1BA77EA931600BBE6D02B23462FC1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1ffa054fc9a884d7249bf1a20f98e39b9d6d3335b3793d33dce39a33adcd46e3
MD5 2cc2269f57848b312f5e64f75357802b
SHA1 2b73fd78b66053a571b4e96a5bc1b02fbe2c0114
SHA512 a8c5b6488ed1bc82cf564ef93f3e53e78dad3b28372f1a496fd8785d0b00d78b667e3d7243dbe8b62c01fda2b3cadb4c1a9dd8e563be4416c7ab4bd84f949b6b
TLSH
T1BC117DF3C3D585AE890116F05A24EE1BCE1D0505421C7C1589D4EF6BD3F3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e8ff4440e8e18359ebc0be40dcf177eb03986db987872ea8d4240bfe258ac1f
MD5 8d8aa0bf97abe5271a274f5e724d6dc9
SHA1 9df78f2f19049b3e84dd81d9a7acce6798a5bf42
SHA512 e07427ce837739ebeb52e96c5c0773829ecad48c047fba9d8ee30fd3c7050fca35d24102372b58a75ab0d640e99d18ad14d66101679327479a05b02899f00074
SSDEEP 192:sxZKRB1yM/jK1Ml8MkB/fwsMx7IdpdJJHW6+WNGYHjbUYIgrJ:sxZKDJMB/fwsMxknJHbGK9
TLSH
T1C442E8126A346977CCDBD20DFA51BF53D6F41572A2900E84A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6f49992d64f3b73648c86d2fb316a7ad38f9a7942b9ae4b59561580e79d9fdd6
MD5 56728a9444f693d844b93509a13c5f5c
SHA1 906a7038f9c124d449618a4f22af412526ce7541
SHA512 9c90e2a674ae72f00a7e6fe0b1a79e2cca9c9261cc1e245eb2f46eb85424497eb461868b9cd0f6f8df6b5223543829a758f16bf3cb673c38bc9f8a2b80188648
SSDEEP 192:sxZKRB1yM/jK1Ml8UQkkB/fwsel7IdpHJJHW6+WNGYH4CUYIg5LJ:sxZKDJq/B/fwselkpJHbGqr
TLSH
T17252E8166A34A977CCDBD20DFA51BF53D6F4547292940E84A9FCCE1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9e2122c91b56bab17a6f95dfdc636d507f8b04e72972208e532de3d58e2fd580
MD5 9874a46fd3b3eb3124a19688a95b4538
SHA1 ba31a9621f8dc02226be42a3c7e0beaaab42833c
SHA512 88ee6bbe2300f252af4eeebb1923f8d5715b1d94a7e425e7f967b04d76e531b93225a9f7aac2df7f8b7afeb3b73a70cc0828de58348765c567717fbf6eef5a92
SSDEEP 768:zeUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RgroV80l:zeUZYTMWvg0Pou1ja7eLZmRrxl
TLSH
T1E7D20B2F280CCB7E4F844E9DEC2A6F963ED801CB5A984D5447EA894C03C76EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2a13c1c4597069414c0d9f2e1d034386ff8851dc0c3c7ce1aa1fd31a2d82c842
MD5 e532c055b2ed41bdce2eb8be3e006306
SHA1 6875d892aa71c84e23b285dd5dc68b507057293d
SHA512 cac8136e8432c8c2a7fe959aff4972a869c4574ea066dc96de05f3f7191f1a73df03822fed9e9222c831b9b86e3068301067800f509f2dc34a4f10be65e21ffc
SSDEEP 96:KA1eK2AITaKUUOmD6KUsw9QDn9TzxOH+sIvxKJ:EI5Bx9QDn9TzMH+Dv8
TLSH
T1A391019272BA03053C3D6B1C8294875FAE4276633018A52B7BAC41B18E67E255DFDCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592a14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592a14.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 45e1c981714719a6381db8d132554a5835810c27cb90f948400de55e656ac320
MD5 601914893783b7f9ac5d4bd528a41b83
SHA1 53218ec9c7c00e967847a61825617b7255314adf
SHA512 37644bd6cad432692371fe03404bbdbf7509bc0aeffbd87c84cacf0dc13ff874af3ee33a6355db3811f0252522cbeb8d94b1fc37968f5ee2e24520e29c898c5a
SSDEEP 384:TsNbhhLZKuYgBe4zX5od+t8s1MAXXlchX0Z:TUegOsPmhXA
TLSH
T1A7420973A878AC765EE2E546B40B32139FB451679A882F84D6FD5F1D00DA69C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5b016bb1c413419c2b655cecbe9b1e62811dbb5518818dba698eda6f1209169e
MD5 ab136340517ffe0c37a2054a70e0ce4e
SHA1 c8d7daf3665e02995f6e354227b8fff891fe2abc
SHA512 19b1ab3b9558b753235af03af55b556effca29fe4943e73232b8366b4b259d650cb06317242ca6324b1a0a56da9ff5e934eaa41cca6bd0f2739b2d76f068a400
SSDEEP 384:ViF2sNl8TUNTUlIlWhLZKuYgBe4zX5od+t8s1MAXXvohX0G:cF2IwgsegOsPghXP
TLSH
T179620A7358A49C7B9EE6DA45F90A32139EB45067CA84AF94D3EC5E1D00DB1DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54047c215cd6671d6de1c2718a11d7ca2f6b604e5fbb0a2f27acb796d9eedfba
MD5 1921782da63403ee9eccb3f22a72fb7a
SHA1 bd9e60661f00995ee62f5863725732219c8d4023
SHA512 11a431f79c9efefc39657e908a71104550c65e89b64831b3a864c2d2f08661cda3d823cddcdf22daaf85632bc51ed37beead8ab6ba15bf8af1db655fe1a39473
SSDEEP 192:yONx61VWQmiUyyTgGX5Obd+jFjzors1yRjL/aH3YtU6:yONx6WLgGX5od+t8s1MuItU6
TLSH
T14102B836A9686CBB8EE2FE45B88737135FD4106BEA556F84D6EC1F1C009765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ed4fa6b8832eba67e0530a4abb78fe1c4ba4159187e0daca5fc66e307e6af9f7
MD5 468fdf9a467bf4043792e9722cb4256c
SHA1 b3e1211c62009fc2fcd2b30a910a6c7055e587de
SHA512 165719e0437f586f432bb96e30b78141b9f98da5e5716c886a1bc8003a5e48ba6876259571effb0b644d46e8a8908c634bf1314d245c4c0a31616eb06d573e42
SSDEEP 384:WsNbWhLZKuYgBe4zX5od+t8s1MAXXlchX0G:W/egOsPmhXP
TLSH
T1AF420973A878AC775EE2E546B4073213AFB450679B882F84D6FD5F1D00DA69D130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd0b231240289cbd54ae0f6de8c73050d4eb6869ffbfee6c2f351999ea7dcb66
MD5 e17368a8230f718f0a6114bd1dc4a5e3
SHA1 a974df74626d7df060feacd2bc9c9842dd3a0b97
SHA512 95efbed72a51cba17dd33eb885494f7f69ed02b32e7c96db04c7b4d0a55c8ee084bcef63bd2dd69ea049fe12797834fe07cec2e6407ab5d2cfed16dff990663d
SSDEEP 192:5ONG61YWQmiUyeoTVGX5Obd+jFjzors1yRjAX6kl3YjJ7qOU6:5ONG65f8VGX5od+t8s1MAXXQhU6
TLSH
T1DC12DA36A468AC6B9ED2F555B48B32135EE55127EB896FC0D6EC2F1C00DB69C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 648cb5577f315a5a008f846874c4032c28acef63cad308533813f44e473dda9a
MD5 7acdef95aaa890c9923314cd16773a8f
SHA1 39d9142c088e496a2999c604fd9bdc6229da466d
SHA512 a2c6dba2a5872ee485e77a012af419577b564473d8c7788ce120524baf689d6c17a2516f07d1bc2f535ba9f36a2b109b84d829175c5d50c1549e03ec0495066b
SSDEEP 384:ViF2sN+8TUNTUlIlWhLZKuYgBe4zX5od+t8s1MAXXlXDhX0G:cF2twgsegOsPBhXP
TLSH
T135621A7398A49C7BAEE6DA85F90A32139EF45067CA84AF94D3EC5E0D009B1DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1df8c6f1-f839-46c5-afea-67dd2297a56d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1df8c6f1-f839-46c5-afea-67dd2297a56d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a3ba083b9a937484baadc81ffa054a5fd2184df50863901646d0dca1ac204cb5
MD5 9e5fd2ad5aa1e13060917f45e8a2fb41
SHA1 099b48eb048bffacca18b6ee952c3245bd68e98b
SHA512 f0cefcf7c0f2bbe8df6b0ccb236fc7c57689f5489f9b0d928278e9bd1191b1e1646730b05055dacf47ab7ffc6986996ae97f6995402bc7a022eda920d79a34d7
TLSH
T196411859A6E91148B3B76F59ABF6A86D487FBC772F06D45D10110D4E4622B00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download